Question: "aws sso login" returns "command not found" error

"When I run aws sso login I get the following error:$ aws sso loginaws sso login: command not foundAll other aws commands work fine.aws sso help returns the sso man page with a description and available commands: AVAILABLE COMMANDS       o get-role-credentials       o help       o list-account-roles       o list-accounts       o login       o logoutI get the same error for the other aws sso commands (except help):$ aws sso logoutaws sso logout: command not found$ aws sso get-role-credentialsaws sso get-role-credentials: command not found$ aws sso list-account-rolesaws sso list-account-roles: command not found$ aws sso list-accountsaws sso list-accounts: command not foundUsing: $ aws --versionaws-cli/2.11.2 Python/3.11.2 Linux/5.15.90.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/offInstalled following these instructions.Debug output:$ aws --debug sso login2023-03-14 11:30:36,369 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.11.2 Python/3.11.2 Linux/5.15.90.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.222023-03-14 11:30:36,369 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['--debug', 'sso', 'login']2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_s3 at 0x7f030ab953a0>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_ddb at 0x7f030b5d6840>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.configure.configure.ConfigureCommand'>>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x7f030b554a40>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function change_name at 0x7f030b5560c0>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function alias_opsworks_cm at 0x7f030ab97880>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_history_commands at 0x7f030af25260>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method BasicCommand.add_command of <class 'awscli.customizations.devcommands.CLIDevCommand'>>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <function add_waiters at 0x7f030ab97740>2023-03-14 11:30:36,383 - MainThread - botocore.hooks - DEBUG - Event building-command-table.main: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7f030a151750>>2023-03-14 11:30:36,384 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.11.2/dist/awscli/data/cli.json2023-03-14 11:30:36,387 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_types at 0x7f030afd6ac0>2023-03-14 11:30:36,387 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function no_sign_request at 0x7f030afd6de0>2023-03-14 11:30:36,387 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_verify_ssl at 0x7f030afd6d40>2023-03-14 11:30:36,387 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_read_timeout at 0x7f030afd6f20>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <function resolve_cli_connect_timeout at 0x7f030afd6e80>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event top-level-args-parsed: calling handler <built-in method update of dict object at 0x7f030a14eac0>2023-03-14 11:30:36,388 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/2.11.2 Python/3.11.2 Linux/5.15.90.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off2023-03-14 11:30:36,388 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['--debug', 'sso', 'login']2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_timestamp_parser at 0x7f030ab95d00>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x7f030bd30220>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_binary_formatter at 0x7f030a120d60>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function no_pager_handler at 0x7f030bd04a40>2023-03-14 11:30:36,388 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x7f030bd51b20>2023-03-14 11:30:36,389 - MainThread - botocore.utils - DEBUG - IMDS ENDPOINT: http://169.254.169.254/2023-03-14 11:30:36,391 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function attach_history_handler at 0x7f030af09b20>2023-03-14 11:30:36,391 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_json_file_cache at 0x7f030b5beac0>2023-03-14 11:30:36,400 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/aws-cli/v2/2.11.2/dist/awscli/botocore/data/sso/2019-06-10/service-2.json2023-03-14 11:30:36,402 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sso: calling handler <function add_sso_commands at 0x7f030b5bcea0>2023-03-14 11:30:36,402 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sso: calling handler <function add_waiters at 0x7f030ab97740>2023-03-14 11:30:36,409 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sso: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7f030a151750>>2023-03-14 11:30:36,411 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sso_login: calling handler <function add_waiters at 0x7f030ab97740>2023-03-14 11:30:36,411 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sso_login: calling handler <bound method AliasSubCommandInjector.on_building_command_table of <awscli.alias.AliasSubCommandInjector object at 0x7f030a151750>>2023-03-14 11:30:36,411 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.custom.login.no-browser: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7f030a185650>2023-03-14 11:30:36,412 - MainThread - botocore.hooks - DEBUG - Event process-cli-arg.custom.login: calling handler <awscli.argprocess.ParamShorthandParser object at 0x7f030ab99c10>2023-03-14 11:30:36,412 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.custom.login.sso-session: calling handler <awscli.paramfile.URIArgumentHandler object at 0x7f030a185650>2023-03-14 11:30:36,412 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()Traceback (most recent call last):  File "awscli/clidriver.py", line 460, in main  File "awscli/clidriver.py", line 595, in __call__  File "awscli/customizations/commands.py", line 205, in __call__  File "awscli/customizations/sso/login.py", line 43, in _run_main  File "awscli/customizations/sso/utils.py", line 166, in _get_sso_config  File "awscli/customizations/sso/utils.py", line 195, in _get_legacy_sso_configI tried uninstalling following these instructions and installing again, that didn't solve the problem.Running /usr/local/bin/aws sso login works.$ which aws/usr/local/bin/aws$ whereis awsaws: /usr/local/bin/aws# There are no alias for aws$ alias | grep awsRunning it as an alias also works:$ aws sso loginaws sso login: command not found$ alias pippo='aws sso login'$ pippoAttempting to automatically open the SSO authorization page in your default browser.If the browser does not open or you wish to use a different device to authorize this request, open the following URL:https://device.sso.eu-west-1.amazonaws.com/What can I do to troubleshoot this issue?FollowComment"

Answer: "1Did you try it with --debug -option? That could reveal where the problem is.aws --debug sso loginMy guess is, there is some trouble finding your default browser.CommentShareKalluanswered 3 months agomarco-lackovic 3 months agoThanks! I did that and added the output to the question (it was too big for a comment). I also added that both running as /usr/local/bin/aws sso login and from an alias work fine.ShareKallu 3 months agoI think this something with your shell rather than aws-cli. "aws sso login: command not found" says it can not find cmd "aws sso login", like it was ignoring whitespaces between cmd and arguments. Everything else seems to work; debug-flag, fullpath, even "aws sso help", but not "aws sso login".  I can get similar error if I add quotes around cmd and parameters.$ 'aws sso help'-bash: aws sso help: command not foundHave you checked you don't have function called "aws" defined?$ typeset -F | grep awsSharemarco-lackovic 3 months ago@Kallu I suspect you are right, something is wrong with my shell. It is peculiar it only happens with aws. typeset -F | grep aws produces no output.Share"


Question: How to clear Cloudfront cache

"I have a static website using cloudfront and S3, how do I clear the cache?FollowComment"

Answer: 1This Knowledge Center article outlines how you can invalidate objects in CloudFront.CommentShareBrent Everman AWSanswered 2 months agoEXPERTalatechreviewed 2 months agorePost-User-7272768 2 months agoThanks I just found this nowShare


Question: How to send delay response from lambda function to aws lex bot?

"Hi Team,How to send delay response from lambda function to aws lex bot? using c#Ex: Session timeout notification will be send to user. Please help on this.FollowComment"

Answer: "0There is no way to my knowledge doing it during run time without exiting the backend lambda. You can configure the response in the Lex Bot Model (or the console) to send delay response, but this did not work for me either.CommentShareTalkFirstanswered a month ago"


Question: Auto scaling question

"Quick question regarding auto scaling that I could't answer myself from reading the docs.When a fleet is autoscaling down and the protection policy of a fleet is set to full protection. Does gamelift set the PlayerSessionCreationPolicy to DENY_ALL automatically on running gamesessions to prevent new player sessions from entering a game session that should be terminated in time as a result of scaling down?If not, is there another way to 'mark' gamesessions that should end? So that the instance will gracefully shut down once all sessions are done.Thanks.FollowComment"

Answer: 0Accepted AnswerHi-This does not happen automatically. When you are scaling down it will treat all hosts equally. The first host that ends up with no game sessions running on it will be the first eligible to scale down. When placing game sessions we pack them onto instances in such a way that we favor fully-loaded hosts. This allows for other hosts to free up and become eligible for scaling down.Does this help?CommentSharerePost-User-0985817answered 4 years ago0That's clear. Thanks.CommentSharerePost-User-9762214answered 4 years ago


Question: EC2 instance Compute Optimizer found that this instance's Memory is under-provisioned.

"Hi Team,One of my ec2 machine is memory under provisioned. Just wanted to know that what is the threshold value  by default where instance say under provision or over provision. How much memory should be free for instance to run normally. Suggest any references to understand the limits where this under/over provisions trigger for instancesFollowComment"

Answer: "1Accepted AnswerGreetings,The threshold at which an EC2 instance is considered under-provisioned or over-provisioned can vary depending on the instance type and the workload running on the instance. However, a general guideline is to ensure that there is enough free memory for the operating system and applications to function efficiently, without experiencing excessive swapping or out-of-memory errors.For Linux-based EC2 instances, the free command can be used to view the amount of free memory. The free command displays the total, used, and free memory in kilobytes (KB), along with the amount of memory used for caching and buffers. You can use this information to determine the amount of free memory on your instance and whether it is under-provisioned.As a rule of thumb, it is recommended to keep at least 10% of the total memory available as free memory for the operating system and applications to function efficiently. However, this can vary depending on the workload and applications running on the instance.There are several factors that can impact memory usage on an EC2 instance, including the number of applications running, the size of the datasets being processed, and the memory requirements of individual applications. To determine the optimal amount of memory for your workload, you should monitor memory usage over time and adjust the instance type or size as needed.Here are a few references that can help you understand the memory limits and thresholds for EC2 instances:Amazon EC2 Instance Types: https://aws.amazon.com/ec2/instance-types/Best practices for running applications on Amazon EC2: https://aws.amazon.com/ec2/getting-started/best-practices/Monitoring memory usage for Amazon EC2 Linux instances: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-memory-use/Please let me know if I answered your questionCommentShareZJonanswered 3 months agoEXPERTTushar_Jreviewed 3 months agorePost-User-2738569 3 months agoThank you a lot @Zokir for taking time to answer my question. I got answer for my questionShare"


Question: RDS Aurora VolumeBytesUsed value suddenly decreased

"I checked CloudWatch and found that the Volume Bytes Used metric suddenly dropped around 700GB without any cause, I'm the only one authorized to run queries in the company on a live environment and I didn't run any Any query like "delete" or "drop" the table/data at the time of this drop, can anyone who has encountered this situation explain it to me?FollowComment"


Question: Unable to add new compute environment on JobQueue on AWS Batch

"Hello!I'm unable to add new compute environments on an already existing job queue, currently the queue uses a AWS EC2 managed spot environment.When editing the queue, it doesn't show the already added compute environment, but just says: "No resources. No FARGATE compute environments available", even though it is already running jobs on a AWS EC2 managed compute environment.Does anyone know what is going on here? It seems that it isn't recognizing any compute environments.FollowCommentAshish_T SUPPORT ENGINEER7 months agoI tried the same in us-east-1 region and i could add more compute environment in existing job queue. May i know the region in which you are facing the issue? can you please try again and see if the issue still exist?Share"

Answer: "0Dear customer,From your initial correspondence, I understand you don't expect the warning No FARGATE compute environments available when you edit/create your AWS Batch job queue, because you want to add an EC2 compute environment.Please note, AWS Batch have recently introduced Batch on EKS clusters [1], which implied slight changes on the Batch Web Console as well. Hence, there is a new choice group at the top of the screen with the Orchestration type, defaults to Fargate. However, if you don't have any Fargate compute environments available, you will receive the aforementioned warning.All you have to do is switching the Orchestration type selection to Amazon Elastic Compute Cloud (Amazon EC2), so you can pick on of your EC2-based compute environments to assign with your job queue.I hope this helps you solving the issue you are facing. If you still need additional assistance, please open a Premium Support case from your account, so we can provide more tailored help after checking the resources in your account.References:[1] https://aws.amazon.com/about-aws/whats-new/2022/10/aws-batch-supports-amazon-eks/CommentShareSUPPORT ENGINEERJankoanswered 7 months ago"


Question: AWS Tower Setup failed: Subscribe To AWS EC2 Service

"Hi, is it possible to delete AWS Tower failed installation. I attempted to setup AWS Tower in my organization in the eu-west-1 region but the installation failed with an error "*AWS Control Tower failed to set up your landing zone completely: AWS Control Tower setup failed. Be sure your account is subscribed to the AWS EC2 service, then try again. *I have attempted to retry and I still get the same error, I notice that the accounts were created but everything that is done behind the scene has failed.Is there an easy way to delete the Tower setup and start from scratch.FollowComment"

Answer: "1You can decommission the Landing Zone, however some resources still going to be there, such as s3 buckets and CW logs.https://docs.aws.amazon.com/controltower/latest/userguide/walkthrough-delete.htmlCommentShareAWS-User-3204258answered a year agoDivine a year agoThank you, I was reading over the docs. I think I would need AWS to resolve the problem as it actually failed. The document says it won't resolve a failure. I was trying to take the easy way out "I thought" by using Tower. It may be better off just building my own landing zone.Share0Which account are you trying to deploy the Control Tower (CT) Landing Zone on? Is it the organizations management account? Is there any SCPs and /or restrictive policies applied to the account and the user / role?How long has the account been opened and is there any resources such as EC2 instances running in that account? If not please do launch 2 EC2 instances for about 30 mins.Have you reviewed the pre-requisites for deploy CT Landing Zone here?I would suggest you contact AWS Support in your support center so they can take a look into your account.It is possible to clean up the Landing Zone, besides the documentation, you might need to manually reset the root password and close the log archive and audit accounts. You will need two new email addressed for a brand new deployment. But like you mentioned before, it's a last resort to try only if no other causes can be identified.CommentShareJason_Sanswered a year agoMaycon Santos a year agoHello @Json_S, I am facing the same issue. In my case, it is a new account, that was created over 3 days but never used.I received the error and also launched an instance for over 30 minutes after seeing your suggestion. Also, unless Control tower is blocked by default, I don't think I am going over any quotas.As I don't have a paid support plan, I am unable to contact the support directly, is there any other step that you suggest I take? I really would like to avoid have to recreate the setup.Share"


Question: ECS w/ Fargate and AWSVPC network mode - connetion to localhost refused

"My app consists of 2 containers running on the same task - a vue 3 frontend and flask api backend running on gunicorn on port 5000. I have opened ports 80 and 5000 on the containers, respectively and also added the ports to security groups. When I try to connect from the frontend to the backend using http://localhost:5000/resource or http://127.0.0.1:5000/resource, I get connection refused error. I can access the API with the tasks public IP on port 5000. Maybe it's of importance, but the API also refuses to connect with the application load balancers DNS address on port 5000, while front end loads without issues.Also tried to connect using the container name as host, but no luck there.EDIT:I checked gunicorns logs and it seems that the connection from frontend doesn't reach it.FollowComment"

Answer: "0Hello :)FYI you don't need to open the security group of your container to itself if it is going to make calls internally over localhost etc., however, you definitely need to have the LB SG granted access to your application. If it is only to the frontend, use the frontend ports.As for the localhost:5000, I am not sure why this is not working for you. Connection refused could be because your gunicorn API is not actually running? Eitherway, to be able to scale properly, I would recommend to use a different ECS Service, one for your frontend, one of your backend. Then you can use ECS Connect or AppMesh to perform frontend-to-backend API calls routing. You can also use very basic DNS based routing for that, I just think that using something like AppMesh can give you a lot more features out of the box.CommentShareJohnPrestonanswered 2 months agozz 2 months agoThanks for the answer. The gunicorn API is most definitely working as I'm able to connect using the public IP of the task. Really puzzled by this as it's my understanding that inter container communication should work out of the box with AWSVPC network mode within the same task.ShareJohnPreston 2 months agoOkay, this is very odd then. I have had many applications do exactly that with typically NGINX pass to localhost to another app etc.Have you maybe bound your gunicorn app only on the eth0 which is quite possible. Check that your gunicorn listens both on "eth0" and the loopback interfaceShare"


Question: Unable to stop ec2 instance

unable to stop ec2-instance id : i-0d78759cbe0110f81. while trying to stop force fully then getting the following message: An internal server error.Please help me ASAP.FollowComment

Answer: "0Have a look at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesShuttingDown.html. Specficially under Delayed instance termination, you can raise a support ticket there.CommentShareAWS-Useranswered 10 months ago"


Question: how to set same IP for multiple instances when using outgoing restful request?

"Hi,I am trying to use 3rd party services with my EC2 instances.The 3rd party service has some security rules. one of them is that my instance's IP has to be whitelisted.I am working with multiple instances that can be scaled over time and I don't want to set Elastic IP for each instance. and I don't want to register new IP every time I'm adding a new instance.Is there a way to use a service (maybe proxy) that listen to all my instances and forward the outgoing request with the same IP?I also believe it is more secure to put my outgoing requests behind a proxy.Can I get an explanation/tutorial for doing that?Thank you!AsafFollowComment"

Answer: "1This is presented as a use case for a NAT Gateway.When you create a public NAT Gateway you associate it with an elastic IP which the IP address that outside services would see when it is used by your servers:The NAT gateway replaces the source IP address of the instances with the IP address of the NAT gateway. For a public NAT gateway, this is the elastic IP address of the NAT gateway.CommentShareCarlo Mencarellianswered 4 months agoEXPERTskinsmanreviewed 4 months agoskinsman EXPERT4 months agoExactly, assuming the EC2 instances don't need to be public and accepting inbound requestd from the internet - a reasonable assumption given it's a scaled fleet.Share"


Question: Difference between EKS managed node group and self-managed node group

"Hi guys!I read these two documents about EKS managed node group and self-managed node group, but I still can't understand the difference between these two types.Could you please help me explain with the simple way to understand.Thanks!https://docs.aws.amazon.com/eks/latest/userguide/worker.htmlhttps://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.htmlFollowComment"

Answer: "2Let's use the Container ship analogy to answer your question.Some basics out of the way first . . .Node = Host, or to use the analogy The Container Ship.It is where your tasks or groups of containers run.The question here is how much control do you want over ship building?Self ManagedWith self managed, you build and maintain the ship.You specify your EC2 instance and AMI image (i.e Bottlerocket, Firecracker, Windows)  You have more to do when patching your nodes and have complete control of the instance.Managed NodeAWS manages the servers for you - You just specify the instance type, but not the AMI.  Patching can be managed for you.FargateThe last type of node group is Fargate - This is like giving your container to someone else to ship. You don't have a ship.Your container runs on a node with other customers and you are only billed for the compute you use, not the whole node or empty ship.  This is considered serverless since you don't provision or maintain servers with this node group type.You can mix and match Node Groups on the same cluster if you desire.CommentSharetedtrentanswered 6 months agoEXPERTTushar_Jreviewed 6 months agoSteven 6 months agothanks for your answerShare0Accepted AnswerWith a self-managed node there is a lot you are responsible for configuring. That includes installing the kubelet, container runtime, connecting to the cluster, autoscaling, networking, and more. Most EKS clusters do not need the level of customization that self-managed nodes provide.Managed node groups handle the lifecycle of each worker node for you. A managed node group will come with all the prerequisite software and permissions, connect itself to the cluster, and provide an easier experience for lifecycle actions like autoscaling and updates. In most cases managed node groups will reduce the operational overhead of self managing nodes and provide a much easier experience.CommentShareNoah_Lanswered 6 months agoSteven 6 months agothanks for your answerSharevneekhra 4 months agois there any pricing difference in managed and self-managed? Let's say we will run 2 two worker nodes only, so any difference in the pricing? Also Savings plan can also be used if we opt any managed or self-managed?ShareNoah_L 4 months agoManaged nodes only bill for the other AWS resources consumed (EC2, EBS, etc). The managed worker nodes will appear in your account and savings plans will apply to both managed and self managed nodes.Share0But you still need manually update the eks managed node group AMI:(CommentSharemyronix88answered 2 days ago"


Question: AWS IoT core multicast to LoRaWAN Class A devices

"I have some sensing-labs pulse counter devices deployed (@ R&D stage) with intention of attaching to pulse output cables.  Technology is proven and works in TTN v.3.The devices are Class A and need a downlink sending to change the data granularity.  Feedback from Sensing-labs support is :Your encode downlink is the good one " port 2  payload - will be 0107010101c2019c02070800bb09000f0b01", but needs to be send as a Class A downlinkyou should check on AWS help or contact AWS support about this point.https://resources.lora-alliance.org/technical-specifications/lorawan-specification-v1-0-3https://resources.lora-alliance.org/technical-specifications/lorawan-remote-multicast-setup-specification-v1-0-0FollowComment"

Answer: "2Hi,You can find information on how to send multicast messages to your LoRaWAN devices using this link: https://docs.aws.amazon.com/iot/latest/developerguide/connect-iot-lorawan-create-multicast-groups.htmlIn case you are not yet experienced with AWS IoT Core for LoRaWAN, I suggest starting with an example on how to send downlink data to a speciific LoRaWAN device (without multicast) by using these resources:https://docs.aws.amazon.com/cli/latest/reference/iotwireless/send-data-to-wireless-device.htmlhttps://github.com/aws-samples/aws-iot-core-lorawan/tree/main/send_downlink_payloadPlease let me know if any questions remain.thanks, AndreiCommentShareAndrei Sanswered a year ago0I am looking for a Console option to Multicast to Class A devices.Link to screen grab of multicast set-uphttps://drive.google.com/file/d/1vFRXGfceuop9QsjsynDQd2qNs6Vu0xg_/view?usp=sharingIs there a none console option for a multicast to Class A devices?CommentShareAWS-User-2215265answered a year ago0In The Things Network the option in console is (link to screen grab)https://docs.google.com/document/d/1HdHuRb01pDwK1JB3YWKKWFyEZ0RaIAiw2k-ZvME6AbM/edit?usp=sharingCommentShareAWS-User-2215265answered a year ago"


Question: script to update python runtime from 3.6 to 3.9 in lambda functions

i have multiple lambda functions. is there any script to update python runtime from 3.6 to 3.9 in lambda function automatically.thanks.FollowComment

Answer: "4Accepted Answeryou need to change the region in below code ,it will automatically update python runtime 3.6 to 3.9 in all lambda functions.#!/bin/bash# listing all functions in csv format using Regular expressionslambda_fun=$(  aws lambda list-functions \  --function-version ALL \  --region=us-east-2 \  --output text \  --query "Functions[?Runtime=='python3.6'].FunctionName" | sed -E 's/+/\\n/g')# adding header to csv and redirecting to file [file.csv]echo -e "lambda_functions\n$lambda_fun" > file.csv# updating lambda function by iterating using while loopi=0# input file separateOLDIFS=$IFSIFS=","# while loopwhile read  lambda_functionsdo  ((i=i+1))  # skipping header  if [  "$i" -eq 1  ]; then      continue  fi  runtime_update=$(    aws lambda update-function-configuration \    --function-name "$lambda_functions" \    --runtime python3.9 --output text --query "Runtime"  )  echo "$lambda_functions" is successfully updated to "$runtime_update"done < file.csvIFS=$OLDIFSCommentSharechaitanyaanswered a year agoJaccoPK a year agobe aware that aws lambda list-functions will not return all lambda since it uses pagination... (you can add the switch --no-paginate to prevent this)Share1You can do something like this. It will update all function in one region.Attention though:this will ruin any Infrastructure as Code that you have. If you have IaC you should update any code there in stead of running a scriptthere are differences between python 3.6 and 3.9, your lambdas might stop working after the update so testing out all code paths is necessaryimport boto3import jsonclient = boto3.client('lambda')functions = []response = client.list_functions()nexttoken = response.get('NextMarker', None)functions.extend(response['Functions'])while(nexttoken):    response = client.list_functions(Marker=nexttoken)    nexttoken = response.get('NextMarker', None)    functions.extend(response['Functions'])for function in functions:    if function['Runtime'] == 'python3.6':        client.update_function_configuration(            FunctionName=function['FunctionName'],            Runtime='python3.9'        )CommentShareJaccoPKanswered a year ago"


Question: From where data transfer going to be performed

"Hello,I am starting to use AWS S3 standard storage service for my web application .I'm concerned at this point by data transfer costs because we are not transferring any data outside to AWS or to internet then why we are getting charge of data transfer out cost?I also want to know data transfer's origination and how can i reduced its cost?Please refer the below as example in which we getting $17.66 charge for data transfer cost in May month 2022.so tell me how it is calculated on what basis?And is it possible Data Transfer Costs with content download from website - S3  ?Bandwidth                                                                                $17.66$0.000 per GB - data transfer in per month                                                                16.271 GB                             $0.00$0.000 per GB - data transfer out under the monthly global free tier                    100.000 GB                           $0.00$0.000 per GB - regional data transfer under the monthly global free tier              0.008 GB                             $0.00$0.090 per GB - first 10 TB / month data transfer out beyond the global free tier  196.192 GB                     $17.66FollowComment"

Answer: "0Hi,The S3 data transfer happens from the region the S3 bucket is at. Even though S3 appears as a Global service in the Console it's not. So if you go to the S3 Console you will see in the list a column with the S3 bucket region.I probably need some more details on your specific use case but it seems most of the charges are from regional data transfer that means you probably created the S3 in a different region than where you're running your services.CommentSharemarianordanswered a year ago0HiCost Usage Reports are a great way to understand your S3 costs. You should go through following link which details billing for S3.https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketBilling.htmlIn particular refer the section for usage reportinghttps://docs.aws.amazon.com/AmazonS3/latest/userguide/aws-usage-report-understand.htmlYour bill & cost usage reports will provide the breakdown of the costs. The metrics will show whether the data transfer costs is from data going to internet or others.As always leverage tags for your buckets so you can identify and map the costs. In order to understand how the bucket is getting used, leverage Storage lens. Storage lens has usage metrics which are free and activity metrics have a nominal fee of 20 cents per 1 million objects (refer to s3 pricing for details). Considering the data you get out of these metrics and the 15 month history, it is recommended to turn on.  Activity metrics will tell you how your bucket is utilized.  Here's a great blog to learn more about it:https://aws.amazon.com/blogs/aws/s3-storage-lens/If you want to dive deeper on the activity then turn on CloudTrail and S3 Server logs. You can find out what's the difference in activity reporting available from each.https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.htmlOverall leverage the tools to dive deeper into the S3 usage to understand the access pattern to optimize your cost.CommentSharerePostfanclubanswered a year ago"


Question: Forecast - how to handle missing values in the dataset

"I have a few questions regarding data preparation for Forecast.I have a dataset with about 3,000 item_id's, the data is recorded on weekdays only (no row for weekends/holidays), and the forecast horizon is 1 day.For example:[item_id | timestamp | target_value]item_A | 2022-01-19 (Wed) | 100item_A | 2022-01-20 (Thurs) | 101item_A | 2022-01-21 (Fri) | 99item_A | 2022-01-24 (Mon) | 98item_A | 2022-01-25 (Tues) | 102Q1. Is it recommended that the weekends (1/22, 1/23) row is inserted to the dataset with NaN as the target_value?Q2. If target_value for a timestamp is NaN, do the RTS attributes get ignored regardless of what value it is?Q3. When the Forecast is training, does Forecast recognize that on Friday, the next value to predict is on Monday rather than on Saturday?Q4. If an item_id has small time series data points (for instance, global startend date ranges from 2018 to 2021, but a particular item_id only has data recorded for a couple months in 2020), should I front-fill & back-fill with NaN to match the global startend range? (I only intend to use the data for training, not creating a forecast)FollowComment"


Question: No streaming resources are available when connecting to an Appstream streaming url

"We've seen that when the fleet that we've available is scaling out instances people is prompted with a pop up with the following message "No streaming resources are available, try again after a few minutes" with a retry button available.In this situation we would have expected that if after a while there are no instances available the streaming url generated will expired after the time value configured for url validity 60 seconds but it's not, users can retry even when the url should have expired.Can someone confirms that url validity doesn't take effect in this situation? if so, what's the max time the user can use that given url after is invalidated if he remains clicking retry periodically?We already know that the recommended approach is ensuring that there are enough instances for incoming users but we can't predict our usage patterns accurately and we end up reaching this more than desired affecting to our user experience.FollowComment"

Answer: "1In this situation we would have expected that if after a while there are no instances available the streaming url generated will expired after the time value configured for url validity 60 seconds but it's not, users can retry even when the url should have expired.Can someone confirms that url validity doesn't take effect in this situation? if so, what's the max time the user can use that given url after is invalidated if he remains clicking retry periodically?The streaming URL validity, and ability to generate streaming URLs, are not related to the capacity in the fleet at any given time. The streaming URL authorizes a user to access a specific stack, and the URL remains active only for the validity period that was entered (if 60 seconds, then the user has 60 seconds from URL generation to access the stack). Once the user lands on the AppStream 2.0 application catalog, they can attempt to access an instance, or continue retrying (I think for 16 hours). However, they will not be able to use the streaming URL to access the application catalog page again.We already know that the recommended approach is ensuring that there are enough instances for incoming users but we can't predict our usage patterns accurately and we end up reaching this more than desired affecting to our user experience.You will need to ensure sufficient capacity for your users to access to avoid having them see that URL. We generally recommend customers over provision their fleets for a duration to understand what the utilization pattern will look like, then use a combination of target tracking and scheduled scaling to meet that demand. Eg: use scheduled scaling to set a higher minimum during business hours, then use scheduled scaling to reduce the minimum outside business hours - and target tracking will grow/shrink within those boundaries.If your application can be made portable, you could consider using Elastic fleets. Elastic fleets eliminates the need to predict usage patterns or create/manage scaling policies entirely. As long as your application can be delivered to the streaming instance on the fly, this might be a good option. Elastic fleets also bill per second, with a minimum duration of 15 minutes, so may reduce your costs, too.CommentShareEXPERTMuraliAtAWSanswered a year ago0I see thanks, summarizing:max time for the url generated for the streaming app (https://appstream2.eu-west-1.aws.amazon.com/authenticate?parameters=foobar) is tied to max url validity timewhen the user get access to the fleet by the previous step, the url is something like (https://73f7571060c9b77b111bd783c61dc4da4d6fd249afb0b49dd5b05a21.appstream2.eu-west-1.aws.amazon.com/#/catalogs?reference=fleet%2Ffoo) waiting for a fleet, then the max time this session could last is the one configured for max user sessionis this right?CommentShareAWS-User-4795852answered a year ago"


Question: DNS Certificate Validation with Network Solutions

"We use Network Solutions for our domain name.  Upon generating a Certificate the DNS information was added by Network Solutions.  The Certificate, however, was never validated by AWS.  Is there another step that is required for us to take in order to validate the certificate?FollowComment"

Answer: "0Hello, When did you start the certificate validation request? Please note that your new certificate might continue to display a status of Pending validation for up to 30 minutes.Reference: https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.htmlThe above link for the process to validate the certificate. Please follow the same.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago0Hi,You have to find the corresponding CNAME from the certificate and create a recodred with the value of CNAME in the corresponding hosted zone.If you request the certificate in ACM, you can fine the similar recored from below table and copy them to Route 53 hosted zone as CNAME record for validation.Domain NameRecord NameRecord TypeRecord Valueexample.com_a79865eb4cd1a6ab990a45779b4e0b96.example.com.CNAME_424c7224e9b0146f9a8808af955727d0.acm-validations.aws.CommentSharejcvipanswered 9 months ago"


Question: Amazon SES - How to remove a domain mail.ru from the global suppression list?

All my subscribers who have email addresses on the mail.ru domain do not receive my letters. I add random email addresses from the MAIL.RU domain to a mailing list and they are added to the global suppression list. https://disk.yandex.ru/i/NcjfrUQ41f1UQwHow long to wait for it to be removed from the suppression list?FollowComment

Answer: "0Hello,Thanks for sharing that screenshot.I see that you have Account-level suppression setting turned ON which I think enabling the global suppression list which operates and is managed in the background by SES - you cannot interact with it directly. However, Amazon SES now offers a new way for you to manage your suppression lists by making available account-level suppression lists and configuration set-level suppression lists that offer you more customized control over how you handle email suppression for your own account.I would recommend you create a custom configuration set and override the account level settings under Suppression list options. You can follow the instructions given here -https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list-config-level.html#:~:text=level%20suppression%20list.-,Enabling%20configuration%20set%2Dlevel%20suppression,-To%20enable%20configurationHere under #5, use Option b or c.CommentShareHarry Siddhuanswered a month ago"


Question: "It worked normally in alb, but when connecting to cloudfront, ssl:handshake_failure occurred. What is the reason?"

"After connecting the domain name to alb and inserting the certificate into alb, payment-related services were provided.During service, cdn caching was required, so a situation occurred where cloudfront had to be connected to the front end.I connected cloudfront in front of alb, put the same certificate, matched the tls version, and changed the domain name to confirm normal operation.However, when connecting to an external payment siteAn error such as exception:javax.net.ssl.sslhandshakeexception: received fatal alert: handshake_failure has occurred.(Connected normally with alb.)All settings are the same, but I wonder what causes it to work in alb but not in cloudfront.FollowComment"

Answer: "0That error could be CloudFront not being able to connect to the origin, in this case the alb. Can you check your origin configuration in CloudFront, and make sure that it is correct? You should be able to correct directly to the alb to rule that out.CommentShareJeremyAWSanswered 11 days agojoker 11 days agoSince cloudfront cannot connect to another origin, another listener is connecting to the same cloudfront through the same alb and is serving.Cloudfront's origin configuration and operation are working normally, so the example.com domain is running.Again, the other domain, pay.example.com, is working properly, but the "error exception:javax.net.ssl.sslhandshakeexception: received fatal alert: handshake_failure" is occurring in communication with the external domain.Share"


Question: How to export Amazon Monitron data to Grafana Dashboard?

"Hi,I'm working on a test project involving Amazon Monitron Starter Kit and was wondering if there was a straight forward way to export data (measurements for vibration and temperature) collected and displayed on Amazon Monitron Dashboard out to Grafana?I've tried using the live data export stream but didn't get too far.I also couldn't find an option within Amazon Managed Grafana to add Monitron as a direct Data Source.Any guidance on this would be much appreciated.Thanks in advance.FollowComment"

Answer: "0Hello!There are a couple of different ways that you can interact with your Amazon Monitron data outside of the dashboard. If you are looking for occasional or a one-time export, you can manually export directly to S3 (https://docs.aws.amazon.com/Monitron/latest/admin-guide/data-download-monitron.html). If you are looking for ongoing access to your data in an Amazon Managed Grafana, you can configure Amazon Monitron to automatically add your data to a Kinesis stream which can then deliver the data to a number of locations, including S3, CloudWatch, and Lambda functions (https://docs.aws.amazon.com/Monitron/latest/admin-guide/monitron-kinesis-export.html). If you deliver the data to CloudWatch, you can use the dashboard and monitoring provided there or, if the ultimate destination needs to be Managed Grafana, both the CloudWatch and CloudWatch Logs APIs can be added as a source for Managed Grafana. The admin documentation has a really helpful breakdown of how you can access your Amazon Monitron data (https://docs.aws.amazon.com/Monitron/latest/admin-guide/access-data.html).I hope this was helpful!CommentShareMVR-060709answered 2 months ago"


Question: E: Unable to locate package libtool-ltdl-devel (in Ubuntu IP SSH - Mac Terminal)

"Dear Community,I managed to connect the SSH client to my Mac Terminal.I'm now having another issue which I followed in the Step 4 https://docs.aws.amazon.com/managed-blockchain/latest/hyperledger-fabric-dev/get-started-create-client.htmlHave tried to install --> sudo yum install jq telnet emacs docker libtool libtool-ltdl-devel git -y(Note: For Ubuntu, "yum" command is used as apt or apt-get)but I have the following error:sudo apt install jq telnet emacs docker libtool libtool-ltdl-devel git -yReading package lists... DoneBuilding dependency tree... DoneReading state information... DoneE: Unable to locate package libtool-ltdl-develI have tried all 4 methods from this link --> https://itslinuxfoss.com/unable-locate-package-error-ubuntu/#2but the error "E: Unable to locate package libtool-ltdl-devel" still persists. Have tried to search for related questions but not available.I'm using ubuntu-jammy-22.04-arm64-server-20230303 and is the above package is spelled correctly? Or is it because the Ubuntu version I'm using does not support it?Please guide, thank you.FollowComment"

Answer: "3Accepted AnswerIt seems the package libtool-ltdl-devel is named differently in Ubuntu repositories. Instead, you should install libltdl-devsudo apt update && sudo apt install jq telnet emacs docker libtool libltdl-dev git -yCommentShareEXPERTsedat_salmananswered a month agorePost-User-7775189 a month agoThank you and it works!Share"


Question: How To disable assistive touch icon on iPhone X

"Hi AWS Team,I see my tests failing due to the Assistive touch icon appearing and my Tests are failing.Is there a way to disable this button?I am using XCUITest and iPhone X (iOS 12).https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/71d35811-ce87-44bf-814c-66b05c7b90c0/runs/2f060fad-9c6a-47d0-a1a3-f45ead84ff21/jobs/00000ThanksNormanFollowComment"

Answer: "0Hello,We have disabled assistive touch on the device that was used in the mentioned run. Please let us know if you face any other issues.Thanks.CommentShareanand-awsanswered 4 years ago0This seems to be an issue on more than just one device. Is there a way we can ensure that AWS Device Farm disables assistive touch after very run? Is it device farm customers who is setting it?My tests keep failing as well.Job:https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-east-1#/projects/99081f6c-7497-4b33-b7d5-f38b2932d852/runs/4b87b8b7-14b0-4d4f-a732-bda1dd72b46f/jobs/00000CommentShareTomBlustreamanswered 4 years ago0Hi,from time to time it happens that this assistive touch is enabled. As we are using an image recognition component some tests fail because of that :-(Would be great that this setting will be set to "Off" during device clean up.ThanksNormanCommentShareNormanHeinrichanswered 4 years ago0This needs to be a thing, i'm impacted as well, randomly seeing failures because of assistive touch,link >https://us-west-2.console.aws.amazon.com/devicefarm/home?region=us-west-2#/projects/427902a5-5295-4852-8711-4a76c910ba46/runs/7868686b-1d93-470b-93ce-0b72c42f48ee/jobs/00001/suites/00001/tests/00000CommentShareSSNAPProdanswered 3 years ago"


Question: Create a sub directory on aws

"Hi, i want create a sub-directory on domain name like  <www.example.com/fr>. How i can make this ? I'm waiting to your idea of the roadmap to takingFollowCommentiwasa EXPERTa year agoHi.Where are you hosting your website? EC2?Share"

Answer: "1Hello,I don't think you can create domain like <www.example.com/fr>, As far as I understand that you would like to reach your domain like www.example.com/fr, So in this case, you can use redirection from your webserver/hosting-server/Ec2/anyserver, Here are the steps if you would like a redirection to the path /frYou just need to add the DNS record** "A"** into your hosted zone like **  www.example.com --A Record-- IP address**, Redirection can be taking care by the Webservers or Load balancers, Please look at the below links to do the configuration based on your Webservers.Redirection to /fr using Nginx:Redirection using Apache:Redirect using AWS ALB:CommentShareGKanswered a year agoAWS-User-6438027 a year agohi, i using S3, can it work with it?ShareGK a year agoYes you can use S3 Redirections rules, I have answered related questions here  https://repost.aws/questions/QU2fuhkBb7S8O6OixBLmlKYA/bucket-redirection-rules-not-working-with-folders#ANOEzTJBCuRQmQx7ZT2GNo9wShareAWS-User-6438027 a year agoThanks but I'm no expert. What I want to do is from the domain name vapeprivate.com make vapeprivate.com/fr, vapeprivate.com/es, vapeprivate.com/it to create several versions of the website at the language level. Can you give me the example of how to do in my case concretely because with the example you gave me I can not apply it to my case. Currently I have a bucket created in the name of vapeprivate.com connected to the domain name vapeprivate.com with route 53Share"


Question: aws cloudformation delete-stack command failing

"I'm trying to delete a cloudformation stack and am getting the following error after the delete failed:StackStatusReason": "The following resource(s) failed to delete: [InternetGateway, VPC, GatewayAttachement, PublicSubnetOne]. "Are there any CLI commands that will allow me to delete the above resources so that I can get a successful delete?Thanks,GioEdited by: GioFromArdamore on Apr 9, 2020 7:38 AMFollowComment"

Answer: 0I resolved this issue by first issuing the following commands:aws elbv2 delete-load-balancer --load-balancer-arn  "arn-string"aws elbv2 delete-target-group -target-group-arn "arn-string"After that the aws cloudformation delete-stack command worked.Thanks to all who considered answering this question!GioCommentShareGioFromArdamoreanswered 3 years ago


Question: "how to delete Security Groups referenced by other security groups, or are associated with instances or network interfaces?"

I connected the security group to the EC2 instance. And deleted the instance. I cannot delete the security group because it is connected to the deleted e2c instance. How can I delete it?FollowComment

Answer: "3The Security group that you are trying to delete is referenced somewhere. Based on the screenshot it's mostly due to being referenced by another security group rather than a network interface. You can click on the text shown in the reason to identify what it is.You can also use the filter Source/Destination (Group ID): <SG_to_be_deleted> to find if any other SG is referencing this SG that you want to delete.--SydCommentShareSydanswered 9 months agoEXPERTToni_Sreviewed 9 months agorePost-User-7599351 9 months agoThank you for your answer. As you said, the security group I was trying to delete was linked to the default security group. After removing all items in the inbound and outbound rules of the default security group, I was able to delete the security group!!!Share"


Question: EC2 instance can't connect to AWS SecretManager via private IP

"When debugging a startup issue in our ElasticBeanstalk container, my startup was hanging on aws secretsmanager get-secret-value --secret-id=[redacted] --region='us-east-1'. It would hang indefinitely and not give me any "denied" message or any other indication that I had a permission issue in SecretsManager.I narrowed the issue down to reachability to SecretsManager when I discovered that I couldn't even telnet to SecretsManager via telnet secretsmanager.us-east-1.amazonaws.com 443. It wouldn't even connect.I then noticed that it was resolving SecretsManager's IP to an IP that is internal to our VPC. Updating /etc/resolv.conf to use another DNS provider switched the IP address and we were able to connect no problem. I am moving forward with a fix that will add a static IP to /etc/hosts.Interestingly, AWS's Reachability Analyzer reports that my instances should be able to reach secretsmanager.us-east-1.amazonaws.com. I am able to reach other AWS services like s3, etc. I don't have any outbound Security Group settings that should prevent this. Everything in this instance is AWS managed. It's an AWS image with no special configuration on our side. It's a AWS Linux Corretto Java 17 image.Any thoughts on what may have caused this seemingly out of the blue? Any thoughts on what to probe at to determine where the issue is coming from?FollowComment"

Answer: "0Thank you for the detailed description.resolving SecretsManager's IP to an IP that is internal to our VPC is an indication that you might have deployed Secrets Manager VPC endpoint [1] in your VPC. If this is the case, you might want to review the security group [2], as well as the endpoint policy, associated with this endpoint to make sure that they both allow your container's IP to connect through.[1] https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html[2] https://docs.aws.amazon.com/vpc/latest/privatelink/interface-endpoints.html#associate-security-groupsCommentShareweidianswered 8 months agoctucker 8 months agoHello - I'm a colleague of @mressler - we are utilizing a VPC endpoint for secrets manager. We believe that our instances should have access both via manual checking, and by using AWS's Reachability Analyzer to ensure that there is a successful path from EB instance to Secrets Manager VPC Endpoint.Are there any other suggestions for troubleshooting this issue?Edit: I just tried using port 443 on the analyzer and it is now saying Not reachable - I will investigate this further.Edit2: I've added a rule to allow that traffic through for port 443 over IPV4 and we're now seeing that connection work properly. Though, now I'm confused why the IPV6 rule didn't catch this.Share"


Question: Retrieving Generated Files by the Server Process

"Hi There,We are Currently using Gamelift for Our Unreal Engine Dedicated Server on Linux Platform. Since Unreal crash reporting on Linux platform is currently unsupported, due to the fact that the Unreal engine doesn't generate adequate information in Linux environments, We have Enabled our servers to Core dump the Memory at the time of the crash.As of Now We have Seen Multiple Core file Generated on the Servers But Since the gl-remote-user Permission are Limited for the Runtime Generated Files; we are Unable to Download generated these files.The files are generated at: /local/game/OurGameName/Binaries/LinuxWhat would be the suggested approach to this issue?Thanks!FollowComment"


Question: My URL comes up This Site Can't Be Reached

I used Route 53 to register my domain in November of 2022. I am now attempting to set up Google Workspace to handle email and need to add MX records to my hosted domain in Route 53. The URL is not visible on the internet outside AWS and thus Google can not verify.When I try to test my domain on MX Toolbox I get "No DMARC record found" and "DNS Record not found"Within Route 53 I see these NS Recordsns-1581.awsdns-05.co.uk.ns-864.awsdns-44.net.ns-398.awsdns-49.com.ns-1382.awsdns-44.org.FollowComment

Answer: "1The URL is not visible on the internet outside AWS and thus Google can not verify.What exactly is this situation?Are you saying that you are using Route53 private host zones?If you are using a private host zone, you cannot perform DNS validation and must create a public host zone.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/AboutHZWorkingWith.htmlCommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-5018417 a month agoIt is a public host zoneShareRiku_Kobayashi EXPERTa month agoIs it possible to use the "nslookup" command to resolve the names of registered domains?Share0When a domain is setup, the only record it has (as you showed) is to where it's DNS services are being handled - these are the NS records you shared.  So that being said, you now need to setup an MX record which tells mail servers where to send email when sending to your domain.   Follow this article and then try MX Toolbox again to verify your results.https://support.google.com/a/answer/6149697?hl=enCommentShareChristian Lorisanswered a month ago"


Question: Sample config setting Kubeflow with custom OIDC provider

"Is there any step-by-step guides/tutorials on how to implement Kubeflow with custom OIDC providers?I want to install Kubeflow in region Jakarta with EKS, but Cognito is not available in region JKT (ap-southeast-3), so alternatively I'm looking to use Dex and custom OIDC provider (Github or Google workspace).I've tried to do some research but can't figure out how to set it:There is this vanilla installation guide for AWS Kubeflow distribution: https://awslabs.github.io/kubeflow-manifests/docs/deployment/vanilla/guide/, but it only contains sample on changing static user passwordI've tried to look at the code from https://github.com/awslabs/kubeflow-manifests.git at upstream/common/dex, but I'm not sure what and where to change. I'm not familiar with Kustomize eitherI found this docs: https://v1-2-branch.kubeflow.org/docs/aws/authentication-oidc/#enable-tls-and-authentication but it seems to be old (deprecated?) version of Kubeflow distribution on AWSFollowComment"

Answer: "1Accepted AnswerIn specific case of AWS region Jakarta, the ALB at the time of writing this answer only supports authentication with OIDC.To work with Kubeflow, we can configure the ALB to authenticate directly with auth-idp-oidc. We will have to get endpoints, client ID, and client secret from our OIDC idP, and specify it as annotations to the ALB ingress, and we'll also need an envoy filter to pass authenticated user data to Kubeflow.For step-by-step sample, you can try to follow this guide.CommentSharerizputraanswered 9 months ago0You can use Cognito in another region. There, you can federate your custom OIDC through the Identity Providers section of Cognito.Cognito is integrated nicely with the EC2 Load Balancers, which sit in front of the EKS ingress gateway, used by the ui for ml-pipelines, notebooks, model serving, etc. So, all requests ending to your Kubeflow environment through that ingress, are authorised. Furthermore, the ALB access logs for your Kubeflow traffic are stored in S3 by the ALB properties, externally to EKS. That makes it agnostic to Kubeflow and hence a best practice for security auditing.CommentSharetheofpaanswered 9 months ago"


Question: Amazon Connect > Dev -> UAT -> Production

"Hi all.Hope you're well.Wondering if I'm able to pick your brains.I'm currently deploying Amazon Connect, doing everything manually.Let's say I have a blueprint design and I follow this design build, for every deployment I do.The deployment of Amazon Connect is not only the configuration of Amazon Connect, including uploading around 15 flows, configuring the out of hours and so on, but it's also creating around 18 lambda functions, 6 DynamoDB tables, CloudFront, S3 buckets and so on.As you can appreciate setting it up the first time was cool, until I've done quite a few of these.I'd like to automate this process, taken into consideration several aspects.I want to deploy this whole architecture, or as much as possible from what I would call a golden image/blueprint. The only real change is the project name (where the connect deployment had the name of the project as well as all the lambda functions and so on) and the messages in the call flows change of course.I want to build this in a Dev/UAT environment and once signed off, I want to push the changes (call flows for example) to production.any further changes once project is live, it would be made in the Dev/UAT and pushed to production once ready. Therefore there is a copy of the Amazon Connect implementation in two places let's say.I know there are several options/tools.CloudFormationAWS SAMAWS SDKTerraformAnd so on.My ask is two things basically.I want to automate as much as possible and run what I can from a script, where all I change for this initial build is the project name (variable)Copy call flows for example from UAT/Dev to Production.I've gone through some of the documentation, specially the API stuff but it's a bit confusing how to put it all together and what ideally a good path is. Also for instance on CloudFormation it seems there are less amazon configurations than through the API but then for instance you can do a lot on AWS SDK, which then "converts" it to CloudFormation. I presumed that irrespective of using AWS Sam/AWS SDK/CloudFormation, the features/amazon connect functionality should be the same on all of them for instance configure out of hours ? Hope this makes sense.What are your thoughts? Any input would really be appreciated and hopefully this can help others.Thanks so muchFollowComment"

Answer: "0Hello,There are several options to deploy Amazon Connect as Infrastructure as Code. It depends on your needs you could use AWS CloudFormation, AWS SDK or others.Said that, for your use case and customization probably you can not automate 100% directly because AWS is releasing new features constantly day by day.I would suggest you to have a look into AWS CDK, a nice way to simplify automation (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_connect-readme.html) and use AWS CDK custom resources available in CDK (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.custom_resources.AwsCustomResource.html) to deploy "non-supported" features with AWS api calls. With this you can probably automate in a single tool (AWS CDK) all your deployment.Hope it helps.JoanCommentShareJoan_Banswered a year ago"


Question: CDK v1: Deploy RDS SQL Server and use credential in a connection string for fargate docker instance

"I have been trying to find an answer in documentation, github, here and the old forums, but I fail to find the answer to my question.In my CDK v1 (python) I create a RDS instance of SQL Server and set credentials with aws_rds.Cerednetials.from_generated_secret(), but when I  later on want to provide environment/sercrets values to the docker container I want to run in fargate I have the following environment variable that I need to be set:DB_CONNECTION_STRING, which has the following syntax:Server=<somehost.aws.com>,144;Database=<databasename>; User Id=<databaseuser>;Password=<databasepassword>All the examples I have seen uses multiple variables like DB_USER/DB_PASS/DB_HOST and then you can easily set those with help of secret_value, but there is no example on generating a connection string.How do you solve this? I took a look at aws glue, but it didn't feel like the right optionand I'm not too keen on making a dockerfile to try to pull the official docker image and then create a kind of a wrapper to have environment/sercret variables and then a script that builds up the connection string and sets it before calling the start script for the application (this has other downsides).The reason why I'm not using the CDK v2 is that the current version seems to be broken when you create a new project in WSL (seems to think it's pure ms-windows and fails to create a number of files needed).Thanks in advance for any reply.FollowCommentdozenyommer a year agoI'm not 100% sure I follow the issue you're facing - are you trying to build the connection string from secrets manager dynamically?   If so, I see maybe a couple of options:Create a custom value secret in secrets manager with the full connection string as your value, and then reference that.  (Seems less desirable)I'm not sure if this will work in fargate, but can you reference a var from another var?   So, you have your individual values for DB_USER, DB_PASS, etc. referenced using secret_value, and then you have another var that is something like:DB_CONNECTION_STRING="Server=${DB_HOST},144;Database=${DB_NAME}..."But, I'm not sure if that's a bad idea or not.  Ideally, you'd break up the reference in your config files to reference the individual values, and not a full string.  So, essentially, #2 above, but you're doing that in your config file and not in the env vars.  But I know that's not always a possibility.ShareBashScripter a year ago@dozenyommer:Still need manual steps, as far as I know you won't be able to build that custom secret from secret with help of CDK.That would require that the variables are always set in sequencecontainer = fargateTask.add_container(...,sercrets={  'DBUSER': ecs.Secret.from_secrets_manager(self.database.secret, 'username'),  'DBPASS': ecs.Secret.from_secrets_manager(self.database.secret, 'password'),  'DB_CONNECTION_STRING': '...;User Id=${DBUSER};Password=${DBPASS};...'},...So that both DBUSER/DBPASS are set before DB_CONNECTION_STRING, it's worth a try at least.The issue is that the docker image is an official image provide by the company who done the application, so I do not have a say on what variables can be used and I'm trying to avoid to make my own docker image based on that official docker image where I do build up the variable in the docker and then execute the binary, but sure I have to in worst case :(ShareBashScripter a year ago@dozenyommer:Sadly the second suggestion of building the connection string from environment variables do not work, it will be literal as you wrote without any value substitutions. I guess I have to go the step and create a Dockerfile which based on the official package and try to build the connection string as a variable and start the application with the environment variable set.Share"

Answer: "0Hello,I understand that you are trying to figure out how to set the DB_CONNECTION_STRING environment variable for a Fargate container.If are using CDK to create ECS resources, then you should be able to pass environment variables to the container with your Task definition - https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.TaskDefinition.htmlECS allow you declare environment variables to be populated with secret values from SecretsManager. Since the secret values does not get evaluated until ECS is running the container, there is no good way to inject those values into another string, unless you do it from inside the container. Since MS SQL seems to want to use DB_CONNECTION_STRING containing these details, you would have to either have that connection string stored in secrets manager, or assemble the connection string at your end by generating it from the DBUSER and DBPASS values.The links below would help shed light into how to achieve your use case - https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-rds.Credentials.htmlI hope this information can help achieve your use case.If the information above does not help, please open a support case with AWS using the following https://console.aws.amazon.com/support/home#/case/create and provide details on the code snippet and also please let us know if you are using CDK to create ECS resources in the support case.CommentShareSUPPORT ENGINEERSomto_Manswered a year agoBashScripter a year agoIt's not the creating the secret that is the issue, but transforming the secret to the connection string format that mssql wants. I would have liked that secret had a function that could take a format string ( for example "User Id={username};Password={password}") and generate the string when deploying the image to fargate.secrets = {CONNECTION_STRING=yourSecretObject.string_format("User Id={username};Password={password}")}I'm sadly now building a new docker image based on the official docker image and generating a script that builds the  connection string from environment variables and executing the original entrypoint command and then setting my custom script as the entrypoint. This causes the problem that I have to keep an eye that the original docker image do not change entrypoint between releases, which makes the whole solution less automated than one would like.Share"


Question: CodePipeline ECS Rolling Updates for multiple services

"Hi,I think I have worked out how to enable rolling updates for more than one service in my cluster. I solved this by writing out more than one imagedefinitons.json file.However I have an issue in that every time my pipeline runs, even if the ECR image digest hasn't changed, both services taskDefs get bumped and replace the previous task.Is this the expected behaviour? Is there a way for ECS deploy to spot the digest is the same and not to roll forward.Thanks, GuyFollowComment"

Answer: "0Hello,This is actually an expected behavior for CodePipeline, since whenever a Pipeline is executed, by nature this means there are some changes being pushed to the Source and a deployment needs to be done, so the ECS tasks will be replaced by the deployment. See the current available option here. As a solution, you might consider to split the Pipeline to multiple Pipelines for each ECS service. Alternatively, if you still would like to use the same Pipeline to deploy multiple ECS services, to ensure availability, I would recommend to increase the desired count and minimumHealthyPercent and maximumPercent to maintain tasks availability during rolling update.CommentShareSUPPORT ENGINEERZhiyuan_Lanswered a year ago"


Question: block pemfile for my ec2 instance

I want to block the Pemfile that some people are using to ssh into my ec2 instanceFollowComment

Answer: 1Accepted AnswerDelete the corresponding information in the pemfile according to the method in the following document.The ".ssh/authorized_keys" file is located in the home directory of the user using ssh.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replacing-key-pair.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoEXPERTJonathan_Dreviewed 2 months ago


Question: I can have the api that allows me to display the costs linked to each of my AWS services used ?

"HelloI may have expressed my request incorrectly, I apologize. The links you sent me, I have consulted them several times.Several times but I can't find the URL or API that allows me to collect my ecological and financial footprint data and services associated with the periodic user cost, then display it to me in json or csv format. (My services and cost associated with user aws periodically).ThanksFollowCommentrePost-User-3327100 10 months agoHi Chris,Is it possible to give me an example because I don't know how to rebuild an API with the links you just gave me.Thank you.Share"

Answer: "0Hello,Per your last question, one of the APIs that was mentioned was the Cost Explorer API here:https://docs.aws.amazon.com/cost-management/latest/userguide/ce-api-best-practices.htmlHere is a reference guide for the Cost Explorer API.  With this API, you can return the results in JSON format.https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.htmlCommentShareEXPERTChris_Ganswered 10 months agorePost-User-3327100 10 months agoHi Chris,Is it possible to give me an example because I don't know how to rebuild an API with the links you just gave me.Thank you.ShareChris_G EXPERT10 months agoHello, if you do not understand how to use the API, you may want to look at exporting the data to CSV in the Cost Explorer.  See here: https://docs.aws.amazon.com/cost-management/latest/userguide/ce-download-csv.htmlShare0Hi there.Not sure if the API is a requirement, but if not, you might want to check out the Cost and Usage reports in your Cost Explorer console. Once configured, the service will drop CSV (or Parquet) reports of all the costs incurred in your environment on a daily basis in S3, broken down to every line item from your AWS bill. From there you can access them via Athena, or download them to analyze in depth.Hope this helpsCommentSharevmuelleranswered 6 months ago"


Question: How to create (Serverless) SageMaker Endpoint using exiting tensorflow pb (frozen model) file?

"Note: I am a senior developer, but am very new to the topic of machine learning.I have two frozen TensorFlow model weight files: weights_face_v1.0.0.pb and weights_plate_v1.0.0.pb. I also have some python code using Tensorflow 2, that loads the model and handles basic inference. The models detect respectively faces and license plates, and the surrounding code converts an input image to a numpy array, and applies blurring to the images in areas that had detections.I want to get a SageMaker endpoint so that I can run inference on the model. I initially tried using a regular Lambda function (container based), but that is too slow for our use case. A SageMaker endpoint should give us GPU inference, which should be much faster.I am struggling to find out how to do this. From what I can tell reading the documentation and watching some YouTube video's, I need to create my own docker container. As a start, I can use for example 763104351884.dkr.ecr.us-east-1.amazonaws.com/tensorflow-inference:2.8.0-gpu-py39-cu112-ubuntu20.04-sagemaker.However, I can't find any solid documentation on how I would implement my other code. How do I send an image to SageMaker? Who tells it to convert the image to numpy array? How does it know the tensor names? How do I install additional requirements? How can I use the detections to apply blurring on the image, and how can I return the result image?Can someone here please point me in the right direction? I searched a lot but can't find any example code or blogs that explain this process. Thank you in advance! Your help is much appreciated.FollowComment"

Answer: "0You should package the model files into model.tar.gz file and use TensorFlowModel object to deploy the mode in SageMaker Endpoint.You can see and example here.This is and example for the same, but with PyTorch.CommentShareEitan Selaanswered a year agoGeorge a year agoI've put one of my .pb files in a .tar.gz and uploaded it to s3.Then I tried the following in a notebook:from sagemaker.local import LocalSessionfrom sagemaker.tensorflow import TensorFlow, TensorFlowModelsession = LocalSession()session.config = {'local': {'local_code': True}}role = 'arn:aws:iam::xxxxxxxxxxxxxxxxx:role/SageMakerRole'model_dir = 's3://xxxxxxxxxxxxxxxxx/anonymiser/face.tar.gz'model = TensorFlowModel(    entry_point='inference.py', # copied from example code    source_dir = './code',    role=role,    model_data=model_dir,    framework_version='2.3.0',)predictor = model.deploy(initial_instance_count=1, instance_type='ml.t2.medium')This has been running now for more than an hour, but still pending. I believe something has crashed. I also can't view the endpoint in the console, even though it shows up in the menu.Any thoughts?Share"


Question: BULK EMAIL VERIFICATION

"I have an email list of thousands of emails from my website pop up but before I send bulk email marketing and risk getting hard bounces or marked as spam, I have to verify this emails to make sure emails are valid and reach the inbox, what service can I use and how do I go about it, somebody help with more info kindlyA service thats similar to bounceless.ioFollowCommentrePost-User-0665211 5 days agoare you sending on SES?Share"

Answer: 0Yes am sending using SesCommentShareinfopromoanswered 5 days ago


Question: "Cannot Create Lambda Authorizer Using API Gateway WebSocket Console, Error: Unexpected Key 'ProviderArns' Found in Params"

"I cannot add a lambda authorizer to my WebSocket API from the AWS Console.When I click the Create button, I get a red error banner at the top with the text: Unexpected key 'ProviderArns' found in params and nothing happens.I've even tried creating a blank test WebSocket API and a blank test Lambda function, but I still get this error when creating a a new authorizer. I have tried every combination of having or not having Lambda Invoke Roles or Identity Sources, but I still get this error.This was all working yesterday, but my authorizers spontaneously stopped working today, and I haven't been able to add/edit them. I have since added a CloudWatch log role for logging, but even when I remove this, all my webSockets are still broken.The authorizers in my REST APIs are still working just fine and I can add/delete/edit these authorizers with no problem.Does anyone know what's going on or at least how to fix/circumvent it?FollowComment"

Answer: "1Accepted AnswerAre you able to use AWS CLI to create an authorizer to work around the issue?aws apigatewayv2 create-authorizer --name my-ws-authorizer --api-id <api id> --authorizer-type REQUEST --identity-source route.request.header.Auth --authorizer-uri arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/arn:aws:lambda:<region>:<accountid>:function:<function name>/invocations I was unable to reproduce the issue on my end in the us-east-1 region. However, if you constantly receive the error, can you capture a HAR file to see what error you see?CommentShareTaka_Manswered 7 months agoFranticTyping 7 months agoUsing the CLI worked. After doing that, the console is working now too... must've been some weird bug. Thank you so much for the help!!Share"


Question: Lex v2 Build - bot version - using aws cli command

"Hi, I am working in lex v2, just want to know what is equal aws cli api method to build lex v2 bots. In old lex version we were using "aws lex-models put-bot" aws cli then we append "processBehavior": "BUILD" and that will build bot automatically , how i can able to Lex v2.  Please any one share your thought, not able to find an answer for this query.ThanksRamFollowComment"

Answer: "0Hi Don, thank you for your reply and the information you share. few more questions on automation question in LEX v2 BOT,Below is the logic we used previous LEX v1 automation,Step 1: export bot/intents/slots - in JSON formatStep 2:  merge all bot/intents/slots - in single JSONStep 3: zip the JSON fileStep 4: AWS lex-models start-import the zip file and used parameter --merge-strategy OVERWRITE_LATESTStep 5: AWS lex-models put-bot to update or replace the bot - BUILD the BOTstep 6: AWS lex-models get-bot-alias, and find the LEX version and if no version is found create the new versionStep 7: AWS lex-models put-bot-alias - update latest version.can we achieve the same in LEX v2? can able export individual files for bots/intents/slots and merge them all in a single file? please share your thoughtsThanksRamCommentSharerePost-User-4595727answered 7 months ago0Hello Ram,You can use the build bot locale api to build the bot via clihttps://docs.aws.amazon.com/lexv2/latest/dg/API_BuildBotLocale.htmlThe simplified workflow is CreateBot  -> Go to Draft -> Create bot locale -> Create Intents and Slots -> Update intents with slot priority -> Build bot locale.Thanks!CommentShareDonanswered 7 months ago"


Question: Long response time for cloudfront misses

"Need some help debugging this long response time I'm seeing from my cloudfront CDN for images that have not been cached. The outline of our setup is that we have a cloudfront cdn that responds with cached images when available. If no cached image is available, there's a lambda that pulls the requested image from s3 and resizes it using sharp.js, then sends the resized image as the response to the request. Cloudfront caches this image and then uses it for subsequent requests for the same image. The problem is that this handling takes 2-3s usually. You can see in this screenshot.I'm only partially aware of the breakdown of those 2-3s. That screenshot is of logs from cloudfront, so that means the problem must lie somewhere within our cloudfront setup. The lambda itself takes 800-1300ms from start to finish, and that includes the time it takes to pull the image from s3, resize it, convert it to a buffer, then respond to the request. We already use the http keepAlive optimization to reduce the latency of pulling the image from s3. However the lambda's running time is often 50% or less of the total response time, so that means there's another significant bottleneck elsewhere that I haven't discovered, and I'm not sure how to go about finding it. I've tried enabling AWS X-Ray to get more insights into the problem but our lambda is on Lambda@Edge, which doesn't support X-Ray. What else can I investigate and where else could I look?FollowCommentrePost-User-2543029 5 months agoHi! Have you solved the issue ? I am experiencing the same problem...Thanks for your help.Share"

Answer: "0Hi there,Would it be possible for you to copy the code you have on the Lambda@Edge to a normal Lambda? If you do that, then you could use our AWS Distro for OpenTelemetry (ADOT) Lambda Layers to profile your code and send traces to X-Ray to see where your bottlenecks are occurring for the Lambda part of your code.Although Lambda may not be the exact same as Lambda@Edge, it might help you narrow down the cause for the slowdown. With the Lambda Layers we distribute for JavaScript, all you have to do is add your Lambda Layer and invoke your Lambda function. As long as it has permissions to send traces to X-Ray (the easiest way is to enable active tracing) then you'll see traces for your downstream S3 calls in the X-Ray console. The documentation I liked has options to trace the call in non-Lambda environments as well.Hopefully you can try that and let us know if it helps you identify any slowdowns!CommentShareaws-nathanielanswered a year ago0Thanks for the response! Is there a doc/guide that explains how to move from Lambda@Edge to normal lambda for a cloudfront distribution? The function associations are defined in the behaviors of the distribution, and for origin response it only gives me two options: "No Associations" and "Lambda@Edge". It seems I would need a third that would be something like just "Lambda", is that right? I'm still learning my way around aws so I'd greatly appreciate some direction, thank you!CommentShareAWS-User-8778696answered a year ago0Even though Lambda@Edge does not support X-Ray, does it by any chance support Lambda Layers? I'm assuming it does not, and I guess I mentioned this above already, but if it did you could use our documentation for adding OpenTelemetry Lambda Layers independent of X-Ray.I'm not aware of any documentation for moving from Lambda@Edge to Lambda :/ But is your Lambda@Edge function really complicated? If it were simple enough then you could just copy and paste the function code a fresh new Lambda? It's not ideal but that should let you profile your code at least...Towards OpenTelemetry, you might be interested in this Step by Step guide on adding OpenTelemetry to a Python Lambda I wrote just a few months ago. Even if you're not using Python the steps should be very similar!Glad you're exploring AWS! :) I'll mention to my team that you'd like a tracing solution for Lambda@Edge, and we'll look for the opportunity to provide this enhancement!CommentShareaws-nathanielanswered a year ago0In case you are still experiencing this problem, the recent release of the server-timing response header may be helpful in trying to track down where the latency is occurring. You can find further info on the server-timing header here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-response-headers-policies.html#server-timing-headerThis is also something that AWS support can help you with, if you are still experiencing problems I would recommend opening a support case.CommentSharePaul_Lanswered a year ago"


Question: Old buckets reappear

"I had an account wide settings that blocked public access to S3, all 4 boxes checked.I deleted several bucketsI removed the account wide block mentioned under 1.When entering the console and listing the buckets, the buckets deleted under 2. now have reappeared, with a created date that is around the moment I executed step 3.The buckets remain visible in the console, in several browsers, incognito or not, with cache and cookies cleared or notAWS CLI command "aws s3 ls" does not list the phantom buckets.What is happening?https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/Edited by: BeepBeep on Oct 9, 2019 9:07 AMFollowComment"

Answer: "0Buckets have disappeared now. So this resolved itself. Seems to me it was a caching problem, albeit not one of the client browser, but (dare I say it) on AWS' end.CommentShareBeepBeepanswered 4 years ago"


Question: Kafka Lambda Trigger (EventSourceMapping) - Credentials in secret not refreshed

"Hello, I am integrating my custom Kafka cluster with AWS Lambda using Kafka trigger (Cloudformation EventSourceMapping).If I reset the password on my Kafka cluster and subsequently update the secret that is used in the EventSourceMapping, the EventSourceMapping does not refetch/refresh the secret.Instead the EventSourceMapping is still trying to use the old secret version (with old password) which results in error:Last processing result: PROBLEM: SASL authentication failed.As a result of this problem, no events are delivered to the lambda function.Since I am passing the ARN of the secret to the EventSourceMapping and am granting Lambda the permissions to get this secret, I would expect that the EventSourceMapping would automatically refresh/refetch the secret periodically.Instead what I need to do is delete the EventSourceMapping (trigger) and recreate it again (with the same configuration). This is unacceptable as we are using multiple Lambda integrations with our Kafka cluster and deleting/re-creating all of them after the password (and aforementioned secret) has changed is ineffectiveFollowComment"

Answer: "0Accepted AnswerHello,I understand that you are using custom Kafka event source mapping with Lambda. You did reset on existing password of Kafka cluster by associating a new Secret to the cluster. Following this, you updated Lambda event source mapping with a new Secret. However, Lambda event source seems to be still using previous secret and not doing automatic refetch/refresh on new secret, resulting in SASL authentication failure error. Please correct me if I am misunderstanding anything.I tried to replicate this in my AWS account, where I created a new secret, associated new secret to Kafka cluster. Further, I updated the Kafka client username/password to match the values in the new secret. Finally, I updated Lambda event source mapping to use new Secret ARN. Here is the CLI command I used to update the event source:$ aws lambda update-event-source-mapping --uuid <Event Source Mapping ID> --function-name <Function_Name> --source-access-configurations "Type"="SASL_SCRAM_512_AUTH","URI"="<New_Secret_ARN"After the update, I was able to successfully authenticate using new secret credentials, and deliver Kafka events to Lambda. There is no need to delete and re-create Lambda Event Source.In order to further troubleshoot your specific issue, please specify whether you are using CloudFormation to deploy all changes and update.Assuming you are using CloudFormation to update Lambda with new secret, do you see the new Secret ARN being reflected in Console or CLI (list-event-source-mappings).Do you see the error "Last processing result: PROBLEM: SASL authentication failed.", in Lambda logs. If possible, please run a test for Lambda event source update, using AWS CLI and confirm if the issue persists.Related Links:https://docs.aws.amazon.com/cli/latest/reference/lambda/update-event-source-mapping.htmlhttps://docs.aws.amazon.com/cli/latest/reference/lambda/list-event-source-mappings.htmlCommentShareSUPPORT ENGINEERIsha_Kanswered a year agosimon a year agoActually I was not updating the event source mapping, I was updating the secret itself. However, I have already resolved this problem.It seams that there was short period of time (after I updated the secret), that the event source mapping was trying to still use the old credentials. After waiting a while event source mapping refreshed the value of the secret and it started working.Thanks for your helpShare"


Question: More granular control of file versioning in WorkDocs Drive in the future?

Having an option to disable automatic file versioning every 30 seconds would be beneficial.  Currently this versioning model uses too much storage for a scenario of 3D design software with potentially hundreds or thousands of files locked for edit at once on Drive.  Perhaps I have overlooked an option to disable this functionality?FollowComment


Question: How can i pass cognito email details($context.authorizer.claims.email) in an api gateway VTL mapping template to a  synchronous express workflow

"I have a rest api gateway with direct integration with aws step functions.I want to get the email of the logged in user and pass it on to the step functions workflow.How can i get the email details in the integration rrequest? I have the following cloudformation but i cannot get the details from $context.authorizer.claims.email being passed on to the step functions workflow  despite the other params being passed on.RequestTemplates:application/json: !Sub- |-#set($inputRoot = $input.path('$')){"params": [            {              "OrganisationName": $('$.OrganisationName')              "OrgCreatedBy": "$context.authorizer.claims.email"            }                        ]          }          {              "input": "$params",              "stateMachineArn": "${StateMachineArn}"          }        - { StateMachineArn: !Ref OrgAdminStateMachine }FollowComment"

Answer: "0Finally succeeded ! After trying harder, here is the api gateway body mapping template for any other person out there;The trick is to manipulate the object this way before.#set($data = $input.path('$'))#set($input = " { ""OrganisationName"" : ""$data.OrganisationName"", ""OrgStatus"" : ""$data.OrgStatus"", ""OrgCreatedBy"" : ""$context.authorizer.claims.email"" }"){     "input": "$util.escapeJavaScript($input).replaceAll("\\'", "'")",    "stateMachineArn": "<put your step machine arn here>"}VTL not my cup of tea, there are few resources with examples especially AWS specific VTL.I wish more tutorials are made for this - maybe i will make one!.Lambda would be the go to for somethings but who doesnt want pure serverless and not to worry about compute.Long live AWS!  The power this functionality enables for my use case is tremendous!CommentShareawsfanboyanswered 9 months ago"


Question: "Connecting to instances, EC2 PuTTy"

"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstances.htmlI read through this User Guide, I'm attempting to connect to my instance and run a Deep Learning Code.  The problem is half way through the Guide at step 4 after I've converted my .pem to a .ppk the instructions read Select ConnectionSelect AUTH and Select Browse.There is NO browse option under AUTH except for under the X11 tab, I'm newer than new here and need some clear, real help and possibly some guidance into running code and tooling it as well, Im seeing the post are 2 months to 2 years to 4 years old this is how late I am and I've gotten this far only through ChatGPT is there help?FollowComment"

Answer: "1Select the key from "Browse" in "Private key file for authentication" in "Credentials" as shown in the image below.CommentShareEXPERTRiku_Kobayashianswered 2 months ago0EUREKA!!! Thanks Human! Now that I've finally connected to my instance how do I run the prompt, I have Python, do I do this from PuTTy?Thanks for showing me something so simple, the User Guide did not mention the Credentials Tab.CommentShareDaMoanswered 2 months agoRiku_Kobayashi EXPERT2 months agoUpload the Python script to EC2 and run itShareRiku_Kobayashi EXPERT2 months agoDid you solve the problem here?If resolved, please approve the answer.Share"


Question: Lambda Functional URL Permission

"Hi All,Suddenly I got this error in my account.*notes I try to add functional URL permission in lambda, last week same ARN work fine, But now I got this error for same ARNThe provided principal was invalid. Please check the principal and try again. (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: 44d2210c-34a4-4586-93f9-c94683d7c8a0; Proxy: null)*FollowComment"

Answer: 0Hi - Is it possible to review this https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html and see if there is anything missing. Possibly review it againCommentShareEXPERTAWS-User-Nitinanswered 7 months ago


Question: Amazon Aurora cross-account and cross-region backup

Is there any possibility to create a backup plan which stores Aurora cluster backup in vault which is in different region and on different account to mitigate multiple risks at once?FollowComment

Answer: 0It is possible to create cross-account and cross-region backup of Amazon Aurora databases using AWS Backup. Please see this blog post for details:https://aws.amazon.com/blogs/database/cost-effective-disaster-recovery-for-amazon-aurora-databases-using-aws-backup/CommentShareAslan Ganswered a year ago


Question: HIVE_PARTITION_SCHEMA_MISMATCH - Query Id: 7eaf1758-52b0-455f-a67f-87cd42690a44

"HIVE_PARTITION_SCHEMA_MISMATCH: There is a mismatch between the table and partition schemas. The types are incompatible and cannot be coerced. The column 'id_soggetto' in table 'db_innolva.bilanci' is declared as type 'bigint', but partition 'year=2022/month=05/day=10/hour-minute-second=14-08-18' declared column 'id_soggetto' as type 'double'.the query ID is7eaf1758-52b0-455f-a67f-87cd42690a44thank youFollowComment"

Answer: "0Hello,The error that you re seeing occurs because there is a schema difference between the schema of particular partition and the schema of table defined in your Glue catalog. In Athena, a table and its partitions must use the same data formats but their schemas may differ. When you create a new partition, that partition usually inherits the schema of the table. Over time, the schemas may start to differ. Please do read this documentation that explains the several reasons for the cause of the error.If in case you have crawler for this table, then please re-run the crawler by setting the option "Update all new and existing partitions with metadata from the table". This should essentially update the schema.In case the above does not work out then it would be better to drop the corresponding partition and then recreate the partition.ALTER TABLE DROP PARTITIONALTER TABLE ADD PARTITIONhttps://docs.aws.amazon.com/athena/latest/ug/alter-table-drop-partition.htmlhttps://docs.aws.amazon.com/athena/latest/ug/alter-table-add-partition.htmlThe above documentations should be able to help you.CommentShareSUPPORT ENGINEERChaituanswered 2 months ago"


Question: Pinpoint SMS with link

We need to track down the link clicked in a SMS with Pinpoint (like email clicked event). But I don't find anything about this topic. I have found this page for the possible event for SMS pinpoint (https://docs.aws.amazon.com/pinpoint/latest/developerguide/event-streams-data-sms.html). Do you know other way to track link in an SMS in pinpoint? Many thanksFollowComment


Question: Gap Letter for Report Isae 3000

"Where can we find a Gap letter for the report ISAE 3000, where cover the months from Oct to Dec 2022.FollowComment"

Answer: "0AWS Artifact provides on-demand downloads of AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI) reports, and Service Organization Control (SOC) reports. You can submit the security and compliance documents (also known as audit artifacts) to your auditors or regulators to demonstrate the security and compliance of the AWS infrastructure and services that you use. You can also use these documents as guidelines to evaluate your own cloud architecture and assess the effectiveness of your company's internal controls.A full set or FAQs regarding AWS Artifact is available here:  https://aws.amazon.com/artifact/faq/If you cannot find what you need, contact AWS Support for additional assitance.CommentShareEXPERTiBehranswered 24 days ago"


Question: "Job executes successfully, but still marked as "failed". Why?"

"I'm using aws-iot-sdk-js "jobs-agent.js" to "install packages" ( but really just put files and execute commands). The following works just fine:(Note, I have a cron job writing "[]" to "installedPackages.json" every minute to prevent all the package management stuff from happening, hence "doesntmatter". Yes, I know it's hacky.){"operation": "install","packageName": "doesntmatter","workingDirectory": "/home/pi/tamgbin","launchCommand": "chmod 755 /home/pi/tamgbin/sessionValidator && chmod 755 /home/pi/tamgbin/tagGenerator && rm /home/pi/tamgbin/*.old","autoStart": "false","files": [{"fileName": "sessionValidator","fileVersion": "0.0.0.1","fileSource": {"url": "https://mybucketname.s3.amazonaws.com/sessionValidator"}},{"fileName": "tagGenerator","fileVersion": "0.0.0.1","fileSource": {"url": "https://mybucketname.s3.amazonaws.com/tagGenerator"}},{"fileName": "tamgSessionValidator.jar","fileVersion": "0.0.0.1","fileSource": {"url": "https://mybucketname.s3.amazonaws.com/tamgSessionValidator.jar"}},{"fileName": "tamgTagGenerator.jar","fileVersion": "0.0.0.1","fileSource": {"url": "https://mybucketname.s3.amazonaws.com/tamgTagGenerator.jar"}}]}My files get placed and the launchCommand executes perfectly. The only problem is, in the IOT console, the job is listed as "failed" and "completed".Why? The console doesn't give any useful information about the WHY of the failure.FollowComment"

Answer: "0I figured this out. Basically the jobs-agent.js was interpreting "IN_PROGRESS" as an invalid state, so modified it to not. This will probably relatively moot soon due to v2 of the js sdk in progress.CommentShareCyrusanswered 3 years ago"


Question: When I am adding an inline policy to the user. It is saying memory exceeded

This is the error I am getting:Limit exceededYour request exceeds one of the limits for this account. Remove one or more existing items and try again. Learn moreMaximum policy size of 2048 bytes exceeded for userFollowComment

Answer: 0Please refer this article and it can help on your error - https://aws.amazon.com/premiumsupport/knowledge-center/iam-increase-policy-size/Also refer to this document for quotas and limits on the accounts - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.htmlCommentShareRajuanswered 5 months ago