Question: Can ALB route traffic except path?

I want to route traffic with path "/apps1/hello/world" to apps1 "/hello/world".Is it impossible with ALB rules?FollowComment

Answer: "0Hi ThereIs this what you are looking for?Redirect actionsYou can use redirect actions to redirect client requests from one URL to another. You can configure redirects as either temporary (HTTP 302) or permanent (HTTP 301) based on your needs.https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#redirect-actionsCommentShareEXPERTMatt-Banswered 10 months agoAWS-User-3427223 10 months agoNo, I am looking for some feature like "rewrite-target" of nginx ingress.I am using aws load balancer controller, but there is no same feature I think.ShareMatt-B EXPERT10 months agoOk yes thats not something you can do directly on your ALB.  Can you use CloudFront Functions to modify the request?https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.htmlShare"


Question: Preventing fake cognito sing ups

How to prevent fake user signups with Cognito? If some malicious actor sends fake user singup requests to the UserPool endpoint they can do it at the rate of 50 req/s (default quota). It takes only 1000 seconds (17 minutes) for them to exhaust the free tier - because each sign up is treated as MAU.  If they continue to create fake account our organization will be billed a lot of money.How to the limit number of daily signups? Or not count signups as MAUs?FollowComment

Answer: "0Hi,You can prevent fake account sign-ups in real time with AI using Amazon Fraud Detector.Please refer to the link for more information.CommentShareAWS-User-4371564answered 2 months agorePost-User-2578639 2 months agoThanks but this solution is overly complex for such a simple requirement as limiting the number of sign upsShare0HiYou can hook a pre signup lambda https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html where you can then perform validation such is checking the amount of daily signup from a DynamoDB table for instance, which has a counter incremented for any successful sign up.Hope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Bug: Unable to connect to RDS Aurora Serverless V2 with IAM authentication using role with only rds-db:connect permission

"When I attempt to connect to an RDS Aurora Serverless V2 instance using IAM authentication, I receive an error during client authentication:"pg_hba.conf rejects connection for host "...", user "", database "", no encryption" (host, user, and database names redacted)I tried both on the shell by fetching the password using AWS CLI with the aws rds generate-db-auth-token command as well using Python by fetching the password using Python's boto3 library with boto3.client("rds").generate_db_auth_token(...).If I add the AdministratorAccess AWS managed IAM policy to the role that I'm using, then I am able to successfully log in to the database. But if I remove AdministratorAccess then I am not able to log in. In both cases the role has the "rds-db:connect" permission with the appropriate db resources. If I update the role to "rds-db:" with resource "" I still receive the error.To try to learn what it is about AdministratorAccess that makes it work, I tried instead granting all of kms:, sts:, "iam:", "rds:", "rds-data:", and "acm:, with resource: "*", thinking that perhaps there was some undocumented IAM permission that was needed, but that didn't fix the issue.FollowComment"

Answer: "0Accepted AnswerI found the answer in this post: https://repost.aws/knowledge-center/aurora-postgresql-connect-iamIt turns out that for Aurora PostgreSQL the resource id in the IAM policy needs to be the rds cluster id, not the rds instance id. In contrast, for RDS PostgreSQL the resource id needs to be the db instance resource id. And my policy was using the instance id.I wish the generate-auth-token request would fail immediately with an IAM error – that would have helped pinpoint the problem much faster. Instead, the generate-auth-token request still succeeded, but the password that was generated wouldn't allow me to connect. And the "pg_hba.conf rejects the connection ... no encryption" error message is misleading as well.CommentSharelorenanswered 2 months ago0In my environment, I was able to access it using the following IAM policy.The configuration is based on the following document.https://docs.aws.amazon.com/ja_jp/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "rds-db:connect"            ],            "Resource": [                "arn:aws:rds-db:region:account-id:dbuser:*/*"            ]        }    ]}CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Run test methods in sequential order

"Hello,I have one Junit test class with two test methods in it.@FixMethodOrder(MethodSorters.NAME_ASCENDING)public class Class1 {@Testpublic void method1() {....}   @Testpublic void method2() {....}   @BeforeClass    public static void setUp() {        driver = new AndroidDriver(new URL(URL), getCapsAndroidEmulAut());   }   @AfterClass //executed after run all methods   public static void tearDown() {        driver.quit();}}When I run this test, I want run method1 first, and keep state of app in device to execute method2 (this is standard behaviour of Junit).But AWS Farm run method1 and then reinitialize the state of device and run method2 with a new state.Is there any configuration to have the standard behaviour ?Environnemnt : Junit/AppiumThank youFollowComment"

Answer: "0I understand the problem.for a test class like : @FixMethodOrder(MethodSorters.NAME_ASCENDING) public class Class1 {@Testpublic void method1() {....}   @Testpublic void method2() {....}   @BeforeClass    public static void setUp() {        driver = new AndroidDriver(new URL(URL), getCapsAndroidEmulAut2());   }   @AfterClass   public static void tearDown() {        driver.quit(); }}AWS Device Farm considers Class1 as a suite, each method as a class.According to the results: Farm executes setUp(), then method1(), then tearDown() (this is the first suite)Then Farm executes a new suite : setUp(), then method2(), then tearDown().While the standard behavior of JUnit is Class1 is a class, il execute setUp(), method1(), method2(), and tearDown().Any help ?CommentShareAWS-User-257answered 5 months ago"


Question: AWS Lighthouse - site went down all of a sudden and now getting an Error establishing a database connection

"public IP to view site: 35.161.38.56Content/credentials within the wp-config.php file have not been altered at all other then I've enabled wp_debug to view any helpful details.The WordPress site was running but started to slow down one day so I logged into AWS Lightsail and tried rebooting the server, upon doing so I started getting this error.  I've also tried stopping the instance and then starting it again.I've also tried creating a snapshot and creating a new instance with that snapshot with a plan that allowed for more resources than the starter plan at like $3.50 a month.With that being said, I'm at a loss.  I can generally troubleshoot WordPress issues but I haven't changed any database information on my end.  Would Amazon/AWS change database credentials without notifying me?  What are some other steps that I can try here?FollowComment"

Answer: "0The error "Error establishing a database connection" might occur for the following reasons:There are corrupted database tables.-The remote database connection is disabled.-The database service is down.-There is insufficient space on your volume.-There are incorrect login credentials in your WordPress Configuration fileTo fix this follow the steps belowaccess the wp-config.php file using a text editor, such as the vi editor through this command$ sudo vi wp-config.phpAdd the following line in your wp-config.php file. Make sure to add the line immediately before the line "That’s all, stop editing! Happy blogging".define('WP_ALLOW_REPAIR' ,true);After adding the preceding setting to the file, access the following URL and then run Repair Database:/wp-admin/maint/repair.php (for example, example.com/wp-admin/maint/repair.php)After running the database repair, remove the line of code you added to your wp-config.php file. If you don't remove this line, then anyone can run the repair on your database.Disabled remote database connectionSometimes databases reside on a remote database server. If the database server doesn't allow remote   connections from the instance hosting the website, then you can't connect to the database. To troubleshoot this, do the following:Check the configuration file wp-config.php for the DB_HOST value. If the host isn't localhost or 127.0.0.1, then the database resides in a remote server, as shown in the following example:define('DB_HOST', '192.168.22.9');Try to telnet from the server to the remote server on port 3306. If you can't connect, then remote connections aren't allowed in the database configuration on the remote server. Or, there's a firewall on the remote server that's blocking the connection. Contact the external database owner or support for assistance allowing connections from your Lightsail instance.It's a best practice to store the website database in a Lightsail managed database for high availability and security.Database service is downNote: The following file paths and commands might change depending on whether your Lightsail WordPress instance uses MySQL or MariaDB. Also, the file paths and commands vary depending on whether the instance uses native Linux system packages (Approach A), or if it's a self-contained installation (Approach B). To identify the database server type and which approach to follow, run the following commands:test ! -f "/opt/bitnami/common/bin/openssl" && echo "Approach A" || echo "Approach B"test -d /opt/bitnami/mariadb && echo "MariaDB" || echo "MySQL"If you verified that there are no table corruption and no remote database connection issues, and WordPress still can't connect to the database, then your database server might be down. This might happen due to database configuration issues, heavy traffic on a server, low disk space, low available memory, and so on. Check the database service status using the following command:MySQL database serversudo /opt/bitnami/ctlscript.sh status mysqlMariaDB database serversudo /opt/bitnami/ctlscript.sh status mariadbIf the preceding command shows that database is in the stopped state, then try starting the database service using the following command:MySQL database serversudo /opt/bitnami/ctlscript.sh start mysqlMariaDB database serversudo /opt/bitnami/ctlscript.sh start mariadbIf you're still not able to start the database service and you're seeing errors during the start process, then check the database service logs to identify the root cause and troubleshoot the issue. The main database service log file is located at one of the following locations in your Lightsail WordPress Instance:MySQL database server following Approach A: /opt/bitnami/mysql/logs/mysqld.logMySQL database server following Approach B: /opt/bitnami/mysql/data/mysqld.logMariaDB database server following Approach A: /opt/bitnami/mariadb/logs/mysqld.logMariaDB database server following Approach B: /opt/bitnami/mariadb/data/mysqld.log-Database performance and connectivity can be affected by low disk space and/or low available memory. Check these resources using the df and free commands.Insufficient space on your volumeIf the free disk space on your volume is 100% or just below 100%, then the database service might go down.Run the following command:$ sudo df -hThe preceding command lists the amount of free disk space, as shown in the following example:Filesystem      Size    Used     Avail      Use%    Mounted ondevtmpfs        1.9G     0       1.9G        0%     /devtmpfs           1.9G     0       1.9G        0%     /dev/shmtmpfs           1.9G    400K     1.9G        1%     /runtmpfs           1.9G     0       1.9G        0%     /sys/fs/cgroup/dev/nvme0n1p1  8.0G    8.0G      0G        100%    /tmpfs           389M     0       389M        0%     /run/user/1000If the command output shows that you don't have enough available space, you can resize your instance to bigger size. Or, you can delete unnecessary files from the server to create free space.After increasing the free disk space, restart the database service.Incorrect login credentials in your WordPress settingsWordPress needs a specific database connection string, which includes a user name, password, and host to access the database. If any of those items have changed, then WordPress can't access the database.To verify you're using the correct connection string, get the connection string details DB_NAME, DB_HOST, DB_USER and DB_PASSWORD in the wp-config.php file.Access the database from a terminal using the connection string. Make sure to replace DB_NAME, DB_HOST AND DB_USER with the values you got in step 1.sudo mysql 'DB_NAME' -h 'DB_HOST' -u 'DB_USER' -pEnter password: ********Note: The password isn't displayed as you enter it so that it won't be visible to other users.Press the ENTER key after entering the password.If you're getting an Access Denied error when using the preceding command, then it usually means that the credentials are incorrect.If you're using a remote DB host, then add the correct connection string in the wp-config.php file. If the database is in the same server, then make sure that DB_NAME is bitnami_wordpress and DB_USER is bn_wordpress.To reset the database user password, do the following:Use the following command to access /home/bitnami/bitnami_credentials. Make a note of the root database password.sudo cat /home/bitnami/bitnami_credentialsLog in to MySQL/MariaDB shell using the following command, then enter the password you got from the preceding command. If you're not able to log in to shell using the database root password, then reset the password (MySQL or MariaDB)sudo mysql -u root -pEnter password: ********Inside the MySQL or MariaDB shell, run the following query to make sure that database bitnami_wordpress exists:show databases;Run the following query to make sure that the database user bn_wordpress exists:SELECT user FROM mysql.user;Reset the password of the database user "bn_wordpress" using the following query.Note: Replace PASSWORD with the password you got from the wp-config.php file.MySQL databasealter user 'bn_wordpress'@'localhost' identified by 'PASSWORD‘;alter user 'bn_wordpress'@'127.0.0.1' identified by 'PASSWORD‘;MariaDB databasealter user 'bn_wordpress'@'%' identified by 'PASSWORD‘;Note: If none of the preceding resolutions work, you can restore your instance using a backup snapshot.CommentSharerePost-User-9017359answered a year agoseosuccor a year agothanks for the response, I finally went through the above steps and am getting a "Failed to start mariadb" error when running: sudo /opt/bitnami/ctlscript.sh start mariadb so I'm guessing the database isn't running and unable to start.Share"


Question: access all ec2 across region via lambda

I have lambda function for auto AWS AMI backup is it possible to execute lambda across the region for take automatic backup of all EC2 running on account.One lambda function execution for all ec2 across region.FollowComment

Answer: "0var ec2 = new aws.EC2();to connect to another region you can usevar ec2 = new AWS.EC2({apiVersion: '2006-03-01', region: 'us-west-2'});now you can use the aws-sdk in lambda.CommentShareharshmanvaranswered 4 years ago"


Question: RDS Aurora - stop upgrading process

"Hello. I decided to upgrade my Aurora from 5.6 to the 5.7 version. I click Modify and apply changes. The process of upgrading starts. I use a single region. After 30 minutes I decided to see the result, but I saw the next errors: in the cluster event - I see Upgrade in progress: Performing online pre-upgrade checks. and in the instance, I see the next error: /bin/cat: /etc/rds/huge_page_size.dat: No such file or directory. Database reboot each 2-5 minutes. I decided to delete this instance and cluster but now I see the next statuses for a long time: Cluster: Upgrading and instance: Deleting.How to fix it and completely remove it?FollowComment"

Answer: "0Accepted AnswerI received answer from AWS Support Center:A previous update of an internal monitoring component on these database clusters caused a configuration change which caused the recent upgrade from proceeding. An AWS engineer helped to unblock the upgrade.We started working on a fix for this issue with a release date in Q2/2022.CommentShareKonstantinZanswered a year ago0Hi,MySQL 5.6-compatible cluster and want to upgrade it to a MySQL-5.7, you can do so by running an upgrade process on the cluster itself. This kind of upgrade is an in-place upgrade, in contrast to upgrades that you do by creating a new cluster. This technique keeps the same endpoint and other characteristics of the cluster, so once upgrade initiated we can't stop. Reason for in-place upgrade being canceled or slow, sometimes could be due to below factors.-Cluster is processing any data definition language (DDL) statements-Cluster has uncommitted changes for many rows-Cluster is in the process of committing a large binary log transactionIf you are looking to delete then, we may also use a snapshot as part of the upgrade to restore and destroy your old instance once the instance state is available.Alternative approach, this post shows how you can perform a major upgrade for Aurora MySQL with minimal downtime using a blue-green deployment. This is useful for database administrators or DevOps team members responsible for the Aurora MySQL upgrades.https://aws.amazon.com/blogs/database/performing-major-version-upgrades-for-amazon-aurora-mysql-with-minimum-downtime/CommentShareawsramsanswered a year agoKonstantinZ a year agoI've restored the new DB from the snapshot.Now I need to destroy the old cluster and instance, but it doesn't delete for a long time.Share"


Question: "<alias>@<organization>.awsapps.com can send, yet not receive"

"Hi,a while ago I set up an Workmail Account and got it working back then, it could receive E-Mails.The account is set as return-path to handle bounces for SES and manage an automatic blacklist for hard bounces.Now I noticed that I can't receive mails anymore, can't even tell since when."<alias>@<organization>.awsapps.com: hostinbound-smtp.eu-west-1.amazonaws.com[176.32.109.132] said: 550 5.1.1Requested action not taken: mailbox unavailable (in reply to RCPT TOcommand)"I tried searching for a solution for a typical "can send but not receive" and only saw that awsapps.com should work just fine. Typically problems seem to be around custom domains one way or another. I'm at a loss where to look :/Sincerely,akalkFollowComment"

Answer: "0Accepted AnswerHi akalk,I'm sorry to hear you're experiencing problems with receiving mail. I took a look at your account and it seem you do not have an active SES rule set. I can see you have 2 rules, 1 is called INBOUND_MAIL which is created by WorkMail and only contains a WorkMail delivery action. The second one has 2 actions, 1 for WorkMail and a second rule that does something else.In order to receive mail you need to have an active rule set that contains the WorkMail action (with the correct settings). Please enable either of these rule sets. If you enable the non WorkMail created rule set please make sure that the non WorkMail action works.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago"


Question: How to query data from dynamoDB table with multiple filter layers?

"I'm using AWS appsync API with lambda resolver. My question is how to add 2 separate filter when querying data from DynamoDB using direct lambda resolver?My app is a news app. It has a feed. I want to show content in that feed like mixture of News of native country + News with 100K+ views. My problem is if I add and operator, condition will be like: native country news AND news with 100k+ views it will filter out only native country new with 100K+ views. But I want to show both native country news as well as global news with 100k+ views. Secondly if I use OR operator then if one condition become true it will fetch that type of content but I want in every 15 post there should be 10 native country  news and 5 global news.My question is I want that both conditions should be satisfied separately? if we use AND operator it will limit one condition.FollowComment"

Answer: "0Accepted AnswerYou are in a situation where you need to separate query, as your limit based on the condition so a single dynamodb query can have a single limit parameterIt s an application solutionSimply run two parallel tasks retrieving 2 query and mix them upCommentShareOmid Eidivandianswered 9 months agoAmplify_lover 9 months agoWill it affect response time?Share"


Question: Work mail issue

Dear Teamwe are using Aws work mail  domains verify also done but only 50 are 100 mails only its going after that we are facing this errorYou are currently not allowed to send this e-mail. Please try again later.2022-02-04 08:10:56 : An error occurred while trying to deliver the mail to the following recipients:XYZ@gmail.comTechnical report:Final-Recipient: rfc822; XYZ@gmail.comFollowComment


Question: PHP SDK and  listObjectsV2

"I'm using the aws sdk to connect to an s3 bucket.  I have built an IAM Policy to allow read using   "s3:GetObject",  "s3:GetObjectAcl" and "s3:ListBucket" and I can use the AWS cli to view objects and list files.  When I use:    $file = $s3client->getObject([        'Bucket' => $bucket,        'Key' => $key,    ]);    $body = $file->get('Body');    $body->rewind();    echo "Downloaded the file and it begins with: {$body->read(26)}.\n";I can view file contents but when I try: $contents = $s3client->listObjectsV2([        'Bucket' => $bucket    ]);    echo "The contents of your bucket are: \n";    foreach ($contents['Contents'] as $content) {        echo $content['Key'] . "\n";I receive a super helpful error:Fatal error: Uncaught Error: Class 'SimpleXMLElement' not found in /var/www/html/vendor/aws/aws-sdk-php/src/Api/Parser/PayloadParserTrait.php:39 Stack trace: ....It goes on but I figure it's all trash so not continuing.I grabbed the code straight from: https://docs.aws.amazon.com/code-samples/latest/catalog/php-s3-s3_basics-GettingStartedWithS3.php.htmlAny suggestions on what is wrong?FollowComment"

Answer: 0sudo apt-get install php-xmlCommentSharenashkenanswered a year ago


Question: Incorrect documentation for Dimensions for GameLift metrics in CloudWatch

"Hi.FYI, In https://docs.aws.amazon.com/gamelift/latest/developerguide/monitoring-cloudwatch.html the Dimensions for GameLift metrics for MatchMaking are described as MatchmakingConfigurationName and  MatchmakingConfigurationName-RuleName, but in CloudWatch those are named ConfigurationName and ConfigurationName-RuleName.The following command lists the correct Dimensions:aws cloudwatch list-metrics --region us-east-1 --namespace "AWS/GameLift" Cheers.FollowComment"

Answer: 0Thanks for letting us know! We'll make an update soon.CommentSharerePost-User-1836907answered 2 years ago


Question: How to directly stream HLS to MediaStore from Raspberry Pi & ffmpeg

"Hi,I'm trying to stream HLS on a Raspberry Pi 4 via ffmpeg directly to MediaStore, without using MediaLive. At least, I've confirmed that Camstreamer can skip MediaLive and directly stream to MediaStore.My question:How can I directly stream HLS to MediaStore?Should I use PutObject API to write to MediaStore? (Only way?)How can I continuously do PutObject for HLS files (.ts files) that are generated continuously?This question seems to be related below and helped me a lot, but this didn't answer my above whole questions.Using Wowza Streaming Engine with MediaStorehttps://forums.aws.amazon.com/thread.jspa?threadID=330312&tstart=0Sample ffmpeg HLS generation (success)ffmpeg -f v4l2 -thread_queue_size 16384 -s 1920x1080 -vsync -1 -i /dev/video0 \-c:v libx264 -b:v 1000k -bufsize 1000k \-flags _cgop_loop-global_header \-bsf:v h264_mp4toannexb \-f segment -segment_format mpegts -segment_time 10 -segment_list live/channel.m3u8 live/segment%03d.tsThank you in advance for your help.FollowComment"

Answer: "0Hi KiyoKiyo!It sounds like you're looking for the simplest way to get the result of your ffmpeg transcode onto MediaStore. I can think of a few paths for you. Normally an encoder would be responsible for flinging segments as they're generated. For you, I think some assembly will be required. But, in a nutshell, you just treat it like S3. As your segments and manifests are created, either use the aws cli or your own custom code to move them one at a time into MediaStore.You will have the full set of MediaStore commands available to you via the AWS CLI.  Make sure that you configure an IAM user with the appropriate permissions and take note of their access key and secret access key.Another path would be to use the Botocore SDK for whatever your preferred programming language is. I suspect that on your Pi this will be the better way to go, as you will likely have to code your own solution for checking for new segments and manifests appearing and moving them into MediaStore as soon as possible.Let me know if I've understood your question properly and I'll be happy to provide any other clarifications.NateCommentShareAWS-User-7399595answered 2 years ago0Hi Nate,Thank you for your answer! I see, I'll treat MediaStore like S3 with AWS CLI, just keep putting ts files generated. Also look into Botocore SDK too for simplicity.You helped so much!KiyokiyoCommentShareKiyoKiyoanswered 2 years ago"


Question: DNS address could not be found

"Hello,I am facing a problem where my website’s DNS address cannot be found.What I have done:I have purchased a domain through Route 53 and use S3 buckets.I have followed this guide https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html#website-hosting-custom-domain-walkthrough-domain-registry and everything was followed.The provided website endpoint works as I can see my website and it functions correctly.The hosted zone is set with the guide and it has 4 records. 2 that get generated (haven't been touched) and 2 for my domain and subdomain.The record names and the bucket names match.The value/route traffic to the NS record name is:ns-1971.awsdns-54.co.uk.ns-506.awsdns-63.com.ns-769.awsdns-32.net.ns-1249.awsdns-28.org.The name servers of the domain are the samens-1971.awsdns-54.co.ukns-506.awsdns-63.comns-769.awsdns-32.netns-1249.awsdns-28.org(They were not but I changed them)When I try the test record without entering enting in record name the DNS response code shows No Error, however when I type in the exact same name in the record name I get Non-Existent Domain.So basically I have no idea where to go from here, please help.FollowCommentJoseph Gruber 6 months agoIf I'm understanding correctly, you're trying to create a record in Route 53 to point to your static website on an S3 bucket, is that correct? Is your S3 bucket named the same as the record your adding to Route 53 (e.g. my.site.com)?Share"

Answer: "0Only way someone can guide is, if you share output of your both test and also domain nameCommentShareMuhammadanswered 5 months ago"


Question: Does Route53 support .dev tld?

Does Route53 support .dev tld?FollowComment

Answer: "2Accepted Answeryou can check the following linkhttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.htmlas you can see currently route53 does not supportbut in the future maybe AWS Support. You can create a ticket or contact with support for this one,CommentShareEXPERTsdtslmnanswered 15 days agoumberto c 15 days agoThanks for the information. How can we request a service update or new feature like this from AWS team.Share1I don't think you can purchase .dev domains from Route53, but you can create a hosted zones for .dev domains. I use Route53 to run my personal blog which is a .dev domain.CommentSharehNZcvNgj2Oanswered 15 days ago"


Question: "Cert Renewal Fails Due to CAA mismatch, Can't Authorize Additional CA"

"I recently received an email that AWS failed to renew certificates for subdomains whose DNS is through Route53. The root domain uses a certificate from another authority.There is a mismatch in the CAA records because the current record is for the root domain which uses a certificate from the different certificate authority, so AWS fails to renew. Fine, I thought... I will just add the appropriate record to additionally authorize AWS.Now, research tells me that you cannot list multiple authorities in a single CAA record, and that the appropriate process is to create multiple CAA records.But:Route53 errors when attempting to create another CAA record for the root, complaining the record already exists (research says this actually should be valid).Route53 errors when attempting to create a CAA record for the specific subdomains under the AWS certificate, complaining that the subdomain.example.com CAA is in conflict with example.com CAA (research says this actually should be valid).So it seems that AWS Route53 implementation of CAA is bugged and it is not possible to renew my AWS certificates unless AWS can alter their own code. Please advise.FollowComment"

Answer: "0Thank you for the detailed analysis/description.CAA record type is supported in Route 53 while we might consider its format listed in doc [1], especially that the coexistence of  CAA and CNAME record with the same name is not allowed.For example via the Route 53 Console, creating a single CAA record to include all of the required CAs should be sufficient for ACM validation:More CAA record examples are available in https://docs.aws.amazon.com/acm/latest/userguide/setup-caa.html while I also find https://aws.amazon.com/premiumsupport/knowledge-center/acm-troubleshoot-caa-errors/ extremely helpful in understanding how CAA validation works in ACM.If the issue persists, please feel free to provide additional information for further discussion.[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#CAAFormatCommentShareweidianswered 8 months ago"


Question: How do I migrate a VM from VMWare ESXi to Lightsail?

"What would be the best way to migrate a VM that is currently on VMWare ESXi to a VM on Lightsail?I looked at the AWS Application Migration Service, but I don't think it has an option for a Lightsail migration, only EC2, am I correct?The VM in question is a Gitlab CE server (Ubuntu 20.04), and today runs on a local VMWare ESXi 6.5 server. I know I could create a new instance of a Gitlab server in Lightsail and do a backup/restore process, but that's a complex procedure (in my opinion, looking at the Gitlab documentation).I think about using Lightsail instead of EC2, due to my lack of knowledge with EC2 and because it is easier to estimate costs. And I also know that in the future with the VM being in Ligthsail, it's easy to switch to EC2.I wonder if there is a simpler way to do this?FollowComment"

Answer: "0You are correct that you cannot use AWS Application Migration Service (MGN) with Lightsail.....it only supports EC2. With Lightsail you have to select one of the images listed here. Ubuntu 20 is an option but you would need to manually configure Gitlab or use a launch script, you obviously would also need to restore your existing data...If you chose to use EC2 you could migrate your onprem VM using MGN or use a preconfigured Gitlab AMI and restore your data (this would be what I would do). The costs should be just as easy to estimate once you know the instance type you need.CommentShareEXPERTPeter_Ganswered a month ago0If you choose to migrate to EC2, there is also the option to use AWS Backup, where it will backup your VM and restore as EC2.CommentShareEXPERTVitor Euphrasioanswered a month ago0Its that way because Lightsail instances aren't freely configurable the way EC2 instances are.  See this Knowledge Center article for a breakdown on the differences.MGN, AWS Backup, VM Import/Export all work in the same basic way - they convert a VMware VM that is backed by a VMDK file to an AMI image that can be booted as an EC2 instance.  You can't provide your own custom AMI with Lightsail, you have to run one of the prebuilt bundles.  Constraints like that are one of the ways AWS is able to offer lower pricing for Lightsail vs. EC2 instances.You should also consider taking this opportunity to deploy Gitlab as a container instead of a full server.  That will make future portability simpler.CommentShareseahowanswered a month ago"


Question: RedShift Scheduled Query Failure Alerting Issues

"Hi Team,I am having issues while creating alerts for RedShift Scheduled Query.Service : AWS RedShiftRegion : us-east-1(N. Virginia).Exact Issue :When we schedule a query in RedShift there we can enable the monitoring and it will send alerts for all the triggered queries but, I want whenever a query fails it should alert us.Looking forward to hearing from you soon.Thanks & Regards,Abhisabhi8226@gmail.comFollowComment"

Answer: "0Amazon SNS topics attached to a scheduled query is currently designed to only send out notifications every time the query gets triggered, but do not come with the additional details (like query failure or success).To verify if a schedule query is a success or failure, we have the option to check (using CLI) as of now using redshift-data API 'describe-statement'. (https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_DescribeStatement.html)CommentShareCHELSEA IPanswered 10 months agoEXPERTJulia Beckreviewed 10 months ago"


Question: SMS messages sent via SNS are failing to be delivered to Vodafone customers in Qatar without delivery failure reports

"Dear AmazonWe are currently unable to send Transactional SMS messages to our customers who are using the Vodafone network in Qatar. We are not using a Sender ID for these messages.In the majority of cases, there are no delivery failures reported either, despite us turning this feature on (delivery reporting). We previously used to get errors when an SMS couldn't deliver, but now we don't.Of course, we can register a Sender ID. But the problem is that we should be getting delivery failures so that we know about the issue, instead of relying on communication between our account managers and customers to make us aware of the problem.If you need further information, I'm happy to provide it.ThanksFollowComment"

Answer: "0Depending on the destination phone number's carrier, it can take up to 72 hours for delivery logs to appear in the Amazon SNS console.[+] https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.htmlTo troubleshoot SMS delivery delays in Amazon SNS, you can refer the below article.[+] https://repost.aws/knowledge-center/sns-sms-delivery-delaysAlso, Kindly make sure for Success sample rate, specify the percentage of successful SMS deliveries for which Amazon SNS will write logs in CloudWatch Logs. For example:To write logs only for failed deliveries, set this value to 0.To write logs for 10% of your successful deliveries, set it to 10.If you don't specify a percentage, Amazon SNS writes logs for all successful deliveries.CommentShareMakendrananswered a month ago"


Question: EC2 Auto Scaling

"I need to set a auto scaling group and the requirement is , if CPU utilisation goes above 50% for 5 minutes then it should add New instance and if CPU utilisation drops below 50% for 5 minutes then it should  delete 1 instance.Please advise.FollowComment"

Answer: "1You will need to use step scaling to have control over both the alarms and number of instances added/removed (the amount the desired capacity will be changed by the policy).  Target tracking will dynamically decide how much capacity to add or remove based on the specific state of the group and metric at any given time; and does not allow you to customize the alarm settings.  So while target tracking does work very well for the majority of use cases, if you have a hard requirement for your environment to only add/remove 1 instance at a time with a 5 minute alarm, then it won't work for you.I highly recommend not setting both the scale-in and scale-out thresholds to 50% though, you should leave a gap between them to prevent oscillation.  For example: lets say you have 3 instances, and the CPU goes to 60%, triggering the +1 step scaling policy.  If the load stays constant, it will now be distributed to all 4 instances and the average CPU will drop to around 45% and the scale-in alarm will go off.  This will then keep happening in a loop until the load goes up or down enough for one of the alarms to stay in the alarm state and the ASG reaches the min or maxCommentShareShahad_Canswered a year agoRodney Lester a year agoAlso, best practice is to scale up fast, and scale down slow. You don't want to be stuck where you need the instance you just removed.Share0Hi, you could use ASGAverageCPUUtilization to "Create a target tracking scaling policy (console)" as per https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html#available-metricsYou could create a scale-out and scale-in depending on the CPU utilisationCommentShareSrianswered a year agoShahad_C a year agoTarget tracking doesn't allow the alarms or scaling amounts to be customized, so it wouldn't meet the requirementsShare"


Question: Adding Hive and beeline client on AWS MWAA

"Hi all,I am using HiveOperator to execute a query on EMR  cluster using beeline client from AWS MWAA. Rather than adding a step on EMR, I want to hit the Hive Query directly using HiveOperator from AWS MWAA. But due to missing binaries on MWAA, it says no such beeline directory. Please see the below dag code and  stack trace.Sample Code (The below code works fine with our airflow installed on EKS)hive_direct_task = HiveOperator(task_id='hive_direct_task',hive_cli_conn_id='hive_emr_dag_connection',hql='CREATE TABLE XXXX.XXXX STORED AS ORC AS SELECT DISTINCT * from XXXX.XXXX limit 2'){{logging_mixin.py:112}} INFO - Running %s on host %s <TaskInstance: spark_hive_ssh_dag.hive_direct_task > ip-XXXX.ec2.internal{{hive_operator.py:121}} INFO - Executing: CREATE TABLE XXXX.XXXX STORED AS ORC AS SELECT DISTINCT * from XXXX.XXXX limit 2{{hive_operator.py:136}} INFO - Passing HiveConf: {'airflow.ctx.dag_email': 'XXXX@XXXX.com', 'airflow.ctx.dag_owner': 'airflow', 'airflow.ctx.dag_id': 'spark_hive_ssh_dag', 'airflow.ctx.task_id': 'hive_direct_task', 'airflow.ctx.execution_date': '2020-12-09T18:03:28.344312+00:00', 'airflow.ctx.dag_run_id': 'manual__'}{{taskinstance.py:1150}} ERROR - No such file or directory: 'beeline': 'beeline'Traceback (most recent call last):File "/usr/local/lib/python3.7/site-packages/airflow/models/taskinstance.py", line 984, in _run_raw_taskresult = task_copy.execute(context=context)File "/usr/local/lib/python3.7/site-packages/airflow/operators/hive_operator.py", line 137, in executeself.hook.run_cli(hql=self.hql, schema=self.schema, hive_conf=self.hiveconfs)File "/usr/local/lib/python3.7/site-packages/airflow/hooks/hive_hooks.py", line 258, in run_cliclose_fds=True)File "/usr/lib64/python3.7/subprocess.py", line 800, in initrestore_signals, start_new_session)File "/usr/lib64/python3.7/subprocess.py", line 1551, in _execute_childraise child_exception_type(errno_num, err_msg, err_filename)FileNotFoundError:  No such file or directory: 'beeline': 'beeline'Similar to this, If I want to use HDFSSensor, it will require hadoop/hdfs client. and many-more like this.Talking about my on premises airflow setup on EKS, We added all the binaries (hive, hadoop, hdfs) by keeping the base image - Apache Airflow. The same code works fine, whenever queried from Airflow to EMR using HiveOperator.Does MWAA support integrations to AWS Services only? Like EMR ClusterLaunch, EMR AddStep, AthenaOperators etc.Can I Achieve the above use case with AWS MWAA?  Till now I have explored everything and I am unable to find a way to add the binaries on MWAA.If the above usecase is possible, please let us know how can I add the binaries in MWAA.Thanks,Neeraj Vyas (Data Engineer)Neerajvyas615@gmail.comEdited by: NeerajVyas on Dec 13, 2020 1:37 AMEdited by: NeerajVyas on Dec 13, 2020 1:39 AMFollowComment"

Answer: "0Hi!Amazon MWAA limits the number of binaries installed on the worker images in order to ensure a small enough image size for reasonable performance.  As such, some operators may not be available, for example those that depend on the Java runtime.One possible workaround is to leverage an external container and the ECS_Operator or kubernetesPodOperator to run your commands on custom images.  Another alternative, if running on EMR, is to use the PythonOperator with the boto3 library for more fine-grained control on the EMR commands.Thanks!CommentShareJohn_Janswered 2 years ago"


Question: AWS EC2 Class Load Balancer Retiring question

"Can we confirm if all EC2 Classic Load Balancers will be retired after Aug 15, 2022?Per this AWS Blog post https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/ it says that the EC2 Classic Load Balancer will be retiring on August 15, 2022.It also seems to indicate that there are 2 types of EC2 Classic Load Balancers.  The first being the first generation.  The second being the one with VPC.I wasn't sure if both of those are going to be retired or just the first one.I have projects using EC2 Classic Load Balancers with VPC so I want to make sure I'm ok and that I don't have to do any migration.FollowComment"

Answer: "2What will be retired is EC2-Classic Network, not Classic Load BalancerIt is the default network mode very long ago when VPC did not even exist.First, if your account was created after 2013-12-04, you can't even launch EC2-Classic, so it doesn't affect you.If your account was created before that, you can see if your EC2 is running on EC2-Class Network by looking at the VPC ID of the instance. If there is no VPC ID, then it's the classic one.You can also use the tools to search for EC2-Classic resources: https://github.com/aws-samples/ec2-classic-resource-finderRef: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-classic-platform.htmlCommentShareRichardFananswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: What's the best way to filter out duplicated records in a Glue ETL Job with bookmarking enabled?

"I have an etl pipeline that loads json data from a source bucket, runs an etl job with bookmarking enabled, and writes as parquet to a target bucket.I'd like to ensure that the target bucket never contains duplicate records, what's the best way to achieve that?My json records have a "requestid" field that's unique.FollowComment"

Answer: "0If I understand well, you are afraid that some of the new files (the old one are filtered out by the bookmark) contain duplicates, is my assumption correct?If that is correct you could have a couple of different approaches:If you want to remove duplicate based on the entire row (all columns match) you can use spark distinct() functionIf you want to remove rows that are duplicated based on matching your key, but you are not interested in getting a specific row you can use the spark function dropDuplicates()In case you have another column that you could use to find the row you want to keep (for example a datetime column with last_updated values), you could use the spark window function row_number() partitioning by your key and ordered by the datetime column desc and then keep only the row with rownum=1.for example on the first 2 points you can look here.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agoborg a year ago@fabioaws ok that makes sense, I also realized I could just filter out dupes within athena? I built my first and fully automated etl pipeline so still grokking a few concepts. I understand now that using bookmarking the input data is only a subset, so I can't filter against the full target data source without querying it and then running .distinct()/filter() etc? Seems like that may be overkill or inefficient vs filtering it out within athena or quicksight itself?Thanks!Share"


Question: Athena Iceberg delete failing

"I am trying to perform a fairly simple delete via Athena on a table defined with the tabletype of Iceberg.delete from emaildelivery where uniqueid in (select b.uniqueid from deletestaging b)The following error message is returned.GENERIC_INTERNAL_ERROR: Invalid descendant for DeleteNode or UpdateNode: com.facebook.presto.sql.planner.plan.JoinNodePerforming the query with values directly in the query is successful.delete from emaildelivery where uniqueid in ('6e41279b-a22d-4bad-ad8d-448625ae9d88','2831e5a1-8a5c-424f-8d07-198a57f6a04a')The same query as a select works successfully.select uniqueid from emaildelivery where uniqueid in (select b.uniqueid from deletestaging b);Any assistance with resolving the issue with the delete query is greatly appreciated.FollowComment"

Answer: "1Is there any update on this? I am currently stumbling on the same problem while testing Iceberg, and this is a key feature for our PoC.CommentShareaudigent-davideanswered a year ago0Hello, Thank you for brining on to the notice, Currently, this is a known issue only for DELETE and UPDATE. Athena Service team is actively working on it.CommentShareHarsha_Tanswered a year ago0Is there additional information related to when there will be a resolution to this issue?CommentShareAWS-User-2264092answered 9 months ago0I had the same issue. The workaround which I found works for me is to use merge into .. with delete statement when there is a match.E.g. first create a table with the record ids that need to be deleted (emailtodelete). Then use it to delete the data from the original table.MERGE INTO emaildelivery t USING emailtodelete sON (t. uniqueid = s. uniqueid)WHEN MATCHED THEN DELETECommentShareMikeWanswered 4 months ago"


Question: modifying an amazon rds db instance type with lambda

upgrade and downgrade rds instance type to using lamda functionsFollowComment

Answer: "1Hi,you could:use the ModifyDBInstance operation to modify a DB instance by using the Amazon RDS API ( https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBInstance.html).use the SDK https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-rds/And add your code in your lambda function, which must be in a VPC.Hope it helps ;)CommentShareEXPERTalatechanswered a month agosdtslmn EXPERTa month agoIn addition to @alatech's commentNote that upgrading or downgrading the instance type may require some additional configuration changes, such as modifying the DB parameter group or adjusting the allocated storageShare"


Question: AWS Batch: How to enable metrics on EC2 auto scaling groups?

AWS Batch creates auto scaling groups for managed EC2 compute environments. I would like to monitor the auto scaling behavior but these auto scaling groups are created with CloudWatch metrics disabled.I have not found a way to configure a compute environment such that its auto scaling groups get created with metrics enabled. Is there a way to do this?FollowComment

Answer: "0Hello,Interesting question !!For Autoscaling Groups, AWS does collect metrics for the instances within an autoscaling group.By default, basic monitoring is enabled for the autoscaling group. If you want detailed CloudWatch monitoring, you can enable that as well in the launch template: https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#advanced-settings-for-your-launch-template.More information here: https://docs.aws.amazon.com/autoscaling/ec2/userguide/enable-as-instance-metrics.htmlFrom there, you can then look at both Autoscaling metrics and EC2 metrics: https://docs.aws.amazon.com/autoscaling/ec2/userguide/viewing-monitoring-graphs.htmlThe metrics you see at the autoscaling group level will be aggregated for the ec2 instances within the autoscaling group and can be viewed here: https://console.aws.amazon.com/ec2autoscaling/Hope this helps !!CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoRalf J 9 months agoIf I understand you correctly then you are saying that setting detailed_monitoring=True in the launch template (https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/LaunchTemplate.html) that I pass to a Batch's ComputeResource (https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_batch_alpha/ComputeResources.html) should cause the auto scaling group created by Batch to have auto scaling group metrics enabled.  I just tried it and did not observe that behavior (auto scaling group metrics are still disabled).ShareRalf J 9 months agoTo be clear, the metrics I am interested in are GroupDesiredCapacity, GroupStandbyInstances, etc, described here:https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-cloudwatch-monitoring.htmIs it possible to configure AWS Batch so that it will create the auto scaling group for its compute environment with these metrics enabled?Share"


Question: Process hangs when running on batch

"Hey,I'm running my code on aws batch and after finishing code similar to below, it hangs. with Pool(processes=6) as pool:    pool.starmap(self.some_function,[[...] for ind,x in enumerate(list)])When running it on my computer, there is no problem.it seems that the configurations on my machine and on batch are the same.Is there a known problem about running multiple processes on ecs?FollowComment"

Answer: 0It was insufficient resources. starmap does not alert about that.CommentShareNetanelanswered 3 years ago


Question: How to change browser tab headers for website hosted on S3

"I have a website through S3 with a Cloudfront distribution in front of it. The title of the tab for the website homepage has the domain title, but the title of every page just says "Document." How can I change this so that each page of my website shows the domain title in the browser tab title?FollowComment"

Answer: "1The title of the browser tab for any web page is determined by the following:If the web page contains a <title></title> tag pair, then the text between those tags will become the title of the browser tab.If the web page does not contain a <title></title> tag pair, then the default title kicks in, which is the domain name of the website.If you are getting "Document" as the title of the browser tab, that means the web page specifically contains "Document" within the <title></title> tag pair, like: <title>Document</title>You can view the HTML source of the web page to verify this.In short, having a CloudFront distribution in no way changes the web page's title that appears in the browser tab. Hence, to have the domain name in the browser of any web page, ensure that the web page does not contain the <title></title> tag pair.CommentShareAWS-CPLEEanswered a year ago"


Question: Problem starting Docker image as lambda function source

"I am trying to use a container image as the source for a lambda, but am not able to start the container.No matter what I set the CMD to, I get entrypoint requires the handler name to be the first argumentMy Dockerfile looks something like:FROM public.ecr.aws/lambda/python:3.8COPY requirements.txt .RUN pip install -r requirements.txtCOPY custom_module ${LAMBDA_TASK_ROOT}COPY app.py ${LAMBDA_TASK_ROOT}CMD \[app.lambda_handler]The function to run in app.py is definitely called lambda_handler, and I've run out of things to change.Anyone have any thoughts?Edited by: arogers on Jan 29, 2021 4:52 PMFollowComment"

Answer: "0arogers wrote:I am trying to use a container image as the source for a lambda, but am not able to start the container.No matter what I set the CMD to, I get entrypoint requires the handler name to be the first argumentMy Dockerfile looks something like:FROM public.ecr.aws/lambda/python:3.8COPY requirements.txt .RUN pip install -r requirements.txtCOPY custom_module ${LAMBDA_TASK_ROOT}COPY app.py ${LAMBDA_TASK_ROOT}CMD \[app.lambda_handler]The function to run in app.py is definitely called lambda_handler, and I've run out of things to change.Anyone have any thoughts?Edited by: arogers on Jan 29, 2021 4:52 PMarogers wrote:I am trying to use a container image as the source for a lambda, but am not able to start the container.No matter what I set the CMD to, I get entrypoint requires the handler name to be the first argumentMy Dockerfile looks something like:FROM public.ecr.aws/lambda/python:3.8COPY requirements.txt .RUN pip install -r requirements.txtCOPY custom_module ${LAMBDA_TASK_ROOT}COPY app.py ${LAMBDA_TASK_ROOT}CMD \[app.lambda_handler]The function to run in app.py is definitely called lambda_handler, and I've run out of things to change.Anyone have any thoughts?Edited by: arogers on Jan 29, 2021 4:52 PMarogers wrote:I am trying to use a container image as the source for a lambda, but am not able to start the container.No matter what I set the CMD to, I get entrypoint requires the handler name to be the first argumentMy Dockerfile looks something like:FROM public.ecr.aws/lambda/python:3.8COPY requirements.txt .RUN pip install -r requirements.txtCOPY custom_module ${LAMBDA_TASK_ROOT}COPY app.py ${LAMBDA_TASK_ROOT}CMD \[app.lambda_handler]The function to run in app.py is definitely called lambda_handler, and I've run out of things to change.Anyone have any thoughts?Edited by: arogers on Jan 29, 2021 4:52 PMHey arogers,Here is what I have as a Dockerfile that is working for me, this may work for you too. However, I'm currently having issues with OpenCV.FROM public.ecr.aws/lambda/python:3.8    COPY requirements.txt ./    RUN pip install --upgrade pip  RUN pip install -r requirements.txt    COPY . ./  CMD \[ "app.handler" ]  Edited by: samatvery on Feb 3, 2021 12:23 PMEdited by: samatvery on Feb 3, 2021 12:23 PMCommentSharesamatveryanswered 2 years ago0Can you please try placing your app.handler inside quotes ["app.handler"] instead of keeping it without quotes [app.lambda_handler] ?I believe docker needs between double quotes and it worked for me.CommentShareharshit-intellicaanswered 2 years ago0Hi @samatvery, I tried customising the base image but it always fails, refer to my stackoverflow question here:  https://stackoverflow.com/questions/66369212/aws-lambda-is-unable-to-find-app-handler-custom-docker-imageCommentShareharshit-intellicaanswered 2 years ago"


Question: Enforce FindIncrementalMatches in AWS Glue to use existing match_id

"The use case is that we have an incremental source of data from which we need to identify the matching records. For this purpose, we are running Find Matches using AWS Glue 2.0.Result after Find Matches is RunWhen I run FindMatches on the initial source, the following result is generated against the source. Note the match_id generated for each recordResult after Find Incremental Matches is RunWhen I run FindIncrementalMatches using the above result of Find Matches as the existing source, the following result is generated with completely different Match IDs:QuestionIs there a way to enforce FindIncrementalMatches in AWS Glue to use existing match_id while processing matches from an incremental source?Important linksWe've followed the steps described in the following link:AWS Blog - Incremental Data MatchingFollowComment"

Answer: "0Accepted AnswerI understood that you wanted Glue to use the same match_id's for subsequent FindIncrementalMatches runs for incremental data.Please note that the match_id's are arbitrary identifier which act as labeling for your data and it denotes the matching records which is predicted by your ML transform Algorithm. In case of incremental data the datasets is changing overtime and new or or modified records are being added thus there are now more candidate rows taken to be consideration by the machine learning model to decide the pairing and it is possible to have new match_id as it starts labeling from scratch, just like you provided as in the example. Unfortunately in Glue we do not have any option to enforce the previously generated match_id's to put it in use for the subsequent FindIncrementalMatches runs for incremental data as of now.CommentShareSUPPORT ENGINEERShubhanswered 10 months agofahadqadeer 10 months agoThank you for the response. I have a follow-up question that there is a field with the key: "enforcedMatches" in FindIncrementalMatches. What is the purpose of this field?It is mentioned in "https://docs.aws.amazon.com/glue/latest/dg/glue-etl-scala-apis-glue-ml-findincrementalmatches.html" but there is no implementation example for this.Share"


Question: Aurora Replica Sizing vs. Source DB Sizing - Do they need to match?

"Question from customer:We currently run Aurora with the following sizing:primary: db.r4.16xlargereplica-a: db.r4.8xlargereplica-b: db.r4.8xlargereplica-c: db.r4.8xlargereplica-d: db.r4.16xlarge <-- failoverIn this documentation link, we saw this paragraph:"For replication to operate effectively, each Read Replica should have as the same amount of compute and storage resources as the source DB instance. If you scale the source DB instance, you should also scale the Read Replicas."However, we couldn't find anything similar written in the Aurora docs.Are there any guidelines on primary/replica sizing for Aurora MySQL? Do they need to be the same instance size?UpdateFollow-up question from customer:Would it simply be a performance impact when failover happens (i.e.primary fails and the highest failover replica gets promoted)? Or wouldit have any impact during normal replication?FollowComment"

Answer: "0Accepted AnswerUpdate Follow-up question from customer:Would it simply be a performance impact when failover happens (i.e. master fails and the highest failover replica gets promoted)? Or would it have any impact during normal replication?Answer:Since Amazon Aurora Replicas share the same data volume as the primary instance in the same AWS Region, there is virtually no replication lag. We typically observe lag times in the 10s of milliseconds.How far behind the primary will my replicas be?: https://aws.amazon.com/rds/aurora/faqs/By design, the replication asynchronous. So, the replica lag varies depending on the rate of database change. That is, during periods where a large amount of write operations occur for the database, you might see an increase in replica lag. Because we have to send the same log changes (Redo Logs) to Read replica to update the cache. If there are too many changes you might see a lag than expected. This does not depend on the which instance class you are using for Read Replica.Re-invent Video: https://youtu.be/duf5uUsW3TM?t=422Now, by having the smaller instance class for read replica:1.) You might see lot of queries might be doing physical read (Read IOPS increase) instead of logical read.2.) You might see a performance impact when failover happens to a Read Replica because it has less resources (CPU, Memory, etc. )CommentShareVijayKanswered 4 years ago"


Question: Network error: Failed to fetch

The database looks OK but starting from tonight no communication from any clientAny ideas on what should I do to fix it?FollowComment

Answer: 0the image was downCommentShareAWS-User-1160541answered a year ago


Question: Our request for SES production access getting denied. Case id: 9467358421

"We provided all of answers following aws documentation how to our from the sandbox, but still can't get out of a sandbox. That is really important question, we need help with that.FollowComment"

Answer: "0I've found that my initial request is almost always denied, and I need to follow up with more info.  They've been getting more and more stringent over time about what they require for prod access.  If they denied you, they should have given you a reason, and providing that here could help guide the answers.  But, in general, the big things I've seen denied in the past are:Vague usage detailsNo verified domain/email addressNo bounce/complaint handling details (even if manual)No website url providedNo example email providedSES production access already enabled in another regionThat said, I've found it helpful to include info this way:Specify exactly what is being sent.  Example: “This system does not send unsolicited emails.  Only for password resets and account sign-ups, so the correspondence, as well as bounces, complaints, etc., should be limited.  Our process for bounces and complaints will be manual, and will be processed by monitoring a mailbox and disabling/removing them in the application as needed.”Include the website url (even a temporary or staging one, if needed)Also, the turnaround time can be a little slower than it used to be, so you'll be contending with that as well.  Just make sure to include as much info as possible, and be sure to read their replies carefully to make sure you're addressing everything they describe.CommentSharedozenyommeranswered a year agoHeidi22 a year agoHm, thanks for your answer, but even for the questions from your answer, we have all answers in our caseShare"


Question: Guide to creating an instance role that will allow my App Runner service to use values from SSM Parameter Store?

"I have an existing App Runner service. In the 'Security' configuration section of my service, the 'Instance role' is blank.  All is good, but....I want to add a new environment variable to my service that uses a 'SSM Parameter Store' source. Doing so seems to make the 'Instance role' field required - just leaving it blank is no longer an option. However, when I click on the drop-down there are no roles listed.So, I assume that I need to create an instance role in IAM.  I've tried doing that, but I'm really confused. I've tried various ways of creating a new role, but none of them feel quite right, and the 'Instance role' continues to remain empty (even after refreshing).Is there a simple walkthrough guide that explains how to create (using the AWS web console) the instance role that will allow my App Runner service to use values from the SSM Parameter Store?FollowComment"

Answer: "0Accepted AnswerI didn't work out how to create the instance role that I needed using the web console.  However, I was able to take the CloudFormation template from Hari's response and tweak it to fit my needs.CommentShareSimonanswered 3 months ago0Hi @Simon,You need to provide this as a trust policy for a App Runner instance role, then this new role would start showing up in the App Runner console{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": "tasks.apprunner.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}Once you have the new role, just make sure to assign the required permission to read data from SSM parameter store. Here is a blog that talks about this integration with a sample app that you can try it out - https://aws.amazon.com/blogs/containers/aws-app-runner-now-integrates-with-aws-secrets-manager-and-aws-systems-manager-parameter-store/. Hope this helps, let us know if you have any further questions. thanksCommentShareHarianswered 3 months agoSimon 3 months agoThanks for your reply @Hari. It didn't tell me how to an instance role using the web console, but budged me towards a solution.Share"


Question: "Lambda provisioned concurrency for $LATEST, or, updating API gateway to refer to version"

"Dear Experts,I have API gateway and Lambda working happily, without using any versions or aliases. I'd now like to enable provisioned concurrency.It seems that I cannot configure provisioned concurrency for $LATEST - is that correct? (Can I maybe enter "$LATEST" in the Alias field in the provisioned concurrency set up box?)Assuming that I cannot do that, what's the best, simplest way to move forward? Let's say that I publish a new version now and enable provisioned concurrency for that version. Until I next upload code, $LATEST == this version - so do invocations from API gateway use the provisioned concurrency?My guess is no, and that I need to update my API gateway configuration to refer to either this published version of the function, or to refer to a named alias which I need to create and make refer to this version.I do not find the API Gateway console particularly clear. It has an "Integrations" page which refers to my lambda function by name, but there doesn't seem to be a field on that page where I can set the version or alias of the function. Similarly if I create a new integration I can choose the function by name, but not select a version or alias. Do I somehow configure this from the Lambda end?Any advice would be much appreciated.Thanks, Phil.FollowComment"

Answer: "0We're having the same issue. Lodging a support ticket, but following here as well.CommentSharedternyakanswered a year ago0We ran into a similar issue with a hitting an API Gateway WebSocket API, where the requests were being routed to a Lambda that had an established Alias with provisioned concurrency setup. After deployment, we realized none of the requests were being handled by the provisioned lambda instances.As you suspect, the issue was that our WebSocketApi routes were configured to point directly at the ARN of the Lambda we created, and not the ARN of the alias (or version), which is referred to as the "qualified" ARN.To correct this in the Console, in the Integration settings, where it specifies the name of the Lambda you're targeting, you can append the version or alias to the function name using a colon.For example, with a function named lambda_worker and an alias named current you would specify:lambda_worker:currentYou can then setup provisioned concurrency on that lambda alias and the routed requests should be handled by your provisioned instances.CommentShareZachanswered a year ago0In the console you can select from the list of functions and that will actually refer to the $LATEST version. Alternatively, you could just put the full function ARN, including the alias (e.g., arn:aws:lambda:REGION:ACCOUNT:function:FUNCTION-NAME:ALIAS-NAME) and that will work as well.Saying that, I would recommend not using the console but rather use infrastructure as code tools such as SAM, CloudFormation, CDK, Terraform, etc.CommentShareEXPERTUrianswered a year ago0Thanks for the answers everyone.I've just noticed that in the "create alias" form, I appear to be able to create an alias that refers to $LATEST. If I do this, will I be able to configure provisioned concurrency for that alias? Will it continue to refer to the new $LATEST when I upload a new version?CommentSharePhil Endecottanswered a year ago0Answering that last point - I see that there is a note "Can't assign an alias with provisioned concurrency to $LATEST" if you try to do that.CommentSharePhil Endecottanswered a year ago0To summarise:It's correct that you can't have provisioned concurrency for $LATEST.You need to publish new versions after each update.You can create an alias, which you need to update to refer to the newest published version each time.The alias can have provisioned concurrency.In API Gateway, you can paste the ARN of the alias in the integration target. (You may also be able to type lambda-name:alias, but I've not tried that.)Thanks for the comments everyone.CommentSharePhil Endecottanswered a year ago"


Question: How to create a no-internet access (private) subnet?

"Points of My Scenario:I tried to create 3 private subnets (subnets without an internet gateway) so that EC2 instances would be unable to access InternetI used the procedure in AWS document https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-subnets.htmlUpon completion, I checked the route table for each subnet...Alas! Each one had destination 0.0.0.0/0 associated with the default igw-<GUID>: just like the other system-generated subnets.Question: why is this happening and how can I create truly private subnets?FollowComment"

Answer: "3Accepted AnswerIn your VPC is a default route table. The instructions on that page don't mention it but if you don't assign a specific route table to a subnet the default is used. In your case, the default route table has a route to the Internet Gateway.To fix this, create a new route table in your VPC and assign it to the private subnets.CommentShareEXPERTBrettski-AWSanswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months agowaltforbes 6 months agoOMG! That's it! That works! A bundle of thanks, Brettski-AWS!Share"


Question: QuickSight-Athena Query Error

"[Simba]AthenaJDBC An error has been thrown from the AWS Athena client. Amazon Athena experienced a permission error. Please provide proper permission and submitting the query again. If the issue reoccurs, contact AWS support for further assistance. You will not be charged for this query. We apologize for the inconvenience.Please I need your help. I have created a new bucket in the region which is empty and have even gone empty the other bucket. Yet the same errror.FollowComment"

Answer: 0Are you seeing this error when QuickSight is refreshing data from Athena?Have you checked these resources?https://docs.aws.amazon.com/quicksight/latest/user/troubleshoot-connect-athena.htmlhttps://docs.aws.amazon.com/quicksight/latest/user/athena.htmlCommentShareRajesh Sanswered 10 months ago


Question: ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role found

"I'm starting to get the following errors in the aws-ssm-agent.log file.  The errors seem to happen and last for 10-15 minutes, during which time my application stops working and I get the error message "Unable to reach credentials server".  It's using an instance role so when this happens no aws service on this server works.Ubuntu 18.04.5 LTSamazon-ssm-agent version: 3.0.1124.0Not Docker2022-01-25 23:03:05 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": read tcp 10.1.3.220:43346->169.254.169.254:80: read: connection reset by peer2022-01-25 23:03:05 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:08 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:03:08 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:10 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": read tcp 10.1.3.220:46762->169.254.169.254:80: read: connection reset by peer2022-01-25 23:03:10 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:12 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": read tcp 10.1.3.220:48406->169.254.169.254:80: read: connection reset by peer2022-01-25 23:03:12 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:14 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": read tcp 10.1.3.220:49960->169.254.169.254:80: read: connection reset by peer2022-01-25 23:03:14 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:17 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:03:17 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:19 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:03:19 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:21 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:03:21 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:23 ERROR [ssm-agent-worker] [MessagingDeliveryService] error when calling AWS APIs. error details - GetMessages Error: EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": read tcp 10.1.3.220:55810->169.254.169.254:80: read: connection reset by peer2022-01-25 23:03:23 INFO [ssm-agent-worker] [MessagingDeliveryService] increasing error count by 12022-01-25 23:03:26 ERROR [ssm-agent-worker] [MessagingDeliveryService] MessagingDeliveryService stopped temporarily due to internal failure. We will retry automatically after 15 minutes2022-01-25 23:05:00 ERROR [ssm-agent-worker] [MessagingDeliveryService] [Association] error when calling AWS APIs. error details - EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:05:00 INFO [ssm-agent-worker] [MessagingDeliveryService] [Association] increasing error count by 12022-01-25 23:05:01 ERROR [ssm-agent-worker] [MessagingDeliveryService] [Association] error when calling AWS APIs. error details - EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:05:01 INFO [ssm-agent-worker] [MessagingDeliveryService] [Association] increasing error count by 12022-01-25 23:05:01 ERROR [ssm-agent-worker] [MessagingDeliveryService] [Association] Unable to load instance associations, unable to retrieve associations unable to retrieve associations EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:05:33 INFO [ssm-agent-worker] [HealthCheck] HealthCheck reporting agent health.2022-01-25 23:05:33 ERROR [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:05:33 INFO [ssm-agent-worker] [HealthCheck] increasing error count by 12022-01-25 23:05:33 ERROR [ssm-agent-worker] [HealthCheck] error when calling AWS APIs. error details - EC2RoleRequestError: no EC2 instance role foundcaused by: RequestError: send request failedcaused by: Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": EOF2022-01-25 23:05:33 INFO [ssm-agent-worker] [HealthCheck] increasing error count by 1FollowComment"


Question: Cost of autoscaling endpoint Amazon SageMaker endpoint to zero

I want to use an Amazon Sagemaker endpoint for a custom classification model. The endpoint should only handle sporadic input (say a few times a week).For this purpose I want to employ autoscaling that scales the number of instances down to 0 when the endpoint is not used.Are there any costs associated with having an endpoint with 0 instances?Thanks!FollowComment

Answer: "2Accepted AnswerYou dont pay any compute costs for the duration when the endpoint size scales down to 0. But i think you can design it better. There are few other options for you to use in SageMaker Endpoint(assuming you are using realtime endpoint)Try using SageMaker Serverless Inference instead. Its purely serverless in nature so you pay only when the endpoint is serving inference. i think that would fit your requirement better.You can think of using Lambda as well which will reduce your hosting costs. but you have to do more work in setting up the inference stack all by yourself.There is also an option of SageMaker asynchronous inference but its mostly useful for inference which require longer time to process each request. The reason i mention this is it also support scale to 0 when no traffic is coming.CommentShareEXPERTVikesh_Panswered 7 months agorePost-User-3310359 7 months agoThanks for your answer!As I understand it I could also use "SageMaker Batch Transform inference" (given I have the inputs saved in s3 bucket), and that will save my predictions automatically to a s3 output bucket. Do you think that interference type could also be useful for this use case?Share"


Question: .NET 6 MVC (C#) app not deploying .ebextensions on elastic beanstalk host

"I'm having trouble with my .ebextensions files deploying with my .NET application to my elastic beanstalk environment. I've verified the yaml, even using some test code to simplify things.commands:  create_test_file:    command: "echo 'This is a test file' > /tmp/test.txt"Directory & file is included in the publish zip file (file is copy always). When I publish, the above test.txt file is not created (nor any other configurations have worked). I also don't see anything in the logs references ebextensions. I'm publishing with the AWS toolkit "Publish to AWS Elastic Beanstalk...", all other changes do get deployed (i.e. code changes), just not .ebextensions.Edit:Tested another configuration file in my .ebextensions folder and it seemed to work, but for a different path:files:    "/etc/httpd/conf.d/filelimit.conf":        mode: "000755"        owner: root        group: root        content: |            LimitRequestBody 102400Copied that file and created a second .conf file:files:    "/etc/nginx/conf.d/proxybuffer.conf":        mode: "000755"        owner: root        group: root        content: |            proxy_buffer_size 256kAnd this one did NOT work. Then I modified the same file to change nginx to httpd to drop this same file in that folder, and it worked.So it's something to do with /etc/nginx - looking at permissions all of the folders have the same drwxr-xr-x (755), so that doesn't seem to be it. Is there some additional protection on the nginx folder? Going to maybe try putting the file in source and copying it.FollowComment"

Answer: "0Accepted AnswerResolved:For some reason using .ebsettings and yaml did not work only for the nginx conf.d folder. Was really strange, never got to the bottom of why. It would create and/or copy files to other folders no problem.Solution:Added a .platform folder to the root of my .net project. .platform\nginx\confd\nginx-proxybuffers.conf containing the nginx config modifications. That worked for some reason. Problem solved for folks who may have this problem in the future.CommentSharerePost-User-0898075answered a month ago"


Question: Recovering IP Address for A Record

"I'm working to install an https cert on my site, and changed both my wildcard and www A record for my site, hosted on Lightsail / Route 53. Is there a Route 53 preference pane where I can recover the original A record information to put back in place?FollowComment"

Answer: "0Hello Devin,From the Route53, there is no such option to retrieve/see the previous value of the record. However, you can use the Cloud Trail to view the any changes happened to the Route53 records.Back in days, I think I have used the following event name "ChangeResourceRecordSets" to view the change logs.https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.htmlRegards,CKCommentShareChethan SEanswered 10 months ago"


Question: Light Sail Server not working

How do i get my Lightsail server to work properly I get prompted to put in the server details however I am getting an error with the details that were provided in my instance.FollowComment

Answer: "0What specific settings did you try to start with?Also, would it be possible for you to share the full text of the error that appears at startup?CommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: Failed to stabilize Instance with id

"I have this problem: Failed to stabilize Instance with id. My CF looks like:Resources:DocumentDBSecurityGroup:Type: AWS::EC2::SecurityGroupProperties:GroupName: 'DocumentDB SG'GroupDescription: !Sub 'Security Group for the DocumentDb'VpcId: !Ref VPCDocumentDBSubnetGroup:Type: AWS::DocDB::DBSubnetGroupProperties:DBSubnetGroupDescription: "Subnet group for Document DB cluster"DBSubnetGroupName: "document-db-subnet-group"SubnetIds: !Ref PrivateSubnetIdsDocumentDBParameterGroup:Type: AWS::DocDB::DBClusterParameterGroupProperties:Description: "Parameter group for Document DB cluster"Family: docdb4.0Name: "document-db-paramater-group"Parameters:audit_logs: "disabled"DocumentDBCluster:Type: AWS::DocDB::DBClusterProperties:BackupRetentionPeriod: 7DBClusterIdentifier: "docdb"DBSubnetGroupName: !Ref DocumentDBSubnetGroupDBClusterParameterGroupName: !Ref DocumentDBParameterGroupPort: 27017PreferredBackupWindow: "07:00-09:30"PreferredMaintenanceWindow: "tue:07:00-tue:11:00"VpcSecurityGroupIds:- !Ref DocumentDBSecurityGroupStorageEncrypted: trueDocumentDBInstance:Type: AWS::DocDB::DBInstanceDependsOn:- DocumentDBClusterProperties:DBClusterIdentifier: !Ref DocumentDBClusterDBInstanceClass: db.t3.mediumDBInstanceIdentifier: "docdb"PreferredMaintenanceWindow: "tue:07:00-tue:11:00"If i search this problem i find information about RDS (snapshot), but i don't use snapshot in this deployment..FollowCommentYurii 8 months agoResolved! It was problem with IAM role. I didn't have enough permission.Share"

Answer: "0After some quick checks using the CloudFormation validation function and my own spot checks, there were several hyphens ("-") that needed to be removed. Additionally, I'm running on the assumptions that !Ref VPC, !Ref PrivateSubnetIds, and so forth are filled in with your account-specific IDs.I've included my revised version of your code block below, and I was able to successfully create the stack in my own AWS account.AWSTemplateFormatVersion: 2010-09-09Resources:    DocumentDBSecurityGroup:        Type: AWS::EC2::SecurityGroup        Properties:            GroupName: 'DocumentDB SG'            GroupDescription: !Sub 'Security Group for the DocumentDb'            VpcId: !Ref VPC    DocumentDBSubnetGroup:        Type: AWS::DocDB::DBSubnetGroup        Properties:            DBSubnetGroupDescription: "Subnet group for Document DB cluster"            DBSubnetGroupName: "document-db-subnet-group"            SubnetIds: !Ref PrivateSubnetIds    DocumentDBParameterGroup:        Type: AWS::DocDB::DBClusterParameterGroup        Properties:            Description: "Parameter group for Document DB cluster"            Family: docdb4.0            Name: "document-db-paramater-group"            Parameters:                audit_logs: "disabled"    DocumentDBCluster:        Type: AWS::DocDB::DBCluster        Properties:            BackupRetentionPeriod: 7            DBClusterIdentifier: "docdb"            DBSubnetGroupName: !Ref DocumentDBSubnetGroup            DBClusterParameterGroupName: !Ref DocumentDBParameterGroup            Port: 27017            PreferredBackupWindow: "07:00-09:30"            PreferredMaintenanceWindow: "tue:07:00-tue:11:00"            VpcSecurityGroupIds: !Ref DocumentDBSecurityGroup            StorageEncrypted: true    DocumentDBInstance:        Type: AWS::DocDB::DBInstance        DependsOn: DocumentDBCluster        Properties:            DBClusterIdentifier: !Ref DocumentDBCluster            DBInstanceClass: db.t3.medium            DBInstanceIdentifier: "docdb"            PreferredMaintenanceWindow: "tue:07:00-tue:11:00"            CommentShareawsendoanswered 8 months ago"


Question: SSH authentication fails to work after having worked previously

"I am using the free tier and have cycled through several flavors of linux.  The is issue that my ssh login to the instances works fine for some short period and then suddenly stops working.My Security Groups are setup correctly to allow the traffic.  I am logging in from the same location each time.  It simply returns Permission denied (publickey).  I have cycled through 4 instances, have to re-establish a new vm each time and it keeps happening.FollowComment"

Answer: "1Since you are getting Permission denied, you know your security groups are configured to allow the traffic. It would be helpful if you pasted the exact error you receive.Make sure you are using the right default user name for your AMI https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.htmlIn the EC2 console, you can look at the details of the instance and make sure you are using the correct Key pair name.CommentShareJeremy_Sanswered a year ago0The error message you mention indicates that the (public) encryption key stored on the instance for the user that you're trying to log into the instance with doesn't match the (private) encryption key that you have on your laptop or local host.I would suggest doing some forensics on the root volume of an instance which has stopped working: Take the volume and mount it on another instance which is working, then look at the private key to see if it is the right key; look at the time/date stamp; look at logs to see if there was some process or user that changed it.Does anyone else have access to your private/public keypair? If so, generate a new keypair and delete the old one.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: LakeFormation assumed role cannot access s3 objects during Athena requests ("Permission denied on S3 path" )

"I have Delta Lake tables (using Symlink text input format) catalogued in Glue, stored in a S3 bucket, with all its resources tagged with LakeFormation Tags (for tag-based governance).The problem is that, although the users can see the database, tables, and metadata within Athena's catalogue, they cannot perform queries against the specific tables because of "Permission denied on S3 path" errors.LakeFormation has the data location registered for the datalake bucket, with AWSServiceRoleForLakeFormationDataAccess role. And this role has IAM permissions automatically added to the resources:LakeFormationDataAccessServiceRolePolicy{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:ListAllMyBuckets"            ],            "Resource": [                "arn:aws:s3:::*"            ]        }    ]}andLakeFormationDataAccessPolicyForS3{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "LakeFormationDataAccessPermissionsForS3",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObject",                "s3:DeleteObject"            ],            "Resource": [                "arn:aws:s3:::MYBUCKET/*"            ]        },        {            "Sid": "LakeFormationDataAccessPermissionsForS3ListBucket",            "Effect": "Allow",            "Action": [                "s3:ListBucket"            ],            "Resource": [                "arn:aws:s3:::MYBUCKET"            ]        }    ]}I have also tried registering the data location with a role with Admin permissions (Action "" and Resources ""), but even so the same error is thrown.Looking through the CloudTrail logs, I found that LakeFormation passes custom policies to the role when running AssumeRole:"policy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n         {\n           \"Action\": [\"s3:GetObject\"],\n           \"Effect\": \"Allow\",\n           \"Resource\": [\"arn:aws:s3:::MYBUCKET\",\n           \"Condition\": {\"ForAnyValue:StringLike\":{\"s3:prefix\":[\"MYTABLE/_symlink_format_manifest\",\"MYTABLE/_symlink_format_manifest/*\"]}}\n         },\n         {\n           \"Action\": [\"kms:Decrypt\"],\n           \"Effect\": \"Allow\",\n           \"Resource\": [\"*\"],\n           \"Condition\": {\"StringEquals\":{\"kms:ViaService\":[\"s3.us-east-2.amazonaws.com\"]}}\n         }  ]\n}"    }This seems like a malformatted json string that is being passed to the assumed role. Can this be causing the errors I'm having? And does anyone have had this issue before?PS:I have manually removed ACL control over the S3 bucket and objects. Still same behavior.The error is not shown if I remove the data location, and Athena ignores Lake Formation.FollowCommentCorvus_L a year agoDo you mean that you have a table in AWS Lake Formation with the "location" pointing to manifest file(s)?Sharedmouravars a year agoNo, it's pointing to a folder with parquet files, and manifests in subfolders.Sharedmouravars a year agoJust saw in the Lake Formation documentation that it does not support queries that use manifests.Shareazo91 a year agofacing the same issue and my steps are exactly the same as yours and being completely stucked with it...Share"

Answer: "0Are your bucket and objects encrypted?  If your bucket and objects are encrypted, I would make sure Lakeformation has the proper access to use the KMS Key (KMS Key Policy).CommentSharejsoncanswered a year agodmouravars a year agoThey are encrypted with AWS managed keys. I've added the specific KMS permissions to the access role I'm using, but still ends up denying the access. I've tried adding full KMS access, still nothing.Share"


Question: sso create permission-sets not authorized in CLI but works in Console

I'm using the same SSO Role in the same account  to create a an SSO Permission set.  It works in Console but not from CLI.  I'm using AdministrationAccess managed policy. Checked with IAM Policy simulator and it should work.This is the CLI`aws sso-admin create-permission-set --name test --instance-arn 'arn:aws:sso:::instance/ssoins-1234567c07aa927c'An error occurred (AccessDeniedException) when calling the CreatePermissionSet operation: User: arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AdministratorAccess_d856d636dbae8a64/admin_XXX is not authorized to perform: sso:CreatePermissionSet`FollowComment

Answer: "0Accepted AnswerResolved the problem,  the SSO arn was incorrect.  Not using the one of the correct organizationCommentShareAWS-User-8503569answered a year agoAWS-User-8503569 a year agoIn addition it needs to run in the same region as the region where the SSO was createdShare"