Question: Redshift Serverless is missing Geospacial data types

"This was added to provisioned Redshift 2021-11-24 (https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-redshift-spatial-geography-datatype/), yet is still not available in Redshift Serverless.  Meanwhile, the documentation offers no indication whatsoever that there's functionality that's only available with the provisioned version of Redshift (https://docs.aws.amazon.com/redshift/latest/dg/geospatial-overview.html).I have a test table in Serverless Redshift which I test every couple days, and it'd be so much simpler if I just had a rough idea of when (or if?) there's a plan for Serverless to have feature parity with non-serverless Redshift.  Furthermore, a listing of what other features are missing would be very helpful in determining if the service is even something we want to be using.The test query is as simple as:alter table test_db.main.test_tableadd column GeoLocation geography;ERROR: Column "geolocation" has unsupported type "geography".FollowComment"

Answer: "1Please, consider that Redshift Serverless  is still in preview.When you encounter such problems, send them with details to ***redshift-preview-serverless@amazon.com ***.Including what syntax tried and errors you got.The team will, then, be able to investigate.CommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-9279990 a year agoIs that still the recommended path, after filing a Support Ticket?  From my point of view, I've reported this issue multiple times already, I'm just trying to find out if a timeline exists where it'll be solved.ShareFabrizio@AWS EXPERTa year ago@AWS-User-9279990, yes that is the recommended path, during a preview that is the way the team capture requests to prioritize the new features.you do not need a support ticket. the email is enough. Sometime getting a ETA will not be possible though.Share0Hi, as mentioned earlier, Serverless is still in preview and changes may be happening frequently.I was able to create and alter table successfully in Redshift Serverless using datatype ‘geography’ so you may want to test this now.create table x(geolocation geography)show table xCreate table test1(name char(10))alter table test1add column geolocation geographyAlmost all provisioned features are available in Redshift Serverless with the exception of DMS & KDF which are not certified yet in Serverless.CommentShareNita_Sanswered a year ago"


Question: AWS CodeGuru Profiler

HiDoes AWS CodeGuru Profiler work with Node JS?And what are other stable solutions as an alternative available in market?Thanks.FollowComment

Answer: "0Accepted AnswerUnfortunately, it does not appear to be possible to use Node JS at this time.https://docs.aws.amazon.com/codeguru/latest/profiler-ug/what-is-codeguru-profiler.htmlCodeGuru Profiler currently supports applications written in all Java virtual machine (JVM) languages and Python. The following table explains which features of CodeGuru Profiler are supported by which language.Datadog Continuous Profiler can be used to monitor code performance and more.I believe this is a product similar to the AWS CodeGuru Profiler.https://docs.datadoghq.com/profiler/CommentShareEXPERTRiku_Kobayashianswered 7 days ago"


Question: API Gateway not forwarding all access logs to Cloudwatch

"I've setup access logging for API Gateway with a CloudWatch log group as destination. While testing this feature it seems that not all logs are captured/forwarded to CloudWatch.eg. an "HTTP 413 Request Entity Too Large" is not visible in the CloudWatch logs. I would assume that this is also part of access logs?What kind of logs should appear in the access logs? (HTTP 2xx, 4xx, 5xx...)FollowComment"

Answer: "0Hello:All requests (with a few exceptions, like the 413 you noted) should generate access logs. The requests that may not be logged are requests that failed before the service read the request or the service was unable to determine where to send logs:Most 413 requests (there is a window where a 413 will generate a log message, but it's very small)** Some 429 requests (only if you go *well over your account level limits)4XX errors sent to a custom domain basepath that has no API mappingSome 5XX errors (due to internal failures)FWIW, many of these cases will also not generate metrics for the same reason.Apologies for the confusion. I hope this helps.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago0Hi Bob,Thanks for your answer. Is this documented somewhere?Regards,Gert-janCommentSharegurtjunanswered 3 years ago0Hello:Unfortunately it is not documented today, but our documentation team has been notified to add this in the next update to the docs.Apologies for the inconvenience.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago"


Question: Amazon Workspaces MacOS client hangs with copy/cut paste operations

"Hi,I have had an ongoing problem with copy/cut-and-paste operation with the Amazon Workspaces client on MacOS.I have experienced this with both Intel based Macbooks and M2 based Macbooks - when doing copy/cut-and-paste operations my Macbooks hang (spinning wheel).Please can you resolve this issue?FollowCommentAbhiAlate 8 months agoWhat version of WorkSpaces are you using?It would help if you could provide more details on the operation, e.g. Are trying to copy data bigger than set limit?Share"

Answer: "0Hello,Thank you so much for your question on Re:Post! My name is RJ and I will be addressing your inquiry today.I understand while using the copy/paste functionality with the AWS Workspaces client for MacOS, the client encounters the spinning wheel.After provisioning a new test environment with the same configuration as provided, I was able to successfully copy and paste text between my local MacOS device and Workspace using the latest AWS Workspace Client.To help resolve this experience, please consider the following actions:Update/Upgrade the Workspaces Client to the latest release, download hereReview and consider any available vendor-specific updates for your local device.Please consider opening a Premium Support case in order to engage with a support engineer and dive deeper into the troubleshooting.CommentShareSUPPORT ENGINEERRJ-Danswered 8 months ago"


Question: "Best services for client data upload, data cleaning, ingestion into RDS"

"I'm having trouble figuring out the best AWS service/services for a scenario where a client uploads a .csv file, then these data are cleaned and ingested into RDS using and R script. FTP and code pipeline? Any suggestions?FollowComment"

Answer: "2Is this CSV a custom one or some database backup etc. ? Assuming that its former, then is R a mandate requirement to use? One quick option would be to use AWS Glue which can be used to do your ETL. The source of CSV can be S3. Glue automatically generates Scala or Python code for your ETL jobs that you can further customize using tools you are already familiar with.CommentShareEXPERTAWS-User-Nitinanswered 8 months agoEXPERTChris_Greviewed 8 months agorePost-User-3666101 8 months agoThat's very helpful. Thank you. It is a custom CSV. I will look into Glue right now!Share"


Question: Several Organisations with a centralised Identity Center connected with Active Directory

"Currently there are several Organisations A, B and C. The IAM users are created by a member account (hosting the git repositories also) in Organisation A.  The IAM users are currently accessing the other aws resources hosted in other organisations' member accounts with a cross-account assume role.  I know i will get the question why not put all organisations under same umbrella because the organisations need to keep their billing separate as they operate in different branches of the company.Now, there will be an integration of the Aws IAM Identity Center[formerly known as SSO] connected to an Active Directory for the Organisation A.  The questions are as follows:Does Organisation A with the IAM users integration with active directory affect their assume cross-account role towards other Organisations' member accounts? [According to the documentation, there will be a mapping of the AD users/groups to IAM users/groups]Does the organisations B and C need their respective Identity Center connected to the same Active Directory as right now, the IAM users are working perfectly fine with the assume cross-account role without AD.Does the organisations B and C need to replicate the IAM users created in organisation A upon integration with active directory?FollowComment"

Answer: "1Accepted AnswerWhen using AWS Identity Center (IC), IAM users are no longer even involved. IAM users are completely separate from IC users.If you want to only have IC configured one time in OrgA, you can have new assumable roles in every account across OrgB and OrgC.However, if you have configured IC for each org, I would do that.Then the users are managed via your external Identity Provider and you can more easily manage granular permissions across accounts in each org instead of deploying unique assumable roles across your other accounts.You can deploy IC in parallel to your IAM user configuration and have no impact, use both solutions together until you have configured IC how you need, and then recommend termination IAM users for Console Access and only use them when absolutely necessary for programmatic access.CommentShareRoss Wickmananswered 2 months agoVincent Chu 2 months agoI'm looking for like a single IC to manage all the users from a single Org instead of having to manage the users in nth Orgs which will be difficult to keep track of.Right now, Identity Center has not been configured for any organisations, the iam users are using assume roles.  AD users have same username as IAM users.Is it possible to do the management of users from within a single Identity Center while integrated with the AD; without having to replicate the IAM users accross organisations ?ShareRoss Wickman 2 months agoAs I stated, you could create a single IC configuration in OrgA.Then using permission sets in an account and role trust polices, you could, in fact, manage access to other accounts from a single IC but it will not give you the direct result you are looking for.There is no other way to use IC to access multiple Orgs.Again, IAM users are not in the equation when using IC.When using AD and IC, your IDP & and SCIM configuration will replicate the same users to all orgs.It just boils down to the proper configuration. This setup would be significantly more scalable, secure, and simplified than using individual IAM users in each org and account(s).N number of IC configurations is way better than N x Accounts X Users.ShareVincent Chu 2 months agoI have another question what about the IAM users security credentials - will the IC users be able to use them (after being mapped to their respective IAM users) :- Access keys, MFA, SSH public keys for AWS CodeCommit, HTTPS Git credentials for AWS CodeCommit, etc.ShareRoss Wickman 2 months agoNo, there are no IAM credentials or access keys for IC users. They will not be able to be used by IC users. Access Keys would be the remaining use case for IAM users.Temporary session credentials are provided to IC users to allow cli access.IC users can assume roles in the account but not IAM users.CodeCommit and everything else listed will still by used and the use case for IAM users.While using IC greatly reduces the need for IAM users and helps with centralized management, IC is used for Console Access primarily with the ability to have temp creds for CLI.IAM use case is for these others requirements but with IC, you should be able to completely remove console access for IAM users.Share"


Question: "Chrome-Sumerian engine  broken, do you even care about the platform?"

"Hi,Sumerian engine suddenly stopped showing the menu bar on Chrome, so it is impossible to work; there is no way to create entities or even publish the scene.The engine keeps working in Firefox.Have you officially stopped Sumerian development? There are no resources, it is completely abandoned without any previous notice This is a truly unethical and horrible way to treat your clients. it will create me lots of problems with my clients, but you guys don't seem to care at all. Sumerian was truly a great tool, you're killing it and it's so frustrating and sad to see. I feel like I am the only user of this platform, but I deny to believe that and I think as developers we deserve an answer!!!FollowComment"

Answer: "0@mauriciohdz:  This is an issue we are actively working to fix, and will have a resolution posted ASAP.  We apologize for the inconvenience that was introduced with the latest version of Chrome.  Thankfully we have a workaround with Firefox in the meantime.CommentShareJames_Canswered 2 years ago0Thanks for your quick reply!I look forward to the fix, cheersCommentSharemauhdzanswered 2 years ago0The issue should be corrected now; let us know if you still have issues.CommentShareJames_Canswered 2 years ago0Fix issued today.CommentShareJames_Canswered 2 years ago0Thanks heaps! it works now!About the Sumerian support, do you have plans to continue creating resources and documentation. The YouTube channel was great! Any chance that will come back in the near future?Cheers!Edited by: mauriciohdz on Dec 6, 2021 4:37 PMCommentSharemauhdzanswered a year ago"


Question: Quicksight help!

"Dear friends,Greetings.I need help with a project in Quicksight that was delegated to me. I have the budget for 2023, where I have to add month by month the amounts spent. But I have not been able to find a way to add up the months to today.I have the following table in Quicksight, the idea is that at the end of the current month it shows the sum of the previous months. I have been thinking about a kpi, I don't know if it is the right one.FollowComment"

Answer: "1Hello,Try runningSumhttps://docs.aws.amazon.com/quicksight/latest/user/runningSum-function.htmlThis might be more than you need, but you might want to take a look at the Cost Intelligence Dashboard Well-Architected Lab as a way to visualize this and more.The Cost Intelligence Dashboard is a customizable and accessible dashboard to help create the foundation of your own cost management and optimization (FinOps) tool. Executives, directors, and other individuals within the CFO’s line of business or who manage cloud financials for an organization will find the Cloud Intelligence Dashboard easy to use and relevant to their use cases. Little to no technical knowledge or understanding of AWS Services is required. Out-of-the-box benefits of the CID include (but are not limited to):Create chargeback or showback reports for internal business units, accounts, or cost centers.Track how Savings Plans (SP), Reserved Instances (RI), and Spot Instance usage has impacted your unit metrics such as your average hourly cost of Amazon EC2.Keep track of which accounts or internal business units receive savings and when RIs and SPs expire.Explore a sample Cost Intelligence DashboardCommentShareSara_S_1answered 9 months ago"


Question: Device Farm ending remote access session stuck on pending

"I made some remote access sessions and a particular run is stuck in Pending status. I have already tried to stop it via aws-cli and it does not seems to be stopped.I tried the Samsung Galaxy S9+ (Unlocked), i was able to swipe but not to click. I ended the session and then i'm stuck at:"Your session is ending. Please wait while we process the results."And in the FAQ: "Similarly, for Remote Access sessions, device minutes are measured from the time it takes to prepare a device to your specification to completely removing any apps and data you placed on the device."https://us-west-2.console.aws.amazon.com/devicefarm/home?region=eu-west-3#/projects/87a3e29c-b102-486f-a985-3c4f59700a6b/sessions/5a572b4d-2c51-4976-afed-c7e668225bdb/00000I hope i will not be charged for a never ending session .FollowComment"

Answer: 0Status changed to ErroredCommentShareThoDelanswered 4 years ago


Question: WordPress Running Slow For Logged-In Customers

"Hey! I recently installed WordPress on Amazon EC2 using the following guidehttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/hosting-wordpress.html#install-wordpressNow, the issue I'm facing is that the WordPress website runs terribly slow when a customer logs in. It takes 5-6 seconds for him to be redirected to the dashboard.Surprisingly, the website runs fast for WordPress administrators.The same version of the website is also hosted on cloudways Vultr server and there the website runs blazing fast for Logged-in users....I tried to tweak the php-fpm configurations, changed apache MPM from "Prefork" to 'worker" on AWS EC2 but no luck.Can anyone please help me figure out how can I speed up Apache to run WordPress faster on AWS EC2 as it is running on Cloudways server?Thanks!!FollowComment"

Answer: "0Hello there,I see that you are experiencing issues with the website load time.Since this might be caused due to multiple reasons, it is important to narrow down the issue.First things to check would be the authentication process for your customers. You can review the overall time taken by the authentication process on both Cloudways and EC2.Then, you can try reviewing the network configuration of both the servers.It is also important to review the application versions being installed in both servers. Confirm you are using same version of the application on both servers.Is there any specific AMI you using on EC2 and the instance type also plays a major role. You can try using the AWS Graviton instances for better performance:https://aws.amazon.com/ec2/graviton/If you find that there are issues with the EC2 instance you are using, please feel free to reach out to the support team via Support console and we will investigate the same in detail.Hope this helps.Take care and have a great day ahead!CommentShareSUPPORT ENGINEERHarshavardhan_Ganswered 10 months agoMuheyuddin 10 months agoThank you so much Harshavardhan for such a detailed answer. I'm using C7.large instance. Upon checking the authentication process, I noticed that my authentication code somehow performs authentication twice on EC2 and just once on Cloudways. Now, that is really strange but that's what I found through the network console. That is exactly why, the loading time of the website is 2X on AWS when the user is logged in.Now I'm really confused as to what to do. I really don't understand why same code is showing different behavior on both servers.Please take a look at the screenshots.  That's a wetransfer link. https://we.tl/t-jTm2pJOOW2This is what I see in the network console when is user is redirected to the dashboard after authentication. You can see that it shows that jquery runs twice for the website hosted on AWS. Though the code is 100% same as on cloudways.I tried talking to AWS support but they always say we can't help. Sorry to say but I'm pretty disappointed with them. I'm on "AWS Developer Support" plan but I think that it's just a waste of money.Please let me know if you could help.ThanksShare0Hey there!Trying to debug website performance issues can be fairly difficult due to the number of possible bottlenecks and/or problems that can arise. Have you done any performance profiling comparison between the Vultr server and EC2? Usually this can give you a decent place to start your troubleshooting.A good tutorial for performance profiling can be found here:https://www.debugbear.com/blog/devtools-performanceCommentShareJack Hemionanswered 10 months ago"


Question: [1.6] Camera near plane setup not working in Release build

"Hi,I observed that cl_DefaultNearPlane console param not working in Release build.Also changing #define DEFAULT_NEAR in Cry_Camera.h not helps.Do you have any idea how to fix it ?CheersFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERCan you provide some more info on what you are trying to do?SharerePost-User-8353690answered 6 years ago0Hi @REDACTEDUSERYou are right I am using legacy camera. I will try with a new Camera Component and I will let you know.I am creating interactive eCatalogue for Terma products (www.termaheat.pl). I need small near, clip plane to show close product details (through camera and sequences).Thank you very much for your idea :)CheersSharerePost-User-0352889answered 6 years ago0That sounds cool @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0hI @REDACTEDUSERSharerePost-User-0352889answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0I'm still looking into this one.SharerePost-User-8353690answered 6 years ago0Hi @REDACTEDUSERREMOVEDUPLOADHope that helps, let me know if you have any questions!SharerePost-User-5841084answered 6 years ago0@Binky, I tested it locally and it is works (I will retest it at production in a upcoming days). As I see a new camera component have a lots of additional interesting stuff to work with it :) cool :)SharerePost-User-0352889answered 6 years ago"


Question: Amazon Managed Blockchain - Further Inquiry

"Interested to work for the Hyperledger Fabric setup under Amazon Managed Blockchain.From one of the Use Cases for Financial Services:Are you referring that once the Hyperledger Fabric (Amazon Managed Blockchain) has been set up, I can directly issue the asset (such as Digital Asset in fiat currency value) and send it as payments to other networks (whose also using the AWS Network) too?Would the Amazon Managed Blockchain be easy usage for Non-Coders? Or is it a Must to have Chaincode to deploy and run? Is there a UI for us to Write/Read and Execute? Does AMB accept the Chaincode written in Golang?Do you know where I can find a list of payment networks that is also using the AWS Network and at the same time, accepting the transfer of Asset from Hyperledger Fabric?Appreciate your guidance on the above.ThanksFollowComment"

Answer: "0Accepted AnswerYes, once the Hyperledger Fabric network is set up on Amazon Managed Blockchain, you can issue assets and use them to make payments to other networks that are also using the AWS network.In terms of ease of usage for non-coders, Amazon Managed Blockchain provides a managed service that abstracts away many of the complexities of running a blockchain network, but some knowledge of blockchain and smart contracts is required to fully utilize the service. To deploy and run smart contracts (chaincode), you will need to have programming knowledge, but there are pre-built templates available that make it easier for developers to create smart contracts without deep blockchain knowledge. Amazon Managed Blockchain provides a console UI for network management, and you can also use the AWS SDKs or CLI to interact with the service.Amazon Managed Blockchain supports chaincode written in Golang, as well as JavaScript and Java.Regarding payment networks, I don't have access to a specific list of networks that are using the AWS network and accept asset transfers from Hyperledger Fabric.CommentSharehashanswered a month agorePost-User-7775189 a month agoThanks so much.Share"


Question: Why can't I find my RDS database from my lambda function?

"I am trying to connect a lambda function to my RDS database. They both have the same subnets, VPS, and security groups, but whenever I try to run code to connect to the database, I get an error saying that it wasn't found. The database also isn't showing up as an available database proxy. Do you know how I can get this to appear?FollowCommentSandeepVudata a year agoWas Database created? What is the exact error message?ShareAWS-User-0616660 a year ago@SandeepVudata The database was created. The error message says "ERROR: Unexpected error: Could not connect to MySQL instance. (1049, "Unknown database 'database_name'")" I have my database connection in a try except block, and this is the exact error that is supposed to be thrown when I can't connect to the database. I am trying to connect by using pymysql.connect() with the endpoint, username, password, and db name as parameters, but the code can't find the name of the database even though it is correct.Share"

Answer: "1Hello, not sure if you already did this,  but just including two instances (in your case lambda and rds) in the same subnet and the same security group doesn't open any communication ports - you need to define the specific security rules to open the DB port for communication.If you want to keep them in the same security group, you'll have to create a self-referencing rule in this group with the right DB port to open (depending on your database engine) and indicating the source as the same security group.RegardsCommentShareAWS-ADolganovanswered a year ago"


Question: Setting up Athena connection in VSCode

"I am trying to set-up Athena connection in VSCode.When I do Test Connection, I get this errorError opening connection Inaccessible host: `athena.us-east-1.amazonaws.com'. This service may not be available in the `us-east-1' region.I tried this successfullync -v athena.us-east-1.amazonaws.com 443Connection to athena.us-east-1.amazonaws.com port 443 [tcp/https] succeeded!How can I fix this errorFollowComment"

Answer: "0Hello,I understand that you are getting Error opening connection Inaccessible host: athena.us-east-1.amazonaws.com'. This service may not be available in the us-east-1' region. When you perform a test connection while Setting up Athena connection in VSCode.Usually this error is more related to networking but as mentioned, you are succeeded to check the connectivity with the Athena endpoint. So, here the networking aspect does not seem to be causing the problem.It is also possible for endpoints to be inaccessible once in a while.I tried replicating in my test environment and I was successfully able to connect with Athena from VSCode in us-east-1 region without any issue. So, I believe that it can be the intermittent issue for you.Further you can also check with these:Try with disconnecting the VPN if you are connected with any.Try with latest version of VSCode.Also, please open a support ticket, if you are facing this issue frequently/continously.Below is the JSON for the successful connection:{"connectionMethod": "Profile","previewLimit": 50,"driver": "driver.athena","name": "Test","workgroup": "primary","region": "us-east-1","outputLocation": "s3://bucket_name/ ","profile": "default","group": "Test"}CommentShareSUPPORT ENGINEERrePost-User-2664608answered 23 days agoadbdkb 23 days agoI do have the latest version of VSCode - it was 1.78.   updated today to Version: 1.78.1.  Also, after your suggestion, I did try disconnecting from VPN and it worked.  But,  I have to be connected to VPN to do my other tasks.  Is there a way to set-up that I can still connect even though I am connected to VPN?  ThanksShareadbdkb 20 days agoOne other test I did was to run this script from terminal on my Mac - from this link https://stackoverflow.com/questions/43338442/command-line-tool-to-access-amazon-athena and it runs without any issues even when I am connected to VPN.  So, is there a set-up I can do in VSCode that will allow me to connect to Athena even when I am connected to VPN?Shareadbdkb 19 days agoOne other observation - And when I tried to set-up a connection from dBeaver to Athena, I had to add these extra user parameters when looking at the driver settings - AwsCredentialsProviderArguments, AwsCredentialsProviderClass, UseResultsetStreaming, Workgroup, ageforResultReuse, enableResultReuse. Do we need to do something similar on VSCode, and how would we define those in VSCode. Of these the Workgroup is part of the connection definition, but do we need to add any other and where?Share"


Question: AWS VPN Client can not be connected.

"AWS VPN Client can not be connected with below logs.2022-08-10 13:21:44.518 +09:00 [DBG] CM processsing: >LOG:1660105304,I,open_tun2022-08-10 13:21:44.518 +09:00 [DBG] CM processsing: 2022-08-10 13:21:44.518 +09:00 [DBG] 🥶 APPEND line2022-08-10 13:21:44.518 +09:00 [INF] Begin receive init again2022-08-10 13:21:44.521 +09:00 [INF] Received bytes: 1052022-08-10 13:21:44.521 +09:00 [DBG] Message marshalling complete2022-08-10 13:21:44.521 +09:00 [DBG] CM received: >LOG:1660105304,,CreateFile failed on TAP device: \\.\Global\{5B0DB356-AB62-485C-A071-3537D307D3BB}.tap2022-08-10 13:21:44.521 +09:00 [DBG] CM processsing: >LOG:1660105304,,CreateFile failed on TAP device: \\.\Global\{5B0DB356-AB62-485C-A071-3537D307D3BB}.tap2022-08-10 13:21:44.521 +09:00 [DBG] CM processsing: 2022-08-10 13:21:44.521 +09:00 [DBG] 🥶 APPEND line2022-08-10 13:21:44.521 +09:00 [INF] Begin receive init again2022-08-10 13:21:44.521 +09:00 [INF] Received bytes: 1512022-08-10 13:21:44.521 +09:00 [DBG] Message marshalling complete2022-08-10 13:21:44.521 +09:00 [DBG] CM received: >LOG:1660105304,F,All TAP-Windows adapters on this system are currently in use.>FATAL:All TAP-Windows adapters on this system are currently in use.2022-08-10 13:21:44.521 +09:00 [DBG] CM processsing: >LOG:1660105304,F,All TAP-Windows adapters on this system are currently in use.2022-08-10 13:21:44.521 +09:00 [DBG] CM processsing: >FATAL:All TAP-Windows adapters on this system are currently in use.I reinstalled the VPN Client but the error occurs continuously.Raptop brand is Lenovo and OS is Windows.How should I correct this error?FollowComment"

Answer: "1Accepted AnswerThe below error indicates issues with the Windows TAP adapter, Have you tried re-installing the TAP driver?2022-08-10 13:21:44.521 +09:00 [DBG] CM processsing: >FATAL:All TAP-Windows adapters on this system are currently in use.See below reference, please note this is external link so can not vouch for the solution but you can give it a try. As such, this is not AWS ClientVPN issue but rather Windows TAP issue so this would be out of scope for even support to troubleshoot.https://vpn.ac/knowledgebase/64/OpenVPN-Error-All-TAP-Windows-adapters-on-this-system-are-currently-in-use.htmlCommentShareEXPERTTushar_Janswered 10 months agoAWS-User-3427223 10 months agoThank you for supporting.It was perfect answer for me.Share"


Question: How to convert a .265 file to HLS format using AWS Elemental MediaConvert

I tried to convert a A220531_083012_083026.265 file to HLS (m3u8) format using AWS Elemental MediaConvert job but my input was rejected. I used one of the system templates (System-Ott_Hls_Ts_Hevc_Aac) that support HEVC.Is there a way to convert .265 files to HLS using AWS Elemental MediaConvert or any other AWS Media service?FollowComment

Answer: "0You may need to review what the error message is when the job fails. Does it indicate an issue with source file? Please verify the name of the source file for the AWS MediaConvert job contains no additional characters, such as a space.Do you know what is the wrapper type for the H265 encoded file? Is it an MP4 or some other format? You may try changing the extension from .265 to .mp4.Also, the template System-Ott_Hls_Ts_Hevc_Aac creates HLS with HEVC (H.264) encoded video. Is this what is needed? Perhaps the System-Ott_Hls_Ts_Avc_Aac could be used to create H.264 HLS renditions.CommentShareMike-MEanswered a year agoJonathan Ekwempu a year agoThank you, Mike-Me for your answer.The file I tried to convert is: A220531_083012_083026.265 (No space in file name)I don't know wrapper type is, but what I know is that I could convert A220531_083012_083026.265 to A220531_083012_083026.mp4 with ffmpegI did try changing A220531_083012_083026.265 to A220531_083012_083026.mp4 but it did not work with MediaConvert"Also, the template System-Ott_Hls_Ts_Hevc_Aac creates HLS with HEVC (H.264) encoded video. Is this what is needed?" NO. The files I want to encode are in H.265 formatDoes it mean MediaConvert does not support encoding H.265 files?Share"


Question: How exactly does target-based auto-scaling work?

"I have been experimenting recently with auto-scaling in GameLift using a target tracking policy, and I have come across a few things that I have questions on.When there are zero active game sessions on the fleet and the minimum instance count on the fleet is zero, the fleet scales down to zero instances. Why is this? And do I need to have a minimum instance count of at least 1 instance for auto scalilng to work? It seems to be that way after reading this forum post, https://forums.awsgametech.com/t/auto-scaling-from-zero-capacity/1458/9, but I just wanted to confirm.When does the upscaling take effect? The reason I ask is that when the percentage of game sessions is lower than the buffer percentage, it takes about 10-15 minutes for a new instance or multiple instances to start up for the percentage of game session availability to go back up. Are the dashboard metrics delayed or does it actually take this long for the number of instances to scale up? And do the new instances start spinning up right when the game session availability percentage drops down below the buffer for the auto scaling policy? Or is there more involved?When does the downscaling take effect? Similarly to the last question, it also takes about 15 minutes for idle instances to shut down when the percentage of game session availability is "too high". I ask the same question as before here: are the dashboard metrics delayed or does it actually take this long for the number of instances to scale down? Also, how exactly does GameLift know when to scale the number of instances in a fleet down when target tracking is implemented? Does GameLift constantly check whether the percentage of game session availability will still be above the buffer if a certain instance or certain instances shut down? Or is there more involved?Lastly, if it truly does take a while for the number of instances to scale up and down within a fleet, what can we do to best reduce player wait times? Should we try to avoid shutting down server processes and rather try to reuse them after terminating a game session? Should we increase the number of concurrent server processes running in an instance? Should we increase the minimum and maximum instance count range for a fleet? Should we make the target-based policy's buffer bigger? These are all ideas but I just want to make sure that they are all valid and inquire about other ideas.I know these are a lot of weird questions that are more about the inner workings of GameLift, so thank you in advance!FollowComment"

Answer: "0@REDACTEDUSERYou asked the fleet to scale to zero as the min instance count is set to zero " Under Instance Limits , check that the minimum and maximum limits are appropriate for the fleet. With auto-scaling enabled, capacity may adjust to any level between these two limits."See https://docs.aws.amazon.com/gamelift/latest/developerguide/fleets-autoscaling-target.htmlThere is a natural tension about what todo with fleets scaled to zero. For some developers a fleet scaled to zero should remain there because you know there should be no traffic to fleet, why pay for empty instance hours during game development? There are also lots of fleets deliberately shut off like this.For other developers, esp during alpha/betas, you want the fleets to be available at all times so you expect traffic to drop to zero and then start up again.For now, GameLift respects the hard stop of fleets at zero, even if target tracking is on.  I know GameLift has been looking at how to support both, but for now you need to maintain some active buffer for GameLift to autoscale your fleet or a process to kick off scaling again.Metrics propagation is relatively fast but scaling up new instances is expensive (takes x minutes depending on instance type, region and OS). Your build needs to be dropped onto the machine, spun up and then connected to GameLift. I'd recommend tracking metrics on instance creation time as this will help you understand what spare capacity you might need and also enables you to tune your server launch time.I don't know the internals here. But downscaling requires stopping existing resources which can take time esp if resources are slow to respond. In addition EC2 instances do not stop instantly, your game server also needs to shut down when it gets that termination signal, logs need to be uploaded etc (https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-sdk-interactions.html#gamelift-sdk-interactions-shutdown-request).GameLift generally considers capacity gone once a server / session has been successfully terminated (or force terminated if your process will not exit cleanly).You should ideally track / measure metrics around the time to shutdown for your server and ensure you shutdown correctly (to avoid hitting the time delays around forced shutdowns).You reduce player wait times by having some spare capacity in your fleet. First, you maximize your server costs by: packing as many servers per instance as you can, use Linux servers and use spot.  Second, you understand the cost of scaling up new servers based on your metrics. Thirdly, you have some data that helps drive where your scaling needs to be (ie expected load, peak loads etc).Then you work out what spare capacity/buffer is sufficient for your needs."Choosing a buffer size depends on how you want to prioritize minimizing player wait time against controlling hosting costs. With a large buffer, you minimize wait time but you also pay for extra resources that may not get used. If your players are more tolerant of wait times, you can lower costs by setting a small buffer. "Some folks do manual scaling to really control costs (which is tricky) or use Lambdas/processes to handle some aspects of their scaling (ie scale up fleets on weekend in region x, or move fleet from zero based on some metrics).Hope that helps somewhat.CommentSharerePost-User-5332620answered 3 years ago0Thanks @REDACTEDUSERCommentSharerePost-User-5100160answered 3 years ago"


Question: Data movement from prod to dev with anonymization of PII

"Hi All, Are there best practices and recommended tools for moving a copy of  production data (in RDS/Dynamo/S3) to dev, with the ability to detect and anonymize personally identifiable information (PII) along the way?FollowComment"

Answer: "0Accepted AnswerYou can use Amazon Macie to identify PII data that is stored in S3: https://docs.aws.amazon.com/macie/latest/userguide/macie-classify-data.htmlFor data in RDS/Dynamo, you would have to export that into S3 and then use Macie.Once you identify, you can then implement your own logic (perhaps using AWS Glue) to anonymize data and then move it back into a dev cluster.CommentShareAWS-User-2843108answered 5 years ago"


Question: Running a NextJs app from monorepo via Amplify throws 500 Internal Server Error

"Im trying to deploy a NextJS app (Just one page /home) from a monorepo present in AWS CodeCommit via AWS Amplify. The deployment is successful and when opening the page I always get that the page is not working such that the page  is currently unable to handle this request with 500 internal server error. But when I run the same in my local (either via yarn dev or yarn build followed by yarn start), I could see my app running successfully fine with no issues.The corresponding amplify.yml file for this deployment of Next App within a monorepo is as followsversion: 1applications:  - frontend:      phases:        preBuild:          commands:            - rm -rf node_modules && yarn install --frozen-lockfile        build:          commands:            - yarn build      artifacts:        baseDirectory: .next        files:          - '**/*'      cache:        paths:          - node_modules/**/*    appRoot: apps/staticSitesEdit: When looking into cloudwatch logs, found that there is an error log Error: Cannot find module '@swc/helpers/lib/_async_to_generator.js'. After seeing this log, I made my nextjs app to use babel instead of swc to see whether it is working now, by creating a .babelrc file in which I added below lines{  "presets": ["next/babel"]}But still seeing same log in cloudwatch. Also tried to include @swc/helpers package but still no improvements.Could anyone let me know how to overcome this issue which Im not able to replicate in my localFollowComment"

Answer: 0Accepted AnswerGot the issue on why it is not working. yarn.lock was causing the issue since it already had some problems with @swc/helpers. I did a cleanup with yarn.lock by deleting the file and then it had no issues and worked perfectly fine.So the command i used which solved the issue is- rm -rf node_modules -rf yarn.lock && yarn install --frozen-lockfileCommentSharerePost-User-6686295answered 5 months ago


Question: How to restrict which principals can appear in a role's trust policy

"I'm trying to set up permissions so that my users can create roles and policies and use them to give AWS resources access to other AWS resources, but not use them to give humans access to AWS resources. For instance, I would like a developer to be able to create role and attach policies giving access to an RDS instance and certain SSM parameters, and then attach that role to an EC2 instance. However I do not want that developer to be able to give, say, his college roommate, access to that RDS instance and SSM.We have an AWS Organization with multiple accounts, mostly split along cost allocation boundaries, and use AWS SSO to control access to them.My first attempt at this was to create an SSO permission set with permissions to create roles and policies, and then an SCP to limit who can use the roles.So I created a "Dev" permission set with the PowerUser and IAMReadOnly AWS managed policies, and the following inline policy:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "CreateAndManageDevRolesAndPolicies",            "Effect": "Allow",            "Action": [                "iam:CreateRole",                "iam:DeleteRole",                "iam:UpdateRole",                "iam:PutRolePolicy",                "iam:AttachRolePolicy",                "iam:UpdateAssumeRolePolicy",                "iam:DeleteRolePolicy",                "iam:DetachRolePolicy",                "iam:TagRole",                "iam:UntagRole",                "iam:CreatePolicy",                "iam:CreatePolicyVersion",                "iam:SetDefaultPolicyVersion",                "iam:DeletePolicy",                "iam:DeletePolicyVersion",                "iam:TagPolicy",                "iam:UntagPolicy"            ],            "Resource": [                "arn:aws:iam::*:role/Dev*",                "arn:aws:iam::*:policy/Dev*"            ],            "Condition": {                "StringEquals": {                    "iam:PermissionsBoundary": [                        "arn:aws:iam::aws:policy/PowerUserAccess"                    ]                }            }        }    ]}and then this SCP:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyUseOfDevRolesFromExternalAccounts",      "Effect": "Deny",      "Action": [        "sts:AssumeRole"      ],      "Resource": [        "arn:aws:iam::*:role/Dev*"      ]    }  ]}the idea here was to test that this SCP was properly denying access to all Dev roles, and then add in some conditions to loosen it up to the access I want.However, what this SCP actually does is deny access to all of my organization's users (even if they are listed in a Dev role's trust policy), and allow access by all other AWS accounts (as long as they are listed in a Dev role's trust policy). Essentially external-only access to the Dev roles, the exact opposite of what I actually want.Is there any way to achieve what I'm trying to do?FollowComment"

Answer: "2Hello,It seems like you would like to grant permissions to create an IAM role with only a trust policy that trusts service principals. However, this is not possible as the actions "CreateRole" and "UpdateAssumeRolePolicy" enables users to add any AWS Service, IAM User or IAM role as a principal. Users with these permissions will be able to update a role trust relationship policy without such restrictions. It is not possible to restrict the principals specified in the role's trust relationship policy as we do not have any condition key or resource restriction that supports restrictions of those API actions.Thank you for providing your valuable feedback on the service. We have an existing feature request to support this feature and I have added your voice to this request. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New and Blog pages for any new feature announcements.Resources:-https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html-https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html-https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.htmlCommentSharecindy_wanswered a year agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago1Hi, you can set up a global condition called aws:PrincipalIsAWSService which determines wether the principal is a service or not. More docs on this https://aws.amazon.com/blogs/security/iam-makes-it-easier-to-manage-permissions-for-aws-services-accessing-resources/. Let me know if it hits in the right directionCommentShareJorgeCastilloManswered a year agoScott Stephens a year agoDefinitely a good thing to know, and it was the first time I've seen that, so thanks for pointing it out!If I understand correctly, there would not be much point to using this on a role permissions policy because the principal would always be the role itself, not whatever entity assumed that role. I think that also means that there wouldn't be much use for it in a permissions boundary, permissions set, or a service control policy either, as those all constrain only permissions policies. (continued in next comment)ShareScott Stephens a year agoIt would be useful in a trust policy if you wanted to limit use of a role to either humans or non-humans. Do I have that right?Share"


Question: The default backup plan or backup file library automatic backup vault cannot be deleted

"Using EFS service will automatically create the default backup plan and awsserviceroleforbackup role. The operation backup uses the service role awsserviceroleforbackup permission. The awsserviceroleforbackup role does not have delete permission and cannot be modified, resulting in the role and backup library dead cycle cannot be deleted, After reading the official document that you can't delete this service, you will have a role that can't be deleted. Isn't that reasonable? Is there any way to help the obsessive-compulsive patients delete it?FollowComment"

Answer: "0You can update the backup vault policy for your EFS resource and remove the actions "backup:DeleteRecoveryPoint" and "backup:DeleteBackupVault", and try to delete the recovery points and vault again.  Please see [1].[1] Setting access policies on backup vaults - https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-vault-access-policy.htmlCommentShareJamesson_Banswered 6 days ago"


Question: EKS problem after upgrade 1.23 1.24

Hello I have a problem after the after the upgrade from  1.23 1.24The error I receive is as follows:plugin type="aws-cni" name="aws-cni" failed (add): add cmd: Error received from AddNetwork gRPC call: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp 127.0.0.1:50051: connect: connection refused"after updating the cluster the nodes have all been replaced and are all version v1.24.13 i have also updated the componentscoredns:v1.9.3-eksbuild.3kube-proxy:v1.24.10-eksbuild.2image: amazon-k8s-cni:v1.12.6amazon-k8s-cni-init:v1.12.6Can you help me?FollowComment


Question: Ec2 instance got terminated when I stopped it. How to get it back?

EC2 instance got terminated when I stopped it to change the instance type. For some time I was able to see the terminated instance. But now it's completely gone. How to get it back? please help. This is urgent.FollowComment

Answer: 0There is no way of getting back a terminated instance. By default the root EBS volume get's automatically deleted as soon as an instance is terminated.If you have attached an additional EBS volume this might be still available and can be connected to a new/different instance to access the data on this EBS volume.Please also see: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.htmlCommentShareEXPERTOsterjouranswered 6 months agonithur 6 months agoHow did it get deleted when I just stopped the instance?ShareOsterjour EXPERT6 months agoThere is a high probability that something/someone send a terminate call rather than a stop (maybe a fat finger problem?). You can check in Cloudtrail who and when send the terminate call: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.htmlFor the future you can always protect your instance from getting terminating by mistake via the "termination protection" (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination)Share


Question: Account ************* is denied access whlile creating Glue crawler.

"Hello all, i am using AWS account with 12 month free tier. I have crated a IAM user with administrative Access and loged in with that user. After that i create an IAM role with AmazonS3 full access and GlueServiceRole policy. In data lake formation i crated a database with this new role. Now i am creating a glue crawler which will crawl S3 bucket and will store the schema of csv file in the Lake formation database. Everything works well but when i create crawler it gives error saying account <my account id> is denied access. I also used role for this crawler with upper mentioned policies. The image of error is also attached. I will be very thankful for your help. Thank you.FollowComment"

Answer: 0What is the contents of the trust policy for the role? Does it trust the Glue service to assume the role?CommentShareEXPERTkentradanswered 7 months ago


Question: Everything I do on the AWS Console says "Maximum call stack size exceeded."

"Most pages I go to, in the table where it is meant to display the records it says "Maximum call stack size exceeded." or in a red box at the top of the page for example "An error occurred calling the API: describeAvailabilityZones. Maximum call stack size exceeded."FollowComment"


Question: Aurora Serverless v2 support for Data API

"Is there a plan to include Data API in future releases of Aurora Serverless v2? If yes, any ETA please?Until then, can you please advise what's the recommended solution for connecting Lambdas with Aurora Serverless v2? Based on my reading, RDS Proxy seems to be the only/best solution. Can we assume RDS Proxy is sort of replacement for Data API?Thanks in advance.FollowComment"

Answer: "2Well, we are many that are eagerly awaiting some kind of response from AWS... I can only recommend you to raise feature requests through your Support with AWS and contact your AWS account rep. and ask them to add a feature request on your behalf.The RDS Proxy and Data-API aren't really comparable "function-wise", but they both offer connection pooling (which is the most important feature I guess). The RDS Proxy is a "service" built into the underlying AWS infrastructure which can be used by some other AWS functions, e.g. Lambdas.The Data-API, is what the name says, an API which we can call from anywhere over HTTP.AppSync can also, natively, use the Data-API as a resolver using VTL scripts (something we do a lot), but AppSync can't use a RDS Proxy. To use RDS Proxy with an AWS Service that doesn't have "native" RDS Proxy Support you alwyas have to go through a Lambda, something that adds latency as well as more code that must be maintained. This we can avoid with the Data-API!I really hope that AWS listens to us customers and while being thrown under the bus right now, I hope they ca grab my foot and pull me out from there by announcing the Data-API for v2!We are stuck on v1 (that has the world's worst scaling) because of this and we really need to go to v2 to get a functioning scaling in place but can't because of AppSync and the lack of support for it in v2... :(CommentSharerePost-User-7375555answered 8 months ago"


Question: ENOTFOUND error only in one subnet

"I'm getting a ENOTFOUND error when running a node.js process that calls an external API. The process is running in a Fargate service within a VPC with 2 public subnets, one for each AZ. The process runs fine in 1 subnet, but fails in the other one. Both subnets use the same IGW.Public subnet 1: 10.0.0.0/17Public subnet 2:  10.0.128.0/17The Fargate service has public IP enabled and uses both subnets.FollowCommentAWS-User-0357409 3 months agoHi - Are you using the Amazon provided DNS in each of your subnets?  This would be the .2 offset in each CIDR.  Have you noted any differences with name resolution between subnets?Share"


Question: Exceeded the maximum number of virtual interfaces

"I have an existing virtual interface connected to direct connect connection.While I try to create a new virtual interface, I am getting this error"Exceeded the maximum number of virtual interfaces on [Connection_ID]. The limit is 1"How do I increase this limit ?It is very strange because this is what I see it in the documentation"You can create 50 VIFs per Direct Connect connection, allowing you to connect to a maximum of 50 VPCs (one VIF provides connectivity to one VPC). There is one BGP peering per VPC."FollowComment"

Answer: "1Accepted AnswerAre you using hosted connection? The limit you specify (50 VIFs) is for the Dedicated connection. Private, public, or transit virtual interfaces per AWS Direct Connect hosted connection limit is 1.https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.htmlYou can think of using a Transit VIF, along with DirectConnect Gateway it will give you ability to connect multiple VPCs.CommentShareEXPERTTushar_Janswered 2 months agoEXPERTalatechreviewed 2 months ago1This error "Exceeded the maximum number of virtual interfaces on [Connection_ID]. The limit is 1" comes in case of a hosted connection limit. While dedicated connection does have the limit of 51(50 <Public +Priavte> +1 transit)hosted DX connection i.e the connection is created on your behalf by an APN partner, you are limited to one VIF on the connection [private, public or transit.]. This is why you are unable to create a second VIF.Please see more on DX limits here [1]To create another VIF, you would need to create the VIF on a different DX connection i.e either a hosted connection that does not have any existing VIFs or a dedicated connection which can take up to 50 VIFs.[1] AWS Direct Connect quotas - https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.htmlCommentShareAnjali_Vanswered 2 months ago"


Question: Setup sync between EBS volume and S3 using DataSync

What is the easiest/simple way to setup sync between ebs volume attached to ec2 instance and s3 ?FollowComment

Answer: "0There are a couple of different options.   DataSync will talk to an EC2 server that is sharing data via SMB/NFS/HDFS and you can sync to S3.   Without using DataSync, you can certainly sync directories to S3 via the AWS CLI.  It would somewhat depend on the specific use case, if it is for backup purposes, you might consider AWS Backup.CommentShareMichael_Sanswered 7 months agoAWS-User-1389860 7 months agook we are usin aws cli now but it is very slow. Trying to find a tutorial online to setup DataSync using SMB since volume we want to sync is running a Windows OS but I don't see a simple solutionShareMichael_S 7 months agoPlease see https://docs.aws.amazon.com/datasync/latest/userguide/getting-started.html for a step-by-step guide on setting up DataSync.   You might also consider using a VPC Gateway Endpoint for S3.  https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html.   Also, make sure the S3 bucket is in the same region as your EC2 instance and if the goal is have the data in an alternate region use cross-region replication.   Please be sure to accept my answer if it has helped you.  Thanks..Share"


Question: How to deploy every branch I push to my CodeCommit repo

"I have a pipeline on CodePipeline that checks the master branch on a repo on CodeCommit. Every time there's a change in the master branch, the branch is deployed to my production stack. Pretty standard.Now, for test purposes, I want to create a new pipeline to be able to push any feature branch to the test stack.Every time I execute git push origin feature-1, or git push origin feature-2, ecc..., I want that feature branch to be deployed. In this way I can test the branch and then merge it to master to deploy it to prd. Is that possible?It is OK if the branches to be deployed to test need to have a prefix. Of courde I would like not to trigger the first pipeline.thanksMFollowComment"

Answer: "1Accepted AnswerThe way that CodePipeline works today each branch would need its own pipeline and each branch would trigger is respective pipeline. So if you push to your test branch codepipline on the main branch should not trigger until you merge changes to the main branch. If you pushed to test and it passed all your tests, you can have a step in codepipeline using codebuild or a lambda invoke step that merges the test branch into Main, which would then trigger that pipeline out to production.  You can take a look at this blog post which provides another way to accomplish this and included sample code. You can also look at the preview of CodeCatalyst as well. Hope this make sense and is helpful.CommentShareaaron_lanswered 4 months agoTarun Tiwari 4 months agoYou can blame me for this behavior :). I had identified an issue when BitBucket integration was in beta and I wanted to have separate Pipeline in my Development, Staging, and Production environments to match with my branches.Share0Follow this: https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-trigger-source-repo-changes-console.html.You will need to setup a cloud watch rule associated to code commit, which then can be customized with either lambda or other integrations.CommentShareEXPERTalatechanswered 4 months ago"


Question: CloudWatch Log Groups deletion using AWS Lambda function

"Hi Aws,Need a lambda function to delete log group with no retention and if the retention period <365 days,and with no KMS encryption configuredFollowComment"

Answer: "1Hi,I think this is exactly what you are looking for: https://repost.aws/questions/QUMcZ1aqV1Rwu-IozegdMF6g/delete-cloudwatch-log-groups-using-aws-lambda-functionHope it helps ;)CommentShareEXPERTalatechanswered 18 days agoEXPERTRiku_Kobayashireviewed 17 days ago0I have edited the code created in this question to the code that meets your requirements.https://repost.aws/questions/QUMcZ1aqV1Rwu-IozegdMF6g/delete-cloudwatch-log-groups-using-aws-lambda-functionThe following code inserts an if statement in line 10 to determine if the retention period is less than 365 days and if the file is not encrypted by KMS.import boto3def lambda_handler(event, context):    logs_client = boto3.client('logs')    response = logs_client.describe_log_groups()    for log_group in response['logGroups']:        if 'retentionInDays' in log_group:            retentionin_days = log_group['retentionInDays']            if retentionin_days < 365 and 'kmsKeyId' not in log_group:                log_group_name = log_group['logGroupName']                logs_client.delete_log_group(logGroupName=log_group_name)CommentShareEXPERTRiku_Kobayashianswered 17 days agoAman 8 days agowhat if the log groups have never expire? how to delete that?Share0what if the log groups have never expire? how to delete that?CommentShareAmananswered 8 days ago"


Question: Fortigate as gateway for multiple vpcs

"we currently have an environment set up that uses a fortigate in one vpc as the gateway for 2 other vpcs through a transit gateway, we want to know if there is any way to achieve this without the transit gatewayFollowComment"

Answer: "1Yes you can do that. Through Gateway Load balancer Endpoint in spoke + GWLB with Fortgiate as target in dedicated VPC.See Diagram 2 in Palo Alto article with dotted green and dotted blue line flow ( forget about TGW in that diagram )Essentially , you will created Gateway Endpoint in both spoke, link them with Gateway LB in dedicated VPC that has Fortigate registered with it.After that some Appliances provide 2 ARM design where  traffic will exit out to internet through second ENI of fortigate through IGW in fortigate/GWLB VPC. or in One Arm design where traffic will come back to spoke VPC and exit through spoke VPC IGW.https://www.paloaltonetworks.com/blog/network-security/vm-series-integration-with-aws-gateway-loadbalancer/I just want to give you architectural guidance that what you want to do is achievable.CommentShareMuhammadanswered 5 months ago0Here you got.https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration-guide/570271/north-south-security-inspection-to-customer-vpcDont forget to accept the answerCommentShareMuhammadanswered 5 months ago0Hi, why would you like to achieve this without a transit gateway? Technical requirement, cost? it depends on the reason the most suitable answer. If its because cost, then there other options like Gateway Load balancer but this also implies a cost, if it is because you would like to get other benefits like load balancing, north-south traffic inspection then gateway load balancer could be a solution without transit gateway.If is other reason and you just want to remove transit gateway, then before the transit gateway this kind of scenario was deployed using a Transit VPC, where one central VPC (your fortigate VPC) connects with every other VPC (spoke VPC) through a VPN connection. This architecture comes with own challenges, and transit gateway was the service that came to resolve them, however is still possible to do that configuration.CommentShareVicky Gracianoanswered 5 months ago0As mentioned, generally yes there are deployment options where you can use a Centralized FortiGate NGFW to provide traffic security gateway functionality for other VPC's without using TransitGateway, but there are limitations and every deployment has pros/cons.TLDR: if your desire is to use a FortiGate in Security VPC for North-South (Ingress-Egress) inspection for 2 additional 'workload' VPC's you can setup:FortiGate + GWLB distributed deployment with GWLB endpoints in each of the workload VPC's (1 per AZ).You will not be able to inspect traffic between the 2 'workload' VPC's with the FortiGate + GWLBReference: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/For larger deployments with many VPC's, TransitGateway + Gateway load balancer +  FortiGate is generally the most modern/complete solution covering all traffic use case scenarios and GWLB deployment options: Ingress inspection (inspection either pre or post NLB), Egress inspection, and East-West Inspection.GWLB distributed deployments (GWLB endpoint in workload VPC's) DO NOT NEED TGW, and can support Ingress, Egress, and Intra VPC inter-subnet inspection, BUT NOT East-West inter-VPC inspectionGWLB Centralized Deployments (GWLB endpoint in a central Security VPC) do require a TGW and can support Ingress, Egress, Intra VPC inter-subnet inspection, AND East-West inter-VPC inspectionCentralized and Decentralized GWLB deployments can be combined to cover any traffic inspection scenario with a single GWLB & FortiGate Autoscaling TargetGroupTransit Gateway was created as the successor to Transit VPC, providing a simplified inter-VPC and inter-Region routing capability with external IPSec VPN capability.  This added functionality has inherent costsGWLB was created to provide scalable & fault tolerant traffic inspection capabilities while eliminating the need to handle complexities of IPSec Tunnels/BGP/ECMP or SNAT for traffic inspection.  This added functionality has inherent costs, and there are other considerations depending on your applications and traffic load like handling of existing flows in the event of an appliance failureAlternative options may provide a specific solution to your query at a lower financial cost ($/month) but added complexity cost (extra configuration/dependencies/etc) resulting in a more difficult solution to support and maintain.CommentShareSkiboyjcmuanswered 4 days ago"


Question: "multi-read/write databases, with replication to each other, in multi-az cluster/aurora cluster setups"

"Hello,I want to implement "active-active" replication, like it is described here https://workmarket.tech/zero-downtime-maintenances-on-mysql-rds-ba13b51103c2  , but using multi-az feature created read instances/replicas. As far as i understood, if im using just "multi-az" then i dont have access to the created "secondary" database. In "multi-az cluster" and "aurora cluster", i do have "read" access to the "secondary" database replicas. Is it possible to get "cmd" access into them? Is it possible to implement some manual changes with cmd access? Is it possible to get the "binlog" location, and using it, setup the "active-active" replication, between the "primary" and "standby"? Or there are some limitations, that make it impossible?ThanksFollowComment"

Answer: "0Accepted AnswerHi,From what I have understood from your question, you might need to setup multi-master R/W nodes DB to get "active-active" replication model. As of today RDS does not support multi-master. Only Aurora supports this but limited only for MySQL that too little old compatible 5.6 version(need to cross check this). Other limitation of aurora multi master is that it is tied to single region(I think us-east-1, us-east-2, us-west-2 as of today) and only 2 AZ. So, basically your R/W instances is placed only in 2 AZ's however the underlying storage can span multi-AZ. I think you can configure MySQL binlog replication between 2 nodes.The main point to note here is - your application needs to implement health checks between 2 nodes, load balance requests(since you can use both endpoints to write) and have logic to switch endpoints if any failure happens in any AZ. Nothing is managed by AWS here. Please go through this blog for more detailshttps://aws.amazon.com/blogs/database/building-highly-available-mysql-applications-using-amazon-aurora-mmsr/CommentShareAritro Senanswered 2 months agoJoann Babak 2 months agoHi, thanks for the answer, as far as we have found out, Amazon aurora version 1 (the one, which supports Mysql 5.6) has "end of life" date, which is quite soon, so that is out of option. I have tested implementing "active-active" replication using "binlog", using single-az RDS mysql database, and the question, is if "multi-az cluster" and "aurora cluster" has any restrictions, that make the "binlog" replication being setup-ed impossible.ShareAritro Sen 2 months agoHey, sorry for late reply. I do not see any restrictions in setting up binlog replication in RDS multi-az or Aurora cluster. But be sure this can take up storage space and can have performance issues if you set up ROW level logging. You can also set up till how long RDS can retain the binary logs. Also you can check binary logs from the writer instance only. You cannot access read only replica instances. Also if you want almost 'zero' downtime, I would recommend to check out Aurora Global Database. The replication is done physically with AWS dedicated infrastructure rather than logical(binlog).https://aws.amazon.com/premiumsupport/knowledge-center/enable-binary-logging-aurora/Share0From the referenced blog it seems that you are attempting to create a maintenance environment for some maintenance such as version upgrade? If so you should check out the RDS blue green deployments feature. This is probably what you want. Hth.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments-overview.htmlCommentShareMODERATORphilawsanswered 2 months agoJoann Babak 2 months agoHi, thanks for the answer, we are trying to achieve "0 downtime" solution for AWS RDS databases, both, in case of update scenario and database fail over, and this "blue/green" solution does have downtime.Share"


Question: Error generating an AFI with an .xclbin created with Vitis 2020.2

"HiI am getting an error when I try create an AFI with a 2020.2 Vitis .xclbin.I'm using aws-fpga v1.4.19.It seems like Vivado 2020.1 is being used.#-----------------------------------------------------------Vivado v2020.1 (64-bit)SW Build 2902540 on Wed May 27 19:54:35 MDT 2020IP Build 2902112 on Wed May 27 22:43:36 MDT 2020Start of session at: Sat Apr 10 14:48:42 2021Process ID: 11292Current directory: /home/builder/scriptsCommand line: vivado -mode batch -source ingest.tclLog file: /home/builder/scripts/vivado.logJournal file: /home/builder/scripts/vivado.jou#-----------------------------------------------------------source ingest.tclset userDCP "../checkpoints/SH_CL_routed.dcp"set awsDCP  "../checkpoints/SH_CL_BB_routed.dcp"set awsDCPStripped  "../checkpoints/SH_CL_BB_stripped.dcp"set powerDefaultRPT "../reports/power_report.default.rpt"set powerStaticRPT  "../reports/power_report.static.rpt"set timingRPT       "../reports/SH_CL_final_timing_summary.rpt"set ioRPT           "../reports/report_io.rpt"set partialBIT      "../bitstreams/SH_CL_final_pblock_CL_partial.bit"set partialLTX      "../bitstreams/SH_CL_final_pblock_CL_partial.ltx"set CL_PATH WRAPPER_INST/CLputs "Ingest start time: \[[clock format [clock seconds] -format {%a %b %d %H:%M:%S %Y}]]"Ingest start time: [Sat Apr 10 14:51:01 2021]set_param hd.supportClockNetCrossDiffReconfigurablePartitions 1set_param hd.platformVerifyCachedRun falsecheck_integrity $userDCPINFO: [Vivado 12-5531] Integrity check successful: /home/builder/checkpoints/SH_CL_routed.dcpcheck_integrity: Time (s): cpu = 00:00:07 ; elapsed = 00:00:07 . Memory (MB): peak = 2181.945 ; gain = 0.004 ; free physical = 66549 ; free virtual = 89717set_msg_config -severity INFO -suppressset_msg_config -severity STATUS -suppressset_msg_config -severity WARNING -suppressCRITICAL WARNING: [Common 17-1355] You are suppressing all messages of type 'WARNING'. You may potentially disregard important DRC, CDC, and implementation messages that can negatively impact your design.  If this is not desired, please run 'reset_msg_config -suppress -severity {WARNING}' to undo this change.set_msg_config -id {Chipscope 16-3} -suppressset_msg_config -string {AXI_QUAD_SPI} -suppressputs "Opening user DCP $userDCP: \[[clock format [clock seconds] -format {%a %b %d %H:%M:%S %Y}]]"Opening user DCP ../checkpoints/SH_CL_routed.dcp: [Sat Apr 10 14:51:09 2021]open_checkpoint $userDCPERROR: [Runs 36-378] The checkpoint '/home/builder/checkpoints/SH_CL_routed.dcp' was created with 'Vivado v2020.2 (64-bit)', and cannot be opened in this version.Edited by: Yaniv42 on Apr 10, 2021 8:51 AMFollowComment"

Answer: 0I found the error on my side. XILINX_VITIS was set to 2020.1 when I ran the create_vitis_afi.sh script.CommentShareYaniv42answered 2 years ago


Question: Error 500310   context:   num_tuples != 0

"Hello. Redshift DB, when making a simple request, I get an error, the reason for which is not clear to me. What could be the problem?It seems to me that the problem is in the event_timestamp field, but not sure.event_timestamp BIGINT   ENCODE az64,  only digits, null values are allowed.SELECT count(*) FROM sa_analytics.events  eWHERE   e.client  IN ('25af4d33-991b-4734-bfb5-71c84a131c4e','fbdc9c91-c99e-41eb-8ff8-70146f0fced5')   AND event_timestamp >= datediff(ms,'1970-01-01',(current_date - interval '24 hours')::date)   AND event_timestamp IS NOT  NULL ;  error:  Assert  code:      1000  context:   num_tuples != 0 -   query:     14198439  location:  vec_fetcher_az64.cpp:291  process:   query0_125_14198439 [pid=17070]  -----------------------------------------------;FollowComment"

Answer: 0i was able to execute a similar statement using the DATEDIFF function. Please open a support ticket for your error.CommentShareMilindOkeanswered a year ago


Question: No push sent to Android devices

"Hi.Our SNS service stopped sending out push messages within the last couple days. There have been no changes in our service and when I use the "Publish message" feature to test an endpoint, it just says the message is sent but never shows up (we've tried several of our own devices). Doing the same for an iOS device the message is sent and delivered instantly.I have no idea what is going on, we've been using SNS for a long time. Anyone has any idea?FollowComment"

Answer: "0Hi AndersP@, there are some troubleshooting steps suggested here:https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-failed-sns-deliveries/Can you try those, and let us know your findings?Edited by: aws-jameson on Sep 14, 2020 9:33 PMCommentShareAWS-User-4707726answered 3 years ago"


Question: reboot due to degraded hardware but instance fail to start with 1/2 status check failed

"I received notice that there is degrade of hardware and I reboot my EC2 as requested.Yet instance fail to start, with 1/2 status check failed.It shows " Instance reachability check failed"Below is extracted from System Logtype=1404 audit(1667406588.040:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.Kernel panic - not syncing: Attempted to kill init!FollowComment"

Answer: "0Accepted AnswerProblem solved.Selinux is enabled after switching instance.SolutionCreate a new instance , and mount the original volumechange the grub/menu.lst and add selinux=0 to disable SELinux for onceThe instance then boot normally. proper setting is done afterward.CommentSharerePost-User-2342838answered 7 months ago"


Question: In AWS GameLift Unity Local Test Panel JRE Not Configured

"Hi all,I'm trying to test sample code given by aws gamelift unity package. In local test panel it keep getting not configured in jre. I tried download it several times but still not working. I checked my environmental variables and it has Java_home. I'm using mac mini m1 and my unity version is 2021.3.4. Thanks in advance.FollowComment"

Answer: "1Accepted AnswerEDIT: This issue has been fixed in release v1.2.1 https://github.com/aws/amazon-gamelift-plugin-unity/releases/tag/v1.2.1, thanks for reporting the issuePrevious answer:Hey! Sorry for delay in response. Not sure if you are aware of this open issue on our GitHub: https://github.com/aws/amazon-gamelift-plugin-unity/issues/58 It has a workaround for this:The only way for me to get it to actually work was by making RefreshIsConfigured() in JavaSetting.cs to always return true.We are currently tracking a fix for this issue internally as well.CommentShareAlanZ_AWSanswered 9 months ago0I still have similar issue using the plugin v1.3.0 and Unity 2021.3.20f1. Already download install and put JRE in the PATH. How to resolve this issue again?Edit: Fixed by restarting the PCCommentShareXenodixanswered 13 days ago"


Question: AWS Cost Explorer Tags Not Showing All CloudFormation Stacks

"Cost Explorer is only showing some, not all, stacks in the returned tag results for the AWS CloudFormation tags (stack-name, logical-id, stack-id), the other stacks don't show.Affected stacks also don't show any cost in the Cost Explorer widget in the Application Manager console.FollowComment"

Answer: "1Regarding Tags, in order for Tags to show up in the billing system, including Cost Explorer, those tags need to be allocated for costs [1]. This is a process where you select the tags to show up in billing data and from then on (not retroactive), they will show up.Regarding the Application Manager, my widget states that it is based on Cost Allocation Tags as well, and even has a recommendation of which tags to enable for cost. It further states it can take up to 24 hours for the data to show up in Cost Explorer and the Cost Explorer Widget.[1] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.htmlCommentShareEXPERTShlomo Dubrowinanswered a year ago"


Question: How to delete Analysis Jobs from Comprehend

"I would like to delete these Comprehend reviews so as not to take up space, look at the image pleaseFollowComment"

Answer: "0The analysis jobs page makes a ListEntitiesDetectionJobs API call to get a list of the entity detection jobs that you have submitted. There is no cost associated with having those entities.Can you clarify what you mean by I would like to delete these Comprehend reviews so as not to take up space?Amazon Comprehend PricingCommentShareTaka_Manswered 7 months agoDomenico 7 months agoI would like to delete these Analysis Jobs, even though I know there is no cost. Is this possible?Sharemachinarum 3 months agoI would like to know as well. The list is too big and takes a lots of time (painfully) to load in the browser. There should be a way to delete them, expire them or if the data associated to it is deleted (S3 input and results files for instance) they should go away. It kills the browser when the "Analysis Jobs" link computes the table paging and loads the first page. If I open a job and return to see another one, it reloads the list again. It is almost unusable.Share"


Question: How to add a Gem as dependency of another Gem?

"I'm using Ly 1.13 BetaMy component (inside my Gem) need to use EmotionFxso I guess I have to add EmotionFx as dependency for my Gem, but I can't find any way to do this with Lumberyard Project configuration.Follow"

Answer: "0Accepted AnswerI guess we need to edit the Dependencies in the file gem.json. Check this example.Then I guess we need to re-create the VS project so the changes apply, with this cmd (assume the project name is Empty_ProjectC:\Amazon\Lumberyard\LumberyardSDK\dev\Tools\LmbrSetup\Win>lmbr.exe projects create_vs_solution Empty_ProjectSharerePost-User-6460635answered 5 years ago0I can't we just use "lmbr_waf configure" to apply the changes?SharerePost-User-6460635answered 5 years ago0Have you even tried before asking me that? "lmbr_waf configure" (in Ly 1.13 Beta) doesn't work, I see it did read the file gem.json, but it didn't update (I guess) the VS project.SharerePost-User-6460635answered 5 years ago0But here it said:                              In a command line window, run the following to generate the Visual Studio solution:lmbr_waf configureSharerePost-User-6460635answered 5 years ago"


Question: Client.UnsupportedHostConfiguration whne trying to allocate mac1.metal instance

"I would like to allocate a dedicated mac1.metal host on my account. The Service quota says I can allocate up to three, but the request fails. I tried multiple AZs and Regions - same result➜  ~ aws  service-quotas list-service-quotas --service-code ec2 --query "Quotas[?QuotaName == 'Running Dedicated mac1 Hosts']"[    {        "ServiceCode": "ec2",        "ServiceName": "Amazon Elastic Compute Cloud (Amazon EC2)",        "QuotaArn": "arn:aws:servicequotas:eu-central-1:40....46:ec2/L-A8448DC5",        "QuotaCode": "L-A8448DC5",        "QuotaName": "Running Dedicated mac1 Hosts",        "Value": 3.0,        "Unit": "None",        "Adjustable": true,        "GlobalQuota": false    }]Here is the relevant cloud trail log for the detail.{    "eventVersion": "1.08",    "userIdentity": {        "type": "IAMUser",        "principalId": "AI....62O",        "arn": "arn:aws:iam::40....46:user/sst",        "accountId": "40.....46",        "accessKeyId": "AS.....35D",        "userName": "sst",        "sessionContext": {            "sessionIssuer": {},            "webIdFederationData": {},            "attributes": {                "creationDate": "2022-07-30T11:19:43Z",                "mfaAuthenticated": "true"            }        }    },    "eventTime": "2022-07-30T11:21:24Z",    "eventSource": "ec2.amazonaws.com ",    "eventName": "AllocateHosts",    "awsRegion": "us-east-1",    "sourceIPAddress": "AWS Internal",    "userAgent": "AWS Internal",    "errorCode": "Client.UnsupportedHostConfiguration",    "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.",    "requestParameters": {        "AllocateHostsRequest": {            "HostRecovery": "off",            "AutoPlacement": "off",            "AvailabilityZone": "us-east-1f",            "Quantity": 1,            "InstanceType": "mac1.metal",            "TagSpecification": {                "ResourceType": "dedicated-host",                "tag": 1,                "Tag": {                    "Value": "xxx Demo",                    "tag": 1,                    "Key": "Name"                }            }        }    },    "responseElements": null,    "requestID": "2506eca6-fb62-4354-98f5-8e536e623f1b",    "eventID": "1f9ae005-dadc-445d-b6a1-9b2b21ce0073",    "readOnly": false,    "eventType": "AwsApiCall",    "managementEvent": true,    "recipientAccountId": "40.......46",    "eventCategory": "Management",    "sessionCredentialFromConsole": "true"}FollowComment"

Answer: "0Hello sebsto,The service quota for running dedicated mac1 host isn't global [1]. Since the quota ARN contains eu-central-1, have you tried launching a dedicated host from that region instead? Additionally, you can also check the service quota for running dedicated mac1 host in your intended us-east-1 region by specifying the region:aws --region us-east-1 service-quotas list-service-quotas --service-code ec2 --query "Quotas[?QuotaName == 'Running Dedicated mac1 Hosts']Before launching mac1 instance, you must allocate a dedicated host in the correct region. You can follow this guide [2] to create a Mac1 dedicated host.Also, be aware that Mac dedicated host doesn't support multiple instance types [3], so you should disable support multiple instance types if you're launching the host from the CLI.Lastly, if your issue still persist, you can open a support case for further assistance.Best,1: list-service-quotas CLI docs2: Creating Mac dedicated host guide3: Mac dedicated host limitCommentShareTriet_Vanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: How to reduce data provisioned charges?

"As per this document , https://aws.amazon.com/rds/free/ the above usage was assumed to have covered under free tier.But why $7.66 is charged in this case?How can one reduce the amount of data provisioning assuming one just selected free tier when setting up and went with the defaultsFollowComment"

Answer: "0HiIn billing section, category wise all details will be populated but that doesn't mean you will be charged at the end of your billing month.If you will be charged at the end of your billing month then you can complain about it on support ticket and they will fix it. Thanks.CommentSharemomermushtaqanswered 7 days ago"


Question: AWS Health Lake

I was trying to go to documentation for Health Lake this is what I get:Bad Request Your browser sent a request that the server could not understand. size of request header field excess server limit.I just trying to follow the links given on the Health Lake Page.Also I can't seem to export to a s3 storage --- Also there are no tags Health LakeFollowComment

Answer: 0Go to 'Getting Started' page under Amazon HealthLake  to access the documentation https://aws.amazon.com/healthlake/getting-started/ We have answered the question on how to query HealthLake data and export data into S3 in 'AWS Supports You'  Episode [https://www.youtube.com/watch?v=-nfDpE3Rr3Y?t=14m26s]CommentShareLaksanswered 7 months ago


Question: AWS DMS Service and Limitation

"We are planning to migrate onpremises sql servers to AWS RDS SQl Servers.Currently on premises contains multiple MSSQL server versions/engines, those want to migrate.e.g MSSQL 2015, in this case should we migrate 2015 to 2016 or 2019 or lower to 2014, what will be good.And for this migration can we use DMS service, do we have any limitation to migrate 4 TB data.. is DMS able to manage, how to calculate required timeFollowComment"

Answer: "0I would suggest migrating MSSQL on prem server to RDS with latest versions as long as you dont have any app compatibility issues.this way you are not on eol or approaching eol versions.https://docs.microsoft.com/en-us/sql/sql-server/end-of-support/sql-server-end-of-support-overview?view=sql-server-ver16#:~:text=across%20multiple%20regions.-,Lifecycle%20dates,-The%20following%20tableDMS doesnt have limitation on migrating based on onprem db size.Please note required timing for data migration is combination of network/source db size/table lob distribution thus i would suggest start testing in nonprod environment and that give numbers to analyseCommentShareAWS-User-8174525-subhashanswered 10 months ago"


Question: Amazon Athena experienced an internal error while executing this query----when executed on partitioned table

"select * from abdc a where a.employee_id in (select employee_id from abc)The table abdc  is partition projected on employee_id.** I got this error while executing this query **Amazon Athena experienced an internal error while executing this query. Please try submitting the query again and if the issue reoccurs, contact AWS support for further assistance. We apologize for the inconvenience.The same query got executed when I executed --select * from abdc a where a.employee_id in ('123456789')FollowComment"


Question: CloudFront breaks session sickiness

"We have a quite simple webapp infrastructure: 2 backend EC2 in a target group, internet facing ALB and CloudFront. Session stickiness is turned on on the target group.When we have only one default behavior with Managed-CachingDisabled and Managed-AllViewer policies session stickiness is fine. Obviously this doesn't cache anything.When I add a new behavior to cache resources in media folder session stickiness doesn't work any more. This policy uses one query string param in cache key, otherwise it is like Managed-CachingOptimizedboth CF and ALB on HTTPS, same SSL cert installed on both.I don't really understand why stickiness stops working even if we have AWSALB cookie on cached items too.Please let me know if you need any other details.FollowComment"

Answer: "1Hi there,ALB sticky sessions utilize cookies in order to determine the target that should handle subsequent requests [1], while CloudFront does not forward cookies in the origin request unless specified in either the cache policy or origin request policy. The cookies that CloudFront needs to forward will depend on whether the ALB is using duration-based cookies, application-based cookies, or both.If the value of these cookies affects the cached content that is returned to the viewer, then you will want to ensure that each cookie name is added to your cache policy, so that the cookie and its value are part of the cache key [2]. If the value of these cookies does not affect the cached content that's returned to the viewer, then you could consider adding in these cookies in the origin request policy, or using the Managed-AllViewer origin request policy on your media cache behavior to forward the cookies to your origin [3].If stickiness is not working even when the AWSALB cookie has been added to your cache policy, it may be that additional cookies are being utilized for stickiness that aren't being included in the cache policy or origin request policy, such as the AWSALBCORS cookie for CORS requests or "AWSALBAPP-" cookies if application-based stickiness is being used. To ensure all AWSALB-related cookies are included, you can add "AWSALB*" to your policy. You can also use your browser's developer tools or a HAR capture to identify other cookies that are being set on the client [4], and then add in the necessary cookies to your policies.References[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html[2] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html[3] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html[4] https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/CommentShareSUPPORT ENGINEERMichael_Lanswered a year agoSkornyikG a year agoThank you for the detailed answer.AWSALB* value doesn't affect the content and adding them to cache key doesn't make much sense to me because those values are constantly changingAs origin request policy we are using Managed-AllViewer, though in case of "cache hit" there is no origin request, as I understand. Still we can see AWSALB changing on requests served from cache.Share"


Question: Aws AppFlow HubSpot connector not working

"Hi,I have started using the AppFlow HubSpot connector yesterday and trying to ingest some of the customer's data.First I have bumped into this  issue.Then I have moved on and tried to ingest other objects from the list.When I tried to ingest Campaign and Email_Event, I got the 403 again and after checking the logs on the HubSpot DevAccount, I saw this:{"status":"error","message":"This app hasn't been granted all required scopes to make this call. Read more about required scopes here: https://developers.hubspot.com/scopes.","correlationId":"924b2950-d7ae-461b-916b-c4735fdbbcac","errors":[{"message":"One or more of the following scopes are required.","context":{"requiredScopes":["content"]}}],"links":{"scopes":"https://developers.hubspot.com/scopes"},"category":"MISSING_SCOPES"}Needless to say that when I add mentioned scope to the HubSpot App and trying to re-connect the  AppFlow HubSpot connector - it breaks.Can I please have some with this.For the Owner object from HubSpot v3 API ingestion worked ok.FollowComment"


Question: New Lightsail User - Issue Accessing Websites and Downloading

"Hey, all:I am BRAND new to lightsail, though I do have some other experience with VPS.  Anyway, I created my instance and can open up my Windows desktop via lightsail.  The first thing I want to do is download some programs to use via my new VPS.  But I'm having big time issues accessing web sites and downloading via the IE browser on the desktop.I would like to download Chrome, but when I navigate to the Chrome website, the download button does not work. I can see the button, but nothing happens when I push it.  I've ensured that the Google download site is Trusted, but that doesn't help.I am trying to log into my ig.com account, but when I navigate to IG.com then hit the link to their login page, nothing happens.  Again, I've ensured IG.com is "Trusted", but that doesn't help.I am trying to navigate to my Fidelity brokerage account, but the Fidelity website doesn't load correctly via the IE browser in my lightsail Windows desktop.What am I missing?  Is there some setting that I'm not changing to allow basic website loading, login and download to work?  At this point the desktop is worthless to me.  Super frustrated.  Appreciate any help!Thanks,TWFollowComment"

Answer: "0Disappointing that there isn't more activity on this forum.  I got help elsewhere. I had browser security settings issues I was able to easily resolve with help.  Frustrating not to be able to get simple help from Amazon.CommentShareysroq1answered 4 years ago0To be fair, I suspect most people are using some Linux variant with Lightsail.CommentShareDavid Ganswered 4 years ago"


Question: Sagemaker and Data on Databases

"A customer has a question about data sources“most of our data is stored in SQL databases, while the SageMaker docssay that I have to put it all in S3. It’s not obvious what the bestway to do this is. I can think for example of splitting my analysiscode in two; one pre-processing step to go from SQL queries to tabulardata, and e.g. store that as Parquet files. For high-dimensionaltensor data it’s even less obvious.”Can someone comment on that?FollowComment"

Answer: "0Accepted AnswerWe have an example notebook for interacting from Redshift data from a SageMaker managed notebook, which I believe is suitable for an Exploratory Data Analysis (EDA) use-case: https://github.com/awslabs/amazon-sagemaker-examples/blob/master/advanced_functionality/working_with_redshift_data/working_with_redshift_data.ipynbFor production purposes, the customer should consider separating the job of first extracting data from relational databases to S3 (to build out a data lake), and then using that for downstream processing/machine learning (including SageMaker, EMR, Athena, Spectrum, etc.). Customers can build extraction pipelines from popular relational databases using AWS Glue, EMR, or their preferred ETL engines like those on the AWS Marketplace.CommentShareLaith-at-AWSanswered 5 years ago0I'd recommend using SageMaker Data Wrangler to connects the dots of different SageMaker services. https://docs.aws.amazon.com/sagemaker/latest/dg/data-wrangler-import.htmlCommentShareTheDataWranglersanswered a year ago"


Question: SQL access 2d array element

"HiI have this payload and want to do some comparison operation in aws iot rule:{"state":  {    "reported":{        "temp": [                 [                 1,                0,                2,                "hello world",                "-",               "",               "",              0               ] ,              []             ]           }     }}. I want to compare if temp[0][2] is equal to 2 or not.I have written this sql statementSELECT * FROM '$aws/topic' WHERE state.reported.temp[0][2] = 2 but this throws following exceptionSqlParseExceptionExpected a comparison operation: JPathNode(List(IdentNode(state), IdentNode(reported), IdentNode(temp))) state.reported.temp[0][2] =2 -------------------------------------------------^ at 1:50So anyone up for help?ThanksFollowComment"

Answer: "2Accepted AnswerTo access elements in a collection (array, string, object ) use the SQL function get function:In your case, use get() instead of square brackets to access your array element:SELECT * as result FROM 'topic' where get(get(state.reported.temp,0),2) = 2CommentShareEXPERTJan_Banswered 8 months agoEXPERTGreg_Breviewed 8 months ago"


Question: API Gateway S3 Integration strip request header

"I have an api gateway configured to hit S3. I'm trying to strip off the "accept" header to avoid unnecessary content encoding from S3 but I'm not able to do that. If I attempt to modify the headers, I'm getting a SignatureDoesNotMatch error from S3.FollowComment"


Question: Student account billing for free tier

"Dear AWS team,I am a student who is new to the AWS world and opened my AWS account in march 2023 for learning purpose. I have used very limited services for less time. I recently finished a personal project where I used EBS, ECR, CI/CD and RDS. Though I haven't done much on the website. I deployed my website in March and got a notice in April, saying that I have used up 85% of my free tier. I am still in the free teir period but for some reason i am incuring some charges. On May 2nd I got a bill of $100. I dont know what services are running in the background and as I am new I do not know if I have to close them to stop incurring charges.Could someone please tell me if there is any possibility to weavie off the charges as I am a student and barely used the services, it is very difficult for me to pay such huge amount.Thank you in advance! It is greatly appreicated!FollowComment"

Answer: "1Accepted AnswerHello,I would suggest that you open a billing case through your account : https://console.aws.amazon.com/support/home#/case/create?issueType=customer-servicePlease choose Account and billing, so that the Billing team can look at this specific case and provide a resolution.Thanks,OthmaneCommentShareOthnajidanswered a month ago1Yes, you will have to stop service(s) to avoid incurring more charges.In AWS console, in the menu bar at the top right (where it probably has your name) click it and select Billing Dashboard, then on the pane on the left select Bills, and then when the current month's bill comes up select April 2023 (on mine the box is orange).Scroll down to Charges by Service and you should be able to see a breakdown of what you were billed for by service, and within each service it will be broken down by region.CommentShareRWCanswered a month ago1In addition to the above. AWS cannot delete or remove your services for privacy/security reason, you have to select the services for yourself and delete or remove those by yourself. Yes, they can consider the bills and advise from where the charges are generating.You may follw the advice of "RWC" above, but one thing you can do, just click the plus sign of the respective service and you will see the region as well as the specific service/data usage also, and you have to go in that particular region to delete or remove the service. It appears your data usage and RDS may generating the charges.CommentSharerePost-User-7136343answered a month ago0Can anyone tell me please can i open two aacounts as a free tier with same credit card i m student learning devops wanted to learn cross account replication so created second account as i see in billing section its generated above 6k bill conly for ec2 please reply what i can do i dont have this much of amount to pay can i close that account or what.CommentSharerePost-User-2325694answered a month ago"


Question: Kinesis Video Stream with Content moderation (AWS Rekognition)

"I would like to perform content moderation from AWS Rekognition on a Kinesis Video Stream real time. I see there is documentation for using AWS Rekognition to detect faces on Live Kinesis Video Stream but is it possible to call the contentmoderation method function and perform the same task. If yes, where will the results be stored?Also, if yes, can we extract just that part of the video where the content has been detected and store it in S3 bucket?FollowComment"

Answer: "0Hi, Amazon Rekognition Video stream processors doesn't support content moderation.https://docs.aws.amazon.com/rekognition/latest/dg/using-rekognition-video-stream-processor.htmlYou will need to extract image frames or video clip from Kinesis Video Streams and call moderation APIs.You can use Parser Library to extract image frames or GetClip API to extract video clip.https://github.com/aws/amazon-kinesis-video-streams-parser-libraryhttps://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetClip.htmlCommentShareYuma_Manswered a year ago"