Question: "from airflow.providers.amazon.aws.operators.s3_bucket import S3CreateBucketOperator, S3DeleteBucketOperator fails"

"Hi,from airflow.providers.amazon.aws.operators.s3_bucket import S3CreateBucketOperator, S3DeleteBucketOperator fails withModuleNotFoundError: No module named 'airflow.providers.amazon.aws.operators.s3_bucket'FollowComment"

Answer: "0Hi Santosh,Thank you very much.Where can I find out which providers version my airflow is using? I want to make sure I am looking at the right documents and continue to look at the right documents.How can I tell that I should use apache-airflow-providers-amazon/6.0.0 and not the current stable version, https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/_api/airflow/providers/amazon/aws/operators/s3/index.html?CommentShareAndrew Blossanswered 3 months agoSantosh_S_S SUPPORT ENGINEER3 months agoMWAA environments with Airflow v2.2.2 (you can check the Airflow version in the console) comes with apache-airflow-providers-amazon package version 2.4.0. With Airflow v2.4.3, the default version installed in 6.0.0.You can check the installed versions by running the "pip3 list" command using BashOperator task similar to the example DAG belowfrom airflow import DAG from airflow.operators.bash_operator import BashOperator from datetime import datetime, timedelta with DAG(dag_id='bash_dag', schedule_interval=None, start_date=datetime(2020, 1, 1), catchup=False) as dag:     bash_task = BashOperator(task_id='bash_task', bash_command="pip3 list") bash_taskI hope the above information helps. Please feel free to write back if you any other queries or concerns, I will be more than happy to help.Thank you.I hope the above information helps. Please feel free to write back if you any other queries or concerns, I will be more than happy to help.Thank you.Share0Hi,The module named 'airflow.providers.amazon.aws.operators.s3_bucket' was used until apache-airflow-providers-amazon version 2.4.0. Version 2.4.0 used to be the default amazon provider package version installed in MWAA with Airflow v2.0.2. Based on the error that you are seeing, I am suspecting that you are working on the MWAA environment with the latest version (2.4.3) where the he default amazon provider package version installed is 6.0.0.s3_bucket module in v2.4.0https://airflow.apache.org/docs/apache-airflow-providers-amazon/2.4.0/_api/airflow/providers/amazon/aws/operators/s3_bucket/index.htmlSame module is not present in v6.0.0 and in the immediate releases after 2.4.0, we can see the message that it is deprecatedhttps://airflow.apache.org/docs/apache-airflow-providers-amazon/3.0.0/_api/airflow/providers/amazon/aws/operators/s3_bucket/index.html"This module is deprecated. Please use airflow.providers.amazon.aws.operators.s3."Please use the operators of 6.0.0 as mentioned in the following document using the "airflow.providers.amazon.aws.operators.s3" instead.https://airflow.apache.org/docs/apache-airflow-providers-amazon/6.0.0/_api/airflow/providers/amazon/aws/operators/s3/index.htmlIf you are not using MWAA environment with the latest version 2.4.3, I would request you to check the specific operator documentations to see the correct modules as per the apache-airflow-providers-amazon version.Thank you.CommentShareSUPPORT ENGINEERSantosh_S_Sanswered 3 months ago"


Question: Potential Bug when attaching new alarm model to input

"Problem: I am hitting an "AccessDeniedException" when sending a message to an IOT Events Input from an IOT Core rule only when I attach an Alarm Model to that input. When there is no Alarm Model attached to the input, then the message is successfully sent to the IoT Events InputSteps to reproduce:Create a new rule in IoT CoreAdd Action "Send a message to an IoT Events Input"When selecting an input, press "Create" which will bring you over to the IoT Events service and create your new Input (in my case, I call this input 'input_3')Let the UI create a relevant role or select a role that has the relevant access to complete the Action.Then go to the IoT Events service and add a new Alarm Model using 'input_3' as the inputWhen the rule is triggered, I get the following error from IoT Core{"ruleName": "storage","topic": "core-freshpet/devices/freshpet-lucan-temp/up","cloudwatchTraceId": "9d4051ae-1d35-6b7b-9464-05b082dba748","clientId": "integration-aws/unknown-q1B0hqp6yA4","base64OriginalPayload": "eyJhcHBfaWQiOiJjb3JlLWZyZXNocGV0IiwiZGV2X2lkIjoiZnJlc2hwZXQtbHVjYW4tdGVtcCIsImhhcmR3YXJlX3NlcmlhbCI6IkE4NDA0MTAwMDE4MUNGODMiLCJwb3J0IjoyLCJjb3VudGVyIjoxNDEwNCwicGF5bG9hZF9yYXciOiJESmYvNHdFRmdQLy8vLzg9IiwicGF5bG9hZF9maWVsZHMiOnsiQURDX0NIMFYiOjAuMjYxLCJCYXRWIjozLjIyMywiRGlnaXRhbF9JU3RhdHVzIjoiTCIsIkRvb3Jfc3RhdHVzIjoiQ0xPU0UiLCJFWFRJX1RyaWdnZXIiOiJGQUxTRSIsIkh1bV9TSFQiOjY1NTMuNSwiVGVtcEMxIjotMi45LCJUZW1wQ19TSFQiOi0wLjEsIldvcmtfbW9kZSI6IklJQyJ9LCJtZXRhZGF0YSI6eyJ0aW1lIjoiMjAyMS0wMS0xMVQyMzozMzoyMC4zODQ0ODIwMjZaIiwiZnJlcXVlbmN5Ijo4NjcuNywibW9kdWxhdGlvbiI6IkxPUkEiLCJkYXRhX3JhdGUiOiJTRjdCVzEyNSIsImFpcnRpbWUiOjYxNjk2MDAwLCJjb2RpbmdfcmF0ZSI6IjQvNSIsImdhdGV3YXlzIjpbeyJndHdfaWQiOiJldWktYTg0MDQxMWVlYTY0NDE1MCIsInRpbWVzdGFtcCI6MjQxMDcyMDI0NCwidGltZSI6IjIwMjEtMDEtMTFUMjM6MzM6MjAuMzI5MjAzWiIsImNoYW5uZWwiOjYsInJzc2kiOi02Nywic25yIjoxMCwicmZfY2hhaW4iOjB9XX19","failures": [{"failedAction": "IotEventsAction","failedResource": "input_3","errorMessage": "Failed to send message to Iot Events. null (Service: AWSIoTEventsData; Status Code: 403; Error Code: AccessDeniedException; Request ID: 97a6a8b1-838c-432b-a86b-0ce60e8285ad; Proxy: null). Message arrived on: core-freshpet/devices/freshpet-lucan-temp/up, Action: iotEvents, InputName: input_3, MessageId: aa694491-8b0c-4ce7-af65-97da7a53e1e1"}]}Delete the alarm model you just created in IoT Events but do not touch your rules in IoT CoreThe following is the [info] message I get from IoT Core when the rule is triggered once more, but this time when there is no alarm model attached to the input2021-01-11 23:38:20.695 TRACEID:e907757e-8c3e-f469-11b3-de5b5f03c3fd PRINCIPALID:d9995c0652c616d7c94dc1713d559e14f8bc16caadd5ca10e1cbf386f496d510 [INFO]  EVENT:IotEventsActionSuccess TOPICNAME:core-freshpet/devices/freshpet-lucan-temp/up CLIENTID:integration-aws/unknown-q1B0hqp6yA4 MESSAGE:Successfully sent message to IoT Events. Message arrived on: core-freshpet/devices/freshpet-lucan-temp/up, Action: iotEvents, InputName: input_3, MessageId: 69625f7a-3af2-4fe1-980b-6d94ddc0efe5FollowComment"

Answer: "0Hey, thanks for reaching out. Can you provide more details on the alarm model that you created? Did you define a "key" for that Alarm Model? If so, is that key path present in the payload of your input message?CommentShareAWS-User-6914679answered 2 years ago0Hi thereI am no longer having this problem - I believe I may have had some mix up in permissions on my side, but this error is no longer arising (It seems I am getting past this error and then hitting the "key not found" error in my other posts. Closing this - tks!CommentSharedeladsanswered 2 years ago"


Question: AWS Client VPN re-authenticating while MacOS is asleep

"We have a newly deployed AWS Client VPN, split tunnel using SAML federated authentication against Google. The setup is working reliably, but we've had several users (not all) on MacOS report 30-40 open chrome tabs after a 2 day weekend, all stating "Authentication details received, processing details. You may close this window at any time."  This is normal activity for 1 tab to display this message after connecting and authenticating. Users have reported their laptops have been asleep during this period.  We have the session timeout set to 12hrs.  Do you have any advise on why this is happening and how to prevent it?FollowComment"


Question: AWS client vpn selfservice

"Hi,I'm trying to create a VPN endpoint using AWS SSO as IdP but I'm always getting an error when doing the assertion exchange after logging.I've created the endpoint, selected federated authentication and then selected the ARN of the SAML provider of my SSO configuration. The endpoint is created and available and associated to a VPC.Then I downloaded the AWS VPN client, created a profile using the configuration from my VPN endpoint and then I clicked on 'Connect'. That takes me to the SSO login page but after login I get an error:Oops, something went wrongProvide your administrator with the following info:Issuer of request does not match our recordRequest ID: <<some id>>HTTP status: 403Any idea on what fails?Thanks.FollowComment"

Answer: "0AWS Client VPN is not one of the pre-integrated applications in AWS SSO. As a workaround, create a custom SAML application in AWS SSO. This requires re-creation of AWS VPN Client Endpoint.Create a custom application in AWS SSO to be used with AWS Client VPNCreate a new Identity Provider (IdP) in IAM Provider console, and use the AWS SSO as an identity provider with the custom application that was created in Step 1Finally, use the newly created IdP with AWS Client VPNCustom SAML 2.0 applications https://docs.aws.amazon.com/singlesignon/latest/userguide/samlapps.htmlAuthentication - SAML-based IdP configuration resources -https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authentication.html#saml-config-resourcesAuthenticate AWS Client VPN users with AWS Single Sign-On https://aws.amazon.com/blogs/security/authenticate-aws-client-vpn-users-with-aws-single-sign-on/CommentShareSUPPORT ENGINEERNeha_Sanswered a year ago"


Question: Load testing serverless stack using Gatling

"Hi,I'm doing some load testing on my serverless app and I see that it is unable to handle some higher loads. I'm using API Gateway. Lambda(Java 8) and DynamoDB. The code that I'm using is the same as this from this link.In my load testing, I'm using Gatling. The load that I configured is that I'm doing a request with 120 users, then in one minute I ramp users from 120 to 400, and then for 2 minutes I'm making requests with 400 constant users per second. The problem is that my stack is unable to handle 400 users per second. Is it normal? I thought that serverless will scale nicely and will work like a charm.Here is my Gatling simulation code:public class OneEndpointSimulation extends Simulation {        HttpProtocolBuilder httpProtocol = http            .baseUrl("url") // Here is the root for all relative URLs            .acceptHeader("text/html,application/xhtml+xml,application/json,application/xml;q=0.9,*/*;q=0.8") // Here are the common headers            .acceptEncodingHeader("gzip, deflate")            .acceptLanguageHeader("en-US,en;q=0.5")            .userAgentHeader("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:16.0) Gecko/20100101 Firefox/16.0");        ScenarioBuilder scn = scenario("Scenario 1 Workload 2")            .exec(http("Get all activities")                    .get("/activitiesv2")).pause(1);        {        setUp(scn.injectOpen(atOnceUsers(120),                        rampUsersPerSec(120).to(400).during(60),                        constantUsersPerSec(400).during(Duration.ofMinutes(2))                ).protocols(httpProtocol)        );    }    }Here are the Gatling report results:Image linkI'm also receiving an error:**i.n.h.s.SslHandshakeTimeoutException: handshake timed out after 10000ms ** -> This is usually approx 50 requests. It is happening when Gatling is starting to inject 400 constant users per second.I'm wondering what could be wrong.It is too much for API Gateway, Lambda and DynamoDB?FollowComment"

Answer: "0There have definitely been large-scale events running on AWS that exceed the performance parameters you mention. For example, Prime Day 202. However, these events generally happen after careful planning and design as well as a bunch of testing (which I'm very glad to see you doing).One of the things that usually pops up during stress/load testing are the quotas placed on each account for various services. I suspect that you may be bumping into those.One thing you can do in the short term is to request limit increases for the services that you are using via the AWS console.However, I'd also strongly recommend that you reach out to your local AWS Solutions Architect who can work with you on your application design - that's our job and it's what we're here for (to help customers get the best out of the platform).CommentShareEXPERTBrettski-AWSanswered a year agoMaryn a year agoWhere can I reach out to such AWS Solutions Architect? Is there any special service for that?ShareBrettski-AWS EXPERTa year agoI would start by checking LinkedIn in your local area; it's not possible (yet!) on re:Post to send personal messages otherwise I could recommend someone directly.Share0Your test results show long response time (about 10k ms for 90 percentile).It looks like there is some bottleneck point (ex. DyanamoDB throttling by capacity units with retry logics).You may see the cause of high latency by activating X-Ray for the api gateway and the lambda function.CommentShareJunseong_Janswered a year agoMaryn a year agoHi, I checked the logs and I cannot see any throttled requests. Cloudwatch is saying that there are no throttled requests.Share"


Question: Request for Hebrew

Please add support for a Hebrew Polly voice. It would be much appreciated.Thank you.FollowComment

Answer: "1Yes.  There is a huge demand for this feature in Hebrew.  We created https://tehillim.rab.ai in AWS LEX/Amplify/AppSync/DynamoDB and we would activate Hebrew Polly the minute it becomes available.  We have DOZENS of other Hebrew projects which would also utilize this feature.CommentShareArtificialChatanswered 3 years ago0Thank you for reaching out,I'll forward your request to the Amazon Polly team.Cheers,DomenicoCommentShareAWS-User-1683178answered 3 years ago0It will be very helpful to add  Hebrew Polly voiceCommentShareEli zatlawyanswered a month ago"


Question: CSRF token with static website on S3 bucket

"Hi there,I'm trying to move my private static website to be hosted on S3 bucket. I have a solution fully works without the usage of the website hosting feature of S3. Actually, I have an ALB that forwards the traffic to my S3 bucket via private endpoints. All fine up until here.The next challenge is integrating CSRF tokens into the workflow. Basically, I would like to generate a CRSF token when the first call gets in and then validate it on every next request. Since the CSRF token is managed on the server side, in the current scenario with the S3 bucket I have no server which can take care of that.So, the idea would be of using a Lambda function that intercepts the initial call (on a specific path for example), generates the CSRF token, and pass it back to the HTTP call.Any idea how I could implement the lambda function for such a scenario?Thank youFollowComment"

Answer: "0It might be a good idea to put CloudFront Distribution in front of your ALB.This has the advantage that can arrange caching of static files for you.It also give you flexibility in adding more Origins on specific paths this could well be a Lambda.CloudFront with Lambda originYou can create your CSRF token in the lambda.Validation of the token is usually only done when HTTP-posting something.CommentShareJaccoPKanswered 4 months agoEscape82 4 months agoHi there,CloudFront will force me to go via the Internet at least for the authentication. Actually, I would like to keep the entire workflow private.ShareJaccoPK 3 months agoAh, didn't understand that requirement yet.Then I'd go for a very simple thingy in between maybe even a lambda with url.Otherwise a simple ec2 instance or ecs  container with some intelligent proxy.Share0Hi there,The solution I found consists on getting rid of CSRF record at all. In particular, instead of using cookies we opted for using local storage on the client side.In particular, the idea is to:Remove the CSRF token partUpdate the authentication code to make no longer use of Cookies but replace it with local storage on the client side (https://stackoverflow.com/questions/35291573/csrf-protection-with-json-web-tokens)This requires “small” changes on the application side (back-end and front-end actually).Enable CORS on the S3 bucketOn top of that, using OIDC or moving the authentication to the ALB, we can totally get rid of the backend and host the website fully on an S3 bucket.;)CommentShareEscape82answered 3 months ago"


Question: Build failed to start. The following error occurred: Cannot have more than 0 builds in queue for the account

"Hi, getting the following on a CodeBuild project. Any help would be appreciated."Build failed to start. The following error occurred: Cannot have more than 0 builds in queue for the account"FollowComment"

Answer: "1I’m having the exact same problem. I asked the rate limit folks but so far they responded as though they didn’t even read the issue I mentioned. I don’t believe I should need to pay for support just to have a problem on their end resolved. You may have read about this on other sites. It sounds like a common problem that only AWS employees can remedy.CommentSharejtwiddleranswered a year ago0Accepted AnswerSo it was an IAM issue. I had to create user accounts, and remove the access and secret keys from the root account.CommentShareR3Dlocustanswered a year agoAWS-User-5850558 a year ago@R3Dlocustwhich exactly secret keys did you delete from the root account?I use a user account but still have this issue.Thank you in advance.ShareAWS-User-3333805 a year agoHow many user accounts did you have to create?Share"


Question: PDF Support

"Hi,I see there is only jpeg and png support for now. Is PDF support on the roadmap? If not, I would like to suggest it as an enhancement request.Thanks, MikeFollowComment"

Answer: "0We do support PDF today, but currently only via the asynchronous API.  We'll also add it to the console but don't have that yet.CommentShareAWS-User-0867741answered 4 years ago0Do you have a date in the roadmap for PDF in the console?CommentSharedubaidmanswered 4 years ago"


Question: Location of Listener Logs on AWS RDS Oracle database

Where can I find the listener logs for AWS RDS Oracle databases. I can only find alert logs and audit logs in the AWS console but not listener logsFollowComment

Answer: "0CommentShareNaveen Garg - ProServeanswered 2 months agoraja 2 months agoThanks Naveen, yes I am able to see the listener logs in CloudWatch log groups.Share0You cannot view the listener log in the console. You have to enable the option to send the listener.log to Cloudwatch logs and then view the information from CloudWatchRun this CLI command to find out what database logs are being sent to CW. You should see listener in the output of this commandaws rds describe-db-instances --db-instance-identifier <db name> | jq '.DBInstances[].EnabledCloudwatchLogsExports'["listener"]CommentShareNaveen Garg - ProServeanswered 3 months ago0CloudWatch Logs Export enabled for logs [audit, listener], but I still do not see listener logs, I checked the logs and events tab, I do not find them there. where are the listener logs exported after enabling the logs.CommentSharerajaanswered 2 months ago0I also ran the query  and did not find any data in there, is there anything else required to configure listener logs for AWS RDS Oracle databaseSQL> select ORIGINATING_TIMESTAMP,MESSAGE_TEXT from listenerlog;no rows selectedCommentSharerajaanswered 2 months ago0Search for your DB name in the CloudWatch log groups. I can see the listener entries for my DB in CloudWatch. I will try to find out if the query is supposed to work. It does not return any rows for my DB, so I'm not sure if that is supposed to workCommentShareNaveen Garg - ProServeanswered 2 months ago"


Question: Can send but unable to receive messages

We are unable to receive messages to all of our WorkMail accounts. They are getting to Reflexion but not to AWS. Here is the error message from the Reflexion inbound queue for every message:ReasonERROR: Message is not accepted by the customer delivery queueStatusThe message was deferredNo changes were made and AWS from Reflexion it successfully passes an SMTP connection test.FollowComment

Answer: "0We confirmed that our particular problem is related to Sophos Reflexion. FYI, for everyone that stumbles upon this message, your Sophos rep will do a 1-to-1 license exchange for Sophos Email Security and the renewal is the same cost as Reflexion. Sophos Email Security is a much better platform that integrated with Sophos Central.CommentSharePMajonanswered 4 years ago"


Question: Tracking AWS Nonprofit Credit Program applications

"We submitted an application to the AWS Nonprofit Credit Program recently, is there a way to track its progress? The tickets don't appear to be in the support site. is there an expected turn around time for applications?FollowComment"

Answer: "0Hi there,We reached out our Nonprofit Credit Program team on your behalf, and they requested that you send an email to AWS-Nonprofit-Programs@amazon.com for direct assistance.Best regards,Kita B.CommentShareEXPERTAWS Support - Kitaanswered a year ago"


Question: R53 Registered Domain Vertification Email Broken

"Hi,I bought a domain with AWS.I'm not receiving the verification email, and as a result, my domain has been suspended.When I go to the domain, I click on "Send email again" in the "Your domain might be suspended" dialog, and it says that it sent me an email, but it never arrives.I've been trying this button for 24 hours now, no result.This is broken functionality that is now impacting the domain that I paid AWS for.Please resolve this ASAP.FollowComment"

Answer: "0Hello,I understand that you are failing to receive a verification email, and your domain is been suspend and that broken functionality is now impacting the domain. To verify if you domain is suspended, please Send a WHOIS query for the domain [1]. If the value of Domain Status is clientHold, the domain has been suspended. In addition when a domain is suspended, AWS usually send an email to the email address for the registrant contact for the domain.However, if the domain was suspended based on a court order, the court might not let AWS notify the registrant contact [2].To have your domain unsuspended, please contact AWS Support [3] is free of charge. For more information, about domain registration issues refer to the document below reference link [4].Reference links1.https://whois.com/whois2.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-domain-suspended.html3.https://aws.amazon.com/contact-us/4.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-contact-support.htmlCommentSharestevenanswered a year ago"


Question: AWS managed MySQL  connect as external schema in different account Amazon Redshift

"HiIs it possible to connect AWS managed MySQL to be connected as external schema in Amazon Redshift cluster, which is in different account. Please let know if there is any series of steps which needs to be followed.FollowComment"

Answer: "0Hi SumitJaiswal,You can use the federated queries feature. Since the Amazon Redshift cluster is found in a different VPC, you may consider enabling the VPC peering.Here's a link that lists all the major steps to get started https://docs.aws.amazon.com/redshift/latest/dg/getting-started-federated-mysql.html.Thanks.CommentShareZiadanswered 8 months ago"


Question: VPN connection between on-premises and AWS

"Hello,We have a usecase to implement as below.A scheduled script(batch job) that needs to run dally and collects/checks data Inside multiple private networks(non-AWS). Those private networks can be accessed using VPNs like OpenVPN and L2TP. We don't want to use Direct Connect as it seems to be pricey.Please suggest a way(or a service) to set up and access those private networks Inside AWS.FollowComment"

Answer: "2Hello,Can you clarify the direction of the traffic? Asking since you mention (non-AWS) in your question. Is it from AWS -> On-premises Or on-premises -> AWS? Note that with ClientVPN typically you will have connectivity from Clients to AWS not the other direction. If you need bi-directional connectivity then you would need to look at site-to-site VPN for that use-case.CommentShareEXPERTTushar_Janswered 9 months agoEXPERTToni_Sreviewed 9 months ago0Hello,AWS Client VPN is a managed client-based VPN service that enables you to securely access your AWS resources and resources in your on-premises network. With Client VPN, you can access your resources from any location using an OpenVPN-based VPN client.https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-vpc.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: How to delete an AWS Pinpoint Endpoint via Amplify JS?

"Hello,I am using Amplify to created AWS Pinpoint endpoints which I use further for segments, campaigns, journeys etc.Creating the endpoint works fine for me by doing something like this:  let endpoint = {            address: this.email,             attributes: {                eventStatusUpdate: [true],                wantsToUnsubscribe : [false],            },            channelType: 'EMAIL',             optOut: 'NONE',            userId: this.email,            userAttributes: {              email: [this.email]          }        }    Analytics.updateEndpoint(endpoint).then((event) => {      console.log("ENDPOINT EVENT", event)    });To delete the endpoint, in an email that users receive I have a button that redirects them to a Unsubscribe Page where I have another endpoint that gets the email of the user but I am not sure what to do from that point.I have multiple endpoints for the same user with the same email but apparently all those endpoints get different ID's.I have no idea how to delete the specific endpoint I want so that the user can be unsubscribed and not receive emails anymore.I hope you can help me with that?FollowComment"


Question: How to create a kinesis firehose delivery stream with dynamic partitions enabled using python cdk?

"I am trying to create a firehose delivery stream with dynamic partitions enabled. Below is what I have got so far.analytics_delivery_stream = kinesisfirehose.CfnDeliveryStream(    self, "AnalyticsDeliveryStream",    delivery_stream_name='analytics',    extended_s3_destination_configuration=kinesisfirehose.CfnDeliveryStream.ExtendedS3DestinationConfigurationProperty(        bucket_arn=f'arn:aws:s3:::{analytic_bucket_name}',        buffering_hints=kinesisfirehose.CfnDeliveryStream.BufferingHintsProperty(            interval_in_seconds=60        ),        dynamic_partitioning_configuration = kinesisfirehose.CfnDeliveryStream.DynamicPartitioningConfigurationProperty(        enabled=True,        retry_options=kinesisfirehose.CfnDeliveryStream.RetryOptionsProperty(            duration_in_seconds=123        )),        compression_format="UNCOMPRESSED",        role_arn=firehose_role.role_arn,        prefix="!{partitionKeyFromQuery:log_type}/!{timestamp:yyyy}/!{timestamp:MM}/!{timestamp:dd}/",        error_output_prefix="errors/!{firehose:error-output-type}/!{timestamp:yyyy}/anyMonth/!{timestamp:dd}/",    ))When I run this, I get below error .Processing Configuration is not enabled when DataPartitioning is enabled. I found below references to Processing Configuration in the docsprocessing_configuration=kinesisfirehose.CfnDeliveryStream.ProcessingConfigurationProperty(    enabled=False,    processors=[kinesisfirehose.CfnDeliveryStream.ProcessorProperty(        type="type",        # the properties below are optional        parameters=[kinesisfirehose.CfnDeliveryStream.ProcessorParameterProperty(            parameter_name="parameterName",            parameter_value="parameterValue"        )]    )]),I am not sure what values to put for parameters or type inside processing_configuration.I have logs being put into firehose with below structure.type A - {'log_type':'type_A_log',....other props....}type B - {'log_type':'type_B_log',....other props....}Using dynamic partitioning, I want to achieve the scenario where all logs of type A go into type_A_log directory inside s3 and type B log into type_B_log directory.Can someone please help here ? I am going down a rabbithole.FollowComment"


Question: My EC2 instance stuck on stopping state more than 10 minutes

I have an instance that is stuck in the stopping state more than 10 minutes. Instance ID: i-0e23c7d8101068aec. Already do Force stop but not successful.FollowCommentMarc Schuricht a year agoIs the instance EBS backed?ShareAWS-User-2577527 a year agoUnfortunately noShare

Answer: "0HiWhen your Ec2 instance is Stuck or Still in pending for stopping etc, These issue may be with underlying hardware in the infrastructure.Please look  into the AWS Premium support link to debugg the issue, If you still need any help please let me know.https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-stuck-stopping-state/Thank YouGKCommentShareGKanswered a year ago"


Question: is it possible to use JSON Numeric aggregation functions in API gateway map

"As the subject says, I am looking if it is possible to use JSON Numeric aggregation functions in API gateway mapping templates?I have the below template and I would want to add the "ttl" column as a future date.{"TableName": "api","Item": {"ingestId": {"S": "$context.requestId"},"ttl": {"N": "$context.requestTimeEpoch"}}}So I wanted to try the sum() function of the request Epoch time and some number to get a future date as the result.Any suggestions and inputs are welcome.FollowComment"

Answer: 0I had to use the set variable before the JSON structure. I was trying it inside and was failing at the syntax validation.#set($milliseconds = $context.requestTimeEpoch + 2*86400000)This sets the milliseconds variable to current epoch + 2 days and this variable can be used in subsequent JSON.CommentSharegsk308answered 2 years ago


Question: Multiple SQS queue to same Lambda

"Hi , I m trying to know how events will be pulled by Lambda internal polling system when there are multiple SQS standard queues are configured from same Lambda . All queues are with same configs and similar events but might be at different rate .I tried to read many post including below AWS docs but not getting the clue of how it’s actually works behind the screen .https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.htmlFollowComment"

Answer: "1Every time you configure a queue as an event source for a Lambda function, we create pollers to read from the queue and invoke the function when there are messages. If you configure two queues with the same function, we will create two sets of pollers to read from these queues and invoke the function. Each one of these pollers will scale independently so you will need to have enough Lambda concurrency in your account to accommodate for the higher concurrency.CommentShareEXPERTUrianswered a year ago0The Behavior is described in the "Scaling and Processing" Section.It describes that you have at a max 1k processes reading from a Queue and hand over the Batches to your function.With more than one Queue feeding the function you will have more parallel Lambda executions, so take care of your Lambda Limits.CommentShareMarcoanswered a year ago"


Question: Aurora Serverless V2 (PostgreSQL) gets stuck

"We've PostgreSQL Aurora Serverless V2 cluster with 2 instances (1 reader and 1 writer instance). They are configured to have 2-16 ACUs.When we populate data into the DB, either instance or both instances get stuck. PostgreSQL connections are timing out without any errors. Stuck instance looks healthy in AWS console but AWS doesn't get any metrics from the instance. Only instance reboot fixes it temporarily, but it takes a long time (30-60 min).Error logs contain the following repeated (every 5-10 sec) line:2022-06-20 06:01:06 UTC::@:[31477]:WARNING: worker took too long to start; canceled2022-06-20 06:01:11 UTC::@:[31477]:WARNING: worker took too long to start; canceledWe've checked all instance metrics before the freeze but we've seen nothing interesting.The load is quite heavy when we caused freezes of the database. In the first run we used 1,000 lambdas concurrently to insert data. It was working fine until writer instance got stuck. Later we've used only 100 lambdas in parallel. Writer instance didn't have any issues but the reader instance got stuck.We chose the new Aurora Serverless V2 to be our production database. Currently it feels too unstable for us and we are considering migration to some more mature service.FollowCommentn8ltmp a year agoGet any resolution to this? I am experiencing the exact same problem - no indication of anything going off the rails (Memory, CPU all fine), but a completely unresponsive Writer and "WARNING:  worker took too long to start; canceled" over and over in the logs. This seems like an AWS Aurora issue that we shouldn't have to pay AWS to support since we are already paying for the service and there is clearly something wrong with it.Share"

Answer: "0Can you please post the ACUs it scaled just before the  freeze? It seems like 16 ACU is not enough for your workload and the writer is getting pegged at 100 cpu utilization. Have you tried with a higher min and max ACU setting e.g. 4-32 and see what the results are. Since you are in the testing phase. set a higher max ACU and check to what ACU V2 scales with your workload.Open a ticket with support as well.CommentShareDevinder-theDBGuyanswered a year agotero a year agoACU usage before the latest freeze of the reader instance was 10 and CPU usage 5-10 %. Those numbers were quite stable during the 6 hours before the issue. Before that there was 100 % CPU usage and 16 ACU usage for 20 hours.I haven't tested higher ACU settings because I want to limit maximum cost of RDS. I'd still expect database service be stable even when moderate CPU and memory allocations are throttling the performance.Unfortunately I don't have technical support available on that AWS account, so I can't post proper support ticket.However, I think Serverless V2 was initially wrong choice to our use-case due to challenges with combination of costs, index size and performance after down-scaled ACUs.Share"


Question: AWS SES Click Tracking links pointing directly to my site <Eg: https://mysite.com/CL0...>

"Hello, I am using AWS SES to send out emails and I included to my configuration sets the link tracking. When I send a test to my email, the links are directly pointing to my web instead of the Amazon SES server, and including a /CL0/ path.Eg: https://mysite.com/CL0/https:%2F%mysite.com%3Futm_source...Is this an issue or should I implement the click tracking on my server?FollowComment"


Question: Greengrass V2 Shadow + MQTT (Moquette)

"I'm trying to sync shadows between IoT Core and IoT Devices which are connected through Greengrass V2, Moquette Component. It seems like the ShadowManager service just gets shadows synced for use with IPC (other Components) and doesn't sync with Moquette where the IoT Devices could interact with their shadows. I also tried just using the MQTT Bridge to proxy the AWS Shadow Topics between Moquette and IoT Core, but that just started an infinite loop of messages since there's no deduplication or loop-break happening in the bridge...How are IoT Devices supposed to interact with their shadows through a Greengrass MQTT broker? Greengrass V1 just seemed to work (IoT Devices connected to the Greengrass broker could interact with their shadows).I found this from a year ago, but it doesn't give much info other than, "roll your own component to proxy the requests". Has this advice changed in the last year?FollowComment"

Answer: "2Accepted AnswerHi Casey, please see: https://docs.aws.amazon.com/greengrass/v2/developerguide/work-with-client-device-shadows.html#enable-shadow-manager-client-devices.This provides the MQTT Bridge configuration which you must use to allow shadow access without loops.Cheers, MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 9 months agoCasey 9 months agoPerfect, I missed that article while trying to troublshoot this, thank you! I do have a follow on question about the ShadowManager, which I'll ask in another question to track answers there (how to wildcard subscribe to all devices assigned to the gateway).Share"


Question: Greengrass Lambda Permission Denied Error

"I published a new version of my deployment and out of a sudden the Lambde stopped working. It worked before though.This is the output of the core logs:2021-02-15T17:38:38.964Z INFO (pool-2-thread-138) octopus-greengrass-sap-odata-service: shell-runner-start. {scriptName=services.octopus-greengrass-sap-odata-service.lifecycle.shutdown.script, serviceInstance=10, serviceName=octopus-greengrass-sap-odata-service, currentState=STOPPING, command=["/greengrass/v2/packages/artifacts/aws.greengrass.LambdaLauncher/2.0.3/lambda-l..."]}2021-02-15T17:59:14.242Z INFO (pool-2-thread-140) octopus-greengrass-sap-odata-service: shell-runner-start. {scriptName=services.octopus-greengrass-sap-odata-service.lifecycle.startup.script, serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=STARTING, command=["/greengrass/v2/packages/artifacts/aws.greengrass.LambdaLauncher/2.0.3/lambda-l..."]}2021-02-15T17:59:14.265Z INFO (pool-2-thread-146) octopus-greengrass-sap-odata-service: Finding mounted cgroups.. {serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=STARTING}2021-02-15T17:59:14.304Z INFO (Copier) octopus-greengrass-sap-odata-service: stdout. Started process: 28808. {scriptName=services.octopus-greengrass-sap-odata-service.lifecycle.startup.script, serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=STARTING}2021-02-15T17:59:14.307Z INFO (Copier) octopus-greengrass-sap-odata-service: Startup script exited. {exitCode=0, serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=STARTING}2021-02-15T17:59:14.417Z INFO (pool-2-thread-146) octopus-greengrass-sap-odata-service: lambda_runtime.py:403,Status thread started. {serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=RUNNING}2021-02-15T17:59:14.423Z ERROR (pool-2-thread-142) octopus-greengrass-sap-odata-service: FATAL: lambda_runtime.py:147,Failed to import handler function "app.lambda_handler" due to exception: Errno 13 Permission denied: '/lambda/requests/__init__.py'. {serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=RUNNING}2021-02-15T17:59:14.424Z ERROR (pool-2-thread-142) octopus-greengrass-sap-odata-service: FATAL: lambda_runtime.py:428,Failed to initialize Lambda runtime due to exception: Errno 13 Permission denied: '/lambda/requests/__init__.py'. {serviceInstance=11, serviceName=octopus-greengrass-sap-odata-service, currentState=RUNNING}I created a user during installation (in a root shell):java -Droot="/greengrass/v2" -Dlog.store=FILE -jar ./GreengrassCore/lib/Greengrass.jar --aws-region eu-central-1 --thing-name aws-octopus-core --thing-group-name aws-octopus-group --component-default-user my_ggc_user:my_ggc_group --provision true --setup-system-service true --deploy-dev-tools truePermission on folder:maschine:/greengrass/v2/logs # ll /greengrass/total 4drwxr-xr-x 12 root root 4096 Feb 12 22:10 v2maschine:/greengrass/v2/logs # ll /greengrass/v2/total 52drwx------ 3 root root 4096 Feb 12 22:10 altsdrwxr-xr-x 2 root root 4096 Feb 15 18:35 bindrwxr-xr-x 2 root root 4096 Feb 15 18:35 cli_ipc_infodrwx------ 2 root root 4096 Feb 12 22:10 configdrwx------ 3 root root 4096 Feb 15 18:35 deploymentssrw-rw-rw- 1 root root    0 Feb 12 22:10 ipc.socketdrwx------ 2 root root 4096 Feb 15 19:00 logsdrwxr-xr-x 5 root root 4096 Feb 12 17:12 packagesdrwx------ 4 root root 4096 Feb 12 22:09 plugins-rw-r--r-- 1 root root 1675 Feb 12 22:09 privKey.key-rw-r--r-- 1 root root 1188 Feb 12 22:09 rootCA.pemdrwxr-xr-x 2 root root 4096 Feb 15 18:10 telemetry-rw-r--r-- 1 root root 1220 Feb 12 22:09 thingCert.crtdrwxr-xr-x 4 root root 4096 Feb 14 11:20 workmaschine:/greengrass/v2/logs # ll /total 104drwxr-xr-x   3 root     root       4096 Feb 12 17:12 greengrassComponent runs in GreengrassContainer.Thanks in advanceEdited by: bnjmn on Feb 15, 2021 10:11 AMEdited by: bnjmn on Feb 15, 2021 10:12 AMEdited by: bnjmn on Feb 15, 2021 10:13 AMEdited by: bnjmn on Feb 15, 2021 10:13 AMEdited by: bnjmn on Feb 15, 2021 10:13 AMEdited by: bnjmn on Feb 15, 2021 10:14 AMEdited by: bnjmn on Feb 15, 2021 10:15 AMFollowComment"

Answer: 0I guess I found a solution. Restart the systemd service worked for me:systemctl restart greengrass.serviceCommentSharebnjmnanswered 2 years ago


Question: May I restore a backup snapshot on original instance in AWS lightsail?

"Hello,My I restore a backup snapshot on original WordPress instance in AWS Lightsail? When I search restore snapshot, usually the result shows how to create a new instance with a backup snapshot, rather than restore on existing instance. If do it in this way, does it mean the whole history of the website cannot be recorded in a single instance, and multiple instance will be generated in Lightsail?Any advice will be appreciated.Thanks,WeifengFollowComment"

Answer: "0No.You can use a snapshot to create a new instance, but that new instance is 99.9% identical to the instance that was snapshotted.The work flow would be something like this ...Snapshot original instanceCreate new instance based on snapshotDetach static IP from original instanceAttach static IP to new instanceMake sure new instance is working correctlyDelete original instanceCommentShareDavid Ganswered 4 years ago0Hi David,Thanks a lot for your response. Could you please give me any advice on following questions?if I can only use a snapshot to create a new instance, how could I save the historical snapshots?Is there any other Wordpress host support to restore backup snapshot on existing instance?Thanks again,QidianCommentShareqidian96answered 4 years ago0I would suggest you look into another backup solution.Maybe create another instance, in the same region, and use rsync to copy your content and then create historical backup's from that content.  If you create the backup instance in the same region, there is no data transfer cost if you use internal IP addresses.Snapshots, IMO, are intended for disaster recovery (like if you made a configuration change that caused a problem).CommentShareDavid Ganswered 4 years ago0Hi David,Thank you so much for your suggestion. I think this is the best solution for my question.Have a great weekend.WeifengCommentShareqidian96answered 4 years ago0Hi David,I tried to rsync the instance. However, I just find this information about how to do it in EC2, rather than in lightsail. So is this function not available in lightsail?Thanks,WeifengCommentShareqidian96answered 4 years ago0First of all, what OS are you running?  Linux or Windows?Sometimes I make the mistake of assuming Linux.If it is Linux, then you may need to install the rsync package using the distros package manager.CommentShareDavid Ganswered 4 years ago0Hi David,Thanks a lot for your response. I do use Linux. So, do you mean after install rsync package, I can do it in lightsail? Meanwhile, is there any doc or link to introduce this process?Thanks,WeifengCommentShareqidian96answered 4 years ago0Yes, after you install the rsync package, you will be able to use the rsync program.Check out some of these links for information ...https://www.createdbypete.com/a-practical-guide-to-using-rsync/https://www.tecmint.com/rsync-local-remote-file-synchronization-commands/http://www.yolinux.com/TUTORIALS/Rsync.htmlCommentShareDavid Ganswered 4 years ago0Thanks a lot David. Have a nice day.WeifengCommentShareqidian96answered 4 years ago"


Question: Serverless framework api gateway web sockets authorization bug

"I am trying to use web sockets with serverless framework, but they have a bug.https://github.com/serverless/serverless/issues/6161 if you know the fix please help out.I have tried to work around with a lambda authorizer that calls cognito, but I don t know what the custom authorizer handler should return to API gateway. If I just return the response from cognito it breaks with 500 error.Thanks in advanceFollowComment"


Question: CloudWatch - Alert creation problem: EC2 actions are not available for Metric Math monitors.

"Trying to create a new Alert based on a CPUUtilization metric with minimum statistics and a period of 1 minute.The conditions are the following:Time limit: anomaly detection model.When CPUUtilization is Major (>).Anomaly detection limit 5.ActionsNotification:When In alarm mode, send notification to "Default_CloudWatch_Alarms_Topic"EC2 Action:When In alarm mode, restart this instance (instance ID: )When saving the alarm it throws me the following error:Please if someone can guide me to know what I'm doing wrongthank you so muchFollowComment"

Answer: "0The graph on the first page appears to have two metrics selected.In that case, the EC2 action cannot be set because it may be judged as a formula-based metric.Try to have only one metric to select.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: ERR_SIG_TIMEOUT: An error occurred while connecting to your WorkSpace.

"Dear Experts,We have a "Standard with Windows 10" WorkSpace running in Ireland and are trying to connect via the web client (https://clients.amazonworkspaces.com/webclient#/main).Unfortunately after watching "Connecting" and the arrows chasing each other for a few minutes,  we get this error:"ErrorAn error occurred while connecting to your WorkSpace.Please try again later.If the problem persists please contact your WorkSpaces administrator.ERR_SIG_TIMEOUT"When we connect using the Mac Client is works without a problem.Any ideas?Best,DeclanFollowComment"

Answer: "0Note that the protocol used to connect via a web client is completely different than that used by the MacOS, Windows, Chromebook or mobile clients, so it isn't surprising that one would work while the other might be having problems.I'm just connecting now with the web client to look at it and I too am having the same connectivity problem you are describing so it doesn't seem to be an isolated case (I've a Windows 10 Workspace running in Oregon).I connected via a Windows client and looked at the event log on my workspace and saw this warning:The computer 'WebClient' preference item in the 'Default VM Settings {386871E0-1E30-4EA1-BD1D-2D1D09D618F4}' Group Policy Object did not apply because it failed with error code '0x80070424 The specified service does not exist as an installed service.' This error was suppressed.This corresponds roughly around the time I  was trying to log in.  Looking at older entries, I see an actual error roughly 6 hours ago (3ish a.m.) :Unsupported operating system, this version of Workspace is not currently supported for WebAccess: '10.0.14393.0' - 'Windows_2016_14393-English-64Bit-Workspace_EN_Base-WorkSpaces_EN_Base_WS2016'Not sure why that particular version is not supported.Do you have a similar event log messages on your workspace?CommentShareDonawaAtTeradicianswered 6 years ago"


Question: How to alert if an event doesn't happen within a period of time?

Scenario:For compliance reasons a monitor needs to be in place to alert if a backup either fails or otherwise doesn't succeed.How can we alert if the the rds event category "backup" and id "0002" [Backup Finished] isn't emitted in the last 48 hours?FollowComment

Answer: "1Checking for a negative is always a little tricky.In this case, I'd have something that is triggered by the positive event (Backup Finished) which stores a timestamp somewhere. Then have another process which checks that timestamp at specified intervals - this process would emit an alert if the timestamp is too old.CommentShareEXPERTBrettski-AWSanswered 8 months ago1Please note, as the other contributors have mentioned here, checking for negative is tricky on the managed events and there is no built-in mechanism to achieve this test case. Hence, I would suggest you to consider the below work-around.Create  a lambda function.Utilize the below script. Kindly make the necessary changes to the instance details.Kindly make sure the IAM role associated with this lambda function has appropriate permission to describe the snapshots and to subscribe to SNS.Configure via lambda script to execute every 24 hoursPython script to capture the latest snapshot details  import json    import dateutil.tz    def lambda_handler(event, context):    mydbInstances = ['sandboxinstance']    for mydbInstance in mydbInstances:        snaps1 = [[]*2]        snapshot = []       for snapshot in rds.describe_db_snapshots(DBInstanceIdentifier=mydbInstance,SnapshotType='manual')['DBSnapshots']:           if snapshot['Status']=='available':            snaps1.append([snapshot['DBSnapshotArn'],snapshot['SnapshotCreateTime']])        snaps1.remove(snaps1[0])        snaps1.sort(key=lambda x:x[1], reverse=True)        print ("RDS Snapshot name " ,snaps1[0])        SourceDBSnapshotIdentifierARN=snaps1[0][0]        install_time = snaps1[0][1]        right_now = datetime.datetime.now(dateutil.tz.tzlocal())        diff = right_now - install_time        diff_minutes = (diff.days * 24 * 60) + (diff.seconds/60)        print diff_minutesTrigger E-Mail based on the difference in minutes observed.   notification = "Here is the SNS notification for Lambda function tutorial."        client = boto3.client('sns')        response = client.publish (              TargetArn = "arn:aws:sns:us-east-1:xxxxxx:RDSNote",              Message = json.dumps({'default': notification}),              MessageStructure = 'json'        )CommentShareSUPPORT ENGINEERSanketh Saliananswered 8 months ago0You could also create a file after the job finishes and then check if the file or object in a bucket exists after the certain time period expires.  You'd have to delete it at some point, too, of course, like before the job starts.CommentSharejschwar313answered 8 months ago"


Question: AWS Re/Start Material

how much time the content of the aws re/start course will be available after taking the exam?FollowComment

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 3 months ago"


Question: Monthly RDS charges. Can't see where they're coming from. I've deleted everything.

It just came to my attention I've been getting billed around $20 per month for RDS for about a year. I deleted everything ages ago. No resources show up on the RDS dashboard. How am I supposed to find out where this charge is coming from?FollowComment

Answer: "0Could it be something running in another region?Go to the Billing Dashboard and select one of the bills that has a charge on it for RDS. Scroll down to Charges by Service and you should be able to see a breakdown of what you were billed for by service, and within each service it will be broken down by region.CommentShareRWCanswered a month ago"


Question: Aws glue fbprophet

I have created fbprophet 0.7.1 wheel file on my windows machine and uploaded as an additional python module in aws glue but I’m keep on getting the below error.AttributeError: 'StanModel' object has no attribute 'fit_class'FollowComment

Answer: "0Hi,which method have you used to create the wheel?Have you looked at this blog post?you need the right dependency in the wheel to have it fully working.You can also check the Cloudwatch Log Errors generated by your Glue job to check if there was any problem deploying the external library.hope this helps,FabrizioCommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Is it possible to use artifacts in an S3 Bucket From a Different Region To CodeDeploy Application

"We have a CodeDeploy application running in Asia Pacific 2 and we want to use artifacts that were built and sent to an S3 bucket in US West 2.Is it possible to do this?At the moment if I try to do it the CodeDeploy process fails at the DownloadBundle event with this error message:"The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint."I am using the correct address (copied s3 uri from the s3 bucket). I suspect that error is a generic "can't find the url" type message.If it is a permission issue, can someone point me to how to allow this to work?thanksFollowComment"

Answer: "0Try using the S3 region-specific endpoint as per https://docs.aws.amazon.com/general/latest/gr/s3.htmlExample: https://<your_bucket>.s3.us-west-2.amazonaws.comOr try this:https://s3.amazonaws.com/<your_bucket>If it still not working, check this FAQ for multi-region deployment:https://aws.amazon.com/codedeploy/faqs/#RegionsCommentSharejoahnaanswered a year agoBen Iffland a year agoHi. Thanks for that. Unfortunately when creating a deployment in CodeDeploy it only accepts urls in the format of s3://. I tried changing the out of the box s3:// url to include the region but it didn't work.Regarding the FAQs that you linked me to, I have a couple of questions:It says "copy the application bundle to an Amazon S3 bucket in each region". How do you copy the S3 bucket?It then goes on to say "then start the deployments using either a serial or parallel rollout across the regions". Where do you do this?thanksShare"


Question: "Email forwarding not working. (Using SES, Lambda, Route 53, S3)"

"Hi all,I've tried following on from a few different tutorials online regarding a task I want to complete, which is having any emails sent to my custom domain  forward to a third-party email address. Example tutorials include:https://scripteverything.com/amazon-ses-receive-email/https://www.daniloaz.com/en/use-gmail-with-your-own-domain-for-free-thanks-to-amazon-ses-lambda/https://infra.engineer/aws/11-using-gmail-with-your-domain-utilising-amazon-ses-lambdaI have the created a custom domain in route 53, and the same domain is registered as a verified identify in SES. I'm trying to register an address at that domain. So, for example I have 'customdomain.com' verified, but when trying to register 'name@customdomain.com', I can not receive the messages.I've created the rule sets, have an S3 bucket that is written to from a Lambda function (similar to the ones mentioned in the articles) and inside said function have my third-party address end points defined in forwardMapping. When I send emails to the custom domain, the S3 buckets get written to, and I get the SNS notification (which is sent directly to the third party email address) but I do not get the actual email sent to the third party address. Which means effectively I am unable to register it as a verified identity in SES since I can not receive the email. What possible steps am I missing here?FollowComment"


Question: Create ecs service from ecs-cli

"Hi, I am deploying a service with the ecs-cli console. from my local console the service is deployed perfectly, I integrated the same command but from a pipeline in azure devops but for some reason the task-role remains empty I don't know what could be happening.ecs-params.ymlversion: 1task_definition:  ecs_network_mode: bridge  task_role_arn: arn:aws:iam::xxxxxx:role/analitica-test-prescriptiva-ecs-role  task_execution_role: arn:aws:iam::xxxxxxx:role/analitica-test-prescriptiva-ecs-role  services:    task_auth:      cpu_shares: 0      mem_reservation: 134217728docker-compose.ymlversion: '3'services:  task_core:    image: <URL_IMAGE>    ports:      - "8001:8001"    logging:      driver: awslogs      options:        awslogs-group: /ecs/core_service        awslogs-region: us-east-1        awslogs-stream-prefix: ecsecs-cli compose --project-name testecs --file docker-compose.yml  service up --task-role-arn arn:aws:iam::xxxxxxx:role/analitica-test-prescriptiva-ecs-role --target-group-arn  arn:aws:elasticloadbalancing:us-east-1:xxxxxxxxxx:targetgroup/xxxxxxxxx --deployment-max-percent 200 --deployment-min-healthy-percent 100  --disable-ecs-managed-tags  --health-check-grace-period 0  --scheduling-strategy REPLICA  --container-name task_auth --container-port 8001  --role arn:aws:iam::xxxxxxxxx:role/analitica-test-prescriptiva-ecs-role --cluster analitica-test-prescriptiva-ecsFollowComment"


Question: Message "server is undergoing maintenance"

"Instance i-029a3458f152ffc6e; EC2 reports healthy.  There was an issue ten days ago that led to a restart and the server was working before that.  Deployed new image, rebooted, restarted, server still reports as being under maintenance.FollowComment"

Answer: "0Hello,Thanks for reaching out to us. I see that you're reporting one of your EC2 instances encountered a maintenance issue recently that resulted in a restart of your server. After the instance was restarted, it continues to show as being under maintenance.To begin, please understand that I am unable to post specific information regarding the details of this instance due to our sensitive information handling policies. If you would like to discuss specific details regarding this account and its resources, please open a ticket with our Premium Support EC2 teams [1]. As I am not able to reference this instance, I will provide general guidance based on my experience in this subject.It is quite possible that your EC2 instance encountered an issue at the service level that required your instance to migrate to new underlying hardware. It is also possible (while unfortunate) that it migrated to a new underlying host which has recently become degraded as well. Essentially, you may have migrated from one impaired host to another. While this is very unlikely, it can happen despite our best effort.Since I am unable to confirm that this is the case for this specific instance, you are able to easily refer to your EC2 Scheduled Events area [2] or Personal Health Dashboard [3] in your AWS Console to review ongoing events that affect your EC2 operations.In the situation that there is a scheduled event still affecting your instance, please initiate a stop and start of your instance [4] at a time that works best for you to begin the migration procedure to a new underlying healthy host. This would clear any outstanding scheduled maintenance eventsReferences:https://aws.amazon.com/premiumsupport/https://aws.amazon.com/maintenance-help/https://aws.amazon.com/premiumsupport/technology/aws-health-dashboard/https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#when-instance-startsCommentShareSUPPORT ENGINEERTanner_Sanswered a year ago"


Question: Stopping health check

"My domain, athena.edu, is being bombarded with:" "Amazon-Route53-Health-Check-Service (ref 34c5ddc8-761f-481f-83e1-5d5d91aefb36; report http://amzn.to/1vsZADi)"15.177.50.89 - - [21/Jun/2022:11:04:18 -0500] "GET / HTTP/1.1" 403 - "-" "Amazon-Route53-Health-Check-Service (ref 34c5ddc8-761f-481f-83e1-5d5d91aefb36; report http://amzn.to/1vsZADi)"54.244.52.218 - - [21/Jun/2022:11:04:33 -0500] "GET / HTTP/1.1" 403 - "-" "Amazon-Route53-Health-Check-Service (ref 3f441a8a-32fb-40cf-bafa-23626a1f9f82; report http://amzn.to/1vsZADi)"54.243.31.250 - - [21/Jun/2022:11:04:29 -0500] "GET / HTTP/1.1" 403 - "-" "Amazon-Route53-Health-Check-Service (ref 3f441a8a-32fb-40cf-bafa-23626a1f9f82; report http://amzn.to/1vsZADi)"I did not set this service up and need it to stop. It has caused my hosting service to deny all access.FollowComment"

Answer: "0Hi,I understand you want to stop one of your domains from requesting a health check.Please correct me if I misunderstood.You can configure Route 53 health checks against any public resource.You application is receiving health checks requested from Route 53 ,this may be cased by the following:1)A health check was mistakenly configured against your application by another customer.2)A health check was configured from your account for testing purposes but wasn't deleted when testing was complete.3)The Elastic Load Balancing service updated its public IP addresses due to scaling, and the IP addresses were reassigned to your load balancer.I would recommend you either do one of the methods :1)Find the unwanted health check from the Route 53 console, from the correspondence I can see that it has an ID [34c5ddc8-761f-481f-83e1-5d5d91aefb36], you can follow the detailed steps "To view the status of a health check (console)" listed in AWS documentation [1].2)Delete or block the source of unwanted requests.3)For further assistance you can contact AWS Customer Support, follow link [3]I hope this was helpful!Reference[1]https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/monitoring-health-checks.html[3]https://us-east-1.console.aws.amazon.com/support/home/?nc2=h_ql_cu&region=us-east-1#/CommentShareKaraboanswered a year ago"


Question: Copying EBS Snapshot Across Regions

"I want to copy the EBS snapshots from us-east-1 to us-east-2.Will the snapshot copy be incremental?Here I see the following: "We are excited to announce a performance enhancement to EBS Snapshot Copy, making it faster to copy snapshots across AWS regions. Starting today, we will only transfer the data that has changed since your last snapshot copy, thus transferring and storing less data and completing the copy faster."https://aws.amazon.com/about-aws/whats-new/2013/06/11/amazon-announces-faster-cross-region-ebs-snapshot-copy/#:~:text=The%20copied%20snapshots%20behave%20the,performance%20of%20EC2%20AMI%20Copy.Yet here I see the following: "If you copy a snapshot to a new Region, a complete (non-incremental) copy is always created, resulting in additional delay and storage costs."https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-copy-snapshot.htmlFollowComment"

Answer: "0Accepted AnswerIt would be incremental after the first full copy.Whether a snapshot copy is incremental is determined by the most recently completed snapshot copy. When you copy a snapshot across regions or accounts, the copy is an incremental copy if the following conditions are met:The snapshot was copied to the destination Region or account previously.The most recent snapshot copy still exists in the destination Region or account.All copies of the snapshot in the destination Region or account are either unencrypted or were encrypted using the same CMK.If the most recent snapshot copy was deleted, the next copy is a full copy, not an incremental copy. If a copy is still pending when you start a another copy, the second copy starts only after the first copy finishes.CommentShareAWS-User-1267248answered 2 years ago"


Question: Can GraphQL be deployed to Elastic Beanstalk?

"Customer wants to deploy an existing GraphQL application to AWS. This application will connect to an existing RDS MySQL database and a couple of on-premises databases. Once it's in AWS, the applications that use it will also be migrated to AWS.I told them about AppSync, even though they'd have to use Lambda to connect to their non-Aurora/DynamoDB databases. They asked whether they could use ElasticBeanstalk to deploy it to EC2s that auto-scale with an ELB, but I couldn't find a definitive yes/no. I found a few blog posts that seemed to say EB doesn't support GraphQL, but they were relatively old. They are interested in using the Code suite of services, and CodeDeploy can deploy auto-scaled EC2 instances, but if they can do it through EB or CodeStar that would be even better.Any help would be greatly appreciated!FollowComment"

Answer: 0Accepted AnswerIt is possible to use a Elastic Beanstalk to provision a nodejs app https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_nodejs.html  and you can install Apollo graphQL on a node express server https://www.apollographql.com/docs/apollo-server/v1/servers/express/  so I would expect it possible to deploy a graphQL server on Beanstalk.CommentShareAWS-User-2690830answered 3 years ago


Question: Is Windows 11 available as bundle for AWS Workspaces?

"Hi,I want to deploy AWS Workspace with Windows 11, but I cannot find any bundle with that version of Windows (there's only Windows 10). Is Windows 11 available for Workspaces?In this news it saysWhile Windows Server 10 BYOL WorkSpaces are still supported, you can now choose to run WorkSpaces powered by Windows 11 and benefit from new features such as Trust Platform Module 2.0 (TPM 2.0), and Unified Extensible Firmware Interface (UEFI) Secure Boot. Windows 11 is supported for Standard, Performance, Power and PowerPro bundles. For the best experience with video conferencing we recommend using Power or PowerPro bundles only.So I assume it should be available, but I cannot find it.FollowComment"

Answer: "0It is available through Bring Your Own License, as Windows 10 is. If you have the proper licensing from Microsoft, you can follow our guide with the supported Windows 11 version.We do not offer Windows 10 and Windows 11 License Included versions as that is against Microsoft's SPLA.CommentShareEXPERTStevieStetsanswered 25 days agorePost-User-4824776 25 days agoHi, I'm not sure if I understand. Windows 11 on Workspace is only available if I bring my own license?I was able to deploy Workspaces with Windows 10 a few months ago without BYOL. Isn't that possible with Windows 11?ShareBrettski-AWS EXPERT25 days agoWhat you see as Windows 10 is actually Windows Server 2019 with the Windows Desktop Experience. https://aws.amazon.com/about-aws/whats-new/2021/08/amazon-workspaces-renews-windows-desktop-experience-windows-server-2019-bundles-64-bit-microsoft-office-2019/Share"


Question: AWIS Data Retirement

"I see that the AWIS API is being retired on 15th Dec 2022, but it is unclear if the actual data will be kept updated until then. For example will the web traffic history be added to for each of the days and months upto 15th Dec?FollowCommentMike_O a year agoYou may want to explain what "AWIS API" is and include a link to the retirement announcement.Share"

Answer: "0There was a recent AWS Supports You episode on Twitch, https://www.youtube.com/watch?v=-nfDpE3Rr3Y, where several re:Post questions were covered. You can see an answer to this question at the 22.44 mark.CommentShareStephenHeverin_AWSanswered 7 months ago"


Question: End to End encryption question

"My customer wants to implement a quickstart template to comply with HITRUST requirements. https://aws.amazon.com/quickstart/architecture/compliance-hitrust/This quickstart guide says thatA Secure SocketsLayer (SSL) certificate managed by AWS CertificateManager (ACM) on the load balancer to encrypt all traffic between theinternet and the load balancer. Separateself-signedcertificatesaregenerated on the EC2 instancesto encrypt trafficbetween the load balancer and the application instances.My customer wants to know how is traffic encrypted between ELB and the application?Also, does the traffic being encrypted between ELB and EC2 mean that the traffic from ELB to the application is encrypted? How can you achieve end-to-end encryption between ELB and the application?FollowComment"

Answer: "0Accepted AnswerFrom a quick peek at the CloudFormation templates for this quick start, I can see that the ELB Template sets up a target group to communicate with the application EC2 instances on port 443 via the HTTPS Protocol (TLS). I can see in the Application Template that a launch configuration is created for the application associated with the ELB target group mentioned above. The launch configuration uses an AMI with a user data script to generate a self-signed X509 certificate using openssl. The launch config also installs Apache and configures it to use the instances' self-signed certificate on port 443 as a webserver for WordPress on the same instance.So, consistent with the above text, it seems to me that the load balancer encrypts its connection to the web/app server EC2 instances via HTTPS with a self-signed certificate. I would qualify that as end-to-end encryption between the ELB and the Application. Does that address your question?CommentShareEXPERTJDBanswered 4 years ago"


Question: Step Functions MAP state billing question

"Hello,I was wondering how billing works for the 'map' state in step functions. Let's say I have an array with 100 items and they are processed by map state. States in map state are;1- pass2- wait3- passso in this case there are at least 300 transitions, right? Meaning almost 300 times more expensive than handling all items in a lambda function with a 'for loop' or something similar.I could not find any documentation about the billing of map state. I hope somebody can help me out with this.Thanks!FollowComment"

Answer: "3Accepted AnswerEach step execution, including the steps invoked by map state count as a billable step function state execution.So yes, if you execute 300 steps that is 300 times more expensive then executing 1 step -- in Step Functions CostThe total cost will depend on the cost of the lambda and anything it does as well.One approach to managing large lists is to break the list into 'buckets' using the Map state, then send each 'bucket'  to a lambda call.Example, if you have 1,000,000 objects,  construct a map state that segments them into iterations of 1000 each, then call the lambda 1000 times with 1000 records each.Adjust the size of the buckets as needed for your use case so that the time it takes to execute each bucket is 'reasonable' for your case.If you already can process the largest size of your data set in 1 lambda call and there is no other value in splitting them up, then you dont need map.  Or if the total cost of the worse case is small enough for your use case then use the approach that works best.CommentShareDALDEIanswered a year ago0It depends on the type of workflow you've selected. The standard one is billed by the number of state transitions, so yes if you loop with a map state, it will cost the number of iteration * the number of states in each iteration. If you can use the express workflow, the cost is much lower (you pay per number of executions).How to choose: https://docs.aws.amazon.com/step-functions/latest/dg/concepts-standard-vs-express.html (the main limit is the 5 minutes duration for express vs 1 year for standard...)Pricing: https://aws.amazon.com/step-functions/pricing/CommentShareJerome VDLanswered a year ago"


Question: AWS 50% off on exams

"I have two 50% off discount voucher, can I apply both vouchers on one exam?FollowCommentalatech EXPERT4 months agoHi if the below answered your questions/doubts, I d appreciate if can be accepted so that community can benefit for clarity when searching for same subject. ThanksShare"

Answer: "0Hi,No, you can only apply a single voucher to an exam.Hope it clarifiesCommentShareEXPERTalatechanswered 4 months ago"


Question: Running container-based games on GameLift

"Hi everyone!Since GameLift has a limit of up to 50 game sessions per hardware node, I am trying to find anyway, how can I run more than 50 sessions per node (since the limit of 50 game sessions per node is a REALLY huge waste of resources for my lightweight game).The suggested way was to manage set up FleetIQ manually with EC2 machines (possibly with some built-in autoscaling mechanism). This way should work for us, except for one thing - in this case, we need to run raw binaries instead of containers.If we use simple binaries, we need to work somehow with monitoring, logging, implementing blue-green or canary deployments, and so on. All these concerns can be solved in an easier way by using containers. With the "containers" word I mean Docker container in this case.But running containers on raw EC2 instances seems like is not convenient enough: implementing things like blue-green or canary deployments is not really trivial, etc.I am thinking about the way with AWS ECS, based on EC2 instances. In this case, I can run 1 game session per container as much per node as I can. Fargate is not applicable in my case since the minimal limits for Fargate tasks are too huge for us and it will be a waste of computing resources again.My question is: Can I use GameLift with ECS at the same time? Why I want to use GameLift: it provides more robust Spot instances and these instances will be more suitable for the game.P.S. I also thought about AWS EKS with something like Agones but it's overkill for us, and managing EKS for us is too complex a task.@REDACTEDUSERFollowComment"

Answer: 0Accepted AnswerTake a look at this link: https://github.com/aws-samples/amazon-gamelift-fleetiq-with-amazon-ecsCommentSharerePost-User-0378389answered 2 years ago0@REDACTEDUSERCommentSharerePost-User-9125454answered 2 years ago


Question: What does the Cognito Logout endpoint (/logout) actually do?

"The documentation says:The /logout endpoint signs the user outandThis example clears the existing session ...GET https://mydomain.auth.us-east-1.amazoncognito.com/logout?client_id=ad398u21ijw3s9w3939&logout_uri=https://myclient/logoutWhat does this mean? Does the logout endpoint invalidate refresh tokens / id tokens / access tokens for the user sending the request?I don't think it could because the client_id refers only to App Client ID, not an individual user. It doesn't seem that the endpoint would even know what user the request is associated with.So what does the /logout endpoint actually do?FollowComment"

Answer: "0Log out only invalidates the session.You can call the global sign out , this signs out users from all devices. It also invalidates all refresh tokens that Amazon Cognito has issued to a user.https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.htmlAlternatively :If you want to invalidate the refresh token then the /oauth2/revoke endpoint revokes all of the access tokens that the specified refresh token generated. This is a POST hence this would be a custom signout flow since the log out only supports HTTPS GEThttps://docs.aws.amazon.com/cognito/latest/developerguide/revocation-endpoint.htmlCommentShareJoel_Ponukumatlaanswered 9 months ago"


Question: WorkMail: unable to receive email

I can't receive email through my workman but I'm able to sendFollowComment

Answer: "1HiCan you share the information about your email recieving usecase ?Are you recieving emails via SES to workmail ? If yes, please ensure that you have the correct MX record for inbound region like :10 inbound-smtp.region.amazonaws.comAdditionally, ensure that SES inbound MX records takes precedence or have high priority over other MX records. Kindly note that the lower preference number is the higher priority and two MX records with the same priority will share the incoming emails workload.You might want to also share your Domain that you are using for SES email recieving. If you are not using SES for recieving emails but directly via workmail. Please kindly check on :https://docs.aws.amazon.com/workmail/latest/adminguide/troubleshooting.htmlThank you !CommentSharePumloanswered a month ago0Check your-Email filters-Storage limit for your mailbox-DNS settingsIf you try these to no avail, i'd recommend the support teamCommentShareAWS_Guyanswered a month ago"


Question: X-ray Daemon in ECS Cluster not sending traces

I have set up an X-ray daemon on one of my ECS services as a sidecar by the following guide here https://docs.aws.amazon.com/xray/latest/devguide/xray-daemon-ecs.htmlI have setup Xray daemon as a sidecar to one of the servicewith UDP port 2000 open and task role assigned with appropriate policiesBut the x-ray console didn't receive any traces from the x-ray API:In my log suppose to be shown successfully sent batch after proxy starts but it wasn't.Can anyone help with what I missed please?FollowComment

Answer: 0I'm not sure what language you are using but there is an additional config when using Fargate to set the Xray plugin to ECSPlugin - see here for java.Additionally double check your subnet the container is running in has the internet access to the xray service or the vpc endpoint for xray if running in a private subnetCommentShareEXPERTPeter_Ganswered 7 months ago


Question: How to get Subnet's associated Route Table ID in CloudFormation?

"My CloudFormation template includes creation of an S3 AWS::EC2::VPCEndpoint. In parameters, users select an already-created VPC, Subnet, and AZ. One of the required parameters for S3 endpoint is Route Table Id. For now, I have it set to request a String of Route Table ID ("rtb-xxxxxx") but would like to simplify it for the user by getting it programmatically.The question is, how can I instead get a Route Table ID based on selected Subnet ID? AWS::EC2::Subnet does not support return value for Route Table ID associated with it. I know that I could also do that by calling a Lambda but I was hoping to find a more native solution.The Route Table ID I am looking for is NOT VPC's Main route table.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.htmlFollowComment"

Answer: "0Accepted AnswerCustom Resource (or Macro) is the only way to go. Not only does AWS::EC2::Subnet not support it as a return value as you mentioned, but you're also trying to reference an existing resource not created by your template.Quick sample but do note - DescribeRouteTables will only work if the subnet has been explicitly associated and not for a default route table. That will require extra coding/logic.AWSTemplateFormatVersion: "2010-09-09"Description: Subnet Custom ResourceParameters:   TheSubnet:    Description: Subnet ID    Type: AWS::EC2::Subnet::Id    Default: subnet-32432943294Resources:  CustomFunction:    Type: AWS::Lambda::Function    Properties:      Handler: index.lambda_handler      Timeout: 30      Role: !GetAtt 'CustomResourceRole.Arn'      Runtime: python3.7      Code:        ZipFile: |          import boto3          import json          import urllib          def sendResponse(event, context, responseData, responseStatus="FAILED"):            response_body = json.dumps({              "Status": responseStatus,              "Reason": "See the details in CloudWatch Log Stream: " + context.log_stream_name,              "PhysicalResourceId": context.log_stream_name,              "StackId": event["StackId"],              "RequestId": event["RequestId"],              "LogicalResourceId": event["LogicalResourceId"],              "Data":responseData            })            # Not using the old .put (deprecated)            enc_body = response_body.encode('utf-8')            opener = urllib.request.build_opener(urllib.request.HTTPHandler)            request = urllib.request.Request(event['ResponseURL'], data=enc_body)            request.add_header('Content-Type', '')            request.add_header('Content-Length', len(response_body))            request.get_method = lambda: 'PUT'            response = opener.open(request)            print("RESPONSE {}: {}".format(response.getcode(), response.msg))          def lambda_handler(event, context):            # Delete...            if event['RequestType'] == 'Delete':              sendResponse(event, context, {"Message": "DELETE"}, "SUCCESS")              return '{}'                        try:              ec2 = boto3.client('ec2')              subnet = event["ResourceProperties"].get("SubnetId")              resp = ec2.describe_route_tables(                Filters=                  [                    {                      'Name': 'association.subnet-id',                      'Values': [subnet]                    }                  ]              )              print(resp['RouteTables'][0])              sendResponse(event, context, resp['RouteTables'][0], "SUCCESS")            except:              print("ERROR")              sendResponse(event, context, {"Value": "ERROR"})  CustomResourceRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Statement:        - Effect: Allow          Principal:            Service: lambda.amazonaws.com          Action: sts:AssumeRole          Condition: {}      Path: /      Policies:        - PolicyName: QuerySubnet          PolicyDocument:            Version: '2012-10-17'            Statement:              - Effect: Allow                Action:                  - logs:CreateLogGroup                  - logs:CreateLogStream                  - logs:PutLogEvents                Resource: arn:aws:logs:*:*:*              - Effect: Allow                Action:                  - ec2:DescribeSubnets                  - ec2:DescribeRouteTables                Resource: '*'    SubnetQuery:    Type: Custom::CustomResource    Properties:      ServiceToken: !GetAtt CustomFunction.Arn      SubnetId: !Ref TheSubnetOutputs:  RouteTableId:    Description: Discovered Route Table ID    Value: !GetAtt SubnetQuery.RouteTableIdCommentShareEXPERTRaphaelanswered 3 years ago"


Question: Adding a condition to an IAM Permission causes ec2:CreateImage to not be authorized

"So I have a SSO Role, and I added ec2:CreateImage to the permission set attached to it, and resource is "*". It works fine. As soon as I add a condition like "StringEquals", with the condition being a tag, i.e. aws:ResourceTag/Example, it will not work. It does not have some explicit deny etc. The tag value is correct. I've tried different key,values to rule out spelling errors or some silly mistake.I have tested this in two different environments and I trouble shooted using the Policy Builder (So no syntax issues). I have double checked by deleting the permission (and seeing it blocked), adding the bare permission without conditions (it passes), and then adding a condition (it then fails).I dont see anything in the documentation or dependencies that would cause this to fail. Any reason?FollowCommentsimon 4 months agoFor clarity, can you post an excerpt of the policy json that you are trying to troubleshoot?Share"

Answer: "1Reading your question, it sounds like you are trying to specify Resource:* when using the ConditionKey aws:ResourceTag/${TagKey}. For the action ec2:CreateImage, you must also specify which Resource type when using this ConditionKey. In this case, the Resource type is instance as the other supported Resource type image does not support this ConditionKey.https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-policy-keysIf the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.For example, to match tags on all ec2 instances in an account with ID 111111111111, we must specify "Resource": "arn:aws:ec2:*: 111111111111:instance/*"    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "ec2:CreateImage",            "Resource": "arn:aws:ec2:*:111111111111:instance/*",            "Condition": {                "StringEquals": {                    "aws:ResourceTag/TAG_KEY": "TAG_VALUE"                }            }        }    ]}```CommentSharesimonanswered 4 months agoAWSKid2k 4 months agoHi Simon,I tried that and used the following policy with an example account #, unfortunately it did not work. Is there any possibility that SSO may be conflicting with this? Or that there are dependent permissions? I couldn't see anything amiss in the docs        {            "Sid": "CreateImageCustom",            "Effect": "Allow",            "Action": "ec2:CreateImage",            "Resource": "arn:aws:ec2:*:111111111111:instance/*",            "Condition": {                "StringEquals": {                    "aws:ResourceTag/Example": "ExampleValue"                }            }        }Share"


Question: Is db.t3.medium run in unlimited mode?

"We're inserting a lot of records into the RDS. During the process, we observed that the CPU utilization is throttled down to 10% after running out the CPU credit balance.Here's the Cloudwatch metrics:https://imgur.com/a/P4RGTdMThe insert operations started at around 16:00. The CPU usage was around 100% at the beginning but throttled to 10% at around 18:30. The same moment that we're about to run out of the burst balance.According to the AWS document https://aws.amazon.com/rds/instance-types :"Amazon RDS T3 instances are configured for Unlimited mode, which means they can burst beyond the baseline over a 24-hour window for an additional charge."The RDS t3 instance should be running in "unlimited mode", which should not throttle the CPU usage but charge an additional CPU fee instead when running out the credits?FollowComment"

Answer: "0Yes, t3 uses unlimited CPU credits. Burst Balance is a measure of the gp2 volume burst usage, not related to CPU.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/monitoring-cloudwatch.htmlhttps://aws.amazon.com/blogs/database/understanding-burst-vs-baseline-performance-with-amazon-rds-and-gp2/hth,-PhilCommentShareMODERATORphilawsanswered 2 years ago0We can observe the "Write IOPS" got throttled down to 100 IOPS at the same.https://imgur.com/a/YFCsKKrSo I guess the bottleneck is disk, not CPU.Thank you for the clarification.CommentSharejerryduananswered 2 years ago"


Question: User Defined Functions

I'm using PartiQL to access DynamoDB.Would it be possible to develop my own UDF's and use then in my PartiQL query?If it is possible what would be my next step (I'm new in this area)FollowComment

Answer: "2Hi,DynamoDB only supports a subset of the PartiQL language. UDF's are not currently available. You can see a full list of available features here.CommentShareEXPERTLeeroy Hannigananswered a year ago0Hi Leeroy,Thanks for your reply.Too bad UDF's are not supported.I have to find a different solution.Thanks anyway.kind regardsReyerCommentShareReyeranswered a year ago0Oh I forgot one additional question.The restriction is in DynamoDB, which means that an alternative like Athena would not help either?CommentShareReyeranswered a year ago"


Question: S3_MALFORMED_POLICY - Beanstalk doesn't build any new environment

"Hi there,We are facing this problem since today's afternoon.This error will appear every time we create a any new environment.Screenshot below:https://s3.amazonaws.com/app.audiencerate.com/beanstalk.pngEdited by: enry on Feb 9, 2019 4:05 AMFollowComment"

Answer: 0The issue was related to an invalid bucket policy applied on beanstalk default bucket.CommentShareenryanswered 4 years ago


Question: Integrate AWS Lex with MS Teams

"Hello,Looking to find if there is any documentation around how to integrate Lex bot with MS teams.FollowComment"

Answer: "0HelloThe following link describes integration with any messaging service. You can use it to integrate with MS teams.https://aws.amazon.com/blogs/machine-learning/integrate-your-amazon-lex-bot-with-any-messaging-service/CommentShareAWS-User-5597149answered 3 years ago0Hey @HarshalP, I have tried integrating AWS Lex from the Link you have mentioned and the the Skype Integration sample that has been provided on aws samples Github https://github.com/aws-samples/amazon-lex-skype-integration.  I have created a REST API Gateway and enabled lamba proxy and I have used the API url as the Endpoint for the Micrsoft Bot Framework. I am still getting errors and not able to connect Lex and MS Teams. I believe the sample on Github is built for Bot Framework v3 and not the latest v4, so it had outdated functions. I require assistance in this matter urgently as I am working on a POC.Thanks.CommentShareNitavSanswered 3 years ago"


Question: SES Status Notification with SQS FIFO Queue

"I used a SQS FIFO queue to buffer email status notifications from SES. To increase the processing speed, I would like to have multiple consumer processing the queue. It would requires me to add a MessageGroupId for each item.Can I check how I can specify the MessageGroupId for the email status?FollowCommentEduardo a year agoCould you describe a little bit more about your architecture? I think you are using the SES notifications to send the notifications to a SNS topic, and from there, to a SQS queue. In this architecture, SES doesn't support SNS FIFO, and SNS standard doesn't send the messages to SQS FIFO. I'd like to know how are you sending the notifications to a SQS FIFO and why you need to keep the order of the messages.Share"

Answer: "0Hi,Thanks for reaching out. I would like to echo Eduardo's thoughts here and would like to confirm your use case and how exactly you are sending the SES notifications to the SQS FIFO queue at the moment?Currently, we can only send SES notifications to a standard SNS topic so I am curious how you are sending this to an SQS FIFO queue.  The MessageGroupID is a parameter that we need to set when sending messages to the SQS FIFO queue(unless the message comes from an SNS FIFO Queue). if you are sending messages to an SQS FIFO queue, then you are already somehow setting the MessageGroupID somewhere as this is a required parameter for SQS FIFO queues.https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html#API_SendMessage_RequestParametersImportantMessageGroupId is required for FIFO queues. You can't use it for Standard queues.So it seems there is some context and information that we are missing. Kindly share some additional details and we will do our best to help you.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Hi, thanks for your question. As mentioned by Ryan, SES can send notifications to SNS.I suggest you take a look at this reference architecture and accompanying CloudFormation template to deploy this architecture:https://github.com/aws-samples/communication-developer-services-reference-architectures#SES-Event-ProcessingBest.CommentSharebruno_ganswered 2 months ago"


Question: How to download a file from S3/Elastic Beanstalk instance to local machine using Python?

"I'm trying to transfer a file from S3 to my local machine. I thought runnings3.download_file('bucket', 'key', 'filename')    send_file('filename', as_attachment=True)in my Elastic Beanstalk code will download the file to my local machine but it seems instead to save it on the EB instance instead. No error is being logged either so it's able to download the file, just not to my local machine.Is there a way to transfer the file from the EB instance to the local computer after EB downloads the file from S3? If there's Boto3 Python code that can do that, that would be really good.FollowComment"

Answer: "2Accepted AnswerBased on the send_file() function, am I right that you're using Flask? If the files are small, it might be easier to just keep the file in memory (using get_object()) rather than downloading it to the server's filesystem. For example, something like:s3_result = s3.get_object(Bucket='bucket', Key='key')response = make_response(s3_result['Body'].read())response.headers['Content-Disposition'] = 'attachment; filename=myfile.txt'response.mimetype = 'text/plain' # or whatever the MIME type is of your filereturn responseIf the files are large, you could instead redirect the user to a presigned url (which you can generate using boto3).CommentSharewilliam_oconnellanswered 9 months agoEXPERTChris_Greviewed 9 months ago"


Question: How to connect LDAP after joining EC2 instance to Directory Service Domain?

"Hi folks,I have setup Directory Service in aws, and created windows instance(management instance) to join the domain, and I installed ldap in the windows server, configured public DNS (Alibaba cloud DNS) to point to EIP of the windows server instance, now in windows server I can use ldp.exe and local domain to connect the ldap service, but if want to use public DNS to connect the ldap service, it will fail because the DNS will be resolved as windows server address, then how can I configure the public DNS to point to domain controller? or how to configure in windows server to forward traffic to DCs?thanks in advance if you can share your idea about this.Best regards,BryanFollowComment"

Answer: "0My understanding is that the Directory Service is private so can not be directly exposed to the internet.Easiest way would to be add a load balancer to bridge public/private subnets pointing to the DS servers/endpoints.However, exposing AD to the internet is not a great idea with out lots of controls and security on AD and the VPC. Also bear in mind that AD also uses more than just a single "server" DNS record.What are you trying to achieve by opening up the directory to the internet?It might be easier/wiser to create a "multi site" AD setup and have a DC in another location/cloud that is connected to AWS via secure network (VPN, DX).CommentShareRobin Fordanswered 6 months agoBryan Fang 6 months agoThanks Robin, I am trying to enable RDS authentication with kerberos, and our users are managed by FreeIPA, then I created AWS Directory Service and AWS Managed AD Server instance, want to integrate managed AD with FreeIPA by using LDAP, but facing issue while setup trust.Share"


Question: Feature Request: Transcribe - Support Custom Language Model for Scottish en-AB

Requesting custom language model support for AWS Transcribe for Scottish en-AB.  My organization has a huge use case for this and it would be a critical feature to us using the service.Current Supported Languages and their Supported FeaturesFollowComment