Question: Game Session Terminates Instantly (Apparently Unhealthy?)

"I am having a problem where my fleets can't create game sessions, or rather, they are created and almost immediately are terminated.In the fleet events view I get the message that the fleet apparently terminated a process because it didn't report healthy for 3 minutes, yet when I download the log for the terminated game session I can see that the game session itself wasn't even alive for a full minute (no crash / errors in the log either), and it took less that thirty seconds to reach the point where I call ProcessReady. My health checks are just a lambda that returns true also.I don't think this is a specs issue, as the fleet that I'm trying to create a game session for only has a one process limit and a single process of that build doesn't even reach 1gb of memory usage (this is a lobby server that doesn't even have a single player yet).Same thing is happening with the game server fleet when I try to create a session manually through the aws cli, which makes sense since it is essentially the same build but is using a different map.I am using Unreal Engine 4.22. The logic that I'm following to set up the game session in game is as follows:Process startsIn the game mode constructor, call InitSDK for the gamelift module.Bind the functions for OnTerminate ( call ProcessEnding() ), onHealthCheck( return true ), OnStartGameSession ( call ActivateGameSession() ).When the Process reaches the "WaitingToStart" state, after it has loaded the map and chosen a server port to listen for connections, I finish setting up the process parameters with this port and then call ProcessReady.Am I doing anything blatantly wrong here? Any help would be greatly appreciated, thanks in advance!.FollowComment"

Answer: "1In my specific case, this turned out to be an actual crash, but since the error wasn't being output to the log file, it was not trivial to catch.For anyone using Unreal Engine, this happened because I was making use of the GameSession creation callback to start a timer (we've had some issues connecting sometimes and this timer was meant to serve as a way of hard terminating game sessions if no user had connected in X minutes), and you can't start Unreal timers in a non-game thread, which is where these callbacks are invoked.As a workaround, the thread now modifies a flag, and the game thread reads it periodically until it has been changed, then starting the timer.CommentSharerePost-User-0366499answered 3 years agorePost-User-7891886 a year agoThis was a huge help and solved my issue. Thanks so much!Share0Some quick thoughts:When you call ProcessReady GameLift should start calling your HealthCheck callback fairly quickly.** So I would add some logic here to get timestamps of the call and ensure it hits your callback** As the documents state it calls your health check every 60s so ensure thats what you are seeing.Seen some issues issues with thread lockup/starvation causes problems like this on Unreal so I would ensure everything looks good in your server logs. Ensure you're ticking/updating as expected on server threads.I would also try a sanity test against GameLift local as if you can replicate here, your debug path is much healthier.Also ensure you aren't causing a scale down event, temporarily disable any scaling rules for your fleet, as instance could being terminated.Basically you want to debug on a fleet with one instance and one process. Remote into the fleet to grab/tail the server logs in realtime so you can see whats going on (this is why sanity testing with GameLift local can be a real time saver)If everything still looks good, if you can provide:Which GameLift Server SDK version you are on and/or version of the Unreal plugin you are onA fleet id, region and a approximate time of the most recent failuresI can then get GameLift service team to take a look as this could be a Service/SDK problem preventing messages flowing correctly.CommentSharerePost-User-5332620answered 3 years ago0Hi Pip, thank you so much for responding!I am using Gamelit Server SDK version 3.3.0 (12_14_2018).Testing with Gamelift Local, the health check gets called from the Unreal Server Immediately as soon as I call ProcessReady ( less than 30 seconds after the process was launched ), and again every minute from there. And simultaneously, on the SDK Listener side, it receives the onReportHealth message with a healthy status every time.Uploading the build to gamelift, getting instance access and tailing the log file I can see that the process gets restarted successfully when I start a game session, takes a couple seconds to load the map, and open up its ports, but there's no error or network warning whatsoever.Here is the output I get from describe-game-sessions where I can see that the game session was terminated within 5 seconds of being created:{    "GameSessions": [        {            "GameSessionId": "arn:******            "FleetId": "fleet-******            "CreationTime": 1579078940.086,            "TerminationTime": 1579078944.917,            "CurrentPlayerSessionCount": 0,            "MaximumPlayerSessionCount": 200,            "Status": "TERMINATED",            "GameProperties": [],            "IpAddress": "52.57.231.108",            "Port": 7777,            "PlayerSessionCreationPolicy": "ACCEPT_ALL"        }    ]}It's worth noting that the server process is very much alive and well, despite the game session having been terminated, as I can manually connect knowing the IP and port, but this is not viable as I'm relying on gamelift retrieving the game sessions of the lobby alias for connecting to the lobby, and using flexmatch for matchmaking.CommentSharerePost-User-0366499answered 3 years ago0If you can provide your Fleet id and region, I can get GameLift service team to take a look at whats going on.CommentSharerePost-User-5332620answered 3 years ago0That would be amazing help, thank you so much!The fleet is : fleet-******Region: eu-central-1Most recent failed game session: arn:******CommentSharerePost-User-0366499answered 3 years ago0I ended up contacting premium AWS support, since the fleet that I linked here had already been deleted, sorry for taking up your time, thanks! I'll be sure to update this thread if/when I can get it solved.CommentSharerePost-User-0366499answered 3 years ago"


Question: Neptune not supporting duration() provided by openCypher

"Hi. My usecase requires using the duration() function provided by openCypher which returns the duration between 2 dates/datetime. I am running these openCypher queries in neptune db and its throwing the following error:{"code": "UnsupportedOperationException","detailedMessage": "Date and Time related functions are not supported in this release.","requestId": "e2affbd3-00b0-47d7-9310-11a1be5313e3"}Now this error is relating to the duration function I am using in my query.I am using the latest version of neptune and also checked the version of openCypher it supports(Version 9) which is also the latest. Now my doubt is if all the versions are latest, why isn't neptune supporting these date and time functions to be used? Thanks in advance.FollowComment"

Answer: "0Neptune's openCypher implementation is our newest supported query language, went GA in April 2022, and currently supports a limited set of date/time functions for openCypher as described here.  Based on feedback from customers, we will be working backwards to prioritize adding support for new features.CommentShareDave-AWSanswered a year ago"


Question: AWS Codepipeline change detection

"Hi,Is change detection is automatically implemented in AWS Codepipeline so it means when repo is changed, pipeline is started automatically? I tried 2 options: AWS Codepipeline and Eventbridge. But still the pipeline is started automatically. How to do it the way it's not started automatically, can I switch off the detection? Please see a screen. Thank you.FollowComment"

Answer: "0Accepted AnswerHi,AWS codePipeline option in change detection does not create any Eventbridge rule but has some internal default to poll for changes.The recommended method is to use AWS Cloudwatch events as change detection option which creates an Event Bridge rule and can be disabled to prevent automatic run on source code updates. Make sure you check for the rule in the correct regionIf you are switching from AWS CodePipeline to AWS Cloudwatch detection rule it would prompt you about allowing it to add a CloudWatch Event rule when you finally save it. If you allow, you can then disable the rule in EventBridge in the corresponding region. If you check the box "No resource updates needed for this source action change", it wont create a rule--SydCommentShareSydanswered 9 months agomyronix88 9 months agoHi @Syd, ok but I need to find the solution how to do it via terraform. But I am now closer to my goal. Strange in Terraform there is no change detection options or I can't find it. ThanksShare0Please take a look at this blog to see if it helps you - https://aws.amazon.com/blogs/devops/adding-custom-logic-to-aws-codepipeline-with-aws-lambda-and-amazon-cloudwatch-events/CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agomyronix88 9 months agoThanks. But this post does not seem to be relevant. Detection option for Cloudwatch event does not generate a rule in Eventbridge automatically. Is AWS only can see it? My repo changes trigger a pipeline but there is no rule in Eventbridge.Share"


Question: Cannot SSH to Lightsail instance via AWS Console. Port 22 is open.

"As in title, I am trying to connect to my instance and it simply says "connecting to instance..." and stays there. I've rebooted and also re-created the instance. Any advice?FollowComment"

Answer: "0Accepted AnswerI solved it by using an incognito window, which is similar to the previous answer of deleting cookies. AWS has a lot of issues where you can't even access Lightsail at times due to cookies. So just make sure you delete all cookies or try an incognito window.CommentShareAWS-User-3654353answered a year agoAWS-User-6200294 a year agoI used the browser 'Opera'. Their built in VPN solved my problem after many hours of searching.Share0yes I got the same problem too , did u fixed the problem? or the problem still there?CommentSharejackwanganswered a year agoAWS-User-6200294 a year agoIt's happened to me. Is there an answer?Share0HelloIf you are not able to ssh from the SSH Client you can try from the browser,.CommentShareGKanswered a year ago0I am only using the browser within Lightsail.In fact, the problem is account wide. None of my other instances let me connect, and I even tried to create a brand new instance with no data, and even after creating that I couldn't connect.I think this is an actual Lightsail issue. I've tried different new instances in different regions with different OS or control panels, and I cannot SSH to any of them using the Lightssail connect interface. How do I get Lightsail/Amazon to look at it?CommentShareAWS-User-3654353answered a year ago0I also have the same problem.CommentShareRobert_Clarkanswered a year ago0I cannot connect my instance too. SSH client within Lightsail. There is no response with "Connecting to your instance".CommentSharex21koteanswered a year ago0In my case, I was able to connect by deleting Cookies (Chrome).I don't know the cause, but when I couldn't connect, I was getting the following Websocket error in the console log.WebSocket connection to 'wss://connect-ap-northeast-1.lightsail.aws.amazon.com/ls/websocket-tunnel?~~~~~~~' failed: connect @ bundle_vendors.e57657528586c6d4cd3d.js:2CommentSharezizianswered a year ago0Does anybody know where the answer can be found? As a newbie I'm confused. Please help.CommentShareAWS-User-6200294answered a year ago0Please open your lightsail console with browser traceless mode.CommentShareAWS-User-7220467answered a year ago0Same here. I connected to Lightsail and for about 5 or 6 hours later I cannot access it. I use terminal.I have to stop the instance and start it again. However, this will change the ip address and this is not a solution.CommentSharelightsail-user-aws-from-vnanswered a year ago"


Question: How to add condition in elbsg.config in ebextensions for elasticbeanstak

"Currently, we use docker-compose and .ebextensions to update elastic load balancer security group. However now I have requirement to apply different security groups for different environment. How do I add the condition to elbsg.config ?Below is my current elbsg.configoption_settings: aws:elb:loadbalancer:  ManagedSecurityGroup: "sg-xxxxxx"  SecurityGroups: "sg-xxxxx" aws:elbv2:loadbalancer:  ManagedSecurityGroup: "sg-x"xxxx  SecurityGroups: "sg-xxxxx"Wondering if the normal yaml condition would works or there is a separate syntax for elbsg.config to work ?FollowComment"

Answer: "0You will likely need to have a separate bundle for the new environment which has the needed settings in it, as there is no constructs for setting up a conditional option_settings entry. Similarly, the YAML standard itself does not specify any such conditionals, though some tooling (such as CloudFormation) has its own special syntax for this type of need.CommentShareSUPPORT ENGINEERWayne_Ganswered a year ago"


Question: unable to run aws eks cli commands

"While running eks cli commnds facing the below issues/usr/local/bin/aws eks list-clusters --region us-east-1SSL validation failed for https://eks.us-east-1.amazonaws.com/clusters hostname 'eks.us-east-1.amazonaws.com' doesn't match either of '.us-east-1.es.amazonaws.com', '.cell-01.us-east-1.es.amazonaws.com'but not seen when executing other cli commands. like (aws ec2)..FollowCommentrePost-User-4014483 4 months agoHi - i suspect there is some sort of proxy involved here (or at least something intercepting the traffic and doing something to it). I don't really understand why this would just be for the EKS service though.Can you try this command?aws eks list-clusters --region us-east-1 --no-verify-sslThat should allow it to work i think. You'll get a warning though that this is insecure - ideally you need to find out whats intercepting the traffic and work out why it's somehow affecting calls to the EKS endpoints.SharerePost-User-0286276 4 months agoHi, thanks for the reply but i see below,/usr/local/bin/aws eks list-clusters --region us-east-1 --no-verify-sslurllib3/connectionpool.py:1045: InsecureRequestWarning: Unverified HTTPS request is being made to host 'eks.us-east-1.amazonaws.com'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsAn error occurred (403) when calling the ListClusters operation: Credential should be scoped to correct service: 'es'.SharerePost-User-4014483 4 months agoHi,Been trying to recreate the error and I now suspect that you maybe have an old version of the aws cli that has a bug specifically when trying to access eks endpoints. It looks like the cert validation it is trying to do is just wrong. Latest version looks to be 2.9.22 - can you confirm what version you are on and try to recreate the issue after you do a cli upgrade?SharerePost-User-0286276 4 months agoaws --versionaws-cli/2.9.22 Python/3.9.11 Linux/3.10.0-1160.15.2.el7.x86_64 exe/x86_64.centos.7 prompt/offinstalled latest one recentlyShare"

Answer: "0Hello,I am Manpreet from AWS. Thanks for raising this concern.I understand that you are facing below error when running below command:/usr/local/bin/aws eks list-clusters --region us-east-1 --no-verify-sslLatest Error:urllib3/connectionpool.py:1045: InsecureRequestWarning: Unverified HTTPS request is being made to host 'eks.us-east-1.amazonaws.com'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsAn error occurred (403) when calling the ListClusters operation: Credential should be scoped to correct service: 'es'.It seems like there might be a different mapping for eks.us-east-1.amazonaws.com  in your hosts file, due to which it is forwarding the request to .us-east-1.es.amazonaws.comTo verify the same, I added the below entry in my /etc/hosts file and I got the certificate from google and I also got the same error as of your's ssl validation error.8.8.8.8 eks.us-east-1.amazonaws.comSo it looks like you are have mapping of Opensearch public IP for eks.us-east-1.amazonaws.com  and hence you are getting certificate from that endpoint that is mentioned in your /etc/hosts file and hence getting the SSL validation error.Can you validate your /etc/hosts file and your DNS records for eks.us-east-1.amazonaws.com , is it pointing to Opensearch endpoint? If so this might be causing the issue.Looking forward to hear from you. Have a great day ahead.CommentShareSUPPORT ENGINEERrePost-User-0191609answered 3 months ago"


Question: conntect to RDS Aurora withh less privilege

"Hi team,My app runs on ECS fargate cluster, which connects to MySQL Aurora DB.Actually, the fargate containers connect to my DB using the root/master RDS account of the DB,I want to use the least privilege principle so that my fargate task can not do too much other than: select, insert, update and delete.how can I achieve this architecture where I can pass to fargate only creds that allow my app to do only CRUD operation and not stuff like db dump.....Note: we are not allowed at all to create IAM users in our AWS accountThank you.FollowComment"

Answer: "0Since you are not allowed to create IAM users and database IAM authentication (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/database-authentication.html#iam-database-authentication) might not be an option for you, you can use password authentication instead (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/database-authentication.html#password-authentication).Using password authentication, you can create users and grant them a less privileged access to your database. If you are using an Aurora MySQL version that is compatible with MySQL 8.0, you can refer to MySQL 8.0 Reference Manual for more information.CommentSharejoahnaanswered 9 months ago"


Question: AWS Lightsail Instance in CLI

"I am deploying my first LAMP web app on amazon lightsail using the CLI. I am using windows powershell to interact with CLI. I am attempting to setup an SSH key before creating my instance as the exercise recommends. When I do here is what happens. I can't seem to get past this. Any advice would be appreciated...aws lightsail create-key-pair \--key-pair-name LightsailGuide > ssh_key_response.jsoncat ssh_key_response.json | jq -r '.publicKeyBase64' > lightsailguide.pubcat ssh_key_response.json | jq -r '.privateKeyBase64' > lightsailguidechmod 400 lightsailguide.pub lightsailguide********At line:2 char:7--key-pair-name LightsailGuide > ssh_key_response.json  ~Missing expression after unary operator '--'.At line:2 char:7--key-pair-name LightsailGuide > ssh_key_response.json  ~~~~~~~~~~~~~Unexpected token 'key-pair-name' in expression or statement.+ CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException+ FullyQualifiedErrorId : MissingExpressionAfterOperator********FollowCommentGabriel - AWS a year agoHave you seen this document on configuring PuTTY to connect via SSH? https://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-set-up-putty-to-connect-using-sshShare"

Answer: "0Hi , I understand you are trying to setup an SSH key before creating an instance and you are getting an error.Please correct me if I misunderstood.I replicated this on my end following AWS documentation, using the following command:aws lightsail create-key-pair \    --key-pair-name MyPersonalKeyPairand I got a similar error. However, when I removed the backslash and make the one line command. I was able to create a new key-pair. This is how I did it:Installed and configured AWS CLI.I then created my SSH key with the following command on my powershellaws lightsail create-key-pair --key-pair-name MyPersonalKeyPair > Karabo.jsonYou can verify that your key was created by going to the Lightsail console then click accounts. Go to SSH keys, your newly created key-pair will be on the list.I hope this will be helpful!CommentShareKaraboanswered a year ago"


Question: Can't connect to Lightsail SSH UPSTREAM ERROR 519

"Hi, I'm a newbie and accident do the wrong permission in SSH, I use this command to give a permission to user (default user in Lightsail  instances)"sudo chown <your username>:<your usergroup> -R <path to>"But at the "<path to>" I just put only slash "/". After that I get an error "command not permit"   and can't access ssh via browser or putty at all.I try to restart instances, create new instances from snapshot and put a shell script, so it not success. Any advice or help, please.FollowComment"

Answer: "0Accepted AnswerHi!519 is UPSTREAM_NOT_FOUND [519]There are many possibilities why you see this error, so I suggest to check out this piece of documentation:https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-resolve-ssh-console-errors/After you check the article above and you do not find the solution please include more delails regarding the problem areas mentioned in the docs so that I will check out further options.Also if you have tried some solutions in different articles, please include some info about steps taken, so that I do not point you to the direction you have already taken :)CommentSharePiotr Blonkowskianswered a year agoYo a year agoI'm trying to follow this article but it not success. I search for solution a lot, but I'm not familiar with Linux so it's hard for me to reset root file/folder permission again.But thank you so much for help.SharePiotr Blonkowski a year agoHi!We've all been at the beginning where you are right now, so there is nothing to worry about :)I do not want to leave you hanging with this issue though.I did not found any solution for resetting the default lightsail user permissions while remaining on Lightsail, but if you have some data in this instance you need to backup, you can try moving it to EC2 and troubleshoot there. Articles that might help you with that:Export Lightsail instance to EC2:https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-export-linux-instance-ec2/Troubleshoot EC2 SSH access:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-ssh-troubleshooting/If I am not mistaken, you can try to connect to the EC2 instance using serial console and then try to revert the changes that prevent you from connecting using SSH:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-to-serial-console.htmlShare"


Question: DynamoDB race conditions with TransactWriteItems and Condition Check

"Hi, I wanted to check my understanding of what happens in the following scenario, and to find out if there's a way around it.I have a bunch of global DynamoDB tables set up to store metadata about Documents and their Versions. When a new Document gets created I use TransactWriteItems to write both to the documents table and an ownership table (using PutItem). Each of the actions has a Condition Expression which fails if the item already exists in the table. Let's say the tables are available in regions A and B. Is the following series of events possible?A user in region A creates a new document, which invokes the TransactWriteItems operationSimultaneously, a user in region B creates a new document with the same IDThe PutItem to the documents table in region A succeeds, but for some reason there's a delay calling the PutItem to the ownership tableThe PutItem to the documents table in region B succeedsThe PutItem to the ownership table in region B succeedsDynamoDB replicates the information across from region B to region AThe PutItem to the ownership table in region B gets called, but because the item from region A has been replicated over, the Condition Check failsWhat happens in this scenario? When step 6 happens, do we end up with a last-writer-wins resolution where the item in the documents table in region A gets overwritten? Does the DynamoDB instance in region A attempt to rollback the transaction (which presumably has been overwritten already)? What if the PutItem to the ownership table in region A happens after the PutItem to the ownership table in region B, but before the information gets replicated across regions? Is there a way to ensure we don't have a situation where the user sees the transaction succeed, but ends up with different data in the table from the one they submitted?(I've looked at https://repost.aws/questions/QUP7oi53yZTnaQqOIFJAYboA/concurrent-dynamo-db-transact-write-items-requests-with-same-condition-check but their question is different and doesn't involve global tables)FollowComment"

Answer: "1When using global tables you shouldn't write to the same item in different regions at around the same time (within the replication window) unless you don't care the order in which the writes apply. One write is going to win, the other is going to lose. If both regions at around the same time increment an item's value by 1 the final value might be +1 or +2, depending on if there was a last writer wins conflict. So best not to try to do such things.Furthermore, transactional writes are only ACID in the region where the transaction runs. The remote region will get the data replicated in once the transaction completes, but the items will replicate individually not as a unit. If you try to run a transaction on the remote region it may run against a partial view of the original transaction (half the items updated, half still replicating in) and will make all its conditional decisions against that torn transactional view.Your example talks about using transactions but then talks about delays in the writes within one transaction. That's not how transactions work. You send the one request and either all work succeeds or all fails. Just remember that even if the work succeeds (and is ACID) the individual items replicate independently and the receiving end might will have a partial view as things replicate over.Easiest approach is to route all writes for a given item (or all items) to one region at a time, so you're always working against the latest data.CommentSharejzhunteranswered 3 months ago"


Question: Getting the below error for athena query.

"Hi Team,Im working on with a project on integrating the logs from waf and pushing the log to S3 using kinesis delivery stream which is working fine.Now from aws glue crawler im trying to pull the data into its own inbuilt database and that is also happening. But when the query is being run im getting the below error.HIVE_PARTITION_SCHEMA_MISMATCH: There is a mismatch between the table and partition schemas. The types are incompatible and cannot be coerced. The column 'requestbodysize' in table 'default.jsonwaf_log_trafficlog' is declared as type 'int', but partition 'partition_0=2023/partition_1=05/partition_2=19/partition_3=21' declared column 'labels' as type 'array<structname:string>'.This query ran against the "" database, unless qualified by the query. Please post the error message on our forumor contact customer supportwith Query Id: f684c53c-d74f-45d0-b690-bd221bb762acwhen this error comes i delete three field from the table requestbodysize and labels and requestbodyinspectedbywaf. Post deleting these three fields. im getting the query run successfully.Each and everytime the crawler pulls the data from S3 the table is getting updated and the above deleted columns pop up again and getting the same error. What could be the solution for this. could this be any bug or supporting issue between the table and athena.Need your solution on the team. Awaiting updates from you all.RegardsFollowComment"

Answer: "0Assuming the files have a consistent schema, is possible that the sample the crawler takes confuses it and is not able to resolve the conflict.A simple solution that comes to mind is setting the right schema in the table and then configure the crawler to just add new partitions without touching the schema.CommentShareGonzalo Herrerosanswered 8 days agoVijaygvasan 8 days agoThank you for taking your time towards this. Since I'm new to this crawler and schema. Could you share any document to follow the stepsShareVijaygvasan 7 days agoHi @Gonzaloherreros i have tried creating a new table without crawler first. with below given detailshttps://github.com/aws-solutions/aws-waf-security-automations/blob/main/deployment/aws-waf-security-automations-firehose-athena.template line 179. then i created a new crawler to pull the data. which resulted in the same error with the other three fieldsrequestbodysize, labels, requestbodyinspectedbywaf.ShareGonzalo Herreros 6 days agoare you sure you set the crawler to just add partitions without updating the shema?the error should have changedShare"


Question: Amazon MQ stuck at "Reboot in progress"

We have our production Amazon MQ instance stuck at "Reboot in progress" for a couple of hours.We had a memory issue with the instance hence we decided to reboot the instance and it is now stuck. Any ideas to get that moving?FollowComment

Answer: "0Open a ticket with AWS support, they will be able to check the issue.CommentShareYair Carelanswered 5 months ago"


Question: unable to access or list DATA_PUMP_DIR in RDS (Oracle-SE2)

"unable to access or list DATA_PUMP_DIR in RDS (Oracle-SE2):DATA_PUMP_DIR is default oracle DIR and generally we use this to copy /move dumps of the DB, while list DATA_PUMP_DIR today I got this error which is completely new for me:SQL> select * from table(RDSADMIN.RDS_FILE_UTIL.LISTDIR('DATA_PUMP_DIR')) order by mtime;select * from table(RDSADMIN.RDS_FILE_UTIL.LISTDIR('DATA_PUMP_DIR')) order by mtimeORA-20199: Error in rdsadmin.rds_file_util.ORA-06512: at "RDSADMIN.RDS_FILE_UTIL", line 47ORA-27369: job of type EXECUTABLE failed with exit code: 1 /usr/bin/rm: cannot remove '/rdsdbdata/tmp/.rds-file-list_90266': No such filORA-06512: at "SYS.DBMS_ISCHED", line 242ORA-06512: at "SYS.DBMS_SCHEDULER", line 566ORA-06512: at "SYS.RDS_SYS_UTIL", line 1142ORA-06512: at "SYS.RDS_SYS_UTIL", line 2009ORA-27369: job of type EXECUTABLE failed with exit code: 1 /usr/bin/find: '/rdsdbdata/tmp/.rds-file-list_90266': No such file or directoORA-06512: at "SYS.DBMS_ISCHED", line 242ORA-06512: at "SYS.DBMS_SCHEDULER", line 566ORA-06512: at "SYS.RDS_SYS_UTIL", line 330ORA-06512: at "SYS.RDS_SYS_UTIL", line 1969ORA-06512: at "RDSADMIN.RDS_FILE_UTIL", line 38ORA-06512: at "RDSADMIN.RDS_FILE_UTIL", line 3FollowComment"

Answer: "0Accepted AnswerI  had the exact same issue. Through testing, I determined that this error is now thrown from RDSADMIN.RDS_FILE_UTIL.LISTDIR when you create an Oracle RDS instance and do not enable automated backups.  It appears some necessary directories on the filesystem are not created if this option is not enabled, which causes the errors you are seeing.  As a workaround, you can modify your instance and set automated backup retention to 1 day.  Apply the changes immediately.  When they are applied calls to RDSADMIN.RDS_FILE_UTIL.LISTDIR will now work.  You can then modify the instance again and set backup retention to 0 days and the calls will continue to work.  I agree that this is new behavior that I have not seen before, even when not enabling automated backups.  Seems like a bug.CommentSharerePost-User-ksdanswered 5 months agoRajdeep R 5 months agoThank you, its working for me.Share"


Question: FSx on GovCloud?

"Hello,Our company is looking to move our environment to AWS GovCloud this year and I'm working on verifying that all the features and configurations will work when we move. Currently we use DFS to sync files between Windows servers but I'd like to evaluate FSx to replace DFS.When will you have FSx available in GovCloud? How about N. California? I will use Oregon to do the evaluation and tests but we are located in California and would like to see our environment closer to us. Thanks.FollowComment"

Answer: "0Hello tcicloud,Amazon FSx is currently available in 4 AWS Regions: us-east-1 (US - N. Virginia), us-east-2 (US - Ohio), us-west-2 (US - Oregon), and eu-west-1 (EU - Ireland). We will be expanding region availability of Amazon FSx, including to N. California and GovCloud Regions, but we don't have a specific timeline to share publicly.Thank you,Amazon FSx teamCommentShareAWS-User-9252611answered 4 years ago0Ok, thanks.CommentSharetcicloudanswered 4 years ago0Any updates? We are also looking at FSx availability on GovCloud.CommentSharechildrenofpersiaanswered 4 years ago0I was wondering if there has been an update to getting FSx on GovCloud?CommentShareZacTecanswered 3 years ago"


Question: AWS API - Can't download some pictures from RETS

"I am using AWS API to host my real estate website and we are getting data from RETS. We are getting an error MSG when downloading some pictures.For some of the listings ,we get the following Error form AWS APIFound 3 photos.Already ExistsClient error: GET https://media.crmls.org/mediaz/D22D68F6-D9AE-4725-9443-80702A9D61B4.pdf resulted in a 404 Not FoundWe also checked for "Access denied" error for below listings.And we are getting photos count for them. I attached screenshot named "database" for your reference.ListingId - OC23026727, ListingKeyNumeric - 370979116, Photocount = 63ListingId - OC23028684, ListingKeyNumeric - 370982267, Photoscount = 25For the same listings, if I download photos through thee AWS API, I am getting response in API as "0 photos found".again we do have pictures available but we can't download them.FollowComment"


Question: Control billing for  aws lambda by api hit through locust

"As lambda is pay you go service, I have some question on it . Suppose I host my application using AWS Lambda and API gateway. If someone hits my api through locust then my billing increases tremendously . Suppose I have lambda concurrency of 1000 and someone hits through locust with 1000 concurrency with 1000 users/sec.  My billing will be out of my control. How can I control such load testing by someone others so that billing for Lambda won't increase?FollowComment"

Answer: "2You could restrict the number of concurrent Lambda functions that can run but that might create other challenges for you - namely that your application won't scale when you need it to.A better solution might be to throttle API Gateway calls. For example, you could throttle each individual client or just a specific stage.If this is malicious traffic another solution could be to use WAF to protect your API. One example is where you could detect whether there are a lot of requests coming from a single IP address and dynamically deny or throttle access from there.CommentShareEXPERTBrettski-AWSanswered a year agoTechxonia a year agoDoes Throttling API gateway call count towards API charge ?ShareTechxonia a year agoI have another issue after implementing WAF. https://repost.aws/questions/QUNQvDBuveTF655KQOTpxjfw/aws-waf-didnt-block-requests-if-block-condition-matched-for-first-timeI have posted my qn on that  link to here alsoUsing locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window. When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min .I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked.Share0I believe rate based rules with WAF would be a good solution to protect your application against floods. This blog article may help you: https://aws.amazon.com/blogs/security/three-most-important-aws-waf-rate-based-rules/CommentShareamazonchrisanswered a year agoTechxonia a year agoBilling for WAF is according to webacl , rules and number of web requests received across all web ACLs. While billing for lamda is decreased due to waf , doesn't it instead increase billing for aws waf?Share"


Question: How can I route traffic depending on setting from parameter store.

"Hi,  I'm looking to see what options are available and what might be the best practice to accomplish routing HTTP traffic based on a parameter within the parameter store.Currently we have multiple services all sending HTTP traffic to a single URL.   This receiving endpoint is about to be duplicated and we will be introducing a setting in the parameter store that will determine whether traffic will be send to endpoint A, or endpoint B.A lambda function is always an option, but I'm looking to see if there's anything already within the managed services side of AWS that can help us.  At first ALB seemed a logical choice as that has routing rules, unfortunately it seems the rules can only be determined by attributes of the incoming request, and not a Parameter from the parameter store.So perhaps API gateway could be utilised, but with around a million requests per day, I'm concerned this would be costly and it's also not clear whether I forward traffic  based on a setting from the parameter store.Any thoughts appreciated, thanks!FollowComment"

Answer: "0There is not a single AWS Service that will respond to changes in the values of SSM parameters. Usually values of SSM parameters are considered infrastructure. So the values of these parameters usually come from CloudFormation templates (or terraform modules). The purpose of these parameters is often their use as defaults for the parameters in other CloudFormation templates.That being said: The routing change can be easily modelled as an infrastructure change. If you setup your infrastructure as CloudFormation template to use an SSM parameter (this can be done in 2 ways, input parameter default or a dynamic reference). The internals of the CloudFormation template could arrange the proper routing. Deploying the template would use the value of the parameter, but if the parameter changes you need to redeploy the template (making sure you will use the latest value of the SSM parameter).This could be automated if you set up an EventBridge rule to listen for changes to the parameter in question.  The rule could then trigger a lambda. The lambda could then take care of redeploying the unchanged template.Documentation can be found here:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.htmlCommentShareJaccoPKanswered a year ago"


Question: Elasticache for Redis cluster service update got stuck

We applied 'elasticache-redis-6-2-update' Service Update for our 1-node Redis cluster in ElastiCache but update got stuck.Currently cluster is in 'modifying' status for more than 4 hours.Is it possible to stop/cancel/rollback service update procedure?FollowComment

Answer: "0Yes, the update can be stopped but not from a customer perspective. You need to open a support case via the Support Center in your AWS Account (https://console.aws.amazon.com/support/home?#/) to request the cancellation.CommentShareEXPERTAndreas Seemuelleranswered a year ago"


Question: Can the Panorama device recover automatically if the power of the structure is turned off for a while?

"I observed the following situation: the power disappeared for a few minutes/hours, but panorama applications weren't restored when it came back. So I was needed to redeploy the application manually to get it to work.We are running app on Panorama Dev KitFollowComment"

Answer: "1When the device restarts, applications that were previously running on AWS Panorama will be  automatically restarted. Can you open a ticket with AWS Support and provide more details on the applications ?CommentShareVinod_Ranswered a year ago"


Question: I want to use a larger number of light sales.

"Currently, only two are produced in Korea.I want to use a larger number of light sales.Please increase it to the maximum.FollowCommentmreferre EXPERTa year agoAre these 2 VM instances or 2 container instances in Lightsail? Or two what?Share"

Answer: "1I'm not sure about your issueIf your issue is to have more Instance quota, then you can go to AWS Services Quota to increase the number. By default, lightsail has 20 instances for each accountIf your issue is to create multiple Lightsail instances at once, then you can leverage AWS CLI or rely on Infrastructure as Code services, such as CloudFormation / CDKCommentShareHC Loanswered a year ago"


Question: RDS went into recovery by itself?

"One of our RDS instance went into recovery by itself without any notification/admin interactionsThere werenothing meaningful in the event logs, only indicate it went into recovery and restartednothing logged in the MySQL error logs eitherhttps://docs.google.com/spreadsheets/d/1H4BG-qbmvbfEGV5H9aL28cjuWIeVqMnrryDEuUlynzM/edit#gid=0How do we find out what happened? (ex: if underlying hardware indeed failed?)FollowComment"

Answer: 2Raising a case with AWS Technical Support is the only way to identify if there was any issue occurred in the underlying hardware.CommentShareVetrivelanswered 8 months ago0Most likely the hardware on the backend infrastructure has hit some issue - could be disk failure or node failure - check with AWS support by raising a case and find out the actual reason why.CommentShareRaymond Tanswered 8 months ago


Question: Error 522 Connection Timed Out

"My website is not responding since last 10 days, it's showing Error 522 connection timed out. I have already done all the basic steps which are required to prevent this errors such as clear cookies, used different browsers etc but still it's didn't work. Please help me to fix this issue.Website: machcart.comFollowComment"

Answer: "1According to the CloudFlare website this is cause by the connection to the web server timing out.Have you tried connecting to your instance without going through CloudFlare? What response do you get then? If the web server isn't running or having some other error the steps you've taken (clearing cookies, different browsers) are not going to make any difference.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-9592127 a year agoI have stoped an instance state because it was costing 0.023$/hr. Right after that error 522 popping on the website.Instance id - i-0d63ae9802a4a2baaShareBrettski-AWS EXPERTa year agoI'm not sure what to add here: A stopped instance means the web server definitely isn't responding. ;-)ShareAWS-User-9592127 a year agoBut why it's costing when i'm a free tire user?ShareAWS-User-9592127 a year agoAmazon Elastic Compute Cloud running Linux/UNIX runs Hour274.352 Hrs$0.00 for 1 Gbps per t3a.small instance-hour (or partial hour)274.352 Hrs$0.00 per GB-month of General Purpose (SSD) provisioned storage under monthly free tier6.764 GB-Mo(showing this in the billing dashboard)ShareBrettski-AWS EXPERTa year agoIf you believe you're being charged for something you shouldn't; please post that as a question. Alternately, raise a support case to discuss with our team.ShareShow 1 more comment0Yes, as said by Brettski, the error is due to connection issue.First thing first,Check the server is running or notCheck webserver is running or notDo the telnet by ssh to server as : telnet <server_name> <port_no>Do curl by ssh to server as: curl <website_url> (try both public & provide IP address)Does the server has public IP? yes, then test with IP addressCheck the security & NACL is it allowing connection for specific port not?Above are the troubleshooting point, if still issue persists then provide the following info,What is the architecture of the application, how the server & DNS is connectedaccess.log from the serverRegards,Nikhil ShahCommentShareAWS-User-1576695answered a year ago"


Question: Deleted ec2 instances will be counted in free tier? [duplicate]

"max 20 instances can be created under free tier. I have created some 18 instances. Again if I want to create a 5more instance it's not possible as it reaches max, so I am planning delete 3 and create another 5. So will it count that 3 deleted instance or won't be any problem?FollowComment"

Answer: "0Accepted AnswerIn AWS free tier account, you can delete and recreate another t2.micro instance without being charged for it. But make sure you are not exceeding 750 hours per month.CommentShareharshmanvaranswered 4 years ago0Hello,Thank you for showing your interest in AWS Forums.Few of the AWS services, like as Amazon EC2, Amazon RDS, and Elastic Load Balancing, charge for usage on an hourly basis. The free tier for these services provides you with a monthly allotment of hours for the first 12 months only. For example, the free tier for Amazon EC2 provides you with 750 hours usage of Linux (any combination of t2.micro and t1.micro instances, with a initial limit of 20 instance - which can be modified from https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Limits: ), plus 750 hours usage of Windows (any combination of t2.micro and t1.micro instances). How you divide this allotment is up to you.For example, you can use one Linux instance continuously for a month, or 10 Linux instances for 75 hours a month.Related links : Free Tier Limitshttps://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-limits.html#hourly-limitshttps://aws.amazon.com/free/?all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=ascI hope the above has provided some insight on the matter.If there's something that you're concerned about please do post here and we'll do our best to find out/clarify for you.CommentShareShantanu-AWSanswered 4 years ago"


Question: Can I install ROS2 Eloquent in AWS robomaker?

"So far, AWS Robomaker supports ROS2 Dashing.I want install ROS2 latest version. (now, ROS2 Eloquent).Can I do this?Thanks.FollowComment"

Answer: "0Hi Yasu-S,RoboMaker does not support ROS2-E today but we are constantly adding new features based on customer feedback. I’ll message you to learn more about your requirements.CommentShareAWS-User-5010218answered 3 years ago0Hi pdaws-san,Thank you for your reply.I understand that Robomaker don't support ROS-E.Thank you,Yasu-SCommentShareYasu-Sanswered 3 years ago"


Question: AWS instance randomly becomes unresponsive

My AWS instance randomly becomes unresponsive everyday. I won't be able to ping it and all ports on the public IP are inaccessible but it shows the instance is running from the AWS dashboard. The only way to fix it is by rebooting but I don't want to have to do this every day.The  instance reachability check fails but the system status check doesn'tThe CPU utilization is not even high so I know it isn't crashing or something.The system log doesn't show anything wrong either (pastebin: https://pastebin.com/Ri1ui8sp).My machine type doesn't have EC2 serial console so I can't access that either.FollowComment

Answer: "1The thing that sticks out at me here is the CPU credit balance graph. Note that it goes to zero at 23:15. This is going to cause the performance of the instance to drop to baseline which may be impacting your availability.You can solve this by choosing "Unlimited" mode for the instance. Whenver the CPU credit balance goes to zero the performance will not be impacted; but you will be charge for that service. If this is happening regularly a better option would be to use a different instance type such as the M, R or C instance types.CommentShareEXPERTBrettski-AWSanswered 6 months ago0The best recommendation would be to create a support ticket and they can help with this.CommentShareGautam Kumaranswered 6 months ago0Hello,In addition to Brettski's answer of switching to "unlimited mode" I would also advise to check memory usage of the instance, from our documentation [1] common reasons for StatusCheckFailed_Instance are as following:  - Failed system status checks  - Incorrect networking or startup configuration  - Exhausted memory  - Corrupted file system  - Incompatible kernelBased off the symptoms you described and your approach to fix it sounds a lot like a memory issue, see docs [2] that states Reboot the instance to return it to a non-impaired status. The problem will probably occur again unless you change the instance typeAs you know that EC2 does not natively monitor memory metrics, we have 2 approaches to configure this manually adding them below with links:Configure ATOP/SAR to log resource utilizationUse cloudwatch agent to log memory utilizationIn addition to the resources above also adding this third party link [3] which does a good job of summarizing and configuring the aws agent to log memory utilization.I do hope the above resources help, feel free to comment on this thread if there is anything else we can assist with.[1] Instance status checks[2] Suggested actions[3] How to monitor memory usage on AWS EC2?CommentShareSUPPORT ENGINEERLundianswered 6 months ago"


Question: Cognito pool allows duplicate confirmed email address aliases

"Hello.This may be a problem with Cognito and I am not sure if this is the correct place to report this.We have a cogntio user pool set up with about 100,000 users currently, and growing. The attribute settings are set to using username to sign in but to also allow sign in with verified email, phone, or preferred username. We connect with the pool using the Java SDK.Users can sign up by choosing email or phone (we haven't implemented preferred username) - or Google, Facebook or Apple. When confirming, we call confirmSignUp with forceAliasCreation=false. This causes an error if the user tries to use an existing verified email address. Which is fine. Usually.However, occasionally a user is able to create a duplicate Cognito user with the same exact email address and both users are "confirmed" with the email address set to verified. How is this possible? My understanding is that it is impossible to have the same email address confirmed on two different users in the same pool with these settings.The only way out of this is to manually delete one of the users.Is this a known issue?FollowComment"

Answer: "0Ok - so ...... turns out the issue was NOT duplicate emails. The issue was whitespaceUsers managed to get accounts with both "test@test.com" and "test@test.com " and sometimes " test@test.com" - the email attribute is not automatically trimmed and spaces before or after an email address are not considered invalid or anything else. Also, as far as cognito is concerned, these are treated as different email addresses.In the UI, the email appears the same - because you can't see the rouge spaces.The solution is to clean up these accounts and make sure these attributes are trimmed before the signup call.CommentSharescottdcoanswered 2 years ago0I think it might be considered as a Cognito bug. Since even though you can trim the email using Java SDK, an attacker can sign up a new account using the same technique using Cognito API directly without using UI.CommentShareJackServerlessanswered 2 years ago"


Question: boto3 ecs.describe_task call returns task missing

"I'm trying to use a boto3 ECS waiter to wait on a Fargate ECS task to complete. The vast majority of the time the waiter works as expected (waits for the task to reach the STOPPED status). However, sporadically the waiter will return a failure because a task is marked as missing. However, I can find the task itself in the cluster and cloudwatch logs for the task. When I first encountered this, I switched to using boto3 ecs.describe_tasks method to see if I could get more information about what was happening. When the above situation occurs, descirbe_tasks returns something like:{'tasks': [], 'failures': [\{'arn': 'arn:aws:ecs:us-west-2:21234567891011:task/something-something/dsfsadfasdhfasjklhdfkdsajhf', 'reason': 'MISSING'}], 'ResponseMetadata': \{'RequestId': sdkfjaskdjfhaskdjfhasd', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requestid': 'sdkjfhsdkajhfksadhkjsadf', 'content-type': 'application/x-amz-json-1.1', 'content-length': '145', 'date': 'Fri, 06 May 2022 08:36:11 GMT'}, 'RetryAttempts': 0}}I've looked at the AWS Docs  and the none of the scenarios outlined for reason: MISSING apply in my circumstance. I'm passing my cluster name as an argument to the call as well. Since this happens intermittently its difficult to troubleshoot. What does the MISSING status mean? What are the reasons why an API call to check on task status would return missing when the task exists?FollowComment"

Answer: "0I understand that you are trying to setup a mechanism where a boto3 ECS waiter function to wait until a Fargate task is Stopped. So whenever you are running “ecs.describe_tasks” boto3 method and randomly running in to an issue where the task with a specific task Id is reported as MISSING. Now, I assume that you are essentially trying to obtain Describe task API output to find out if the task is stopped(completed) or to find out if it has failed. Now, when a task is stopped, the details of the task are available for review by Describe task only for a certain amount of time.  At the moment, ECS does not have a fixed time as to when the Stopped task details are reaped(details unavailable for retrieval) using the Describetask API.For example, it is expected that a DescribeTask API can return a response that the task is MISSING even shortly after the task is Stopped. Because the task details in some cases/scenarios can be removed(for retrieval) by ECS as early as minutes and sometimes can stay for an hour(approximately).To answer you question as to what does the MISSING status mean?In addition to the obvious reasons where the task ID/region/Cluster name are incorrect. You could also see the MISSING status for a task ID when that specific Task has been stopped and ECS had reaped this stopped task. Based on the information that you have shared with me and considering that the issue is intermittent, this could be main reason you are observing some tasks showing up as MISSING status.Now I understand that you might be able to view these stopped tasks in the console which ideally you should not be able to view if the Describe task API call is showing the task’s status as MISSING. In such case, I would suggest that you open a support case with AWS Premium Support to troubleshoot the issue further as we would need cluster/task related information.CommentShareSUPPORT ENGINEERPraneel_Manswered a year ago"


Question: GetSecretValueResponse not working to retrieve secret values

"I am manually uploading the aws credentials file which contains access key , secret key, session token and many more. I am trying to fetch the secret values in my secret manager through java code. Currently i am using GetSecretValueResponse for fetching the values and AWSCredsProvider(access key, secret key) as my credentials provider. It is expecting it to be instanceof AwsSessionCredentials( access key , secret key, session token) but this is a final class, So how can I make my java code utilize the session token that is being provided in the file that I uploaded initially?<dependency>      <groupId>software.amazon.awssdk</groupId>      <artifactId>secretsmanager</artifactId>      <version>2.20.22</version>    </dependency>dependancy that i have used.ERROR: The security token included in the request is invalid. (Service: SecretsManager, Status Code: 400, Request ID: 7b4d76ea-389f-4068-8fde-577224a67f5c)FollowComment"

Answer: "0Hi,Thank you for contacting us. Please note that this error message can appear if the expected credentials are not used appropriately. As an example, if your intention is to use temporary credentials, but you have configured your system to use only the access key and secret access key, without the session token value.https://repost.aws/knowledge-center/ec2-expired-tokenPlease feel free to refer to the following documentation to identify how you may pass temporary credentials for use with AWS Java SDK:Provide temporary credentials to the AWS SDK for Java - https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.htmlThe documentation contains details for specifying a credential provider or provider chain.Feel free to reach back with any questions!CommentShareSUPPORT ENGINEERSumukhi_Panswered 2 months ago"


Question: Snapshots (and Volumes created from) Missing changes for a month

"We have a EBS volume mounted on an EC2 instance.  The volume gets daily snapshots created via CloudWatch Events.  Subsequently we have ~2 years of daily snapshots for different volumes.  However, when I recently went back to do a layered restore by creating a volume from the snapshots I found that there seems to be no changes in the created volume since Nov 8th.  The data changes frequently every day but it seems the snapshots have not captured this.  It's almost as if every snapshot captured no changes since Nov 8th until I started looking into the issue last week which included reboots, patches, and various manual recovery efforts.Why would the snapshots not have changes since Nov 8th up to roughly December 10th?  They are all there, all the status is okay, but creating a volume from any of those dailies will show me that a log that changes every day is still Nov 8th.My next steps will be to attempt mounting these snapshot created volumes elsewhere and see if it has something to do with how they are being attached.Another behavior we've not been able to explain is that users reported data loss for a month of data and the active live volume (where the snapshots come from) showed the similar no changes since Nov 8th.  The Apache logs show activity but the data does not.  The apache logs are stored on a separate volume from the data.  This seems to be related but would mean our data volume has somehow been corrupted.  During this time we've used our system and shared content - so we know the content made it to the system and was pulled by other users during this odd time window.Any ideas?  I'm starting to think we've lost data since Nov8 to about Dec10 with no log, alert, or other indication that anything was wrong.  And at least for now moving forward - things appear to be working properly.FollowComment"

Answer: "0After more research this looks like on Dec10, it's as if AWS reverted to a snapshot from Nov8 and continued on.  The app logs on the live volume show Entries up to Nov8 and then immediately jump to Dec10 as if all the days in between never existed.  Another app using the same volume had the same issue.  I'll have to go back but I suspect all the snapshots from Nov8 forward are duplicates until Dec10 at which point history resumed as if Nov8 was the day before Dec10.Has anybody seen this before?  I trolled through trying to see if somehow we did something that somehow restored the main volume from a Nov8 snapshot but nothing in CloudTrail Events show any odd behavior around either Nov8 or Dec10.CommentShareawsuser34s332answered 2 years ago0After digging around a lot here's what I found:A snapshot previously used and converted to a volume and attached inherited the same UUID as the live volume.  To make a long story short, after some updates and a reboot to the system the system apparently picked the first UUID match for the entry in /etc/fstab.  It turns out it mounted the recovery volume that was left attached instead of the proper live volume.  Sometime later on a different update/reboot cycle the system was restarted with the recovery volume properly detached and it appeared there was a missing time slice of data.To prevent this from happening again /etc/fstab has been updated to use devices instead of UUIDs.  Now if we have a restore volume attached it won't be in conflict with the live volume.  The chances of changing attachment devices in the AWS console are very low so that wouldn't be anywhere near of an issue like UUIDs are.While AWS didn't indicate this in the support ticket, some of their feedback on logs and information led me to get this one figured out.  Thanks to the AWS support crew for this effort.CommentShareawsuser34s332answered 2 years ago"


Question: AWS SSO SCIM API pagination for methods

"I'm using the AWS Single Sign-On SCIM implementation API for and integration of AWS SSO with Google workspace, the project is here: https://github.com/slashdevops/idp-scim-sync/ and I also contributed in the AWS original one: https://github.com/awslabs/ssosync which is not active anymore.The integration I did is working fine until you don't have more than 50 users of 50 groups in the AWS SSO service.  That is because you have several limitations on the AWS SSO SCIM API implementation, described herehttps://docs.aws.amazon.com/singlesignon/latest/developerguide/listusers.htmlhttps://docs.aws.amazon.com/singlesignon/latest/developerguide/listgroups.htmlso, the question is:When do you be able to allow the pagination for the ListGroups and ListUsers endpoints?this API have some time already published and we are waiting so long for this feature.FollowCommentDani Salmeron a year agoThis feature is really needed to properly manage SSO and identities.ShareAWS-User-0778201 9 months agoWe launched fully paginated AWS standard APIs for managing users and groups at scale in AWS IAM Identity Center.https://aws.amazon.com/about-aws/whats-new/2022/09/aws-iam-identity-center-apis-manage-users-groups-scale/Share"

Answer: 0We launched fully paginated AWS standard APIs for managing users and groups at scale in AWS IAM Identity Center.https://aws.amazon.com/about-aws/whats-new/2022/09/aws-iam-identity-center-apis-manage-users-groups-scale/CommentShareAWS-User-0778201answered 9 months ago


Question: Move dockerized Jenkins server to AWS

"I have a dockerized Jenkins build server set up like below and I want move it to AWS.I have some questions on how to do it, Thanks.Is ECS the right choice to deploy dockerized Jenkins agents?Is Fargate launch type of ECS support Windows containers?I know ECS can dynamically provision EC2 instances, can ECS provision like below?a. If there is no job to build, there is no ECS2 instance running in the cluster.b. If a build job started, ECS dynamically launch a EC2 instance to run the dockerized agents to handle it.c. After build job is finished, ECS cluster will automatically stop or terminate the running EC2 instance.==================================================================Jenkins master:Runs as a Linux container hosted on a UBUNTU virtual machine.Jenkins Agents:Linux Agent:Runs as a Linux container  hosted on the same UBUNTU virtual machine as master.Windows Agents:Runs as a windows container hosted on a Windows server 2019.FollowComment"

Answer: "1Accepted Answer#1 - ECS is a perfectly reasonable place to run Jenkins, lots of customers do that.#2 - Fargate currently doesn't support Windows, you will have to use the EC2 launch type for Windows servers#3 - ECS doesn't support this model today, this is an area we're looking closely at so stay tuned. For now you'll need to have one instance running./MatsCommentShareMatsanswered 4 years agoDror Helper a year agoUpdate: Fargate does support Windows containers on ECS: https://aws.amazon.com/about-aws/whats-new/2021/10/aws-fargate-amazon-ecs-windows-containers/.However Windows containers tend to have longer startup times than Linux containers and so EC2 with Windows Agents (always on) and/or use Image builder to reduce the container start timeShare"


Question: Deployed Spring Boot using Elastic Bean stack  - Degraded

Hi TeamI Deployed Spring Boot using Elastic Bean stack and done the necessary stepsserver portadding rolesBut application did not deploy it  says degraded.could someone please helpSource Code : https://github.com/andrewsselvaraj/springawt/tree/main/spring-boot-jwtFollowComment


Question: Service Control Policy for restricting certain write actions to specific regions only

"We would like to control which services are available for use in which accounts and regions while still being able to review everything:Allow ReadOnly across all services in all regionsAllow Write on specified services in certain regionsWe are aware of the general policy to restrict actions not in specific regions but this is too restrictive and results in unnecessary confusion when users experience permission errors on various service dashboards.Thus far we have been unable to construct an SCP, or combination of SCPs, that provide the intended effect given the attachment and size limits.Is what we are looking for even possible with Service Control Policies alone?We would like to avoid:Managing this via User/Role PermissionsHaving "Bypass" Roles as shown in the documented example above.FollowComment"

Answer: "1No, you cannot do this via SCPs alone. SCPs don't grant any actions, only allow that certain actions can be granted by identity policies, so you will have to have some identity policies involved.Another problem you will run in to is that an explicit deny anywhere in the policy evaluation logic will result in the action being denied, even if it is also allowed. This means that if you want any principals in an account to have an action (e.g. write to a specific region), then the SCPs must allow it.Unless you scope your regions to specific accounts or OUs, you cannot implement what you want with SCPs.CommentSharerowanuanswered a year ago"


Question: AWS Api gateway for REST API does not work with multi-level base path mapping

"I am currently trying to use aws api gateway CLI to create a multi-level base path mapping. I am running the following command:aws apigateway create-base-path-mapping --domain-name rimbleanalytics.com --base-path orders/v2 --rest-api-id f3ho0c7zx0 --stage productionwhich gives me an error:An error occurred (BadRequestException) when calling the CreateBasePathMapping operation: API Gateway V1 doesn't support the slash character (/) in base path mappings. To create a multi-level base path mapping, use API Gateway V2.This is inconsistent with https://aws.amazon.com/blogs/compute/using-multiple-segments-in-amazon-api-gateway-base-path-mapping/ which states for REST Api's use API Gateway V1. When trying to use API Gateway V2 we get an error stating it can only be used for HTTP apis. How does one create multi-level base path mapping for REST APIs.FollowComment"

Answer: "1Both REST and HTTP APIs are supported, but the CLI to create the mapping is in apigatewayv2. You should use the following command:aws apigatewayv2 create-api-mapping --domain-name rimbleanalytics.com --api-mapping-key orders/v2 --api-id f3ho0c7zx0 --stage productionCommentShareEXPERTUrianswered a year agoAWS-User-9124170 a year agoHey Uri - thanks for the response but it does not work:aws apigatewayv2 create-api-mapping --domain-name rimbleanalytics.com --api-mapping-key v1/orders --api-id f3ho0c7zx0 --stage productionAn error occurred (BadRequestException) when calling the CreateApiMapping operation: Only REGIONAL domain names can be managed through the API Gateway V2 API. For EDGE domain names, please use the API Gateway V1 API. Also note that only REST APIs can be attached to EDGE domain names.ShareUri EXPERTa year agoDid not know you are working with Edge optimized APIs. From the documentation: To configure API mappings with multiple levels, your custom domain name must be regional and use the TLS 1.2 security policy.This means that you can't achieve what you want as your custom domain name is edge optimized.Share"


Question: Deploy newer version of Hugo / change env variables

Hi. I need to deploy a newer version of Hugo than what gets included (Hugo Static Site Generator v0.51 linux/amd64 BuildDate: 2018-11-07T10:10:13Z) during the Provision stage.Is it possible to change / overwrite ENV VERSION_HUGO=0.51 set in the Provision stage?Thanks.FollowComment

Answer: 0I figured out how to do this. I changed the build settings to:        - wget https://github.com/gohugoio/hugo/releases/download/v0.55.3/hugo_0.55.3_Linux-64bit.tar.gz         - tar -xf hugo_0.55.3_Linux-64bit.tar.gz        - mv hugo /usr/bin/hugo         - rm -rf hugo_0.55.3_Linux-64bit.tar.gz        - hugo version        - hugoCommentSharedaunceanswered 4 years ago


Question: Can Nvidia Driver OS be installed on G5g instance?

"My customer want to use our G5g ec2 instance for their auto-driving application dev/test. However their applications are designed to run on Nvidia Drive OS. Do you know if our EC2 instance (e.g. G5g) can support Nvidia Drive OS? If not support yet, is there other workaround to simulate Drive OS on AWS?Thank you!FollowComment"


Question: Application Load Balancer : external IP outside VPC ?

"I need an Application Load Balancer to forward trafic to an external web server hosted outside AWS, outside VPC.Is it possible ? What is the best strategy ?FollowCommentBrettski-AWS EXPERTa year agoCould you explain a little more about what you're trying to achieve here? Short answer is "no" but there may be other alternatives (CloudFront for example).Share"

Answer: "0HiI understand that you would like to use AWS load balancer with servers hosted in another providers, The answer is Yes, Here are the steps:Application Load Balancing via IP AddressYou can use AWS ALB to route the traffic to the Web Server by IP address of serversIP addressesSupports load balancing to VPC and on-premises resources.Facilitates routing to multiple IP addresses and network interfaces on the same instance.Offers flexibility with microservice based architectures, simplifying inter-application communication.Supports IPv6 targets, enabling end-to-end IPv6 communication, and IPv4-to-IPv6 NAT.These addresses can be in the same VPC as the ALB, a peer VPC in the same region, on an EC2 instance connected to a VPC by way of ClassicLink, or on on-premises resources at the other end of a VPN connection or AWS Direct Connect connection.Documentation link : https://aws.amazon.com/blogs/aws/new-application-load-balancing-via-ip-address-to-aws-on-premises-resources/How to proceed ?Create Target Grouo for the Load balancer [ALB]Select target type is** IP addresses type**Select your VPC in the dropdownin the next step you need add the IP adress of your web server [Private IP] that must meet the IP ranges in the VPC, for this you can use site to site connection or Direct connect  from the location of servers to AWS VPCCommentShareGKanswered a year agoBrettski-AWS EXPERTa year agoI don't think this is correct. If you read the article linked above the target IP addresses must be in the (various) private IP address ranges, not public IP addresses. You can't configure a load balancer to send traffic to a public IP address.ShareGK a year agoYou are right did i write public Ip, " you need add the IP adress of your web server [Private IP] that must meet the IP ranges in the VPC, for this you can use site to site connection or Direct connect from the location of servers to AWS VPC"Can you please look into the answer and let me know, Where i answered PUBLIC IP address ?Share"


Question: Greengrass V2 Shadow Manager Manage all assigned devices

"While setting up ShadowManager + MQTT Bridge + Moquette, we have the desire to configure the ShadowManager to manage all shadows for devices under its control.By "under its control", I mean the devices you see listed if you go to Greengrass devices > Core devices > [MY GG DEVICE] > Client devices > Associated client devicesIt looks like, right now, it will only sync from Greengrass-Instance -> Cloud on a "wildcard" basis (any shadow topic that pops up on the Moquette broker is automatically synced to the local shadow service regardless whether it's in the ShadowManager config), but wont necessarily sync all shadows from the Cloud -> Greengrass-Instance. We don't need all shadows, but would like to have the ShadowManager keep the assigned devices to it in-sync without having to call them out in the general group-deployment.We're currently targeting Greengrass deployments at Groups rather than individual Greengrass-Instances, so configuring the ShadowManager during deployment wont work since each Greengrass-Instances in the group will have different device assignments. I think the workaround will be to create a union of thing-ids and just have all Greengrass-Instances under a group sync that superset.Is there a better way to do this?FollowComment"

Answer: "2Accepted AnswerHi Casey,as you mention, the cloud to ShadowManager edge sync is based purely on the configuration of the ShadowManager component. You could do as you point out, include all possible DeviceId in the Shadow Manager configuration but that will imply: 1/ all Greengrass Cores sync all the shadows with an impact on local storage 2/ depending on the number of devices you might hit a deployment document size limitMy suggestion would be to deploy just the ShadowManager component using each core device as target. In this way each configuration can be tailored to reflect the devices which are attached to the Greengrass Core device. I would recommend to implement some automatic logic to manage these deployments.I also encourage you to create a feature request in https://github.com/aws-greengrass/aws-greengrass-shadow-manager.Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 9 months agoCasey 9 months agoAwesome, thank you.I haven't experimented much with distributing deployments across targets, so I just want to make sure I understand. We can have a deployment that targets a group with the bulk of the component configuration, minus the ShadowManager, then create unique deployments targeting each GG-Instance with just the ShadowManager.  Then Nucleus will handle merging those deployments together to create the desired effective-configuration?ShareCasey 9 months agoJust tested with just that and it seems all good. The effectiveConfig.yaml looks like it's keeping track of which Components came from which Deployment, which is cool.ShareCasey 9 months agoFor reference, I created this as well: https://github.com/aws-greengrass/aws-greengrass-shadow-manager/issues/125Share"


Question: AWS DevOps Guru - ASG:EC2 CPU Utilization 99% - No Insight Generated

"HiI was doing a POC on AWS DevOps GuruAs per the documentation it support analyzing EC2 hosted by an ASG.So I launched an EC2 instance using an Auto Scaling Groupand Enabled AWS DevOps Guru for the instance by resource Tag.As per DevOps Guru, it will detect anomalies automatically and generate insightWe don't have access to know how DevOps guru working to analyze the EC2 or to set threshold to generate insightsSo to test I put 99% CPU load on the EC2 instance. In Metric it was showing the CPU Utilization is 99%, and it last for 4-6 hours (the manual stress)But no Insight generated by DevOps Guru when the CPU is at 99-100% for 4-6 hours.We tried this for 2 weeks daily but same result, no insight generated.We put the EC2 stress by using 'stress' package. (stress demo - https://www.cyberciti.biz/faq/stress-test-linux-unix-server-with-stress-ng/)So how to detect EC2 anomaly via DevOps Guru when CPU is at 99% ?Its now working as per the DevOps Guru documentation.Any help will be appreciated. FollowComment"

Answer: "1Hello there,I understand that you are testing the DevOps Guru service and to do that you launched an EC2 instance using AutoScaling Group. On this instance, you ran the stress test to put the CPU Utilisation to 99% for 4-6 hours everyday for 2 weeks daily but were not able to find any insight in DevOps Guru.DevOps Guru applies machine learning to analyze your operational data and application metrics and events to identify behaviors that deviate from normal operating patterns. It is targeted towards finding "unusual pattern" and explain what is going on with it.Now in your case, the instance launched was under high stress from the beginning. So the DevOps Guru expected this load to be there for 4-6 hours on the instance. It became a pattern which DevOps Guru identified and acknowledged.If the load varied for example, if it was 5%-10% for most of the day and then suddenly it goes to 90% then an anomaly should be recorded.I request you to test this scenario and let us know if you still face the issue. If it still exists, please share the steps that you followed.CommentShareSUPPORT ENGINEERGurpreet Singhanswered 3 months agorePost-User-4264815 3 months agoThank you for the suggestion. We have started the analysis as per your suggestion. Now keeping the instance CPU at 25% load. Will keep this for 1 week. After that we will put stress on CPU at 99%. Will revert back to you after the analysis result.SharerePost-User-0599314 3 months agoAs per the instruction provided we followed the steps. We keep the EC2 (by ASG) CPU utilization 12% for 11 days constantly. On the 12th day we put a stress load which increases the CPU utilization to 99-100% for 6 hours, but AWS DevOps guru does not generate any insight for the anomaly. Amazon DevOps Guru not working as per the documentation.Share0As per the instruction provided we followed the steps. We keep the EC2 (by ASG) CPU utilization 12% for 11 days constantly. On the 12th day we put a stress load which increases the CPU utilization to 99-100% for 6 hours, but AWS DevOps guru does not generate any insight for the anomaly. Amazon DevOps Guru not working as per the documentation.CommentSharerePost-User-0599314answered 3 months ago"


Question: Security Group to allow aws cli

"Hi,I'm trying to lock down our default security group but need to keep access to run cli commands on the instances, specifically:aws ec2 describe-tagsWhat port(s) do I need to allow and to/from where/ip? I can't find it anywhere.Cheers,Dave.FollowComment"

Answer: "0Hi dgoodbourn,Are you modifying outgoing rules of your default security group? You generally shouldn't need to do that, as long as you trust the servers this is applied to.aws cli uses https to talk with the amazon API. You should leave port 443 open. You would most likely want to leave port 80 open as well, to be able to get updates on your server.Hope this helps,GeorgeCommentShareGeorge-NGanswered 4 years ago0Hi George,Thanks for this. I thought I had done this but obviously not. That fixed it and all is working. Thanks a lot.Cheers,Dave.CommentSharedgoodbournanswered 4 years ago"


Question: "Trying to deploy docker image from ecr into eks cluster, Stuck in container creating mode"

Warning  FailedCreatePodSandBox  14m                   kubelet            Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "6c7a5941dfd2a9818a306f1502bb5f175bed356154f0b44f87fb7a0959976e55": plugin type="aws-cni" name="aws-cni" failed (add): add cmd: Error received from AddNetwork gRPC call: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp 127.0.0.1:50051: connect: connection refused". Kindly help me solve the issue.FollowComment

Answer: "0Does it work locally?CommentSharemyronix88answered 7 days ago0yes , its is working locallyCommentSharerePost-User-2028403answered 6 days ago"


Question: How to make/access call recordings filenames

"When we add enable Call Recording Behavior in contact flow the call recording files are pushed & stored in S3 with contactId_timestamp.wav format file.We can get the contactId using Amazon connect stream API getContactId() event. I want to get the recordings of every call after call completed so to get the recordings from S3 i need to pass the key as filename in getObject Api.So, i am trying to automate this in my code as after every single call it will fetch/pull the call recording and add it in my call activity, the same procedural we are experiencing in Search Contact Flow as after every call we get a audio file.How to get the timestamp to make and access the call recording files by names?So far i what i have done is:-Used getObject Api to get/downloading the recording by filename.require("dotenv").config();const expres = require("express");const app = expres();app.listen(3001);const aws = require("aws-sdk");const multer = require("multer");const multerS3 = require("multer-s3");aws.config.update({    secretAccessKey: process.env.ACCESS_SECRET,    accessKeyId: process.env.ACCESS_KEY,    region: process.env.REGION})const BUCKET = process.env.BUCKETconst s3 = new aws.S3(secretAccessKey = process.env.ACCESS_SECRET, accessKeyId = process.env.ACCESS_KEY); app.get("/download/filename", async(req, res)=>{    const filename = req.params.filename    let x = await s3.getObject({Bucket:BUCKET, Key:filename}).promise();    res.send(x.Body);})FollowComment"

Answer: "0Hello;We are using Kinesis streams to get file information. Also I think you can create a lambda that is triggered when a new file is put in your s3 bucket.With these approaches you will have the exact filename.Thank you.CommentSharebbolekanswered a year agoAbdul Qayyum a year agoThanks @bbolek, I am using Amazon Connect Streams, can we get disconnecttimestamp somehow like contact.getQueueTimestamp() ?I wanted to make the filename by myself by adding contactId + disconnecttimestamp.Share"


Question: Unable to create EKS Cluster

"Dears,I am not able to create a EKS service using my account.[https://eu-central-1.console.aws.amazon.com/eks/home?region=eu-central-1#/cluster-create] (EKS Create cluster)As there is a role needed for EKS Management, I created the role using the documentation beneath.[https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html#create-service-role] (Create EKS Role)After the role creation, I am navigating back to the Cluster creation page, but the role which was created using this guide is not visible and not selectable in the drop down menu.BRFollowCommentDanilo Silveira BR a year agoIn the same link you sent, https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html , there is the first part to check if the role really exists and if the role was properly created. Could you check if the role eksClusterRole exists, if AmazonEKSClusterPolicy managed policy is attached and if the trust policy has Allow to eks.amazon.com service and AssumeRole action?Share"

Answer: "1Hi!As far as I can understand in your question, you are trying to create a EKS Cluster with the role in the documentation. Perhaps the  user that you have doesn't have the policy that you have created in its group permissions. A role can be assosiated to an AWS Services, not users.I can recommend you to use eksctl and kubectl to create the cluster as this link [1] below says.Also, you can ask to your IAM administrator to add the policy [2] in the permissions that you have.Hope this help you.[1] Creating an Amazon EKS clusterhttps://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html[2] AmazonEKSClusterPolicyhttps://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.htmlCommentShareHernandez Edgaranswered a year ago"


Question: UpdateExpression: Two document paths overlap with each other; must remove or rewrite one of these path

"I have been using this query for a few months, and I don't remember seeing this error before.I am trying to run the update query below, through a DocumentClient from aws-sdk v2 for node.js (some fields omitted for clarity):{  UpdateExpression:    'SET #by = :by, #integrations[1] = :update1, #integrations = list_append(#integrations, :added)',  ConditionExpression: '#integrations[1].#scope = :condition1',  ExpressionAttributeValues: {    ':by': 'system',    ':condition1': 'ScopeAlpha',    ':update1': {      scope: 'ScopeAlpha',      properties: {        some_uuid: 'c94aea21-b2a5-465a-8c72-4ae43a40622e',        some_other_uuid: 'f73f6ebb-a073-40fd-a0a6-43522ed9fe45'      }    },    ':added': [      {        scope: 'ScopeBeta',        properties: {          some_uuid: 'c94aea21-b2a5-465a-8c72-4ae43a40622e',          some_other_uuid: 'baac4f71-5202-463b-8336-b82a27f11356'        }      }    ]  },  ExpressionAttributeNames: {    '#by': 'updated_by',    '#integrations': 'integrations',    '#scope': 'scope'  }}My goals is to update an existing entry of a list, and to insert new items to it as well.I would rather have all this in a single call, as it reduces the update events coming out of the table stream, as I drive a lot of behaviour out of those. It also reduces the likelihood duplications due to double handling.For some reason, this call now fails with the following error:ValidationException: Invalid UpdateExpression: Two document paths overlap with each other; must remove or rewrite one of these paths; path one: [integrations, [1]], path two: [integrations]I don't see anything wrong with this call, and I've tried updating it slightly in different ways to see if I can get it to work, all to no avail.Could someone tell me if there is anything that I miss that makes this invalid, or let me know if this should work at all or not?Thank you.FollowComment"

Answer: "2Accepted AnswerIt's always been this way. It's hard from the outside to reliably answer "why" questions.This StackOverflow post shows a technique to assign and append in one call: https://stackoverflow.com/questions/66534235/invalid-updateexpression-two-document-paths-overlap-with-each-other-must-removCommentSharejzhunteranswered 9 months agoRicardo Nolde 9 months agoVery dirty trick. I will take it. Thanks mate!Share1Hello @MassimilianoA,I understand that I use it twice, and the message is clear on what must happen.My question is WHY this is the case? I don't see how these operations would clash. One operation is updating existing items, and the other is merely adding new items, that were never there in the 1st place. Why would DynamoDB stop me from doing that? And I have been using the specific code that generates this for a while now, and I find it hard to believe that this specific situation did not happen before.I have also tried REMOVE followed by a SET list_append, and that also does not work. In that case, it is not operations over the same field in the same SET statement, but it fails the same way. Seems like this is a blanket validation rule applied over the expression, disregarding the fact that the field is a list.The use case is as I mentioned in my question: I do not want multiple update events in my table stream, if I can avoid those. And it would reduces the likelihood of issues due to multiple concurrent updates.So, summarizing:Did this change, or was it always like this?Why shouldn't it be supported? I understand this limitation for other field types, but not for lists.Should I expect a fix, or should I just go ahead and split the operations?CommentShareRicardo Noldeanswered 9 months ago0The problem is in the SET expression, where you are referring twice to the same attribute #integrations. You need to remove one of #integrations[1] = :update1 or #integrations = list_append(...) to make the expression valid.This means that you cannot update an item in the list and append new items in a single operations.Sharing some additional information about the specific use case (ie the need to update the 2nd element of the list at the same time that you are adding new elements) might help in providing alternative solutions to achieve your goal of minimizing the number of operations on the table.CommentShareEXPERTMassimilianoAWSanswered 9 months ago"


Question: Getting resources list of AWS account using AWS cli

I am trying to get the resources configured under my account from AWS cli using command get-resources but it doesn't work properlyCould someone help with the set options available for this commandFollowComment

Answer: 0Have you already referred this documentation ?https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.htmlCommentShareRajesh Sanswered 10 months ago


Question: Identifying Objects in Video Streams Using SageMaker - CFN template: S3 access denied

"Hi, I have a problem with access to cfn templates. Error appears in every region. How can i solve that?FollowCommentRon_H SUPPORT ENGINEERa year agoHello,To confirm, you are attempting to execute one of the stacks provided in the linked document from the Create Application section?  If so, I too am running into that same issue from my console.  I will check with the team to see if these are indeed publicly accessible templates.  Please confirm.Shareaszti97 a year agoYes, in that section. Thank you for respond :) If you check, please let me know.Share"

Answer: "0Have you updated the S3 bucket policy to allow the Amazon SageMaker service access to the bucket?  Does the Amazon SageMaker service role have a policy which allows it access to your S3 bucket?CommentShareAllison_Panswered a year ago0I'm logged in as a root user. Shouldn't I have AdministratorAccess? I refer to public template: https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/examples-sagemaker.htmlAlso, templates from other sources are available.CommentShareaszti97answered a year ago0Also, when i'm trying to get bucket policy in CLI i get the same error. Is it possible, that this bucket isn't public?CommentShareaszti97answered a year ago0Even while logged in as root (which I would also recommend that you not do), it is not like having administrator or sudo access in Windows/Linux.   Many services and their resources, such as S3, have their own resource policies which may also require configuration to allow access to content stored in said resources (such as a bucket in this case).On the bucket you need to allow the SageMaker service (assuming that's what's needing access) to S3 via a bucket policy (xhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html).Just to confirm, Are you as trying to run the Cloudformation templates in S3 (as a root user) from the Cloudformation console or are you trying to have SageMaker use templates in the S3 bucket?CommentShareAllison_Panswered a year ago0My goal is to upload CFN template via templateURL=https://s3.eu-central-1.amazonaws.com/kvsit-eu-central-1/cfn-template.template.yml in CloudFormation console. And two errors occur. First one is: "You must specify a Stack ID. Displaying your Stacks page". And the second one: "S3 error: Access Denied". I've created s3 bucket role and added few permissions, related to Sagemaker and Kinesis. But it's still not working. I tried also to give full access, but it didn't help either. I doubt it's the problem with policies, because other templates are loading fine.CommentShareaszti97answered a year ago"


Question: Protocols Missing While creating SNS Subscription

"When I try to create a subscription for SNS, initially I can see the entire list of protocols. But after I choose a topic, all protocols except SQS are gone from the list. Choosing a different topic after deleting the current one did not help.FollowComment"

Answer: "0Tried a lot of different things but could not reproduce the issue.Is this happening in a particular AWS region or on any region?Also do you have access to another AWS account where you can try it out. If you would start noting down your actions before you can reproduce the issue, that will be helpful.CommentShareEXPERTIndranil Banerjee AWSanswered a year agorePost-User-7354306 a year agoI had a partial resolution for the issue. When I chose a FIFO topic, I only see SQS in the protocol list. When I chose a standard topic, I can see all three protocols. I'm doing this in N Virginia region.ShareIndranil Banerjee AWS EXPERTa year agoOK. Thanks for the clarification. Yes for FIFO Topics, FIFO SQS Queues are the only supported subscriptions. It is mentioned in the documentation - https://docs.aws.amazon.com/sns/latest/dg/fifo-message-delivery.htmlShare"


Question: Instances unreachable and unable to stop/restart

"Hi,We have a number of EC2 instances in eu-west-2 that are currently unreachable.We are unable to stop or restart instances.Some instances are showing a healthy status check, others are showing: Unable to describe instance status.We are also unable to take instance snapshots.Please advise if there are any ongoing ec2 issuesFollowComment"

Answer: 0https://status.aws.amazon.com/CommentSharefiviumopsanswered 3 years ago


Question: Redshift Version History

Where can I find Redshift version history? It appears to be lost in the migration to the new forum (rePost).FollowComment

Answer: "0Please, refer to the answer to the  question Where to find AWS Release Notes?And to the latest Maintenance posts (they can be searched with the phrase "AWS Redshift Maintenance Announcement"):AWS Redshift Maintenance Announcement (January 9th - March 24th 2022)AWS Redshift Maintenance Announcement (March 2nd - April 4th 2022)Also, do not hesitate to let us know if there are additional information you are looking for not covered by these.Hope this helps.CommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-5498667 a year agoHi Fabrizio,I can't seem to find the version details for our current version 1.0.37509 - it seems a higher (so later I guess) number than in the March 2nd - April 4th 2022 announcement. Maybe we are on a private patch still?Share"


Question: "Password verification in a CUSTOM_AUTH flow, do you need to handle SRP yourself?"

"If I want to verify a username and password, AND go through the custom auth flow, would I need to implement SRP myself?i.e. generate SRP_A and calculate PASSWORD_CLAIM_SIGNATUREIs there no way to bypass these SRP calculations / Is there no function to do these calculations for me?FollowComment"

Answer: "0Hi,It's possible to use the SRP flow if you use it before dropping into the custom challenges.  This blog shows the process specifically with Duo but you could replace the custom challenges with your own.Thanks,OwenCommentShareOwenanswered 8 months ago"


Question: Info about account prices after free tier expiration

"Hi all,I need some help about my free account.I created it on March 2022, so it's going to expire.That means I have to decide if it's worth paying, and how much, starting from April 1st.Following there's one bill about one of last months.Could you please help me understand what will happen if I keep my account on? I tried to search about all service prices, but it's really difficult to understand.Thank you very muchFollowComment"

Answer: "0Thank you very much Peter and Michael.Looking at pages you proposed, I tried to do some calculations for IoT Core, based on my last year mean data:Is that correct?As regards DynamoDB, I can't understand the descriptions:"$0.00 per hour for 25 units of read capacity for a month (free tier)""$0.00 per hour for 25 units of write capacity for a month (free tier)"In my bill I have "744 ReadCapacityUnit-Hrs", well above 25 units.Am I wrong?Thank you!CommentSharerePost-User-7976031answered 2 months agoPeter Grainger 2 months agoThe logic for you calculations looks OK to me. Regarding DynamoDB, there isn't a 12 Month's Free tier at all. As Michael noted it is a perpetual. What is free now will continue to be free.ShareMichael_R 2 months agoThe key with AWS usage based billing is that most items are billed per hour, rather than for the month as a whole. Since the amount you use can vary from hour to hour, AWS adds up the usage for all the hours in the month into a total number.For DynamoDB, this is expressed as ReadCapacityUnit-Hrs, WriteCapacityUnit-Hrs, and TimedStorage-ByteHrs.Using Read Capacity as an example, you have 1 Read Capacity Unit provisioned ever hour for the entire month of March, your Read Capacity usage is:1 RCU / hour * 24 hours / day * 31 days / March = 744 ReadCapacityUnit-HrsWhen the AWS pricing says you have 25 units of read capacity per month, it means 25 units read capacity per hour, for the whole month.25 RCU / hour * 24 hours / day * 31 days / March = 18,600 ReadCapacityUnit-HrsThis in fact matches the Free Tier usage limit for DynamoDB described in the AWS Billing console:18600.0 ReadCapacityUnit-Hrs are always free per month as part of AWS Free Usage Tier (ReadCapacityUnit-Hrs)With this understanding, if you have an average of 25 RCU provisioned per hour, you'll fall within the DynamoDB Free Tier.Share0From the docs: https://aws.amazon.com/free/free-tier-faqs/The Free Tier is comprised of three different types of offerings, a 12-month Free Tier, an Always Free offer, and short term trials. Services with a 12-month Free Tier allow customers to use the product for free up to specified limits for one year from the date the account was activated. Services with an Always Free offer allow customers to use the product for free up to specified limits as long as they are an AWS customer.You can use this interactive page to figure out what is always free and what is only for the first 12 months. https://aws.amazon.com/freeFor example, for your account: Cloudwatch, Cognito, DynamoDB and Lambda have an always free tier (which would cover the usage in the above screenshot). Your IoT usage wouldn't be free, it would be <$1 based on the above screenshot. Full pricing for that is here https://aws.amazon.com/iot-core/pricing/CommentSharePeter Graingeranswered 2 months ago0If you head into the Billing console, there is a menu option on the left for Free Tier, which provides details about your current Free Tier usage as well as the Free Tier limits that apply to each service.For example, Amazon DynamoDB Free Tier usage notes that "18600.0 ReadCapacityUnit-Hrs are always free per month as part of AWS Free Usage Tier (ReadCapacityUnit-Hrs)".Using this view, you can confirm which Free Tier benefits will end and when; note, some are 1 month, some are 90 days, others are 12 months, some even perpetual, like the DynamoDB example above.From here, you can use the AWS Pricing Calculator (https://calculator.aws/#/estimate) to estimate your ongoing costs. Note the AWS Pricing Calculator does not include Free Tier benefits unless specifically indicated otherwise when adding the service details (refer to note at the bottom of the page, here: https://docs.aws.amazon.com/pricing-calculator/latest/userguide/getting-started.html).CommentShareMichael_Ranswered 2 months ago"