Question: AWS Lake Formation Data Filter Issue

"True must be entered in the field "Row filter expression" (obligatory), so there are performance issues due to True in the condition field.Does anyone have a solution to run the Lake Formation Data Filter without having to enter True?If not, is there a solution to improve the runtime?The average of 10 run times with a database filter and the True expression is 5.443 seconds and the average without the True expression and a database filter is 984 ms.FollowComment"

Answer: "0If you do not need Row-level filtration, you can achieve your goal by including/excluding columns via LF-tags  access control (https://docs.aws.amazon.com/lake-formation/latest/dg/TBAC-security.html) .As an example, please check the code below:Create a Lake Formation tag "Confidential"Assign Confidential True/False to the table columnsGrant to user SELECT privileges to object which has Confidential=False tag assigned (or inherited)Alternatively, you can configure LF-TBAC via console interface. I find this article especially convenient:https://medium.com/towards-aws/lake-formation-data-security-and-data-governance-with-lf-tbac-79b6f44a50e9Please let me know if this answer provided you with some benefit by marking it as acceptedRegardsStas# Create a Lake Formation clientlakeformation_client = boto3.client('lakeformation')# Define the tag key and valuestag_key = 'Confidential'tag_values = ['True', 'False']# Create the tag if not existstry:    response = lakeformation_client.get_lf_tag(    CatalogId=account_id,    TagKey=tag_key    )    print(f"Tag {tag_key} already exists.")except lakeformation_client.exceptions.EntityNotFoundException:    response = lakeformation_client.create_lf_tag(        CatalogId=account_id,        TagKey=tag_key,        TagValues=tag_values    )    if response['ResponseMetadata']['HTTPStatusCode'] == 200:        print(f"Tag {tag_key} has been created.")    else:        print(f"Tag {tag_key} has not been created. See response:")        ## Assign tags to the table and columns# Assign `Confidential=False` to the table ( to be used as a default tag)#Assign `Confidential=True` to the columns with "Confidential" in the name# Create a Lake Formation clientlakeformation_client = boto3.client('lakeformation')# Assign the tag to the tableresponse = lakeformation_client.add_lf_tags_to_resource(    CatalogId=account_id,    LFTags=[        {            'CatalogId': account_id,            'TagKey': "Confidential",            'TagValues': ["False"]        }    ],    Resource={        'Table': {            'CatalogId': account_id,            'DatabaseName': DATABASE,            'Name': TABLE        }    })# get names of all columns from teh tablecolumns = wr.catalog.get_table_types(database=DATABASE, table=TABLE)columns = list(columns.keys())# gen name for all confidential columnscolumns = [column for column in columns if column.startswith("confidential")]# assign the tag to the columnsresponse = lakeformation_client.add_lf_tags_to_resource(    CatalogId=account_id,    LFTags=[        {            'CatalogId': account_id,            'TagKey': "Confidential",            'TagValues': ["True"]        }    ],    Resource={        'TableWithColumns': {            'CatalogId': account_id,            'DatabaseName': DATABASE,            'Name': TABLE,            "ColumnNames": columns        }    })if not USE_NAMED_DATA_CELL_FILTER:    print(f"Assigning LF-TAG to the user {USER_NAME}")    # Create a Lake Formation client    lakeformation_client = boto3.client('lakeformation')    # Assign LF-TAG to the user USER_NAME    response = lakeformation_client.grant_permissions(        CatalogId=account_id,        Principal={            'DataLakePrincipalIdentifier': f'arn:aws:iam::{account_id}:user/{USER_NAME}'        },        Resource={            "LFTagPolicy": {                "CatalogId": account_id,                "ResourceType": "DATABASE",                "Expression": [                    {                        "TagKey": "Confidential",                        "TagValues": ["False"]                    }                ]            }        },        Permissions=[            "DESCRIBE",        ],        PermissionsWithGrantOption=[        ]    )    if not response['ResponseMetadata']['HTTPStatusCode'] == 200:        print(f"Error: ")        pprint.pprint(response)    response = lakeformation_client.grant_permissions(        CatalogId=account_id,        Principal={            'DataLakePrincipalIdentifier': f'arn:aws:iam::{account_id}:user/{USER_NAME}'        },        Resource={            "LFTagPolicy": {                "CatalogId": account_id,                "ResourceType": "TABLE",                "Expression": [                    {                        "TagKey": "Confidential",                        "TagValues": ["False"]                    }                ]            }        },        Permissions=[            "SELECT",        ],        PermissionsWithGrantOption=[        ]    )    if not response['ResponseMetadata']['HTTPStatusCode'] == 200:        print(f"Error: ")        pprint.pprint(response)else:    print(f"User {USER_NAME} permissions are set using named data cell filter {FILTER}")CommentShareStas Khirmananswered 6 days ago"


Question: GUI Console for Windows

GUI Console for Windows is a necessity to fix booting issues for Windows. Troubleshooting via cmd is very limited. When will this feature be availableFollowComment

Answer: "0EC2Rescue has a GUI and can be used to diagnose Windows EC2 instance boot or connectivity issues: https://aws.amazon.com/premiumsupport/knowledge-center/ec2rescue-windows-troubleshoot/It allows you to automatically fix common issues, gather logs and restore previous known good configs in the case of boot problems.There is a good video overview of how to use it here as well: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2rw-gui.html#ec2rescue-walkthroughCommentShareCarlPanswered 8 months ago0Hi Carl,Yes, we have that option. I was looking for an option, where we will get remote console like VMWare, so that we can boot the server in safemode and mount ISO to repair any OS issues.CommentShareGRanjeevanswered 8 months ago0Found a solution!Step1: Spin a Windows 2016 + HyperV AMI which is available in MarketplaceStep2: Ensure VM size belongs to bare metal, like i3.metal. It will take around 20 min for the VM to be fully available with 2/2 checks passedStep3: Spin a new VM inside the HyperV with the impacted OS disk.Refer: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-vm-by-use-nested-virtualizationfor steps on how to spin a new VM from impacted OS disk in HyperVCommentShareGRanjeevanswered 8 months ago"


Question: My usecase for AWS Batch

My system connects to share brokers using REST APIs during trading hours.  Each thread takes care of a user account.  Based on the number of my users several threads have to run simulationsly.  Each thread takes care of a user account with a share broker.Can I use AWS Batch service for this usecase?Or is it better to use several Amazon ec2s by calculating memory and processor requirements?FollowComment

Answer: "0Accepted AnswerYou could use AWS Batch as an alternative to EC2. Batch would take care of load balancing the EC2 fleet, queuing tasks and packing tasks onto instances based on the memory and CPU requirements of the task. If your tasks are fault tolerant you could also use a Spot Compute Environment and take advantage of spot pricing.An alternative could be using AWS Lambda if your tasks are small and will complete within the maximum allowed lifespan of Lambda functions.CommentShareMark_Sanswered a year agoAWS-User-4573028 a year agoThank you.  Lambda doesn't suit me because the program has to live for seven hours.Share"


Question: How to configure LWT with AWS Amplify PubSub module.

We are trying to detect mobile app's MQTT client abrupt disconnections.Is it possible to configure Last Will and Testament with AWS Amplify PubSub module? If so how can we enable and configure this?There does not seem to be anything mentioned in the docs we refer to: https://docs.amplify.aws/lib/pubsub/subunsub/q/platform/js/#subscription-connection-status-updatesFollowComment

Answer: "1Hi,you can detect client disconnections also using AWS IoT Core Lifecycle events. These events are published on reserved topics and can be subscribed by an AWS IoT Rule that can send the information to downstream application for further actions. You can have a look at these two projects on how to use such events in your backend:https://github.com/mangelino/aws-iot-device-connectivy-trackinghttps://github.com/aws-samples/connectivity-management-example-for-aws-iot-coreCommentShareEXPERTMassimilianoAWSanswered 2 months ago"


Question: Using AWS OpenSearch - am I able to adjust cluster settings - particularly our watermark

"Tried and gotcurl -H 'Content-Type: application/json' -k -u 'user:pass' -XPUT 'https://localhost:9902/_cluster/settings' -d '{  "persistent": {    "cluster.routing.allocation.disk.watermark.low": "85%",    "cluster.routing.allocation.disk.watermark.high": "90%",    "cluster.routing.allocation.disk.watermark.flood_stage": "95%",    "cluster.info.update.interval": "1m"  }}'➜  prod ./adjust-settings.sh{"Message":"Your request: '/_cluster/settings' payload is not allowed."}%FollowComment"

Answer: "0Yes, those are not configurable in the managed Amazon Opensearch. You can see the supported operations on this page -  https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-operations.htmlCommentShareAlex_Tanswered 2 months ago"


Question: Crawler can't skip header first line

"Hi All,I trying to use crawler to add tables in a Glue Database from CSV files. That works in the most folder/tables, but if the file have only strings separated by commas, crawler can't identify the first line by the name of columns and each one receive names like: col1, col2, etc..In the tables properties with wrong schemas I can't see this property: "skip.header.line.count": 1Someone of you know how can I force crawler to skip the first line?Thank you.FollowComment"

Answer: "1I know this is an extremely old topic, but for those of you finding this result in a search engine, the proper way to solve this is by using a classifier on your crawler. You could either explicitly specify the column headings, or allow auto detection of the column headings within the classifier, more details here:  https://docs.aws.amazon.com/glue/latest/dg/custom-classifier.html .CommentShareJonLegendanswered 3 years ago0Make sure that csv file contains mixed datatypes (string, numeric)  and rerun the crawlerExample,name,age"john",10CommentShareShivananswered 4 years ago0Hi ShivanThank you for your answer.This CSV file have only string data, not mixed datatypes.You know: Why in this case the crawler can't identify correctly?CommentShareraulurzuaanswered 4 years ago0I do not know however, you can add manually skip header table property manually and change the column but, it beats the crawler purpose.CommentShareShivananswered 4 years ago0Seems like Classifiers don't help when there are multiple pre-amble lines (e.g. 6 lines) in the file before the headers and data begin (for CSV format, at least). This is a pity as we have to do some manual data-cleansing outside of Glue.CommentShareeggzoticanswered 2 years ago"


Question: Transit Gateway Inter-region Peering Pricing

"At the time of writing, the pricing page does not explicitly mention pricing for this new feature. Would it be correct to assume that you pay the attachment costs for each peered TGW and inter-region) traffic costs (as in VPC peering)?FollowComment"

Answer: 0Accepted AnswerThe Transit Gateway inter-region peering will have the attachment charges same as regular attachments. The TGW owner will be charged on an hourly basis.There is will be no difference in data processing and it will be same as the VPC cross-region peering for cross region data transfer.CommentSharesumitawsanswered 3 years ago


Question: Allow AWS SSO Login using Windows Desktop credentials

Looking oto see if it is possible to have a user do the following:Log in to their Windows desktop computer using their AD credentials.Navigate to the AWS SSO page and have them be automatically logged in because they are already authenticated in Windows.Is this functionality possible?FollowComment

Answer: "1Accepted AnswerHi Carlos,AWS IAM Identity Center (formerly AWS SSO) supports a SAML based IdP. By configuring it to a domain controller using Active Directory Federated Services and enabling Integrated Windows Authentication, you should be able to have a user logon to their desktop and not be prompted once they navigate to the AWS IAM Identity Center login page.If there are any further questions feel free to ask. If this answer is satisfactory to you please mark it as accepted.Thanks!CommentSharerePost-User-5866180answered 2 months ago"


Question: "Unable to use ANY(), ALL(), SOME()"

"Has anyone seen an error like:Problems with function : ANY. Either the function does not exist, or there is a problem with a dependent functionSELECT * FROM "mytable"."temperature" WHERE device_name <> ANY('Foo', 'Bar')Edited by: dwery on Nov 22, 2020 9:50 AMFollowComment"

Answer: "0Accepted AnswerThe keyword VALUES should be used if the comparison values is a list of literals e.g. SELECT * FROM "mytable"."temperature" WHERE device_name ANY(VALUES 'Foo', 'Bar'). Same for ALL and SOME too. The alternative syntax isSELECT * FROM "mytable"."temperature" WHERE device_name ANY (SELECT 'Foo' UNION ALL SELECT 'Bar')CommentShareRajesh Iyer - AWSanswered 3 years ago0VALUES worked, thank you.CommentSharedweryanswered 3 years ago"


Question: S3 replicate latest version

"I have set up S3 replication from a version bucket to another (versioned) bucket on the same account (SRR). A tag is used to scope the replicated file(s).Every night, a new version of each file is uploaded to the source bucket, and this new version becomes the current version (versioned backups).With a batch operation, I have replicated the current version of the file to the destination bucket without problems, so permissions are set correctly. I understood only current versions will be replicated, not previous versions.However, replication does not seem to take place at all when a new version is uploaded to the source bucket. The destination bucket only has the version from the batch operation, which is 4 versions behind on the source bucket.Why are the new versions not replicated?FollowComment"

Answer: "0I would start with examining the permissions assigned to the replication role. It should look something like this:{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "s3:GetReplicationConfiguration",                "s3:ListBucket"            ],            "Resource": "arn:aws:s3:::primary-bucket",            "Effect": "Allow"        },        {            "Action": [                "s3:GetObjectVersion",                "s3:GetObjectVersionAcl",                "s3:GetObjectVersionTagging"            ],            "Resource": "arn:aws:s3:::primary-bucket/*",            "Effect": "Allow"        },        {            "Action": [                "s3:ReplicateObject",                "s3:ReplicateTags",                "s3:ReplicateDelete"            ],            "Resource": "arn:aws:s3:::secondary-bucket/*",            "Effect": "Allow"        }    ]}And have a trust policy like this:{    "Version": "2008-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "s3.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}CommentShareEXPERTkentradanswered a year agoAWS-User-9889580 a year agoI checked the role against your suggestion and it contains all statements you have specified (I let AWS generate the role with permissions and trust policy and it contains a bit more, I suspect it generated a CRR version, while I only really need SRR).The role permissions do not seem to be the issue, since replication with the batch job succeeded initially. But, running a batch job again does not replicate the latest version to the destination bucket.Share"


Question: Does anyone have OpenZFS filesystem with AWS Parallelcluster  working ?

"Q: Has anyone created an OpenZFS volume in FSx and been able to mount the volume using the pcluster3 cli in AWS Parallelcluster ?It doesn't seem to work. I created an OpenZFS filesystem, but I can't get it to mount using from in the pcluster cli. I do not have this issue with other filesystems.  The YAML descriptors for the filesystem mount looks like this:SharedStorage:  - Name: modelingtest    StorageType: FsxLustre    MountDir: /fsx    FsxLustreSettings:      FileSystemId: fs-045ffe08c17984010It seems the CLI spits out a non-descriptive error before the cluster build even starts. This looks like a cli bug to me.pcluster create-cluster --cluster-configuration ./bluefishtestfsx.yaml --cluster-name testami --region us-east-1{  "message": "'NoneType' object has no attribute 'get'"}The documenation  for this is interesting too. It says you need to specifiy the storage size unless the "FileSystemID" is specified.https://docs.aws.amazon.com/parallelcluster/latest/ug/SharedStorage-v3.htmlIf I add the filesystem size, we get a different error which makes sense. pcluster create-cluster --cluster-configuration ./bluefishtestfsx.yaml --cluster-name testami --region us-east-1{  "configurationValidationErrors": [    {      "level": "ERROR",      "type": "ConfigSchemaValidator",      "message": "[('SharedStorage', {0: {'FsxLustreSettings': {'_schema': ['storage_capacity is ignored when an existing Lustre file system is specified.']}}})]"    }  ],  "message": "Invalid cluster configuration."}FollowComment"

Answer: "0Accepted AnswerToday, ParallelCluster only supports mounting FSx for OpenZFS file systems using custom bootstrap actions.You need to include your mount -t nfs -o nfsvers=4.1 fs-12345.fsx.us-east-1.amazonaws.com:/fsx/ /localpath command in a script, and reference that script under CustomActions: OnNodeConfigured on HeadNode and Scheduling:SlurmQueues in your ParallelCluster configuration file.CommentSharedelwioanswered a year ago0AWS ParallelCluster launched support for FSx OpenZFS in 3.2.0. You can read more about it here: https://aws.amazon.com/blogs/hpc/expanded-filesystems-support-in-aws-parallelcluster-3-2/Essentially you pre-create the filesystem and mount it like:- MountDir: /openzfs    Name: OpenZFS    StorageType: FsxOpenZfs    FsxOpenZfsSettings:      VolumeId: fsvol-02222222222222222CommentShareswsmithanswered 21 minutes ago"


Question: "Template format error: Unrecognized resource types: [AWS::Backup::BackupPlan, AWS::Backup::BackupVault, AWS::Backup::BackupSelection] in eu-central-2?"

"Hi everyone,I'm trying to deploy backup plan for RDS database but get the following error:Template format error: Unrecognized resource types: [AWS::Backup::BackupPlan, AWS::Backup::BackupVault, AWS::Backup::BackupSelection]The resource type definition is correct according to the CloudFormation documentation and previous tests I executed with standard CloudFormation stacks.The region of choice is eu-central-2 (Zurich), and according to documentation, AWS service "AWS Backup" should be available in that region since 2023-04-13.But why is CloudFormation unable to deploy the AWS::Backup resources?Would be great to get some help and if it is a bug to address this to the AWS support team.Best regards and thanks in advance!FollowCommentVikas a month agoIs it possible for you paste Cfn templates here?Share"

Answer: "0Can you do that you want from Console on AWS Backup service ? Just for 1 resource and 1 time to validate that Backup itself is available in region ZurichAlso did you properly enable region Zurich via console: see https://docs.aws.amazon.com/general/latest/gr/rande-manage.htmlCommentShareDidier_AWSanswered a month agorePost-User-1981346 a month agoYes, it is possible to create it manualy but not using cloud formation. Also region is enabled for that accountSharerePost-User-1981346 a month agoWe are using eu-central-2 already for the rest of the setup. Here is CF template:"fastdbbackup0BBC74B5": {"Type": "AWS::Backup::BackupPlan","Properties": {"BackupPlan": {"BackupPlanName": "fast-db-backup","BackupPlanRule": [{"Lifecycle": {"DeleteAfterDays": 35},"RuleName": "Daily","ScheduleExpression": "cron(0 5 * * ? *)","TargetBackupVault": {"Fn::GetAtt": ["fastdbbackupVault282CEB00","BackupVaultName"]}},{"EnableContinuousBackup": true,"Lifecycle": {"DeleteAfterDays": 1},"RuleName": "fast-db-backupRule1","TargetBackupVault": {"Fn::GetAtt": ["fastdbbackupVault282CEB00","BackupVaultName"]}}]}},"Metadata": {"aws:cdk:path": "dev/FastDBStack/fast-db-backup/Resource"}},"fastdbbackupfastdbselectionRoleC29F96D2": {"Type": "AWS::IAM::Role","Properties": {"AssumeRolePolicyDocument": {"Statement": [{"Action": "sts:AssumeRole","Effect": "Allow","Principal": {"Service": "backup.amazonaws.com"}}],"Version": "2012-10-17"},"ManagedPolicyArns": [{"Fn::Join": ["",["arn:",{"Ref": "AWS::Partition"},":iam::aws:policy/service-role/AWSBackupServiceRolePoliShare"


Question: created credentials don´t work

"I created new credentials to be used for sending emails with AWSSES, but when  I copied&pasted them to be used by my email server (sending to email-smtp.eu-central-1.amazonaws.com:587), they don´t work and I get invalid credentials errors. I noticed that the new password is a lot shorter than previous passwords.Any idea how to trouble shoot?Thanks, JoachimFollowComment"

Answer: "0Hi Joachim,Could you test the policies for your new created user? Just go to IAM > In the main Dashboard go to Policy Simulator (right menu of your screen) > Select your (Service) Account > Select all actions from Amazon Simple Email Service v2.Are your desired actions green?Let me know if this helps.Best regards, Gabriel BartholomeuCommentShareGabriel Bartholomeuanswered 10 months agoJoachim 10 months agoHi Gabriel,I cannot even select the security credentials (aka Access key ID) in the policy simulator. My understanding is, I am not supposed to use user ids directly.Regards, JoachimShare0Hi Joachim,I will create another answer so you are notified about the reply. Could you describe step-by-step how you created your credentials? Are your issue regarding the IAM Service Account user or is it the SMTP credentials?Best regards,Gabriel BartholomeuCommentShareGabriel Bartholomeuanswered 10 months ago0Hello Gabriel,In IAM I do have a user (existing) and for that user I created a new access key on the security credentials tab, and I copied access key id and secret to user and password respectively on my email server for outbound relay - and it didn´t work. Afai remember, that´s how I did roughly 6 months ago, as the access keys expire occassionally. I just created yet another set, but how can I test that it can authenticate?Thanks, JoachimCommentShareJoachimanswered 10 months ago"


Question: facebook 2.9 api expires in 4 months

"Facebook will stop supporting Graph API 2.9 (the version cognito uses) in 4 months.Are there plans to update Cognito?If not, I need to start now to remove my dependency on Cognito.FollowComment"

Answer: "0Can I get an answer to this?Also, does anyone else not have this same question?  If not, why not?(I think this would be of huge concern to most cognito users?)CommentSharethetaanswered 4 years ago0We will continue supporting Facebook and the update will be completed well ahead of time.CommentShareSUPPORT ENGINEERAbhilash_Kanswered 4 years ago0Thanks!CommentSharethetaanswered 4 years ago"


Question: typescript support for Beam in Kinesis Analytics

"Hi, I'm trying to figure out if Typescript is supported in Kinesis Data Analytics using Beam. I found this tutorial that uses Java, Flink, & Beam:https://docs.aws.amazon.com/kinesisanalytics/latest/java/examples-beam.htmlApache Beam source code has some examples of running Typescript with Flink https://github.com/apache/beam-starter-typescript , so I was wondering if the same runtime will support Typescript.Would this work: zip up the whole typescript source code, put it in S3, & point the Code Location at that zip file?Is Typescript + Flink support (and tutorial) on the roadmap for Kinesis Data Analytics?Thanks for any pointers.FollowComment"


Question: "AWS DynamoDb scan makes two HTTP requests to server provoking an error, why"

"I've a typescript react application who's using dynamo db services for storing data. I've javascript middleware that manages the db access operations. I developed locally the scan and put and delete operations with no errors. Once I setup the production environment, I have an error. If I execute the code locally with production environment I have the same error.I noticed that scan operation fails. Actually it fails in a weird way, because I saw that request to aws server is done twice.To make my debug life simple I moved for debugging all db access within my react onClick method, in order to isolate the operation from lifecycle of the application.I noticed that:the onClick fetch operation is indeed called once (as expected)the DynamoDb scan operation is indeed called once (as expected)the calllback of the scann is executed twice (not as expected)the first time data is indeed fetched and I can log it (perfect)the second call is executed with an erroraws config codeconst awsConfig = {  accessKeyId: process.env.REACT_APP_AWS_ACCESS_KEY_ID,  secretAccessKey: process.env.REACT_APP_AWS_SECRET_ACCESS_KEY,  region: process.env.REACT_APP_AWS_REGION,  endpoint: process.env.REACT_APP_AWS_ENDPOINT}new AWS.Endpoint(awsConfig.endpoint || '')AWS.config.update({  region: awsConfig.region,  //endpoint: awsConfig.endpoint || '',  credentials: new AWS.Credentials(awsConfig.accessKeyId || '', awsConfig.secretAccessKey || ''),  sslEnabled: false,  maxRetries: 5})const dynamoDbClient = new AWS.DynamoDB.DocumentClient()// note to this part of the code, Typescript gives me an error if I leave the endpoint in the AWS.config.update so I set it differently new AWS.Endpoint(awsConfig.endpoint || '')Argument of type '{ region: string | undefined; endpoint: string; credentials: Credentials; sslEnabled: false; maxRetries: number; }' is not assignable to parameter of type 'ConfigurationOptions & ConfigurationServicePlaceholders & APIVersions'.  Object literal may only specify known properties, and 'endpoint' does not exist in type 'ConfigurationOptions & ConfigurationServicePlaceholders & APIVersions'.ts(2345)or    const awsConfig = {      accessKeyId: process.env.REACT_APP_AWS_ACCESS_KEY_ID,      secretAccessKey: process.env.REACT_APP_AWS_SECRET_ACCESS_KEY,      region: process.env.REACT_APP_AWS_REGION,      endpoint: process.env.REACT_APP_AWS_ENDPOINT    }    const dynamoDb = new AWS.DynamoDB({      region: awsConfig.region,      endpoint: awsConfig.endpoint,      credentials: new AWS.Credentials(awsConfig.accessKeyId || '', awsConfig.secretAccessKey || ''),      sslEnabled: false,      maxRetries: 5    })    const dynamoDbClient = new AWS.DynamoDB.DocumentClient({      service: dynamoDb    })and this isaws database access codeconst searchParams = { TableName: 'table' }let dataItems: DateFields[] = []await dynamoDbClient  .scan(searchParams, (error: any, data: any) => {    if (error) {      console.error(`Error fetchCategories: `, JSON.stringify(error, null, 2))      return    }    dataItems = data.Items  })  .promise()//with the following errorError fetchCategories:  {  "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.",  "code": "InvalidSignatureException",  "time": "2020-04-29T08:39:14.449Z",  "requestId": "xxxxxxxxxxxxxxxxxxx",  "statusCode": 400,  "retryable": false,  "retryDelay": 15.082420221534553}{"__type":"com.amazon.coral.service#InvalidSignatureException","message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}Any idea why this is happening? Thanks a lotFollowComment"

Answer: "0The issue lies in the aws access code and to fix it I updated the DynamoDB client like this:  try {    const data = await dynamoDbClient.scan(params).promise()    return data.Items  } catch(error) {    logError(operation, error)  }This change in the code prevents:-the callback to be executed twice;-the server to answer with an error that probably reflects an AWS security mechanism blocking multiple identical and consequential server query.CommentSharealessandrorabittiadidasanswered 3 years ago"


Question: InvalidRequestException Asset Model Property name is not unique

"Hi,I'm using aws-sdk-go-v2 to create/update IoT SiteWise asset model. But i get "Property name is not unique" error. In API document, i could not find how to get/create/delete asset model property directly.However, i can create asset model with the property name on IoT SiteWise console. What's the difference between SDK and console?How could i solve this error from SDK? Or how could i get/delete asset model property directly?aws-sdk-go-v2:https://github.com/aws/aws-sdk-go-v2API document:https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iotsitewisecode:// generate required configassetModelName := "test"assetModelPropertyList := []types.AssetModelPropertyDefinition{}propertyName := "WindSpeed"propertyDataType := types.PropertyDataTypeDoublepropertyType := &types.PropertyType{Measurement: &types.Measurement{},}property := types.AssetModelPropertyDefinition{Name:     &propertyName,DataType: propertyDataType,Type:     propertyType,}assetModelPropertyList = append(assetModelPropertyList, property)// setting sitewise asset model inputnewConf := &iotsitewise.CreateAssetModelInput{AssetModelName:       &assetModelName,AssetModelProperties: assetModelPropertyList,}output, err := client.CreateAssetModel(ctx, newConf)if err != nil {return nil, err}Edited by: johnDa on Nov 16, 2021 5:11 PMFollowComment"

Answer: "0Sorry, it is a bug in code. I created propertys with the same name in AssetModelPropertyDefinition array.CommentSharejohnDaanswered 2 years ago"


Question: The authorization header is malformed; the region '<AWS Region>' is wrong; expecting '<AWS Region>'

"I have two buckets, one in eu-west-1 and one in us-east-1. Lambda@edge executes on origin requests. The request is dynamically recreated based on the origin of the client. I spun up two servers in respective regions and perform a simple curl to get a file. The file exists on the same path on both buckets. The file consists of single line describing the region, that would allow me to know which region it's in. When the request originates from eu-west-1 the request goes through successfully. However, when the request originates from us-east-1 it fails. All the other posts about this error haven't helped me unfortunately. Anyone have an idea what the issue might be? I will provide more details about the setup if that's needed.Error:$ curl -L cdn.mywebsite.cloud/welcome.html<?xml version="1.0" encoding="UTF-8"?><Error>AuthorizationHeaderMalformed<Message>The authorization header is malformed; the region 'eu-west-1' is wrong; expecting 'us-east-1'</Message><Region>us-east-1</Region><RequestId>N93PW0DBYKD9J801</RequestId><HostId>PVi9MrrxoPmWMIV48Ao/eNogihE/TFFAGvPjkwvRfBZPHLl4Myys5SQ/3vxY1WYuLXmIBt5dJGE=</HostId></Error>Lambda@edge logic:us_bucket = "cdn-origin-bucket-us-east-1-XXXX.s3.us-east-1.amazonaws.com"eu_bucket = "cdn-origin-bucket-eu-west-1-XXXX.s3.eu-west-1.amazonaws.com"# ap_bucket = "mybucket-ap.amazonaws.com"default_bucket = "cdn-origin-bucket-us-east-1-XXXX.s3.us-east-1.amazonaws.com"# Regions Mappingregions_mapping = {  # NA  "us-east-1": us_bucket,  "us-east-2": us_bucket,  "us-west-1": us_bucket,  "us-west-2": us_bucket,  "ca-central-1": us_bucket,  # EU  "eu-central-1": eu_bucket,  "eu-central-1": eu_bucket,  "eu-west-1": eu_bucket,  "eu-west-2": eu_bucket,  "eu-west-3": eu_bucket,  "eu-north-1": eu_bucket,}def lambda_handler(event, context):  request = event['Records'][0]['cf']['request']  # Identify edge region  lambda_region = context.invoked_function_arn.split(':')[3]  # Get S3 bucket based on regions mapping  domain_name = regions_mapping.get(lambda_region, default_bucket)  # Update origin request object  request['origin']['s3']['domainName'] = domain_name  request['origin']['s3']['region'] = lambda_region  request['headers']['host'] = [{'key': 'host', 'value': domain_name}]  return requestI have followed this AWS guide Using Amazon CloudFront and Amazon S3 to build multi-Region active-active geo proximity applications.FollowComment"

Answer: "0Try using this code to get the region more effectively:import osdef lambda_handler(event, context):runtime_region = os.environ['AWS_REGION']CommentSharevtjeananswered a month agoforoozf001 a month agoI'm afraid this doesn't adress the issue, but thanks for the inputShare"


Question: Transfer Family vs Lambda Function for file transfer from SFTP server

"Hello Community,I was trying to narrow down to use one of the options to transfer files from the SFTP server to the S3 bucket, so as to help my Glue jobs because AWS Glue doesn’t support data loads from other cloud applications, File Storages. So, here I am trying to choose one, either AWS transfer Family or AWS lambda function that can connect to the remote server, and move them into the S3 bucket/folder which becomes the source of my integrations.I greatly appreciate it if you could share some insights into this scenario, and the advantages, and drawbacks of choosing one over the other. Any bottlenecks that you guys faced in using either of these services before for file transfer? Which is more cost-effective, suppose we say we have gigabytes of data(files).Thank you.Best,TharunFollowComment"

Answer: "2Hi,Lambda would be better suited for post-delivery data processing operations AFTER the files were fully delivered. Lambda would play no role in the direct SFTP file transfer.Depending on how many files would be transferred or it's size the Lambda function could reach it's limits https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.htmlOne of the limits to keep in mind is the Lambda function timeout of 900 seconds (15 min)Benefits of using AWS Transfer Family are detailed here: https://aws.amazon.com/aws-transfer-family/mftFeatures of AWS Transfer Family are detailed here: https://aws.amazon.com/aws-transfer-family/featuresSeveral blog posts that detail how to setup AWS Transfer Family can be setup and deployed to protect your File Transfer workflows:https://aws.amazon.com/blogs/storage/configuring-your-ftps-server-behind-a-firewall-or-nat-with-aws-transfer-family/https://aws.amazon.com/blogs/storage/secure-your-aws-transfer-family-sftp-and-ftps-vpc-public-endpoints/CommentShareNuno_Qanswered 8 months ago1What Nuno mentioned is correct. Lambda is not a good option for moving files from on-prem to AWS. I would like to make you aware of some other options as well for moving files from on-prem to AWS S3.If you want to move files from on-prem to S3 on a schedule, you can also look at AWS DataSync - https://aws.amazon.com/datasync/There are also some good blogs on AWS DataSync - https://aws.amazon.com/blogs/storage/tag/aws-datasync/If you want the ability to also access files on S3 for your on-prem users, you can also look at File Gateway - https://aws.amazon.com/storagegateway/file/There are blogs on AWS File Gateway - https://aws.amazon.com/blogs/storage/tag/aws-file-gateway/You can look at the AWS Cost Calculators for each of these services to estimate the costs based on your usage patterns.CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: Launch EC2 with storage requirements

"I have to launch an EC2 instance, running RHEL 8, with some storage requirements. And I was wondering how to set it up.>= 60 GB free storage for requirements:>= 50 GB of free storage on the partition that contains /var/lib/<name>. The partition mountpoint should not have the noexec option.>= 5 GB of additional space in /var/log>= 5 GB of additional space in /var/lib/<othername>>= 500 GB of dedicated storageFollowComment"

Answer: 0It depends on whether you want those directories as separate partitions/file systems or not (in order to limit their growth). If you want a single large filesystem then you can launch an EC2 instance with an EBS volume of a size that meets your requirements (60 + 50 + 5 + 5 + 500 = 620 GB).But you can also launch the instance with four EBS volumes of appropriate sizes and mount them using the options that you want - or any option in between. It's completely up to you.Note that you can expand EBS volumes if you need to.CommentShareEXPERTBrettski-AWSanswered 2 months ago


Question: Can you automate cross-account private CA certificate renewal through AWS RAM and ACM Private CA?

"We're planning to use AWS RAM and ACM Private CA for central private certificate authority (CA) management across multiple AWS accounts. If we were to use AWS RAM in one account (account A) to share a private CA with a second account (account B), and then account B uses the private CA from account A in ELB and CloudFront, would the private CA in account B also be renewed automatically when the private CA in account A is renewed? Or would we need to do that manually?FollowComment"

Answer: "0Accepted AnswerCA certificates aren't automatically renewed through ACM Private CA, so you'll have to manually reimport a certificate in account A's private CA. The private CA in account A will automatically come back to its previous state (ACTIVE) and be shared with account B without changing the ARN or ID of the private CA. If your services are exposing the whole certificate chain, then those will have to be updated to match the new shared private CA certificate. For more information, see Updating your private CA in the ACM Private CA user guide.Note: AWS Certificate Manager (ACM) provides managed renewal for Amazon-issued SSL/TLS certificates. This means that ACM will either renew your certificates automatically (if you're using DNS validation), or it will send you email notices when your certificate expirations are approaching.CommentShareJeff Lombardo-AWSanswered 2 years ago"


Question: Block creating public API Gateway endpoints

My customer wants to block their organization from creating Edge and Regional API Gateway endpoints (only allowing private).I can't find a way to do this with an SCP since there is no action or condition around creating the API.Any suggestions?FollowComment

Answer: 0Accepted AnswerIn that case the best way to do it is using AWS Config.  Create custom AWS Config Rule if not already present to trigger a lambda function on creation or modification of APIGateway endpoint. Test the conditions in Lambda and take an action to either delete the endpoint and modify it to private.CommentShareMODERATORAWS-User-3370198answered 3 years ago


Question: AWS Data Analytics - Use of Java

"Hi All, I've started learning AWS Data Analytics. While going through study material I have found use of Java code/programming.Can someone please guide me what level of Java expertise needed to get expertise in AWS data analytics?FollowComment"

Answer: "0Are you talking about the AWS Data Analytics certification, or in general?  I don't remember having to do any Java coding when getting the certification, and it's not listed in the study guide.As far as skills required for "expertise" in AWS Data Analytics in general (i.e. as a practitioner), I can't answer that, as there are many tools, languages, and ways on the data analytics journey.CommentShareDan_Hanswered a year agoAWS-User-5183915 a year agoHi Dan_H,Agree. There are many tools, languages in AWS Data Analytics.My question is on Java. I can see in "Kinesis Data Stream" study material, all examples are based on Java. I wanted to understand what proficiency one should need in Java to be able to perform tasks in AWS? (Beginner, intermediate or Mastery)?I can also see, one can use other languages like Python, but it still uses Daemon which calls Java.Share0QQ: What study material are you referencing? Is it a general "learn AWS Kinesis" or something else?The easiest way to evaluate skill level might just be to look at some code, and see if you're comfortable with it?There are 4 more in the examples documentation on AWS DocsCommentShareDan_Hanswered a year ago"


Question: How does the Remote WRite URL work with Windows Systems for amazon managed prometheus

"Where do i configure the Remote Write URL when working with Windows Instances?From this documentation:https://github.com/prometheus-community/windows_exporterI see this:msiexec /i <path-to-msi-file> ENABLED_COLLECTORS=os,iis LISTEN_PORT=5000Would the command be:msiexec /i <path-to-msi-file> ENABLED_COLLECTORS=os,iis LISTEN_PORT=5000msiexec /i c:\temp\windows_exporter-0.16.0-amd64.msi ENABLED_COLLECTORS=os,logon,cpu,cpu_info,logon,memory,net,logical_disk LISTEN_PORT=5000 --REMOTE_ADDR=https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-XXXXFollowComment"


Question: Wordpress Lightsail Instance keeps crashing even with very little traffic.

"I have a very simple ecommerce website with very low traffic on Wordpress Lightsail Instance (512 MB RAM, 1 vCPU, 20 GB SSD). The website keeps crashing from time to time even with very low traffic (10-20 views a day max). I know the obvious solution would be to choose a higher plan but I am not convinced that would solve the problem as I don't know what's exactly going wrong. Thus, I would like to get some guidance for what and where to look for to solve this issue and also if anyone knows the possible causes?FollowCommentAWS-User-9379790 a year agoPriyesh Did you resolve your issue as I have the same thing - I am creating two websites and both have exactly the same issueL  I am having to constantly stop and restart the instances. I am still creating my sites and they are only tiny at the moment with no visitors but its sooooooooooo slow and just keeps stopping. It's a nightmare - I'm thinking of giving up with AWS etc as I just keep having issues and getting answers is not that easy :-(Share"

Answer: "0I haven't worked with WordPress for over 7 years and I can't remember almost anything but I think you should setup logs and inspect them next time:https://blog.hubspot.com/website/how-to-set-up-wordpress-error-logs-in-wp-configCommentShareScreen nameanswered a year agoPriyesh Shah a year agoHi, Thanks for the answer, I'll set that up. However, it seems to me as more of a case where the instance is unreachable rather than some wordpress error causing the site to crash.Share0It's pretty difficult to troubleshoot without any further details. If (as per your comment) the instance is unreachable then some network troubleshooting during an outage is the place to start; I would also look at any monitoring of the instance that you have set up (as per this announcement) and if necessary look at other metrics such as CPU, memory, disk and network usage to see where the issue is. You can monitor just about anything with CloudWatch but there may be additional charges for doing so.CommentShareEXPERTBrettski-AWSanswered a year ago0It seems to be an AWS issue lightsail is not working properly for a lot of peopleCommentShareAWS-User-4150832answered a year ago0Hi,Guys, I am also facing this issue, did anyone get remediation of MySQL service crashing issue?CommentShareM Junaidanswered a year ago0Facing the same issue, site keeps crashing constantly and having to either reboot or stop the site and restart. VERY frustrating and can’t see a way through. Thought a load balance would do the trick but that didn’t help either.The main problem for me is my app is hosted on AWS and the main domain for the app is linked to the app so it’s not like I can change provider. Need a solution to this ASAP as my board as well customers are having a bad experience on my site.Please share a solution AWS ASAP.CommentSharerePost-User-3622182answered 6 months ago0I can only agree with you here. I am facing as well the same problem. Site crashes from time to time without any obvious reason. It even crashed when nobody is on it.Then after rebooting it has also trouble to build it up and connect to the appropriate databank.CommentShareRightClicksanswered 5 months ago"


Question: AWS ELB log analyzer

"Hi everyone, does anyone know a free application or maybe a website that analyzes ELB logs? I only found paid servicesFollowComment"

Answer: "1Accepted AnswerHi, I read something about that some days ago, there is a web application that analyze your logs and extract the top 15 most active ips and for everyone do a whois query. It is free for use and also there is a comfortable S3 integration.Maybe this can fits for you: https://vegalog.net/CommentShareMRacinganswered a year ago0Hi !For Analyzing ELB logs, you can use Amazon Athena : https://aws.amazon.com/premiumsupport/knowledge-center/athena-analyze-access-logs/We do not support any third party apps/websites for analyzing the logsCommentShareSUPPORT ENGINEERAnsh_C answered a year ago0Here are a couple solutions:https://aws.amazon.com/blogs/big-data/easily-query-aws-service-logs-using-amazon-athena/,https://aws.amazon.com/blogs/big-data/catalog-and-analyze-application-load-balancer-logs-more-efficiently-with-aws-glue-custom-classifiers-and-amazon-athena/CommentShareEXPERTkentradanswered a year ago0GoAccess is a fast, terminal-based log analyzer. Its core idea is to quickly analyze and view web server statistics in real time without needing to use your browser (great if you want to do a quick analysis of your access log via SSH, or if you simply love working in the terminal). It supports Amazon S3, Elastic Load Balancing, CloudFront and others out of the box.CommentShareRoBanswered a year ago"


Question: torque service exits with status 3 on master node

"Hi,I noticed strange behavior of my cluster. I am using torque on centos 8. The cluster was working fine for over 2 months and all of the sudden the compute nodes stopped running queued jobs. I tried restarting the compute fleet but this didn't help and I found out that the torque service on the master node had failed and I am not able to restart it (see listing below). What can I do to repair my cluster?I am using parallelcluster 2.10 with a custom AMI and maximum 12 nodes with 8 processors on each (c5.4xlarge without hyperthreading).[code][centos@ip-172-31-24-41 ~]$ sudo service --status-allUsage: /etc/init.d/ec2blkdev {start|stop}\u25cf munge.service - MUNGE authentication serviceLoaded: loaded (/usr/lib/systemd/system/munge.service; enabled; vendor preset: disabled)Active: active (running) since Tue 2020-12-01 22:03:49 UTC; 2 months 17 days agoDocs: man:munged(8)Main PID: 5974 (munged)Tasks: 4 (limit: 47239)Memory: 3.5MCGroup: /system.slice/munge.service\u2514\u25005974 /usr/sbin/munged\u25cf pbs_sched.service - SYSV: PBS is a batch versatile batch system for SMPs and clustersLoaded: loaded (/etc/rc.d/init.d/pbs_sched; generated)Active: active (exited) since Tue 2020-12-01 22:04:05 UTC; 2 months 17 days agoDocs: man:systemd-sysv-generator(8)Tasks: 0 (limit: 47239)Memory: 0BCGroup: /system.slice/pbs_sched.service\u25cf pbs_server.service - TORQUE pbs_server daemonLoaded: loaded (/usr/lib/systemd/system/pbs_server.service; enabled; vendor preset: disabled)Active: failed (Result: exit-code) since Tue 2020-12-01 22:04:04 UTC; 2 months 17 days agoMain PID: 6173 (code=exited, status=3)jobwatcher                       RUNNING   pid 6467, uptime 78 days, 17:53:12sqswatcher                       RUNNING   pid 6468, uptime 78 days, 17:53:11\u25cf trqauthd.service - TORQUE trqauthd daemonLoaded: loaded (/usr/lib/systemd/system/trqauthd.service; enabled; vendor preset: disabled)Active: active (running) since Tue 2020-12-01 22:03:49 UTC; 2 months 17 days agoMain PID: 5900 (trqauthd)Tasks: 1 (limit: 47239)Memory: 3.1MCGroup: /system.slice/trqauthd.service\u2514\u25005900 /opt/torque/sbin/trqauthd -F[centos@ip-172-31-24-41 ~]$ sudo service pbs_server restartRestarting pbs_server (via systemctl):                     [  OK  ][centos@ip-172-31-24-41 ~]$ sudo service --status-allUsage: /etc/init.d/ec2blkdev {start|stop}\u25cf munge.service - MUNGE authentication serviceLoaded: loaded (/usr/lib/systemd/system/munge.service; enabled; vendor preset: disabled)Active: active (running) since Tue 2020-12-01 22:03:49 UTC; 2 months 17 days agoDocs: man:munged(8)Main PID: 5974 (munged)Tasks: 4 (limit: 47239)Memory: 3.5MCGroup: /system.slice/munge.service\u2514\u25005974 /usr/sbin/munged\u25cf pbs_sched.service - SYSV: PBS is a batch versatile batch system for SMPs and clustersLoaded: loaded (/etc/rc.d/init.d/pbs_sched; generated)Active: active (exited) since Tue 2020-12-01 22:04:05 UTC; 2 months 17 days agoDocs: man:systemd-sysv-generator(8)Tasks: 0 (limit: 47239)Memory: 0BCGroup: /system.slice/pbs_sched.service\u25cf pbs_server.service - TORQUE pbs_server daemonLoaded: loaded (/usr/lib/systemd/system/pbs_server.service; enabled; vendor preset: disabled)Active: failed (Result: exit-code) since Thu 2021-02-18 16:18:48 UTC; 7s agoProcess: 2884631 ExecStart=/opt/torque/sbin/pbs_server -F -d $PBS_HOME $PBS_ARGS (code=exited, status=3)Main PID: 2884631 (code=exited, status=3)Feb 18 16:18:48 ip-172-31-24-41 systemd[1]: Started TORQUE pbs_server daemon.Feb 18 16:18:48 ip-172-31-24-41 pbs_server[2884631]: pbs_server port already bound: Address already in useFeb 18 16:18:48 ip-172-31-24-41 systemd[1]: pbs_server.service: Main process exited, code=exited, status=3/NOTIMPLEMENTEDFeb 18 16:18:48 ip-172-31-24-41 systemd[1]: pbs_server.service: Failed with result 'exit-code'.jobwatcher                       RUNNING   pid 6467, uptime 78 days, 18:14:44sqswatcher                       RUNNING   pid 6468, uptime 78 days, 18:14:43\u25cf trqauthd.service - TORQUE trqauthd daemonLoaded: loaded (/usr/lib/systemd/system/trqauthd.service; enabled; vendor preset: disabled)Active: active (running) since Tue 2020-12-01 22:03:49 UTC; 2 months 17 days agoMain PID: 5900 (trqauthd)Tasks: 1 (limit: 47239)Memory: 3.1MCGroup: /system.slice/trqauthd.service\u2514\u25005900 /opt/torque/sbin/trqauthd -F[/code]FollowComment"

Answer: "0Hi @mfolusiakIt's not clear to me why the torque service crashed.We can find some information in torque logs:[code]/var/spool/torque/client_logs/*/var/spool/torque/server_logs/*[/code]Anyway by reading the log message the pbs server cannot start because the port is already in use by another process:[code]pbs_server port already bound: Address already in use[/code]I'd suggest to stop all the torque related daemons:[code]/etc/init.d/trqauthd stop/etc/init.d/pbs_server stop/etc/init.d/pbs_sched stop[/code]Be sure there are no running processes and eventually kill them[code]ps aux | grep trqps aux | grep pbs[/code]Then restart all the daemons:[code]/etc/init.d/trqauthd start/etc/init.d/pbs_server start/etc/init.d/pbs_sched start[/code]Let us know if it helps,EnricoCommentShareenrico-awsanswered 2 years ago0Thank you for help. Yes, restarting the service and the compute fleet had helped.CommentSharemfolusiakanswered 2 years ago"


Question: How can I use Cloudfront with a root domain name?

"I set up a Cloudfront distribution. I use a non-AWS domain registrar and DNS. I want my distribution to respond to "https://mydomain.com", but there is a problem. Cloudfront provides a domain name and asks you to create a CNAME record in DNS, but you can't create a CNAME record that points to the root domain or "@", like you can with a regular A record.To get around the problem, I set up "www.mydomain.com" as the CNAME record. If I type "https://www.mydomain.com" into my browser it works, but of course "mydomain.com" without "www" does not work.The next thing I did was create a permanent redirect in DNS that should redirect mydomain.com to www.mydomain.com. Now I can type "http://mydomain.com" and it redirects to www.mydomain.com and it works. But if I type "https://mydomain.com" (with HTTPS instead of HTTP) it does not work. I presume that this is because whatever server is implementing the redirect (I use GoDaddy) doesn't have my SSL certificate so the connection can't be made.I'm not sure how to resolve this problem. What I need, I think, is some web server that is on a fixed IP address and also has my SSL certificate, and can simply respond to all requests with the permanent redirect response. The only way I can think of to do this in AWS would be to set up an entire EC2 instance with my own web server, which is a lot of work and cost. Is there a better solution?My company doesn't want to move our DNS or domain registration to AWS, so using something like Route 53 is probably not an option.Thanks,FrankFollowComment"

Answer: "0Hi Frank,Depends on your DNS provider, AWS provides alias records within Amazon Route 53 and you can create an alias record at the top node of a DNS namespace, also known as the zone apex (sometimes called naked domain).Several DNS providers have custom solutions to work around this problem too, including:ALIAS at DNSimpleANAME at DNS Made EasyANAME at easyDNSCNAME (virtual) at CloudFlareBest Regards,Ricardo MakinoCommentShareRicardo_Manswered 6 months ago"


Question: FaceId's when indexing multiple face images of same person

"Hi there,I am not understanding how Rekognition deals with multiple images for the same face, I need help!Scenario:I have 3 years worth of school classroom photos and need to create yearbook of 5 of the studentsI need to identify which photos have only the 5 students in them, and ignore all others.To enhance the accuracy, I was reading the documentation that recommends to use multiple images of the same face when using IndexFaces.When creating a collection using IndexFaces, use multiple face images of an individual with different pitches and yaws (within the recommended range of angles). We recommend that at least five images of the person are indexed—straight on, face turned left with a yaw of 45 degrees or less, face turned right with a yaw of 45 degrees or less, face tilted down with a pitch of 30 degrees or less, and face tilted up with a pitch of 45 degrees or lessI think I get this by default as I will be indexing all images, which will contain many many images of the students, from all angles. This is correct, no? Or do I need to do something specific to tie the photos of the same student to the one FaceId?I noted that if I use 5 images of the same person, using IndexFaces, I get 5 different FaceIds returned. I thought (perhaps incorrectly) that Rekognition would recognise that it's the same face and just update it's internal  data about the FaceId, and return the same FaceId for each of the subsequent 4 images (after the first one is indexed) that are of the same face.So, can anyone help me:Should indexing multiple images of the same person result in multiple FaceIds?Internally, does Rekognition group all those FaceIds together, so it does not matter which FaceId I use in the future to search on - it will still benefit from the multiple images I uploaded for that face?Is there any difference in performance if I search by SearchFaces or by SearchFacesByImageIs my approach of indexing all the images I have, then searching on a single known FaceId a the student the way to go?sorry for multiple questions :)hope you can help, hive mind!FollowComment"

Answer: "0Code snippets are available in the following URLsAt a very high level you would need to:a) https://docs.aws.amazon.com/rekognition/latest/dg/create-collection-procedure.html (create the collection)b) https://docs.aws.amazon.com/rekognition/latest/dg/add-faces-to-collection-procedure.html (add your 3 years worth of photos to the collection)c)  https://docs.aws.amazon.com/rekognition/latest/dg/search-face-with-image-procedure.html (to search for photos that has at least student 1 .. 5)Note: You would need to have a good reference face image for each of the Students 1 .. 5d) Persist the image URLs and tag with the matched student ID to a DynamoDB tablee) You can find the images where any combination of the students appear.Hope this helps.CommentShareKishananswered a year agostr3tch a year agothis is the bit I'm struggling with: you would need to have a good reference face image for each of the Students - this is what I am attempting to do, and really the purpose of my question. How do I tell Rekognition that it is a reference image? can you elaborate on that point please? Apart from uploading multiple images of the same person (which I am doing by uploading all the photos), what special thing do I need to do, to tell Rekognition these are 'reference images'? thanks !Share"


Question: NodeJS DAX client doesn't support Update item having same field name with the condition expression.

"Hello team,So recently, I was trying to enable DAX instead of using the normal DynamoDB client. And I found this issue. When I'm issuing a Update with this:"Update": {        "Key": {            "id": {                "S": "de26b619-d3e1-4de9-a338-12f95780538f"            }        },        "ConditionExpression": "#a0 = :v0 AND #a1 = :v1",        "ExpressionAttributeNames": {            "#a0": "tenantId",            "#a1": "_version",            "#a2": "updatedAt",            "#a3": "_version",            "#a4": "totalAmountOutstanding",            "#a5": "items"        },        "ExpressionAttributeValues": {            ":v0": {                "S": "HelmTest"            },            ":v1": {                "N": "1"            },            ":v2": {                "N": "1650900411690"            },            ":v3": {                "N": "2"            },           ...So basically, I'm using the field _version to implement optimistic locking. When using DAX to run this update, I got the error:{    "errorType": "Error",    "errorMessage": "ValidationException: Two document paths overlap with each other; must remove or rewrite one of these paths _version",    "code": "ValidationException",    "time": 1650900411978,    "retryable": false,    "requestId": null,    "statusCode": -1,    "_tubeInvalid": false,    "waitForRecoveryBeforeRetrying": false,    "stack": [        "Error: ValidationException: Two document paths overlap with each other; must remove or rewrite one of these paths _version",        "    at Function.newValidationException (/node_modules/amazon-dax-client/src/RequestValidator.js:383:12)",        "    at /node_modules/amazon-dax-client/src/RequestValidator.js:84:34",        "    at Array.forEach (<anonymous>)",        "    at Function.validateExprAttrNames (/node_modules/amazon-dax-client/src/RequestValidator.js:78:30)",        "    at Function.validateExpression (/node_modules/amazon-dax-client/src/RequestValidator.js:217:42)",        "    at /node_modules/amazon-dax-client/src/BaseOperations.js:603:26",        "    at processTicksAndRejections (internal/process/task_queues.js:95:5)",        "    at p2 (/node_modules/dynamoose/lib/aws/ddb/internal.ts:30:17)",        "    at /node_modules/dynamoose/lib/Transaction.ts:99:23",The library complains that it won't allow me to use _version many times. I looked into the source code, and this is confirmed:      let attrs = new Set();      Object.keys(attrNames).forEach((k) => {        let v = attrNames[k];        if(k == null) {          throw new AmazonClientException('ExpressionAttributeNames contains invalid key: null');        }        if(attrs.has(v)) {          throw RequestValidator.newValidationException('Two document paths overlap with each other; must remove or rewrite one of these paths ' + v);        }        attrs.add(v);I believe this is a bug in the library, as this is a normal use case and it should be allowed. For now, I've turned off the DAX and gone back to the normal DynamoDB client, where things are working.FollowComment"

Answer: "1Hi,Thanks for reaching out and bringing this to our attention. This is something the team are aware of and have already pushed a fix for the Java SDK. However, they have yet to bring the other SDK's up to speed. Unfortunately I do not have an ETA on this bug fix, but I have added your voice to the prioritization of it.CommentShareEXPERTLeeroy Hannigananswered a year ago0Hello, can you share with me the commit for the fix on your Java SDK? Thank you.CommentShareAWS-User-1261179answered a year agoLeeroy Hannigan EXPERTa year agoThe SDK is not open-source and I will not be able to provide you with a commit. The most recent version of the SDK in Java has the fix implemented.The DAX team will be providing the fix for NodeJS on the next release. As mentioned, I have no ETA on the push of the latest release.Share"


Question: Tutorial For Basic Web App

"Hello all,I'm looking for a super simple tutorial to build a serverless web site.  The web site has very simple needs:Static HTML elementsAbility to read/write to a databaseDynamic HTML elements (ie the page can return data looked up from the DB)Very very small - Looking for probably 12 pages or less to build the entire site... Hits will be less than 200/month.Most of the examples/tutorials I can find are way too much for what I'm looking for.  I'm wondering if there is a way I can do this with just:S3DynamoDBLambda (python)What I can do:I've made lambda functions that can read/write to a DynamoI can author html pages and save them to s3I've built dynamoDB tablesWhat I can't do:I just need some help combining these elements together to build out a website.  Anyone interested in helping or pointing to a good tutorial... or a suggestion on a better simpler way to do what I need to do?Thanks for any assistance!!!FollowComment"

Answer: "1Have you looked at Amplify? You need to pick a frontend framework, but there are various "modules" that you can add (like Dynamodb, S3, Auth, etc.). Here is the getting started page for using React.They've also just introduced something called Amplify Studio which is another way of building with it.If you want more of a "developer" approach, you could look at the Serverless Stack.I hope some of that is helpful.CommentShareJohn Voldanswered a year agoLifeline156 a year agoThanks, for all this information, I will start to go through the links. What does the front end framework do for me? Sorry, still learning.Share0Accepted AnswerThanks for the suggestions everyone.  I did find something that was very helpful.  A series of 9 youtube videos that really walks through this.  It is a little old so a lot of the screens in AWS have changed, but I'm fighting my way through it.  Maybe once I understand what I'm doing a bit more some of these other suggestions will make more sense.  For right now they are just pretty complicated for me.https://www.youtube.com/watch?v=mfAT38B_uhwI at least can host my version of a hello world, where someone hits a page, and the page pulls a hello world record from the dynamodb and displays it.CommentShareLifeline156answered a year ago0Check out: WELCOME TO INNOVATOR ISLAND!CommentShareEXPERTkentradanswered a year agoIgvir a year agoThank you Kentrad, I did not know about this WorkshopShareLifeline156 a year agoThanks! I’ve seen tutorials similar to this.  This seems awful heavy for what I need.  But thanks.  I may end up doing this.Share0Hello,Kentrad's suggestion is a great place to start.In addition, you could also check out https://github.com/aws-samples/aws-serverless-saas-layersI have a collection of workshops on https://start.me/p/1kjb2D/new-page (search for serverless)hope this helpsSriCommentShareSrianswered a year agoLifeline156 a year agoThanks for the answer.  I'm working on understanding amplify a bit more.  Seems like a really complicated way to build a website.  Seems like everything now needs another framework, like death by framework! :)Share0So, Amplify is SUPER confusing.  It leads you down a rabbit hole of like 5 more things you need to do.  Isn't there a way I can just write code?  I'd settle for a html editor at this point, though a graphical editor would be a bonus.  The tutorials I'm seeing don't really go into the detail of what any of the steps really do... they just have you cut and paste a bunch of stuff and you end up with some premade thing, but you haven't learned anything about actually building a site.  This figma thing, how do I even put a textbox on the screen?  I'd love an example of a webpage with a single textbox in the middle of the screen and a button under it.  Every time you click the button, it pulls a random record out of the DB and puts it in the textbox... that would be 10x more helpful to me.  Sorry, I'm ranting.CommentShareLifeline156answered a year ago0This does not check all the boxes, but it is lightweight, so maybe you can learn from it https://wellarchitectedlabs.com/reliability/100_labs/100_deploy_cloudformation/deploys EC2 instances that call DynamoDBuses Pythion http.server for websitehttps://wellarchitectedlabs.com/security/100_labs/100_cloudfront_with_s3_bucket_origin/Shows how to setup a website hosted on S3 and fronted by CloudFronthttps://wellarchitectedlabs.com/security/200_labs/200_automated_deployment_of_ec2_web_application/deploys a Wordpress siteCommentSharesetheliotanswered a year ago"


Question: MediaTailor Cloudfront Custom Domain Fails with SSL

"I have a fully functioning video distribution flow using S3, MediaTailor & Cloudfront. You can watch it here:https://d3helw5t9nveja.cloudfront.net/v1/master/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8My final task in the workflow is to assign a custom domain to the cloudfront distribution. I am using HTTPS for everything (as most video sites use exclusively https). I have created a SSL certificate in Cloudfront & and added CNAMES to the domain radiantfc.com, www.radiantfc.com and *.radiantfc.com by cutting and pasting from the certificate. Certificate Manager says that these records are successful. See screen shot:In my Cloudfront distribution my origin is set to HTTPS only / TLSV1.2 and my attached behavior states HTTPS only, GET, HEAD & caching is disabled. I've been clicking around for a few days and can't seem to get this to work. Here's the link with the URL domain replacement - but it's no go:https://radiantfc.com/v1/master/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8Any assistance / ideas / suggestions greatly appreciated!FollowComment"

Answer: "0This looks like a DNS error. Querying the apex and www records for your domain does not yield any records. Have you set these up on the correct name servers? The name servers for your domain are currently:ns17.domaincontrol.comns18.domaincontrol.comIf you have created the records somewhere else, you would need to change the delegation for your domain at the registrar so that the correct name servers are used. Alternatively, create the records on the name servers listed above.Once you have corrected the DNS issue, things should start working correctly.CommentSharePaul_Lanswered 7 months agoRadiant RePoster 7 months agoPaul -Thanks so much for your response. Yes, I removed the apex and www records to test if they were conflicting with my CNAME records. I've used the CNAME records provided by the AWS SSL Certificate (for radiantfc.com, www.radiantfc.com and *.radiantfc.com) but I'm still getting the error. It is using the nameservers you mentioned. Frankly, I'm stumped - I'm considering deleting the SSL, creating a new one, repopulating the CNAME records and updating my cloudfront instance. This seems a bit extreme, but I can't think of anything else. Suggestions? (btw - got the same error when the apex and www names were there. Host is GoDaddy).Thanks,JockSharePaul_L 7 months agoThe CNAME records that Certificate Manager asks you to add are to verify that you own the domain - when you create those, Certificate Manager issues the certificate and you can then associate it with your CloudFront distribution. You also need to create a CNAME record in DNS to point www at your CloudFront distribution so that your viewers can access your content. Please see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.htmlShare0Hi,Is it for channelassembly ? And without CDN - it works well in Theo Test PlayerCommentShareiamvijaykishananswered 7 months agoRadiant RePoster 7 months agoThanks so much for your input. Yes - channel assembly with programmatic ad insertion. This URL works:https://d3helw5t9nveja.cloudfront.net/v1/master/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8BUT - the same string with the domain replaced in Cloudfront using SSL gets a URL error:https://radiantfc.com/v1/master/58a2f0c6b3528a8407e12e2dd992bd221d5afc39/RadFAST1-Channel-Beachfront/radfast1.m3u8Again, thanks for any ideas.Share"


Question: Account suspended & domain held by amazon

"Hi,I have a suspended AWS account and my domain name is trapped on that account. I'd like to get access to my domain name as it's a very expensive name.How can I resolve this account suspension or recover my domain name?Regards,JohnFollowComment"

Answer: "1Sorry to hear that your AWS account is suspended. You may want to look at a support article - How can I reactivate my suspended AWS account?, at https://aws.amazon.com/premiumsupport/knowledge-center/reactivate-suspended-account/CommentShareronald_lanswered 7 months ago"


Question: "identical nlbs, one has intermittent health check failures"

"i have two nlbs with identical target groups on http, right down to the ip addresses they upstream to. they both upstream to the same 3 ip addresses, same healthcheck port, same attributes on both the nlb and target group level.the only reason i have two nlbs is that 1 does tls termination on https and the other passes tls thru, but this issue is observed on the plan http target which is identical on both.the target group on the first nlb is consistent healthy, the target group on the second is constantly flapping. why would the exact same shape, same backed ips, behave differently from one nlb to the other? do i have a broken nlb?FollowComment"

Answer: "1100% it was a flakey nlb, an issue on the AWS service side.Both my nlbs are set up with cloudformation, i tore them down, recreated them and the issue went away.one of the elastic ips i associate in the cloudformation to the nlb took a good few minutes to disassociate, showing errors when i tried to manually delete, but eventually resolved itself, and after that i was able to spin up the nlbs with my cloudformation again and have not seen errors since. i had a small panic about that elastic ip tho, this is wired up to lots of customer systems, if that were broken i'd have been emailing a few hundred people to try to move them.what is frustrating is that there's no support path for issues like this, this is the second time i've run into an error that is certainly and entirely on the aws side, but how do i get support on failing services that I pay for? Fixing this meant tearing down a production service and going from bad quality to no quality for a few minutes for my customers, is there no way to get support for legitimate AWS bugs? I tried the feedback link in the aws web console and even supplied the arns for my nlbs, but that also seems to be just shouting into the void. it's very frustrating.CommentSharetommyvn-lhranswered a year agoRodney Lester a year agoIf you need better support, consider the premium support options: https://aws.amazon.com/premiumsupport/Share"


Question: Cognito Access Token doen't work in API Gateway Authorizator

"Hello, I have created an API Gateway and in its routes, I have put the Cognito authorizer.If I use the token that the Cognito Sample Login application gives me, everything works perfectly.But if I use the Access Token that gives me the login from one of our applications, the API returns NOT AUTHORIZEDWe use that same token in many lambda endpoints and it works perfectly, but it fails in the API Gateway that sends files directly to S3Why the same Access Token that works on all endpoints, fails on a particular API Gateway?RegardsPabloFollowComment"

Answer: 0FIXEDThe** aws.cognito.signin.user.admin** OpenID Method is Required in COGNITOCommentSharePablo Tilottaanswered 2 months ago


Question: Access RDS via GUI with Linux Machines.

"Hi All,Currently, I have a RDS instance that is sitting inside a private subnet and they are connected to EC2 [Linux Instances] that are in a public subnet.Is there any way for the developers to access the RDS using mysql workbench? Accessing the RDS via CLI is a challenge,FollowComment"

Answer: "0If these subnets are in the same VPC then you should have network connectivity between them.  Just make sure your RDS instance's security group allows connections from that EC2 on the mysql port, and NACLs also allow requests and responses, and you should be able to connect.CommentShareEXPERTskinsmananswered 6 months ago"


Question: Health check at NLB level for a Fargate Service

"I have a service using ECS Fargate behind an NLB, which runs my application at port 8443. The NLB target group health check shows the following settings (default for TCP health check).Protocol                                   TCPPort.                                      Traffic portHealthy threshold                          3 consecutive health check successesUnhealthy threshold                        3 consecutive health check failuresTimeout.                                   10 secondsInterval                                   30 secondsThe NLB target group also has the default target deregistration time of 60 seconds.With this, I wanted to understand the difference between the active health check and the passive health check done by the NLB for its targets.My understanding is that the above health check configuration is for the active health check. Would there also be a default passive health check in an NLB which responds to failed responses from the target?Further, i can see that the moment i stop my Fargate task, even in the absence of any traffic, the target(ECS IP) begins deregistration. There seems to be no 30 second time gap (active health check interval as above). The metric (healthy host as 1) stops getting published.Is this thus somehow configured in the NLB to get notified about terminating Fargate tasks?Finally, I wanted to understand how good is the NLB healthy task count metric to monitor my Fargate application. I was thinking that it is the best metric since it does a TCP ping at the port level (8443 port in my case) thus ensuring that the monitoring is done at the port (application) level as well as the task level.FollowComment"

Answer: "0Hello,As you described, the NLB with TCP healthcheck is basically just going to open a TCP connection on the target + port, and report it healthy if it can open the TCP session. There is no notion of passive healthcheck, it is all actively opening connections to targets to evaluate their health.The way the ECS Task (container(s)) gets added to the Target Group "targets", is that after your container is up, ECS will go ahead and attach the container as a target to aforementioned Target Group. Then the health check starts.If you stop the fargate task, then ECS will remove it from the Target Group (and therefore from the Listener Rule and therefore from the NLB (or ALB)).The healthy hosts metric indeed is a good indicator of whether your targets are healthy or not.If you want an end-to-end demo with NLB + ACM (so, using TLS at the NLB) and Fargate, have a look at this (part 2 is in the writing).Hope this helps,CommentShareJohnPrestonanswered a year ago"


Question: AWS Device Farm can not get the correct app activity for Android app to launch app using Appium

"Hi,I'm trying to run a small test for an Android app using Appium and TestNG on AWS device farm and I'm facing this problem.As recommendation from AWS, I just kept the desired capabilities empty like this and I could run the test successfully on my local machine@BeforeSuite    public void setUpAppium() throws MalformedURLException {        final String URL_STRING = "http://127.0.0.1:4723/wd/hub";        URL url = new URL(URL_STRING);        DesiredCapabilities capabilities = new DesiredCapabilities();        driver = new AndroidDriver<MobileElement>(url, capabilities);        driver.manage().timeouts().implicitlyWait(35, TimeUnit.SECONDS);    }Then I followed all the steps in the instruction: uploaded the apk, zip file, etc. to AWS Device farm. And then when I ran the test on AWS, I got this error:Cannot start the 'com.simplemobiletools.notes.pro' application. Visit https://github.com/appium/appium/blob/master/docs/en/writing-running-appium/android/activity-startup.md for troubleshooting. Original error: Activity name '.com.simplemobiletools.notes.pro.activities.SplashActivity.Grey_black' used to start the app doesn't exist or cannot be launchedAs the error message, AWS tried to launch the activity  ".com.simplemobiletools.notes.pro.activities.SplashActivity.Grey_black" which is kind of weird because when I used the command "adb shell dumpsys window | grep -E 'mCurrentFocus'" to check the app activity then I got this result "com.simplemobiletools.calculator.activities.MainActivity" and I don't know where AWS got that activity. So I guessed because of the wrong activity, appium couldn't start my app and the test couldn't be run on the device farm. I also checked with other apps and I saw the same problem. App activity that I used the adb shell command to check is always different to the app activity AWS got. AWS seems to tend to add the word "Splash" into the app activity and I don't know what it meantI tried this solution from this link "https://forums.aws.amazon.com/thread.jspa?messageID=959277&tstart=0" by adding appActivity and appWaitActivity to the yaml file- echo "Start appium server"      - >-        appium --log-timestamp        --default-capabilities "{\"deviceName\": \"$DEVICEFARM_DEVICE_NAME\", \"platformName\":\"$DEVICEFARM_DEVICE_PLATFORM_NAME\",        \"app\":\"$DEVICEFARM_APP_PATH\", \"udid\":\"$DEVICEFARM_DEVICE_UDID\", \"platformVersion\":\"$DEVICEFARM_DEVICE_OS_VERSION\",        \"chromedriverExecutable\":\"$DEVICEFARM_CHROMEDRIVER_EXECUTABLE\,\"appActivity\":\"com.simplemobiletools.notes.pro.activities.MainActivity\",\"appWaitActivity\":\"com.simplemobiletools.notes.pro.activities.MainActivity\"}"        >> $DEVICEFARM_LOG_DIR/appiumlog.txt 2>&1 &      - >-but it didn't work either. Now I get another error "Waiting for appium server to start. Sleeping for 1 second".I tried to find any solution but couldn't find anythingPlease help me resolve this issue, I really appreciate your help!FollowComment"

Answer: "1Thank you for sharing the details in such a nice manner.Let's start by clarifying some confusion around what AWS changes and does not change.AWS Device Farm does not change the binaries or the intended behavior of Appium server or client code when running in custom environment. The expectation is you should get the same result as you get locally when running an Appium based test.Device Farm is identifying the activity to launch based on what the app is returning in the Manifest file and what is passed in desired capabilities.In this case, you want to wait for the MainActivity which is "com.simplemobiletools.notes.pro.activities.MainActivity". The SplashActivity is typically seen on a fresh install and launch of an app. In case of someone using Device Farm public devices, this is default behavior every time.A simple way to list all the activities would be an adb command which is slightly different than the one you used:"adb shell dumpsys package | grep -i " + (enter package name)  + " |grep Activity"Suggestion:Set the desired capability "appWaitActivity" in yaml file to "com.simplemobiletools.notes.pro.activities.MainActivity"Set the desired capability "appActivity" to the splash Activity "com.simplemobiletools.notes.pro.activities.SplashActivity.Grey_black"As a precaution to eliminate any timing issue, I would also desired capability "appWaitDuration" to 10 secs. This will give it enough time to bypass the Splash screen.Set desired capability "appPackage" to "com.simplemobiletools.notes.pro"Check when you run a fresh install and launch of your app if you get the SplashActivity locally. I would expect to see the same results locally and on Device Farm for SplashActivity.Hope this helps.CommentShareNikhil_Danswered a year ago"


Question: Patchbaseline and RHEL8 not seeing correct package

"I have a RHEL8 instance that has containers-common 2:1-35 installed.  When running a patchbaseline, for some reason it thinks it should have containers-common 1:1.3.1-5 and downgrades the version 2.  It then performs an upgrade back to 2:1-35.  It seems to me like the scan does not see the version 2 in the repository.  I would appreciate any ideas as to why this happens.FollowComment"


Question: Cannot get the username/password from an SNS Subscription URL

"Hello,For a subscription within an SNS topic, I use an endpoint that uses 'Basic Authentication'. The endpoint is like this:https://username:password@test.endpoint.nlUnfortunately, no matter what I try, I cannot get the username and password when AWS sends a notification to the endpoint. I am using PHP/Laravel and I tried all $_SERVER variables to get the username and password, like $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'], $_SERVER['HTTP_AUTHORIZATION'] and $_SERVER['REDIRECT_HTTP_AUTHORIZATION']. None of the variables gives a value when SNS topic sends a notification. And yes, when I test on my machine (so when I am not using SNS topic), I just can get the username and password from the endpoint by using the SERVER variables...What am I doing wrong, so that I cannot get the username and password from the endpoint, when a notification is sent by SNS topic?Hope someone can help. Thanks in advance.FollowComment"

Answer: "0Hello,The body of the message sent by SNS will not contain the username and password. They can however, be accessed from the authorization token. Allow me to explain SNS message sending to a HTTP method with Basic Authentication.This process involves two steps. One is for authentication and other is for the business logic. So SNS sends message to HTTPS URL where as the first step its checks the authentication. After the successful authentication, the message will be delivered to the the URL which is subscribed to the topic.In order to have better understanding, let me provide an example. A HTTPS endpoint is created using API Gateway which has the backend integration configured with a Lambda function, and a Lambda function as a custom authorizer. Once the SNS topic publishes message to the API Gateway API’s https endpoint, which contains both the basic auth credentials (eg: https://admin:pass@domain.com), the Lambda authorizer will manage the authorisation. Only the notification body will be received by the backend Lambda integration.In your case, you will need to check your endpoint’s authentication to retrieve the key value of the authorisation token which contains the username and password in base 64 encoded format after the word ‘Basic’ - you can decode it and use it for your use case. It will be in this format in Nodejs:{“authorizationToken": "Basic {{base 64 encoded username:password}}”}For resource level troubleshooting, I would request you to raise a premium support case and a Support Engineer can look into the topic/subscription in question.CommentShareIbraheem_Kanswered 6 months ago"


Question: How to monitor lambda functions running inside Greengrass V2 core device

"I am trying to understand a bit more on how lambda functions run on Greengrass.This question is more about debugging the execution of a lambda function deployed in a Raspberry Pi 4, running Raspbian.I deployed a Lambda component to my Greengrass core device. However, even though the logs say that the function is running (logs below), I cannot really understand or see if it is actually doing something.2023-05-05T06:05:27.275Z [INFO] (pool-2-thread-20) com.example.LambdaFunction: shell-runner-start. {scriptName=services.com.example.LambdaFunction.lifecycle.startup.script, serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=STARTING, command=["/greengrass/v2/packages/artifacts/aws.greengrass.LambdaLauncher/2.0.10/lambda-..."]}2023-05-05T06:05:27.617Z [INFO] (Copier) com.example.LambdaFunction: stdout. Started process: 1075. {scriptName=services.com.example.LambdaFunction.lifecycle.startup.script, serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=STARTING}2023-05-05T06:05:27.622Z [INFO] (Copier) com.example.LambdaFunction: Startup script exited. {exitCode=0, serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=STARTING}2023-05-05T06:05:28.077Z [INFO] (pool-2-thread-21) com.example.LambdaFunction: lambda_runtime.py:402,Status thread started. {serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=RUNNING}2023-05-05T06:05:28.085Z [INFO] (pool-2-thread-21) com.example.LambdaFunction: lambda_runtime.py:154,Running [arn:aws:lambda:eu-central-1:109139691401:function:gg-lambda-test:1]. {serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=RUNNING}This is the logic for my function: https://github.com/aws-samples/aws-greengrass-samples/blob/master/hello-world-counter-python/greengrassHelloWorldCounter.pyIt is essentially just counting the number of instances that a message has been published into the topic.For testing this lambda function, I created a subscription and a topic. The function should be invoked ideally when there is a new message in the topic.I followed this tutorial https://docs.aws.amazon.com/greengrass/v1/developerguide/long-testing.htmlHowever, whenever I try to publish something into a topic, say /hello/world/counter. Instead of getting the message from the lambda function code:'message': 'Hello world! Sent from Greengrass Core.  Invocation Count: {}'.format(my_counter)I get the same message that I put in the MQTT test AWS console:{"message": "Hello from AWS IoT console"}I suspect that the function is not being invoked at all, but how is it possible if it is actually running?I have been stuck on this for a few days and would love to do some progress for my master thesis.Any help would be appreciated,Best,EdFollowComment"

Answer: "0Hi EdThanks for using Greengrass and thanks for reaching out!I understand you were trying to follow along the Long Testing guide in our tutorials doc (https://docs.aws.amazon.com/greengrass/v1/developerguide/long-testing.html). So firstly, all Greengrass log entries include a timestamp, log level, and information about the event. For example2023-05-05T06:05:27.275Z [INFO] (pool-2-thread-20) com.example.LambdaFunction: shell-runner-start. {scriptName=services.com.example.LambdaFunction.lifecycle.startup.script, serviceInstance=0, serviceName=com.example.LambdaFunction, currentState=STARTING, command=["/greengrass/v2/packages/artifacts/aws.greengrass.LambdaLauncher/2.0.10/lambda-..."]}contains the timestamp, log level: INFO and event related info, ie, this was logged when Greengrass was executing the startup script of the component "com.example.LambdaFunction." You can use logs to monitor events and troubleshoot issues, for example, you can log a friendly message in the lambda function handler before it publishes anything to verify that it is actually being invoked.Coming to the actual issue, the long testing guide specifies after 5 that "This single subscription goes in one direction only: from the Greengrass_HelloWorld_Counter Lambda function to AWS IoT. To invoke (or trigger) this Lambda function from the cloud, you must create a subscription in the opposite direction."If you created only one topic and both the lambda function and the IoT console are subscribing to this topic then any message you publish on this topic, the same message will show up on the IoT console again.Hope this helps!CommentSharesidsrivanswered 22 days ago"


Question: Greengrass v2 interact with shadows from a nodejs lambda

"Is there any way to interact with local shadows in ggv2 from a nodejs lambda? I know IPC is not supported in the js sdk, but maybe an mqtt client in a lambda could connect to the mqtt components. Thanks in advance for any ideas other than a python rewrite which I am working on, but, looking for a solution to get ggv2 running with ggv1 lambdas while working on python conversion.FollowComment"

Answer: "0Accepted AnswerCurrently IPC is the only available method for communicating with the local shadow manager. However, the next release of Shadow Manager will support a PubSub API (code) which will enable you to access shadows via MQTT (as long as you configure the appropriate routes in the MQTT Bridge component).There are downsides to your approach, as you'll need to model your lambda as a client device and give it a private key / cert. But it should serve as a stop gap solution.CommentShareJoeAtAWSanswered a year agoJAG a year agoAwesome! I tried creating a device and using the certs and the aws-iot-device-sdk-v2 js mqtt client from a lambda but I get an AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE TLS (SSL) Negotiation failed. Is this expected until the updates you mention? I have not been able to get a lambda function as a device to connect to the local MQTT broker. Thanks for all your responses.ShareJoeAtAWS a year agoYou won't be able to get this working end-to-end until the next Shadow Manager release. However, you should be able to get the MQTT connection to work.We have a detailed tutorial on how to set up client devices here: https://docs.aws.amazon.com/greengrass/v2/developerguide/client-devices-tutorial.htmlTLS failures are usually caused by your client using an incorrect CA, or Greengrass not having sufficient permissions in the certificate policy to verify the client certificate. Both are covered in the above tutorial.ShareJoeAtAWS a year agoYou can check greengrass.log for hints. Anything along the lines of "bad_ca" points to an issue with the client. Otherwise it's likely a Greengrass configuration issue and the logs should point you in the right direction.Share"


Question: Basic setup on sending text messages via SNS - only from cloudwatch

"Afternoon all, the title says it all.  I really just want to have cloudwatch send text messages when critical services fail.   I am not in the sandbox anymore (it appears), and under Text messaging (SMS) I see my failed messages. (I did setup a cloudwatch alert to use that number).I did notice under Origination numbers I have one number that says active, but capabilities only says VOICE.    The {i} mouseover help says this number doesn't support SMS.So, I am reading a bit all over, and I see where inside pinpoint I can request a short-code or 10DLC.   I am just needing some help confirming that I am on the right path as that step shows for the long code a $54 registration fee, then $11/month.Am I correct in that if the above is needed, I could then send those SMS alerts for the $11/mo?ThanksFollowComment"


Question: Accessing the Kinect SDK Library

"I have successfully embedded the Kinect SDK in the 3rd Party folder and Lumberyard recognizes it. My intent is to leverage the sdk inside the game and use the depth and infrared streams. I'm wondering if accessing the kinect should be done via a LUA/C++ script , a flownode , or a Component. Any recommendations on how to start would greatly be appreciated.Follow"

Answer: "0Accepted AnswerHello @REDACTEDUSERYes we highly recommend customers to use Lua and C++ as well as Components as the go to systems when extending the existing functionality through external SDKs. As you are aware, Flow Graph is being deprecated by another system so we do not recommend users to use it.We have plenty of documentation on this topic. A good place to start would be Component Intro. Your suggestions and feedback is always welcome!Thank you!SharerePost-User-5162062answered 6 years ago0I've filed a ticket to get you some answers on this Kinect question.SharerePost-User-8353690answered 6 years ago0I went ahead and built a component to write text to Lumberyard, worked great. Attempted to modify this same component and do a simple activate of the Kinect. The Library was not recognized. My instinct suggest not to use a hard path to the Kinect Lib. Once LY recognizes it as a 3rd party sdk, how do we reference it in the Component.cpp?SharerePost-User-5337447answered 6 years ago0Hello @REDACTEDUSEROnce you've added it to the SetupAssistantConfig.json file and run lmbr_waf configure it will attempt to create a junction from the 3rdPartyFolder to Code/SDKs which then would allow you to use a relative path from your project's directory (say, Code/KinectSDKProject). A good example of this would be the VR sample project as I'm almost positive they use the VR sdks located in the 3rdPartyFolder.Hope that helps!SharerePost-User-5162062answered 6 years ago0I went ahead and created a Gem and symlinked the Kinect Lib, Works fine so far :)SharerePost-User-5337447answered 6 years ago0I went ahead and created a Gem and symlinked the Kinect Lib, Works fine so far :)SharerePost-User-5337447answered 6 years ago0Hi @REDACTEDUSERNot sure if you have updated your Kinect Gem to Lumberyard 1.10, but here is one I created as a sample (minus the Kinect SDK files) that just shows how to link to the SDK via Gem using the Gem's 3rdparty folder.5121-kinect.zip|attachment (17.7 KB)kinect.zipSharerePost-User-5841084answered 6 years ago"


Question: SageMaker Ground Truth notification after annotation job considered "done"?

"Hi all,Is it possible to generate a notification after an annotation job is done? Couldn't find this info anywhere in the API docs, or by trawling the web. Being able to receive such notifications, be it SNS or something else, would be lot better than having to periodically poll the job's status.JoniFollowComment"

Answer: "0We apologize for the delay in reply. Unfortunately, today we do not have such mechanisms to get notification for the completion of annotation. However, we recognize the importance of this feature and its usability and are working towards it. Watch out this space for updates. Thank you being our valued customer.CommentShareAWS-User-2263778answered 4 years ago"


Question: CannotPullContainerError: no space left on device

"Since today I have been seeing several failures on batch jobs due to the following error:CannotPullContainerError: failed to register layer: Error processing tar file(exit status 1): write /opt/conda/lib/libmkl_avx512.so: no space left on deviceI am using the standard AWS ECS AMI, and my compute environment is set up to use 'm4 family' so I would expect it to choose an instance that has enough resources.Is there anything I can do to prevent this?FollowComment"

Answer: "0Hello,In order to fix this issue, you need to update the dm.base value in the docker configuration. Please refer this article to achieve the same.https://aws.amazon.com/premiumsupport/knowledge-center/batch-job-failure-disk-space/CommentShareAWS-User-0016272answered 3 years ago0Thanks Anish, that helped.  For anyone also having trouble with this, you need toincrease the size of the disk available to docker (/dev/xvdcz) in the launch templateincrease the disk quota available to each container in the launch template, I used:MIME-Version: 1.0Content-Type: multipart/mixed; boundary="==BOUNDARY=="--==BOUNDARY==Content-Type: text/cloud-boothook; charset="us-ascii"#cloud-boothook#!/bin/bashcloud-init-per once docker_options echo 'OPTIONS="${OPTIONS} --storage-opt dm.basesize=30G"' >> /etc/sysconfig/docker--==BOUNDARY==Content-Type: text/x-shellscript; charset="us-ascii"#!/bin/bash# more aggressive settings for cleaning up old tasksecho ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=1m >> /etc/ecs/ecs.configecho ECS_IMAGE_CLEANUP_INTERVAL=1m >> /etc/ecs/ecs.configecho ECS_IMAGE_MINIMUM_CLEANUP_AGE=1m >> /etc/ecs/ecs.config--==BOUNDARY==--CommentShare4TufZBanswered 3 years ago"


Question: SageMaker XGBoost batch transform AttributeError

"Hi,After training XGBoost model using SageMaker inbuilt algorithm, I am trying to perform batch transform operation. I am doing the same steps as for linear learner model which worked fine there.  However in case of XGBoost I get a following error while creating a transformer:AttributeError: module 'sagemaker' has no attribute 'utils'The piece of code causing the error is:xgb_transformer = xgb_estimator.transformer(    instance_count = 1,     instance_type = 'ml.m4.10xlarge',    output_path = '{}/{}'.format(output_path,'output'))I use '1.5-1' version of XGBoost as image in training, and 2.86.2 version of SageMaker.Any help would be highly appreciated!FollowComment"

Answer: "0I have tried replicating the issue and by updating the SageMaker Package to the latest version sagemaker-2.99.0 I did not find any issues creating the  batch transform job. Requesting you to update the sagemaker package to the latest version and let us know if you continue to face the issue.!pip3 install -U sagemakerIf you continue to face the issue I would encourage you to open a support ticket with AWS along with the sample code, the training job and the batch transform job ARN. Due to security reason, this post is not suitable for sharing customer's resource.References:[1] https://sagemaker-examples.readthedocs.io/en/latest/aws_sagemaker_studio/sagemaker_studio_image_build/xgboost_bring_your_own/Batch_Transform_BYO_XGB.html[2] https://github.com/aws/amazon-sagemaker-examples/blob/main/introduction_to_applying_machine_learning/xgboost_customer_churn/xgboost_customer_churn.ipynbCommentShareAWS-User-6649274answered a year ago"


Question: instance randomly rebooting and shutting down

"instance id: i-d577494creboot   system boot  3.13.0-165-gener Fri Jul  2 00:00 - 07:58  (07:58)reboot   system boot  3.13.0-165-gener Thu Jul  1 23:20 - 23:58  (00:38)reboot   system boot  3.13.0-165-gener Thu Jul  1 16:17 - 23:58  (07:41)reboot   system boot  3.13.0-165-gener Thu Jul  1 12:23 - 23:58  (11:34)reboot   system boot  3.13.0-165-gener Thu Jul  1 11:50 - 23:58  (12:08)shutdown system down  3.13.0-165-gener Thu Jul  1 23:58 - 00:00  (00:01)shutdown system down  3.13.0-165-gener Thu Jul  1 23:58 - 23:58  (00:00)I got a notice a few weeks ago that this instance was being retired due to hardware degradation.  I STOP'd/START'd to move to new hardware, a few times actually, but the problem continues.  There has been no recent upgrades or updates, no new automated tasks added.  I've looked through all the logs for clues but don't see anything.Thank you for you reading and any assistance.FollowComment"

Answer: 0(continued) After 1 more STOP/START things have been stable for 3 days or so.CommentSharemyloungeanswered 2 years ago0(continued) After 1 more STOP/START things have been stable for 3 days or so.CommentSharemyloungeanswered 2 years ago