Question: Three of my hosted zones have disappeared from Route53

"I went to update some DNS records in my hosted zones, and they've disappeared. There are two zones left but three are gone. AWS is still serving the zones according to dig but I have no way to afxr them to at least re-create them on some. I also don't appear to have any way to open a support ticket because I'm apparently not paying Amazon enough money.I tried re-creating the hosted zone and it created a new, empty zone. Needless to say, this is a disaster.dig ns openshut.net; <<>> DiG 9.10.6 <<>> ns openshut.net;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62445;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232;; QUESTION SECTION:;openshut.net.INNS;; ANSWER SECTION:openshut.net.172800INNSns-110.awsdns-13.com.openshut.net.172800INNSns-1383.awsdns-44.org.openshut.net.172800INNSns-1809.awsdns-34.co.uk.openshut.net.172800INNSns-901.awsdns-48.net.;; Query time: 141 msec;; SERVER: 192.168.200.3#53(192.168.200.3);; WHEN: Wed Feb 23 08:50:52 PST 2022;; MSG SIZE  rcvd: 178FollowComment"

Answer: "0Please create a support ticket in the AWS console so that the team can help you troubleshoot this.CommentShareEXPERTBrettski-AWSanswered a year agoAWS-User-9456228 a year agoPer my addition: ticket ID 9681976831Share0I created a support ticket with ID 9681976831CommentShareAWS-User-9456228answered a year agoBrettski-AWS EXPERTa year agoI see that the support ticket has been resolved. Was the outcome acceptable?Share0I know this is a little late, but I wanted to share this link on how to back up Route 53 zones:https://medium.com/@sharma.naman/how-to-take-aws-route53-backup-2bc3a0343b4Good luck!CommentSharesharpedgewvanswered a year agoAWS-User-9456228 a year agoThanks, I did some research on that yesterday and will definitely be doing that going forward. Assuming I continue to use AWS, since it is more than a little scary that zones can just be moved somewhere with no notice.Share0I got a response from support which said that while the domains are registered to my AWS account the Hosted Zones belong to another AWS account. Support would not tell me the owner of the other AWS account.This makes no sense because:I only have one account.Since my account owns the domains, only my account could have updated the NS records for those domains.This would have required the other account owner toa) add the hosted domains into their account.b) tell me the name server addresses so that I could update NS records in this account.This is ridiculous on its face and I can certainly attest that this never happened. Worse, this means that somebody else’s account has control of the zone records and could add or change them at any time without me even knowing.I think at this point the safest course of action will be for me to try re-create the hosted zones from memory and update the NS records accordingly.CommentShareAWS-User-9456228answered a year ago"


Question: What is the real use of the Identity Center and how does it stand next to IAM

"I am setting up my organisation with my management account and am logged in as an IAM user. I would like to log in via SSO so I thought about giving Identity Center a try. But after reading the docs, I am not sure what is the real use case of the Identity Center. What kind of users should be logging in via the Identity Center and via IAM.Since the Identity Center is region locked, will users logging in via the Identity Center be able to access (CRUD) resources in other regions? If not, should admin level users always use IAM to login?FollowComment"

Answer: "2Accepted AnswerYou can still access your AWS account in Identity Center and still use other regions.The advantage of the "IAM Identity Center" is that unlike IAM users, there is no need to create users for each AWS account.The management account will be able to manage everything.This is a great benefit for customers who have multiple AWS accounts.The "IAM Identity Center" can also issue access keys that expire in a few hours, making them more secure than permanent access keys for IAM users.https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.htmlIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months agoSayak 2 months agoRegarding "You can still access your AWS account in Identity Center and still use other regions" I need some clarity. Do you mean that if I create the Identity Center in US East, then a user signing in through the Identity Center (and not as an IAM user) can create resources in Asia Pacific?ShareRiku_Kobayashi EXPERT2 months agoYes, that is correct.Even if you set up an "IAM Identity Center" in US East, you can create resources in other regions.Share0One thing to note (although this wasn’t your concern) is that IdC does have a dependency on one region. Meaning that there’s a small chance that if that region has an event that makes it inaccessible, IdC won’t work at all - and all users won’t be able to log in. Although a whole region being inaccessible is unlikely, it’s possible - and AWS recommends having a “break glass” ability to log in with IAM just in case.CommentShareor-3answered 2 months ago"


Question: Client VPN availability question

"The Client VPN examples at https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-client-vpn-to-scale-your-work-from-home-capacity/ use this as an example for a failover (?) setup between two AZs:Is that enough to ensure connectivity between "remote workers" and VPC B/C/D in case of a problem in AZ A or AZ B? Is there any way I could realistically simulate a failure of one AZ?I have the recommended setup for TGW attachments in their own /28. My AZ A and AZ B in this case are not the subnets with the TGW attachment, because the CVPN endpoint doesn't allow association with a subnet smaller than /27 - would it be a better/worse idea or make any difference at all if I used /27 subnets for the TGW attachments so I could associate the CVPN endpoints with the same subnets?Thanks,MarcFollowComment"

Answer: "2Accepted AnswerThe way you have setup is correct, as long as you have TGW ENIs in 2 dedicated /28 subnets in 2 different Availability Zones will give you AZ level redundancy and thats what is mentioned in the TGW Best practice guidance.Similarly as long as you associate 2 subnets from 2 different AZs to the ClientVPN endpoints the setup will give you AZ level redundancy.CVPN endpoints and TGW ENIs don't need to be in the same subnet, it sounds like the way you have done the setup is correct.CommentShareEXPERTTushar_Janswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months ago1hiThe best practice is to use multiple Availability Zone.https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/disaster-recovery-resiliency.htmlMultiple target networks for high availabilityYou associate a target network with a Client VPN endpoint to enable clients to establish VPN sessions. Target networks are subnets in your VPC. Each subnet that you associate with the Client VPN endpoint must belong to a different Availability Zone. You can associate multiple subnets with a Client VPN endpoint for high availability.While there is not a specific solution to simulate  Client VPN failoverthe documentation below might provide some guidance on how to think about ithttps://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#disrupt-connectivityhttps://www.wellarchitectedlabs.com/reliability/300_labs/300_testing_for_resiliency_of_ec2_rds_and_s3/7_failure_injection_az/CommentSharekaveerhanswered 6 months ago0Thank you both for your replies, much appreciated.CommentShareMarcanswered 6 months ago"


Question: What happens to EFS based PVs when a node crashes?

I have some applications which uses dynamically provisioned PVs with EFS (EFS CSI dynamic provisioning). I have an EKS cluster with managed node groups in different AZs. My question: what happens to these PVs when a node crashes for some reason and the pods are restarted on other nodes? Will EKS or k8s automatically remount these EFS based PVs to the proper pods?FollowComment


Question: Getting Access to the Canvas

"OK, so I am at a loss on this. So I've set up a player with a ray cast which initiates a script event when the raycast hits an entity with an 'item' tag. It only does this once and then triggers a boolean to turn false when it's not hitting anything like that. This is all working just fine.The issue is that when the script event fires I'm trying to get access to a canvas which is associated with an entity. I've loaded it automatically. Then I use Get Canvas node and get a reference to that from an entity variable which points to the entity with the loaded canvas.But I try to iterate through the children and I'm not getting any names when I try to use Get Name node and print it out. So I'm not getting access to this canvas and I can't figure out what's going on.REMOVEDUPLOADThe bottom print works. It prints out true and false when it's supposed to. But I can't get access to the canvas.Follow"

Answer: "0Accepted AnswerI see one issue...the Get Children node. Is UI Element Get Children, not UI Canvas Get Children.SharerePost-User-7039295answered 3 years ago0Hey Wcb,Three things I would check here:That the Get hud node is actually being set to an entity.  Does it have your player or hud entity as the value in the variable manager?  Add a print node to print the EntityId value after GetHud (it should look normal, i think it does spit out a dummy entityId value if it isn't set)That the entity with the canvas had enough time to load the canvas before you are asked for a reference to it.  You might just avoid this problem by leaving the canvas unloaded and calling the load canvas node in this script you have posted.  Otherwise I see that there is a 'On Canvas Loaded Into Entity' node that you can use to be sure the canvas ready to reference.  The node should either fire immediately on connecting if the canvas is already loaded and ready or it will fire at some point after when it is ready.If that reference to the canvas is all good, ensure that the canvas actually has child UI elements.  Perhaps add a print node right after 'For Each' and see how many times it fires and that the EntityIds are all unique and match the count you would expect.SharerePost-User-7039295answered 3 years ago0I decided to just do thisREMOVEDUPLOADI made a script canvas just for the entity with the canvas and attached the script canvas to it. This doesn't have any output at all. It doesn't print a thing. The UI Canvas has children.It won't even spark that event.The canvas loads fine but it doesn't seem to be loading into the entity. I know the canvas loads because I can see the GUI.SharerePost-User-9359627answered 3 years ago0REMOVEDUPLOADNot even that works. I meant "HUD LOADED INTO ENTITY" ftrSharerePost-User-9359627answered 3 years ago0@REDACTEDUSERAnother thing to check is that the UI component is on the same entity you are referencing in the 'GetHud' node.  If, in your level layout, your top-level 'Player' entity has the UI component and you are referencing 'Player' in GetHud, that all sounds fine.  If your Player entity has a child entity called Hud or something, and the child actually the entity with the UI component, then the child component needs to be the referenced EntityId in GetHud.Here is an older forum post with a two-part tutorial on working with the UI in scriptcanvas, it has the scriptcanvas graph there too, the layout is probably jumbled, it's from an older version of Lumberyard.  The tutorial doesn't cover cross-entity referencing, but plenty on wrangling UI canvases with some of the caveats of referencing them.https://forums.awsgametech.com/t/creating-a-main-menu-with-script-canvas/5619/6SharerePost-User-7039295answered 3 years ago0REMOVEDUPLOADIf I do this then I can get HUD LOADED INTO CANVAS print statement to work. But it still doesn't print children.SharerePost-User-9359627answered 3 years ago0For that graph to work, it would have to be on the entity with the UI component, because the source is set to self.If this graph is on a different entity you'll need to change the source.SharerePost-User-7039295answered 3 years ago0The graph ("hud.scriptcanvas") is now connected to an entity called "hud" which has a canvas ref attached called "hud" which is hud.uicanvas that has children.I did that to attempt to isolate what the problem is. I have no idea why I can't get access to the children in hud.uicanvas which is attached to entity "hud" which has the above graph in it which is a scriptcanvas "hud.scriptcanvas" It will not print out any of the children.SharerePost-User-9359627answered 3 years ago0REMOVEDUPLOADThis is what I currently have. And I can get this "(Script Canvas) - HUD LOADED INTO ENTITY: [706703339973959]" but that's all I get.I should get all the children but I do not. I have no idea how to know if that big long number is a "dummy" number or not.SharerePost-User-9359627answered 3 years ago0OK that sounds like a good setup to work from. That EntityId looks fine.SharerePost-User-7039295answered 3 years ago0I also tried a different uicanvas file just to see if the hud one is corrupted. It doesn't work with either uicanvas file. Can't print out children.SharerePost-User-9359627answered 3 years ago0Those nodes that have the same name but slightly different categories get me plenty.SharerePost-User-7039295answered 3 years ago0DOH! all I did was search "get children" and assumed since it was UI it was appropriate. That fixed it. THANK YOU!SharerePost-User-9359627answered 3 years ago0You got it! That tutorial might still be worth a look for the caveats...there is another category, UI Canvas Manager that can be useful but you have to mind the pathname, that's covered in one of those pdfs.SharerePost-User-7039295answered 3 years ago"


Question: EC2 ubuntu 18.04 fresh + apache2 install CONNECTION REFUSED

"I am ssh'd into my instance yet can't seem to get the default apache splash page, let alone connect to my instance via http port 80.I have the instance under "anywhere" security group for the meantime, still no go.Since this is a fresh ubuntu install (only did apt update and apt install apache2), what would be the default reason this usually occurs?Thanks!FollowComment"

Answer: 0the problem was between the keyboard and my chair. All good now.CommentShareereztanswered 3 years ago0What was the resolution. I am having the same issue.Thanks.CommentSharesgehmlichanswered 2 years ago


Question: Does the AWS SDK for Java have models for FlexMatch notifications

FlexMatch sends various notifications described here. I have a service getting these messages via SQS polling. The event payloads in the messages are serialized to JSON. Are there models defined for these events in the Java AWS SDK 2.0? I sure cannot find them.Are you supposed to roll your own models to deserialize and work with these events?FollowComment

Answer: "1Accepted AnswerHello,Please note that you can invoke the following FlexMatch API using Java SDK v2.For example, the following are the Java SDK v2 reference for AcceptMatch API call. Example of Java SDK V2 for AcceptMatchHowever, In order deserialize and work with the events emitted by Flexmatch, you should build your own communication model for your Java client and Game server. The GameLift inherently does not support the same. Please refer to the following repost thread for more details.Having said that, in case you face further challenges, please feel free to open a support case with AWS using the following link as this will allow us to provide you resource specific guidance and dive deep into the same.CommentShareSUPPORT ENGINEERMukul_Vanswered 3 months agoRyanO 3 months agoThanks - yeah I found the API client stuff in the SDK, thanks. And I can create my own Java models for the notifications coming back out via SNS. Just hoping that I wouldn't have to do that work.Share"


Question: ec2 instance showing filtered ports

"Hi,I'm having trouble with my instance having ports randomly closing or filtered out. When I runnetstat -tulpn | grep LISTENI get the following:(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.)tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      -tcp        0      0 0.0.0.0:42271               0.0.0.0:*                   LISTEN      -tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      -tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      -tcp        0      0 :::8888                     :::*                        LISTEN      2134/javatcp        0      0 :::20540                    :::*                        LISTEN      2134/javatcp        0      0 :::7777                     :::*                        LISTEN      2134/javatcp        0      0 :::7878                     :::*                        LISTEN      2134/javatcp        0      0 :::18600                    :::*                        LISTEN      2134/javatcp        0      0 :::18505                    :::*                        LISTEN      2134/javatcp        0      0 :::18506                    :::*                        LISTEN      2134/javatcp        0      0 :::18573                    :::*                        LISTEN      2134/javatcp        0      0 :::36525                    :::*                        LISTEN      -tcp        0      0 :::18510                    :::*                        LISTEN      2134/javatcp        0      0 :::18511                    :::*                        LISTEN      2134/javatcp        0      0 :::111                      :::*                        LISTEN      -tcp        0      0 :::8080                     :::*                        LISTEN      2134/javatcp        0      0 :::18512                    :::*                        LISTEN      2134/javatcp        0      0 :::22                       :::*                        LISTEN      -This shows some ports e.g. 18505, 18506 opened and listening.My EC2's attached security group has those ports listed as open to all incoming traffic. The question is, when I try to connect to it from my home computer, the connection is refused. Port mappers like nmap show the port as filtered. Spinning up another instance and moving the EBS volume over and reassigning the elastic IP seemed to work, but then when I changed the instance type, the same problem is occurring again.ifconfig on the host shows:eth0      Link encap:Ethernet  HWaddr 02:D6:91:DE:97:0F          inet addr:xxx.yy.z.ww  Bcast:xxx.yy.zz.255  Mask:255.255.240.0          inet6 addr: fe80::d6:91ff:fede:970f/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:9001  Metric:1          RX packets:2041 errors:0 dropped:0 overruns:0 frame:0          TX packets:2518 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000          RX bytes:240515 (234.8 KiB)  TX bytes:308430 (301.2 KiB)On the host, using nc to connect to both localhost and xx.yy.z.ww above (redacted for privacy) connect fine. Connecting to the elastic IP does not.How can I diagnose where the issue is and restore connectivity?FollowComment"

Answer: "0The issue was resolved with support center and was an issue at the account level, not the technology.CommentShareElleTrudgettanswered 3 years ago"


Question: Host a python django website in aws in free tier

I'm a newbie to AWS. I have developed a python django website of size 5GB. I'm planning to launch it via AWS Ec2 instance by adding ads in the site.I created an ec2 instance by choosing t3.micro and a db- rds instance by selecting mysql. So this db instance went beyond 20GB limit in a day which i have no idea. i did just created the db instance.So this ec2 instance will have project folder of size 5GB and DB rds instance will have a user table which will be used on signup of the user and during login of the user. Only two scenarios.How to choose ec2 instance type and DB rds instance storage to stay in free tier?FollowComment

Answer: "0Below guidance and links with details will help you plan for the scenariohttps://aws.amazon.com/rds/free/https://aws.amazon.com/free/ --> This covers compute, RDS, S3 and EBSCommentShareEXPERTAWS-User-Nitinanswered 6 months ago"


Question: Public IP needs to converted as Elastic IP

"Hi Team,we have a instance with public IP which can get change after stop and start. but we do not want this public IP to be changed. application is designed in such a way.can you help me convert this same public ip to elastic IP or any other way.Regards,JayaFollowComment"

Answer: 0Hi ThereUnfortunately you will not be able to convert an auto-assigned public IP to an Elastic IP.   See https://aws.amazon.com/premiumsupport/knowledge-center/ec2-associate-static-public-ip/You might also consider moving this instance behind an Elastic Load Balancer.  This provides the added benefits of using additional services like auto-scaling.  You will also not need to worry about pubic IP addresses because the load balancer handles it for you.  See https://aws.amazon.com/what-is/load-balancing/ for more info.CommentShareEXPERTMatt-Banswered 4 months ago


Question: external platforms

HOW TO GUARANTEE… THE CREDIBILITY OF A THIRD-PARTY Amazon AffiliateIs this really available?FollowComment

Answer: "0Accepted AnswerI think what you are looking for is how to validate a "partner" IS an AWS Partner.https://partners.amazonaws.com/Give that a try and always let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 13 days ago"


Question: Set default timezone for Amazon WorkMail

"When administering an Amazon WorkMail Organization, there is no method I can discern from documents, google searches nor forums as to the process for having the ActiveSync/Exchange/WorkMail Calendar Timezone be set by the administrator nor the User. This is affecting multiple clients I administer who are seeking to have their local-to-timezone business have a default setting.I'm seeking any information or process I can follow to set a default timezone for all calendar events as an admin, as well as one I can provide to end-users to set their local timezone by default.FollowCommentcheat117 a year agoWhile the recipient should be able to enforce the timezone on their side. Clients of certain age or "why can't it be easy" mentality find this to be deal breakers and as such I've lost more than one account due to this problem."I should be able to just hit save for the appointment and it picks up the timezone from my device" was the intent. However in practice, timezone was pulled by the server and setting in GMT+0 instead of being able to set the timezone from the server for the client and letting those who are comfortable change the zone.Share"

Answer: "0Hi,Thank you for your interest in WorkMail. Currently there is no administration option to force a time zone. The timezone for meetings and the calendar will be taken from the client device. This is intentional behavior to show the meeting at the correct time for the user/device’s local time zone.Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year agocheat117 a year agoUnfortunately, this tends to cause issues for smaller customers/clients who aren't using other timezones and dealing with a local area. While the goal is always to be global, this is a basic function that should be a tag-enforcable or even a server-side enforceable action.This is a deal breaker for my client and as such I've had to close their WorkMail integration.Share"


Question: Fail/Rollback EC2 Instance Provisioning if UserData Fails

"Is it possible to fail or rollback EC2 instance provisioning, if UserData fails? Let's say I execute some PowerShell scripts as part of UserData provisioning and some scripts fail. I want to fail the EC2 provisioning with the errors. Please helpFollowComment"

Answer: "0Accepted AnswerIf you deploy the instance via Cloudformation, you can utilize the cfn-helper scripts to achieve this. Specifically, the cfn-signal script is what you would use, along with Clouformation wait conditions to signal that the script succeeded or failed.CommentShareLawrence Aielloanswered a month agoVenkatesh a month agoThanks a lot for your prompt response. However, I have a couple of questions. Will this work for Windows Instance.? I am trying to implement this in an Auto Scaling Group scenario. Will it work? Can you please share any example, if possible? Thanks a lot once again.ShareVenkatesh a month agoThanks a lot for the hint. This helped me, although I had to make some changes.Share"


Question: Access to the resource https://sqs.eu-west-2.amazonaws.com/ is denied.

"API Gateway -> SQS queue integrationHi AllHope you can help.I am creating REST API in new AWS account with terraform.Using IAM role with AmazonAPIGatewayAdministrator policy to create api gatway method & integration request to SQS queue. Also added permission to role for sending messages to queue aswell.Once terraform deployed, Getting AccessDenied{    "Error": {        "Code": "AccessDenied",        "Message": "Access to the resource https://sqs.eu-west-2.amazonaws.com/ is denied.",        "Type": "Sender"    },    "RequestId": "824c8fe5-2da2-58bc-ad89-d4b1a461bf75"}ThanksSGFollowCommentrePost-User-4402012 10 months agoUsing following IAM Role Policy{"Statement": [{"Action": ["logs:CreateLogGroup","logs:CreateLogStream","logs:DescribeLogGroups","logs:DescribeLogStreams","logs:PutLogEvents","logs:GetLogEvents","logs:FilterLogEvents"],"Effect": "Allow","Resource": ""},{"Action": "sqs:","Effect": "Allow","Resource": "arn:aws:sqs:eu-west-2:account_id:queue_name"},{"Action": ["lambda:InvokeFunction","lambda:InvokeAsync"],"Effect": "Allow","Resource": "arn:aws:lambda::account_id:function:"}],"Version": "2012-10-17"}Share"

Answer: "0Based on the given context, I am assuming that you have correctly added permissions to an IAM role assumed by API Gateway to access an SQS queue. Have you taken a look at SQS access policy, service control policy in AWS organizations, KMS permissions, and VPC endpoint (VPCe) policy (if VPCe is in use)? This article How do I troubleshoot AccessDenied errors on Amazon SQS API calls? covers basic troubleshooting steps.CommentShareTaka_Manswered 10 months agorePost-User-4402012 10 months agoNot using VPCs or KMS{"Version": "2012-10-17","Id": "sqspolicy","Statement": [{"Sid": "First","Effect": "Allow","Principal": "*","Action": "sqs:SendMessage","Resource": "arn:aws:sqs:eu-west-2:account_id:queue_name"}]}Share0HiIn your role policy I see sqs: instead of sqs:SendMessageMake sure{"Action": "SendMessage",.....}CommentShareOmid Eidivandianswered 10 months ago"


Question: "Migrated ELB to ALB, my EBS profile didn't update"

"I have an elasticbeans environment that had been using an "classic" load balancer.  I ran the widget to update that to an Application load balancer.  But EBS is still pointing at the classic instance, which is gone.  Its not obvious how to fix this without rebuilding.  I can change the config of the ELB, but not extract it and replace with with other - at least not through the GUI.  I saw an answer from 2 years ago that suggested a rebuild was the only option - but I'm hoping there has been an update.  Any suggestions?FollowComment"


Question: sign-in through external social identity providers only second time able to login. why?

"While using cognito signin using external social identity providers like google, signin at first attempt not getting access token and so I am not able to signin. if we try second time , is able to login.FollowCommentJeff Lombardo-AWS 4 months agoCan you please specify any error message you received as part of this?Share"


Question: "Announcement: Deprecation of PostgreSQL, MySQL, and MariaDB databases in Amazon RDS running on M1, M2, M3, R3, and T1 instances"

"Amazon RDS will start deprecating M1, M2, M3, R3, and T1 instances for your PostgreSQL, MySQL, and MariaDB databases from February 6, 2023.All PostgreSQL, MySQL, or MariaDB databases running in Amazon RDS on M1, M2, M3, R3, or T1 instances will be automatically upgraded as per the upgrade path outlined below by RDS, no earlier than February 6, 2023 starting 12 AM UTC:Existing InstanceSize,Existing SpecsNew Instance SizeNew Instance Specsdb.m1.small1 vCPU, 1.70 GBdb.t3.small2 vCPU, 2.00 GBdb.m1.medium1 vCPU, 3.75 GBdb.t3.medium2 vCPU, 4.00 GBdb.m1.large2 vCPU, 7.50 GBdb.m5.large2 vCPU, 8.00 GBdb.m1.xlarge4 vCPU, 15.00 GBdb.m5.xlarge4 vCPU, 16.00 GBdb.m2.2xlarge4 vCPU, 34.20 GBdb.r5.xlarge4 vCPU, 32 GBdb.m2.4xlarge8 vCPU, 68.40 GBdb.r5.2xlarge8 vCPU, 64 GBdb.m3.medium1 vCPU, 3.75GBdb.t3.medium2vCPU, 4GBdb.m3.large2 vCPU, 7.5 GBdb.m5.large2 vCPU, 8 GBdb.m3.xlarge4 vCPU, 15GBdb.m5.xlarge4 vCPU, 16 GBdb.m3.2xlarge8 vCPU, 30GBdb.m5.2xlarge8 vCPU, 32 GBdb.r3.large2 vCPU 15.25 GBdb.r5.large2 vCPU, 16 GBdb.r3.xlarge4 vCPU, 30.5GBdb.r5.xlarge4 vCPU, 32 GBdb.r3.2xlarge8 vCPU, 61GBdb.r5.2xlarge8 vCPU, 64 GBdb.r3.4xlarge16 vCPU, 122GBdb.r5.4xlarge16 vCPU, 128 GBdb.r3.8xlarge32 vCPU, 244GBdb.r5.8xlarge32 vCPU, 256 GBMigration will be done in the maintenance window of your RDS instance. During this migration, your database may be shutdown and restarted multiple times. If you choose the “Apply Immediately” option, the migration will be initiated immediately after clicking on the “Modify DB Instance” button. If you choose not to apply the change immediately, the migration will be performed during your next maintenance window.Your PostgreSQL, MySQL, or MariaDB databases in Amazon RDS running on M1, M2, M3, R3, or T1 instances will be automatically migrated to an equivalent M5, R5, or T3 instance by RDS, no earlier than February 6th, 2023 starting 12 AM UTC, as per the migration path.To avoid any unplanned disruptions, we recommend that you migrate your PostgreSQL, MySQL, and MariaDB databases in Amazon RDS running on M1, M2, M3, R3, or T1 instances to an equivalent M5, R5, or T3 instance before February 3, 2023.To learn more about the latest instance types supported on RDS, refer to the Amazon RDS user guide [1]. For guidance on modifying your instance class, see the Amazon RDS User Guide [2]. If you have any questions or concerns, the AWS Support Team is available via re:Post [3] and via AWS Premium Support [4].[1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html#Concepts.DBInstanceClass.Types[2] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html[3] https://repost.aws[4] https://aws.amazon.com/supportFollowComment"

Answer: 0[Announcement] Does not require an answer.CommentShareEXPERTIsraa-Nanswered 23 days ago


Question: Re-attaching EB volume makes instance fail status checks

"I detached and deleted a EB volume from an EC2 instance. After creating a new volume (basically identical to the previous volume) and attaching it to the EC2 instance, when I launch the instance it fails the status checks and the instance stops. I have confirmed that the volume is in the same availability zone as the instance, and the relevant security group has the correct inbound and outbound rules.FollowComment"

Answer: "0Hi tjbraileyThank you for reaching out to us :)Could you please provide an error message. You can get this by retrieving system logs which will allow me to troubleshoot this issue accordingly.Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/  In the navigation pane, choose Instances, and select your instance.Choose Instance state, Reboot instance. It might take a few minutes for your instance to reboot.Verify that the problem still exists; in some cases, rebooting may resolve the problem.When the instance is in the running state, choose Actions, Monitor and troubleshoot, Get system log.Review the log that appears on the screen, and copy the system log error statements and paste into a reply in order for me to troubleshoot your issue.I look forward to your response :)CommentSharenaz97answered 2 years ago0Many thanks for your response.I completed points 1. - 3. and the problem still exists.For 4. - 5., when I open up the system log, I see a black panel. If I try to copy or download the log, there is no text.CommentSharetjbraileyanswered 2 years ago0Thank you for confirming steps 1 -3 :)Could you please provide some more information on how you created the new volume? Such as whether you have created an EBS volume from scratch, meaning, you have gone through the configurations by selecting the volume type, size, etc or if you have created an EBS volume from a snapshot.When you create an EBS volume based on a snapshot, the new volume begins as an exact replica of the original volume that was used to create the snapshot. The replicated volume loads data in the background so that you can begin using it immediately. On the other hand, if you have created your EBS volume from scratch it would be an empty volume with no data.Just for note, it is best practices to back up your data on EBS volumes by taking snapshots before deleting them:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.htmlI look forward to your response.CommentSharenaz97answered 2 years ago0Got it, thanks for the information.I set up a new volume from scratch, so I think this is causing the problem. I don't have any snapshots, so is there a way to attach a new volume and access the instance, or would I need to create a new instance from scratch?ThanksCommentSharetjbraileyanswered 2 years ago0Thank you for the confirmation :)Based on your reply, that the volume was created from scratch and would therefore be empty, there is no way to install an Operating System onto it. It would be advisable to terminate and create a new Linux instance which will contain the root device volume that will have the image used to boot the instanceFeel free to reach out if you require any assistance :)CommentSharenaz97answered 2 years ago0Okay great, many thanks for your help on this.CommentSharetjbraileyanswered 2 years ago"


Question: What's the log4j version on R20211203- P2?

"What's the log4j version on R20211203- P2 (today, 20-Dec-2021)?FollowCommentJaccoPK a year agoCould not find any version number of log4j https://stackoverflow.com/questions/70359982/were-running-elasticsearch-7-8-through-aws-opensearch-with-logging-turned-offShareJaccoPK a year agoAn updated version at least https://aws.amazon.com/security/security-bulletins/AWS-2021-006/Share"

Answer: "0Amazon OpenSearch Service has released a critical service software update, R20211203-P2, that contains an updated version of Log4j2 in all regions. We strongly recommend that customers update their OpenSearch clusters to this release as soon as possible.I would highly recommend you to track/monitor the following AWS security bulletin for updates on this vulnerability’s impact on AWS services :https://aws.amazon.com/security/security-bulletins/AWS-2021-006/CommentSharesyumaKanswered a year agoEXPERTFabrizio@AWSreviewed a year ago0I updated R20211203- P2. However It updated new weekness point log4j, 'CVE-2021-45105' 19/12/2021. Does R20211203- P2 resolve  'CVE-2021-45105'?CommentShareAWS-User-5175751answered a year ago0The R20211203- P2 will not protect from CVE-2021-45105. Probably this will in a next patch although the threat is a bit lower (only DDOS possibility under certain conditions).I do not know the contents of the patch though. There is one version of log4j unaffected: 2.12.3 if they used that version the new CVE would also be covered. This version was release 2020-02-25 though and probably has other vuklnerabilities.The only unaffected version for CVE-2021-45105 is log4j version 2.17 (and 2.12.3) which was released 18 dec 15:14.(source https://github.com/apache/logging-log4j2/tags hover over tag label)The patch R20211203- P2 was suggested before 15 dec 07:43.(source https://stackoverflow.com/questions/70359982/were-running-elasticsearch-7-8-through-aws-opensearch-with-logging-turned-off)CommentShareJaccoPKanswered a year ago"


Question: Problem with ELB logs

"**Context: **i've created an ELB and have connected to a target group which inturn is connect to an ASGASG - Working:I could see that ASG is working fine aka it creates an instance automatically as per the scaling policy.Target Group - Working:I could also see that the target group is indicating the instance as HealthyELB - Not Working:whereas, when I try to hit the ELB's public URL from a browser, I don't see it working, it fails with a timeout error and I've enabled logging for ELB but don't see the logs appearing in S3 buckets (although there's a file created by ELB, which means I've given proper access to it)I literally don't know how else to track a request from ELB and I'm not seeing the logs generating in my application/instances as well.but, when I try to hit the public URL of my instance, the application does workany inputs would be helpful!FollowComment"

Answer: 1Accepted AnswerHave you checked if you security group have all the inbound and outbound rules ? Sometimes the application requires specific rules to guarantee the connection is established successful.CommentShareJapanTakeAWSConsoleanswered a year agoSaru a year agothe issue was that I was only modifying the security group of my ASG template but had a separate security group for ELB which was not being modified and that was the issue exactly.thank you for your input.Share


Question: Deploying web application to aws greengrass

"I am working on a web application for video detection (video uploaded from pc) which run inside a gpu server. Is it possible to apply edge computing by AWS Iot greengrass on the project? Can I deploy the whole project include backend and frontend to AWS greengrass core as a component? How can I do that? Also, is cloud necessary for AWS greengrass? Where should I install the AWS IoT Device SDK?FollowComment"

Answer: "1Hi. Who/where are your web application users? Greengrass really lets you build anything you want, but it may make more sense to keep your backend in the cloud. It's hard to make a recommendation based on the limited information you've provided.Greengrass could be a good option for ingesting your video stream into the cloud. Take a look at the Edge connector for Kinesis Video Streams.If you want to process data at the edge, you can take a look at how to build machine learning at the edge using Amazon SageMaker Edge Manager and AWS IoT Greengrass V2CommentShareJoeAtAWSanswered 7 months agorePost-User-3578470 7 months agoThe web application itself is already a completed project. I run it on the nvdia gpu server to fulfill the hardware requirement for video detection. The video analyse is done at the backend, so I wonder how could I apply edge computing using greengrass with the least modification of my project.Share"


Question: Sagemaker batch transform 415 error

"Hi, I need to run XGBoost inferences on 15MM samples (3.9Gb when stored as csv). Since Batch transform does not seem to work on such large batches (max payload 100MB) I split my input file into 646 files, each around 6Mb, stored in S3. I am running the code below:transformer = XGB.transformer(    instance_count=2, instance_type='ml.c5.9xlarge',    output_path='s3://xxxxxxxxxxxxx/sagemaker/recsys/xgbtransform/',    max_payload=100)transformer.transform(    data='s3://xxxxxxxxxxxxx/sagemaker/recsys/testchunks/',    split_type='Line')But the job fails - Sagemaker tells "ClientError: Too many objects failed. See logs for more information" and cloudwatch logs show:Bad HTTP status returned from invoke: 415'NoneType' object has no attribute 'lower'Did I forget something in my batch transform settings?FollowComment"

Answer: 0Accepted AnswerThis indicates that the algorithm thinks it has been passed bad data. Perhaps a problem with your splitting?I would suggest two things:Try running the algorithm on the original data using the "SplitType": "Line" and "BatchStrategy": "MultiRecord" arguments and see if you have better luck.Look in the cloudwatch logs for your run and see if  there's any helpful information about what the algorithm didn't like. You can find these in the log group "/aws/sagemaker/TransformJobs" in the log stream that begins with your job name.CommentShareAWS-User-8377309answered 5 years ago


Question: Unable to connect to remote host: No route to host

"From today, I have problem to access my server on 443 port. I get an error "Unable to connect to remote host: No route to host".I've made reboot, instance status check is passed, but doesn't work. My instance ID: ****************FollowCommentAdam MODERATOR10 months agoI've removed your instance ID for security purposes. Please review https://repost.aws/guidelinesShare"

Answer: "0Pls, check the Security Group for instance. Maybe you forgot to add ports. If you have already added port 443 (HTTPS), I suggest adding port 80 (HTTP), (Maybe, you are accessing non SSL server). Furthermore, for SSH add port 22 (SSH) (For access through CLI). From the error, its looks like some issues with either the IP address or the Security group. Check your instance subnet (Public or private) and VPC (check whether your VPC internet is working or not: login instance through AWS console and ping public IP ). Also, check whether you are using private IP or Public address. (Use public for outside access and private for internet access).CommentShareVISIanswered 10 months agoAdam MODERATOR10 months agoReview your routing tables as well. How are you attempting to access your instance?Share"


Question: Cloudfront not adding response headers from Cloudfront functions when requests are made in HTTP/3

"When HTTP/3 is enabled in Cloudfront, response headers added in Cloudfront functions (like the CORS headers shown in this example and the security headers in this example) are not actually added. However, these headers are added as usual when the requests are made in HTTP/2. Headers set with 'Response headers policy' in Cloudfront behaviors are also properly added.Is it a bug or am I missing out on something?Edit: Attach some screenshots for my configuration:FollowComment"

Answer: "0I've just tested this and had no issues with at least access-control-allow-origin being added when HTTP/3 is in use. This was the case when using both CloudFront Functions as well as Response Header Policies.Please check that your function uses all lowercase for the header key names.It may also be worth trying a different browser.CommentSharePaul_Lanswered 10 months agoKarl_K 10 months agoThank you for your response.Yes, the function is using all lowercase for the header key names.I've updated my question with some screenshots to show my configuration.In addition to curl shown in the screenshots, I've also tried the latest version of Firefox and Chrome, and the problem persists across the browsers.SharePaul_L 10 months agoI suggest you raise a case with AWS support to investigate further. Please provide them the x-amz-cf-id response headers for each of your examples above.You could also try removing and re-adding the cloudfront function association to see if that resolves the problem.Share"


Question: AWS Codebuild Projects stuck in SUBMITTED Status. Outage?

All of our codebuild jobs have been stuck in Submitted phase (the Queued phase is shown with no status). They worked earlier in the day and we haven't changed anything about the configurationI've checked and there's no outage reported on the AWS health page.Is there an unreported codebuild outage?FollowComment

Answer: "1What is the AWS region ? I would reach out to AWS PS Support for the Code-build team. There is no global outage happening. Had there been an outage which is acknowledged, it would have been reported in the PHD or through an email on the registered email account.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago0Accepted AnswerHad to get on the phone with AWS support, turned out to be an issue with AWS. After working with them for awhile we were able to resolve it but only after escalating it. Here's details from that support issue:In order to test if this was truly a concurrency issue, I had you manually stop all current builds. After all builds were stopped, your current running count should have been "0". Once the count was 0, you attempted to manually start a new build through the console. From here, we witnessed the build get stuck again in the QUEUED state. Because you were unable to provision just one CodeBuild job, we were able to confirm that this was not an expected behavior. At this point in time, I escalated this to the internal team. While working with them, we checked the backend and believed there was an issue with how the running builds were being counted. After resetting certain properties on the backend, you were then able to successfully provision new builds through your GitHub Webhooks.Hopefully useful to somebody elseCommentSharerePost-User-2054100answered 8 months ago"


Question: Ubuntu 18.04 AMI with "ubuntu-desktop" pkg fails to connect (networking)

"The problem can be duplicated easily with the following steps:launch ubuntu 18.04 instanceapt install ubuntu-desktopcreate an AMI from this instancelaunch a new instance from AMI and fail to connect via sshLooking at the system log, it is obvious that the network interface ens5 was not started properly.  Its status is shown as "down".  See image attached.Any ideas? The original instance still works fine in terms of networking.FollowComment"

Answer: "0It turns out ifupdown pkg brought in by ubuntu-desktop is conflicting with the new netplan in some wired way, I suppose.  After "apt purge ifupdown", things are fine now.CommentShareJun S.answered 4 years ago"


Question: Service Catalog and Quotas

"Hello,Is there any way to establish quotas in service catalog? I would need do some tricks with lambda function and events but would like to know if there is anything more pratical.I would like for example to limit how many provisioned products a user can have.FollowComment"

Answer: 1This pattern may provide some good ideas to implement something what you are looking for https://aws.amazon.com/blogs/mt/tracking-aws-service-catalog-products-provisioned-by-individual-saml-users/.It has the following approach that can be extended for your caseThe user provisions a product after authenticating to AWS Service Catalog.AWS Service Catalog launches an AWS CloudFormation template in response to the user’s request.An AWS Lambda function is invoked based on the Amazon CloudWatch rule triggered by the CloudFormation CreateStack event.The Lambda function reads the User Name and CloudFormation stack ID from the event record and stores this information in an Amazon DynamoDB database.The CloudFormation template provisions a custom resource that invokes the AWS Lambda function.The Lambda function reads the user name from the Amazon DynamoDB record associated with the CloudFormation stack ID and returns this information back to the CloudFormation template.You may need to add your own logic to this approach and do a POC to see if it works for your needs.CommentShareEXPERTAWS-User-Nitinanswered 9 months agoEXPERTIndranil Banerjee AWSreviewed 8 months ago


Question: Using concurrent write to DynamoDB

"We have an api for sending SMS, in which we are saving a log in DynamoDB with the information about sending the SMS. We were testing the api and got the following results:First Test: 10 requests are sent to the api, the api responds correctly to all requests, in CloudWatch the 10 calls are evident but in DynamoDB we only have 8 records.Second Test: Another 10 requests are sent to the api with a different message, the api responds correctly to all the requests, in CloudWatch the 10 calls are evident but in DynamoDB we have 8 new records with the message of the second test and the two records that were missing from the first test.We did tests with a larger number of requests and the behavior is similar.Does anybody have idea of what's going on?FollowComment"

Answer: "1Are you overwriting items in your DynamoDB table. Each item in DynamoDB must be uniquely identified by primary (Partition + Sort) key. For that reason, if more than 1 of your items share the same primary key, it would give the impression that the write did not occur, as it has just overwritten an existing item.Some things to try:Make sure all items are uniqueAdd a timestamp to your items to ensure they were updated/written when you expected them to beEnable Cloudtrail Dataplane Logs to see which data modifications you are making.Share a sample of the 10 items, along with the code you use to store them in DynamoDB. I can best help when I have more information.CommentShareEXPERTLeeroy Hannigananswered 5 months agoCarlos Sarmiento 5 months agoWe are using an email as Partition Key and something with this format YYYY-MM-DDTHH-mm-ss.mmss_SMS_UUID as Sort Key, so we can make sure that the Primary Key is unique and avoid overwriting.This is the code we are using to perform the tests, in each test we only change the SMS quantity and the SMS Messageconst axios = require("axios");let params = {message: " ",phoneNumber: "+573XXXXXXXXX", //This must be a mobile phone number};const list = new Array(10);for (let index = 0; index < list.length; index++) {params.message = "test 10 sms: " + (index + 1);list[index] = JSON.stringify(params);}list.map(async (data) => {const apiKey = "<API KEY>";var config = {method: "post",url: "https://yntwygrb91.execute-api.us-east-1.amazonaws.com/dev/sms",headers: {"Content-Type": "application/json",Accept: "application/json","x-api-key": apiKey,},data: data,};axios(config).then(function (response) {console.log(JSON.stringify(response.data));}).catch(function (error) {console.log(error);});});And this is the code of the function that writes in DynamoDBexports.createLog = async function (logInfo, TableName) {const params = {TableName,Item: logInfo,};try {const data = await dynamo.put(params).promise();log(data);return data;} catch (err) {console.error(err);throw err;}};ShareLeeroy Hannigan EXPERT5 months agoThen please enable Dataplane Logging and see what is happening on the serverside.Share"


Question: "AWS CDN signed url doesn't open after redirected from facebook, gmail message"

"When I copy paste Cloudfront signed url https://<Alternate Domain name - CDN>/hello.pdf?Expires=1651030980&Signature=****&Key-Pair-Id=****   in browser, file opens within expiry date. I shared that link through facebook message and gmail but the signed url doesn't work due to trialing added at  end of url while redirecting from them.While redirecting shared link through facebook message fbclid is added .https://<Alternate Domain name - CDN>/hello.pdf?Expires=1651030980&Signature=****&Key-Pair-Id=*****&fbclid=***** It opens only when I remove fbclid manually.How to make signed url working automatically (open hello.pdf) redirected from gmail, facebook message?FollowComment"


Question: How do I find my AWS server IP

"My game provider is asking me for my AWS server IP so they can whitelist my IPswhere can I find this info?thanksFollowCommentiwasa EXPERT5 months agoHi. What service are you using to host your AWS servers?Sharerepost_user_1342 5 months agoIf you are using AWS EC2 instance, you should be able to see it on EC2 Dashboard of the region you have launched the EC2 instance.Start -> Login to your AWS Account -> Select the appropriate region -> Go to EC2 Dashboard -> Click on Instances -> Select your instance (server) ->Select tab Networking (below) -> Public/Private IPs would be visible ->EndShare"

Answer: "0See the comments above. Also, if your server is in a private subnet, you will need the Elastic IP address of the NAT Gateway/Instance instead of the IP of the server.CommentShareEXPERTkentradanswered 5 months ago"


Question: Athena + CUR report - resources created in the last week?

"How can a list of resources that were created in the last week be generated?Is it something that can be done with Athena + CUR (like https://aws.amazon.com/blogs/aws-cost-management/querying-your-aws-cost-and-usage-report-using-amazon-athena/?, but taking into account resources generating spend in the last week and resources that were generating spend before that), but maybe someone already has a query at hand? :)FollowComment"

Answer: "0Accepted AnswerYeah, I think the potential query could be something like'select * from cur where min(line_item_usage_start_date) > current_date - 7'or 'select distinct line_item_resource_id from cur where min(line_item_usage_start_date) > current_date - 7'orselect * from cur where line_item_resource_id in ( select distinct line_item_resource_id from cur where min(line_item_usage_start_date) > current_date - 7 )This should give all resources that are only a week old and all details associated.CommentShareVivek_Sanswered 3 years ago"


Question: DynamoDB streaming to s3 with lambda

"Hi,Can we trim/drop/skip one attribute during the streaming data from dynamodb? If possible can you please guide me how to do it?ThanksFollowComment"

Answer: 0Accepted AnswerThere is no service-side support for dropping/hiding a single attribute from the GetRecords response. You'll have to implement this kind of filtering in your application.CommentShareAWS-User-7008722answered 4 years ago


Question: 我通过Elastic Beanstalk创建环境之后，用code pipeline关联github中的springcloud项目deploy失败了，下面是具体报错原因

"Deployment completed, but with errors: During an aborted deployment, some instances may have deployed the new application version. To ensure all instances are running the same version, re-deploy the appropriate application version. Failed to deploy application. Unsuccessful command execution on instance id(s) 'i-076897bfca156e1b7'. Aborting the operation. [Instance: i-076897bfca156e1b7] Command failed on instance. Return code: 1 Output: Engine execution has encountered an error.. Instance deployment failed. For details, see 'eb-engine.log'.能帮我看看吗？这是我的配置FollowComment"

Answer: "1You need to check the contents of "eb-engine.log" as described in the log.Please refer to the following document to check the logs.https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.logging.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-1988868 2 months agoeb-engine.log2023/04/06 15:02:26.715112 [ERROR] An error occurred during execution of command [app-deploy] - [CheckProcfileForJavaApplication]. Stop running the command. Error: there is no Procfile and no .jar file at root level of your source bundle2023/04/06 15:02:26.715115 [INFO] Executing cleanup logic2023/04/06 15:02:26.715182 [INFO] CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":[{"msg":"Instance deployment failed. For details, see 'eb-engine.log'.","timestamp":1680793346715,"severity":"ERROR"}]}]}SharerePost-User-1988868 2 months agocan you tell mehow to fix it?SharerePost-User-1988868 2 months agocan you tell me how to fix it?ShareRiku_Kobayashi EXPERT2 months agoIt is possible that the folder is not zipped properly.Zip the files and subfolders, not the parent folder, as described in the following documentation.https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/applications-sourcebundle.html#using-features.deployment.source.guiShare0eb-engine.log：2023/04/06 15:02:26.715112 [ERROR] An error occurred during execution of command [app-deploy] - [CheckProcfileForJavaApplication]. Stop running the command. Error: there is no Procfile and no .jar file at root level of your source bundle2023/04/06 15:02:26.715115 [INFO] Executing cleanup logic2023/04/06 15:02:26.715182 [INFO] CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":[{"msg":"Instance deployment failed. For details, see 'eb-engine.log'.","timestamp":1680793346715,"severity":"ERROR"}]}]}CommentSharerePost-User-1988868answered 2 months ago"


Question: Too many abuse reports coming from Yahoo threatens my SES mail sending

"About once a year I'm told by Amazon to keep my complaint rate below 0.5% or they will suspend my mail sending.The biggest (and mostly the only) cause of complaints are abuse reports coming from Yahoo! (which also includes AOL). This is nothing new but I've found no useful advice to mitigate the problem. The abuse report always contains the text "authentication result string is not available". Example follows:This is an email abuse report for an email message from amazonses.com on ****--Feedback-Type: abuseUser-Agent: Yahoo!-Mail-Feedback/2.0Version: 0.1Original-Mail-From: <****@amazonses.com>Original-Rcpt-To: ****@yahoo.comReceived-Date: ****Reported-Domain: amazonses.comAuthentication-Results: authentication result string is not available**Does anyone know if the mysterious "feedback" means anything useful? Is it somehow related to DNS TXT records, or anything I can fix at my end?**As I tell Amazon every year, I ONLY send transactional emails to individuals who sign up for my site. I suspect what happens is that people enter their email address wrongly; mail goes to someone else; they mark it as spam; I get penalised. I see a lot of typos in user-supplied email addresses, so with the large number of Yahoo and AOL usernames it seems it would be quite easy for this to happen. Notably however, I don't see the same problem with Gmail.Incredible that this pushes my complaint rate over 0.5%, but this seems to be the reality. If I am to continue using SES, my only current course of action is to block all sending to Yahoo! and AOL mailboxes. My business will likely suffer as a result, and I would rather leave SES that let that happen.**Has anyone solved this some other way? ** I am tempted to ask AOL/Yahoo users to confirm/re-enter their email address to try to avoid typos.FollowComment"

Answer: "0Unless you are using a custom MAIL FROM with your verified sending domain, Amazon will generate an envelope sender on the amazonses.com domain in the format GUID@amazonses.com, where GUID is a unique identifier. If you want to tie the complaint to the original message, you will need a mechanism to archive sent messages and correlate the generated MAIL FROM address by capturing both the generated MAIL FROM and the original Message-ID by catching a delivery feedback notification though an SES topic configured to dispatch an HTTPS event for that purpose.CommentSharemdibellaanswered a year ago0Have you taken a look at the suppression list, this way if you send to  bad address it will not send again which increases your bounce rate and impacts your rating. https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-email-suppression-list.htmlCommentShareEXPERTRob_Hanswered a year ago0Thanks @mdibella. I am able to match sent messages via the ID. I can see all data related to the sending of individual mails sent for site registrations. However, your point about the Return-Path being @amazonses.com could be relevant to spam categorisation, although my SPF records DO list this domain as a legitimate sender.Thanks @Rob_H. I already block email addresses that reply with a complaint. All complaints are from the first and only message to that address.There is no mystery surrounding what these messages are, or how many are sent etc.. The only mystery is why Yahoo are so aggressive in their abuse reporting when people have elected to receive the mail by registering for a service. I find it hard to believe that so many reach the wrong person, or that so many people sign up for a service and then mark their activation email as spam.CommentShareTim Wanswered a year ago"


Question: My Instance Has Suddenly Failed Whilst Running & No Changes Made to Production

"Dear Team,We are unable to track in our logs the reason why our website was not functioning correctly in the morning. We have checked our domain, our SSL certification as well as our database and we have no information in our logs.What we were seeing is that the pass check instance was failing, and even after restarting the services the same was still failing. We had to manually reset everything, post which the server began functioning normally. The instance was running by itself, no changes were made to production but then all of a sudden the instance stopped working and the data stopped reflecting on the site.Kindly let us know what was the issue and how do we avoid the same in the future. Also is there a check we can put in place so that we don't encounter this issue again.Thanks,FollowComment"

Answer: "0We (users on this forum - even the AWS staff) aren't able to provide troubleshooting services or insights into why specific customer resources do (or did!) specific things. Luckily, our premium support team are exactly the people who can do that!Please create a support case and the team can help you out.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: How does billing work for Workspaces that are recreated.

If you have several Workspaces running and then need to delete/recreate the workspace within the month would you get billed twice for the Workspaces or just only once?  The Workspace would be for the same user and same bundle type.FollowComment

Answer: "0Accepted AnswerThat would be considered 1 WorkSpace for billing purposes. This assumes:it's the exact same bundle type, both in terms of hardware as well as in terms of BYOL vs. License Included, plus software. If it's "Standard/License Included/no software", and then deleted and recreated to "Standard/License Included/Office+Trend Micro bundle", that is 2 unique WorkSpaces.it's the exact same AD user/same directory. This is based on the Active Directory SID of the user (probably also AD Connector ID, if for some reason you have 2 AD Connectors pointing at the same AD - I'd keep them in the same AD Connector to be safe).CommentShareEXPERTgaribaydanswered 3 years ago"


Question: Difference and relationship between CloudWatch "monitoring type" and "metric resolution"

"The monitoring types dictates how an AWS Service sends metrics to CloudWatch and they are of two types: Basic (every 5 minutes) and Detailed (every minute). On the other hand, each metric is one of the following: Standard resolution (with data having a one-minute granularity) or High resolution, (with data at a granularity of one second).My questions:If I'm getting it right, the resolution is the frequency at which metrics are generated and the monitoring type is the frequency at which a service publishes the metric to CloudWatch right?If So, why have a "high resolution" metric being able to generate data each 1 second if CloudWatch can only ingest metrics each minute (based on the detailed monitoring type)?FollowComment"

Answer: "0Hi, CloudWatch can ingest metrics with a resolution of 1 second, but the ability to leverage that resolution is not currently offered by detailed monitoring, so only custom metrics users take advantage of it.Monitoring type is not just about the resolution: Basic monitoring includes some 1-min metrics at no charge (e.g. StatusCheck on EC2- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html). And when you turn on detailed monitoring, in addition to getting 1-minute resolution for many metrics, you also get additional metrics. For example on EC2: "For the instances where you've enabled detailed monitoring, you can also get aggregated data across groups of similar instances." (cf. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html)Regarding sub-minute resolution: If using custom metrics, you can ingest your observations with sub-minute resolution, down to 1-second resolution, then plot them at 1-second resolution, or use CloudWatch statistics to surface means or percentiles over different time resolutions (e.g. 5/10/30 seconds), or alarm on them at sub-minute (e.g. 10-second) frequency.CommentShareJscanswered a year ago"


Question: AWS Amplify Status 301

I got the status 301 in application. So I need to remove permanent redirecting in Amplify route because end of my URL automatically add one / and showing  errorEg Url : https://test.amplifyapp.com/file**/**Eg Error:**     <Error>AccessDenied<Message>Access Denied</Message><RequestId>NR3C1PN5GWQZMG5B</RequestId><HostId>yugKPfgL6YPKX8MR87oaYOEkhrUWSh7uLDqWcILxv3WPGteciQOd4cP+yoVH7UV6cYNv3wbmc9U=</HostId></Error>**FollowComment

Answer: "0Hello,I understand that you are getting an "AccessDenied" error when trying to access your URL and you want to remove permanent redirect in Amplify.Redirects enable a web server to reroute navigation from one URL to another. In AWS Amplify redirects and writes have special configurations. Check the Rewrites and redirects settings in the left navigation pane:AWS Amplify Console > App Settings > Rewrites and RedirectsFrom there, you can edit your Rewrites and redirects by adding a new rule depending on your use case. Refer [1] for more information on redirect and write in AWS Amplify.References:https://docs.aws.amazon.com/amplify/latest/userguide/redirects.html#redirects-for-single-page-web-apps-spaI hope this will help.--CebiCommentShareCebianswered a year ago"


Question: ACM SSL Certificate for custom domain validation timed out (not Route 53)

"Hi, i have registered a domain with all-inkl.com and requested an SSL certificate from ACM. I have chosen a DNS validation method, and added CNAME record as well as CAA record on my DNS provider webpage. Unfortunately, the certificate validation was not successful and timed out after 72 hours. What could have I done wrong?FollowComment"

Answer: "1Hi ThereThere could be a few reasons why this is happening includingThe CNAME record isn’t added to the correct DNS configuration.The CNAME record has additional characters or is missing characters.The CNAME record added to the correct DNS configuration, but the DNS provider automatically adds the bare domain to the end of its DNS records.A CNAME record and a TXT record exist for same domain name.Please follow the steps in this troubleshooting guide: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-pending-validation/CommentShareEXPERTMatt-Banswered 3 months ago"


Question: Query Iceberg Tables already present in Glue

"I have Iceberg tables that were created in Glue with Parquet files, but I am unable to query these tables from Athena. I had a similar situation with Delta Lake tables which was resolved by using the Glue Delta Crawler.Is there an extra step required in order to view and query Iceberg tables from Athena?FollowComment"

Answer: "1First off, I'd like to let you know that Athena only supports Iceberg tables built against the AWS Glue catalogue using the specifications established by the open source glue catalogue implementation. Additionally, in the TBL PROPERTIES clause, you must specify the 'table type' table property to 'ICEBERG' in order to construct an Iceberg table from Athena [1] : -"CREATE TABLE [db_name.]table_name (col_name data_type [COMMENT col_comment] [, ...] ) [PARTITIONED BY (col_name | transform, ... )] LOCATION 's3://DOC-EXAMPLE-BUCKET/your-folder/' TBLPROPERTIES ( 'table_type' ='ICEBERG' [, property_name=property_value] )"In relation to using Apache Iceberg with Athena, I would also advise you to read over the many considerations and restrictions listed in the document found here [2].Incase if you still face the issue , there can other backend issue which can only be seen through backend tool. So, I would request you to raise a case to Premium support regarding the same from the concerned account.References :-[1]: Creating Iceberg tables - https://docs.aws.amazon.com/athena/latest/ug/querying-iceberg-creating-tables.html[2]: Considerations and limitations with using Iceberg tables with Athena - https://docs.aws.amazon.com/athena/latest/ug/querying-iceberg.html#querying-iceberg-considerations-and-limitationsCommentSharerePost-User-3337999answered 7 months ago"


Question: Site-to-Site VPN Connection unstable aws to azure

"Hi Everyone,We currently have multiple Site-to-Site VPN Connections between Azure and AWS, (multiple accounts).One tunnel, on One VPN connection constantly "flaps" due to aws failing to respond via DPD in time. (reported via Azure support)The only difference between this VPN Connection and the others happens to be that the 'Local IPv4 Network Cidr' and 'Remote IPv4 Network Cidr' are set to 0.0.0.0/0. On all our other VPN Tunnels this setting is blank.I am unable to remove this setting. When trying to remove the 0.0.0.0/0 Local & Remote Network Cidr, it stays in modifying and then eventually goes back tonan available state.I am unsure if that could actually cause an issue but thought it would be a mention.I do not see why increasing DPD would solve my issue. When one ipsec tunnel is stable, and one is not on the same VPN connection?Does anyone have any ideas?FollowComment"

Answer: "0By default AWS has DPD at 30 seconds. Where as Azure has it at 45 seconds. Increasing both to 120 seconds has produced a stable tunnel in the end. Currently 18+ hours stable at least. Which is better than the previous 2hours.It would be interesting if someone has an idea why the initial configuration works on 3 of our other tunnels, but this tunnel was the only one that constantly failed every 2 hours due to aws not responding via DPD... (based on what my Azure support says)CommentShareTim11112answered 3 years ago0Hello Tim,DPD is generally the symptom of a problem and the fact that there was no DPD response, combined with the fact that it only happens for certain tunnels, seems to suggest there is potentially an underlying problem with network connectivity. Considering changing the timeout to 120 seconds seems to have fixed it, most likely means the blip likely lasts between 30 and 120 seconds. Its worth noting that network blips may not impact certain applications that have built in resiliency mechanisms and have the ability to re-establish connectivity and continue with packet exchange seamlessly, which may very well be the case here.Further, if DPD timeout is set to 120 seconds on the AWS end, it means that the  DPD "R_U_THERE" messages are sent every 10 seconds and will timeout only if 12 consecutive messages have not been responded to. This would mean that if you had an underlying network problem for 110 seconds, the tunnel will still remain online since the 12th DPD message was responded to and the timer will reset. This could be problematic if you have network sensitive applications but may not be a problem if the application is able to recover/re-establish as explained earlier. My recommendation:if an application using this path is seeing problems, please get in touch with AWS Support via the Support portal from the account that the VPN lives in and mention:a) The corresponding VPN ID(s) and regionb) Timestamps (with timezone) from when the problem was seen the last couple times andc) Excerpts of the Azure logs that can be used to compare with that of our own logsI'm confident we should be able to get to the bottom of this once we look at our logs.NOTE: Please refrain from divulging any personal information around your AWS resources including Resource IDs, Public IPs and Security group rules to name a few since all posts are publicly available indefinitely. If you need pointed guidance, please reach out to us at AWS Support via the Support console.CommentShareAWS-User-9450311answered 3 years ago"


Question: Neptune: Duplicate nodes created for single open cypher Create statement.

"I have java based application, which load csv files and insert into to Graph db. the application works fine with Neo4j and now we are trying to support Neptune using Cypher. the problem I ran is that Neptune created duplicate node (with difference id (Neptune's internal id)) with one cypher create statement. I am wondering anyone run into similar issue. this issue is intermittent and random.running query CREATE (n: Person {firstName: $firstName,lastName: $lastName,dateCreated: $dateCreated,UniqueID: $uniqueID })  with param {firstName=D, lastName=Gordon, dateCreated=1665678784432, uniqueID=Person:30efd386-20ef-4284-b73a-143acd1b4eac}FollowComment"

Answer: "0While there is not enough information to determine what happened here, and since two nodes were created with different ID values the most likely culprit was something inside your Java application called the CREATE query multiple times, maybe as part of retry logic.  If you want to ensure that a value is only added a single time, you should investigate using the MERGE clause, which will perform an upsert operation based on the matching criteria you specify.  In the example below, I am matching on UniqueIdMERGE (n:Person)WHERE UniqueID=$uniqueIdON CREATE  SET n = {firstName: $firstName,lastName: $lastName,dateCreated: $dateCreated,UniqueID: $uniqueID }CommentShareDave-AWSanswered 7 months ago"


Question: Ecs conect fargate tasks

How can I give a task an internal fixed ip or an internal dns host to connect from another task of another service?FollowComment

Answer: "0You could use a load balancer, though that may be excessive. Have you looked at AWS Cloud Map? It's a service discovery service, and may be able to provide the lookup you need.CommentShareJason Butzanswered a month agorePost-User-9500165 a month agoit looks like Cloud Map to register a service requires IP address... but with using Fargate as a capacity provider, as far as I understand, it's always dynamicShare0That is the standard way to do it. Because being something so normal, I imagine that it will be biased in one way, or not?CommentSharerePost-User-5717469answered a month ago0I have the same issue. I'm starting a service using ECS Fargate model, and simply need to access this service from VPC INTERNALLY, it should not be available publicly. Obviously, I'm assuming it should not be additional cost/delay.As far as I understand right now, each time new task is created by ECS based on your task definition, it could have different private IP address.So, you cannot use it in, say, a connection string of your other services.I'm not sure if this is correct, but it looks like I have to implement some kind of service discovery feature, when either service registers it's private ip address somehwere when it starts, or client quires amazon services and figures out service ip address in VPC based on task metadata, like by parsing result of a CLI command:aws ecs describe-tasks --cluster your_cluster_name_here --tasks 6fafaa335_id_of_instantiated_taskWill return you something like:{"tasks": [{"attachments": [{"id": "ffffffff-171e-43e7-8ef3-10c5a2ec396c","type": "ElasticNetworkInterface","status": "ATTACHED","details": [{"name": "subnetId","value": "subnet-fffffffff"},{"name": "networkInterfaceId","value": "eni-fffffffffffffffff"},{"name": "privateDnsName","value": "ip-163-44-44-241.us-east-2.compute.internal"},{"name": "privateIPv4Address","value": "163.44.44.241"}]}],CommentSharerePost-User-9500165answered a month ago"


Question: sam local invoke fails on Ubuntu 20.04.1 (Windows 11 / WSL2 ) => error: Ports are not available

"Hi,I have problems invoking a lambda function locally.I used the the Hello World example provided through sam initI haveUbuntu 20.04.1 (Windows 11 / WSL2 )SAM CLI, version 1.80.0Docker version 20.10.24, build 297e128When executingsam local invoke "HelloWorldFunctionI get:Error: 500 Server Error: Internal Server Error ("b'Ports are not available: exposing port TCP 127.0.0.1:5301 -> 0.0.0.0:0: listen tcp 127.0.0.1:5301: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted.'")netstat shows no used port:Active Internet connections (only servers)Proto Recv-Q Send-Q Local Address           Foreign Address         Statetcp        0      0 127.0.0.1:35687         0.0.0.0:*               LISTENtcp        0      0 127.0.0.1:41707         0.0.0.0:*               LISTENtcp6       0      0 :::8443                 :::*                    LISTENtcp6       0      0 :::3306                 :::*                    LISTENtcp6       0      0 :::80                   :::*                    LISTENtcp6       0      0 :::443                  :::*                    LISTENtcp6       0      0 :::7080                 :::*                    LISTENtcp6       0      0 :::8081                 :::*                    LISTENudp        0      0 127.0.0.1:323           0.0.0.0:*udp6       0      0 ::1:323                 :::*udp6       0      0 :::443                  :::*What could resolve this issue?complete output:Invoking app.lambda_handler (python3.9)Local image is up-to-dateUsing local image: public.ecr.aws/lambda/python:3.9-rapid-x86_64.Mounting /home/mustermann/lambda-functions/helloworld/sam-app/hello_world as /var/task:ro,delegated, inside runtime containerError: 500 Server Error: Internal Server Error ("b'Ports are not available: exposing port TCP 127.0.0.1:5301 -> 0.0.0.0:0: listen tcp 127.0.0.1:5301: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted.'")Traceback:  File "click/core.py", line 1055, in main  File "click/core.py", line 1657, in invoke  File "click/core.py", line 1657, in invoke  File "click/core.py", line 1404, in invoke  File "click/core.py", line 760, in invoke  File "click/decorators.py", line 84, in new_func  File "click/core.py", line 760, in invoke  File "samcli/lib/telemetry/metric.py", line 184, in wrapped  File "samcli/lib/telemetry/metric.py", line 149, in wrapped  File "samcli/lib/utils/version_checker.py", line 42, in wrapped  File "samcli/cli/main.py", line 92, in wrapper  File "samcli/commands/local/invoke/cli.py", line 118, in cli  File "samcli/commands/local/invoke/cli.py", line 203, in do_cli  File "samcli/commands/local/lib/local_lambda.py", line 151, in invoke  File "samcli/lib/telemetry/metric.py", line 324, in wrapped_func  File "samcli/local/lambdafn/runtime.py", line 190, in invoke  File "samcli/local/lambdafn/runtime.py", line 145, in run  File "samcli/local/docker/manager.py", line 116, in run  File "samcli/local/docker/container.py", line 316, in start  File "docker/models/containers.py", line 400, in start  File "docker/utils/decorators.py", line 19, in wrapped  File "docker/api/container.py", line 1095, in start  File "docker/api/client.py", line 263, in _raise_for_status  File "docker/errors.py", line 31, in create_api_error_from_http_exceptionAn unexpected error was encountered while executing "sam local invoke".Search for an existing issue:https://github.com/aws/aws-sam-cli/issues?q=is%3Aissue+is%3Aopen+Bug%3A%20sam%20local%20invoke%20-%20APIErrorOr create a bug report:https://github.com/aws/aws-sam-cli/issues/new?template=Bug_report.md&title=Bug%3A%20sam%20local%20invoke%20-%20APIErrorFollowComment"


Question: What is the role of ports in the target group of the application load balancer?

"When setting up the load balancer, I understand that it consists of a listener port, a target group port, and an instance port (ip port).I think that the load balancer goes to the target group through the listener port and traffic is divided according to the instance port in the target group.Then, the target group port does not seem to affect the load balancing. What is the role of the target group port?FollowComment"

Answer: "0Accepted AnswerThe target group port is the default port if you register the target (e.g. an instance ID) without specifying the port.A brief description is available here: https://docs.aws.amazon.com/cli/latest/reference/elbv2/register-targets.htmlBy default, the load balancer routes requests to registered targets using the protocol and port for the target group. Alternatively, you can override the port for a target when you register it. You can register each EC2 instance or IP address with the same target group multiple times using different ports.CommentShareweidianswered 8 months ago0The Target group port defines the port on which instances receive traffic from Load Balancer and also the port on which health checks are performed (unless the health check port is overridden)--SydCommentShareSydanswered 8 months ago"


Question: CUDOS -Optimization Data Collection - Transit gateway Lambda failing with errors

"Hello,I have deployed the Cost Optimization Data Collection Module. The Transit Gateway Lambda is failing with below erorr -[ERROR] Runtime.UserCodeSyntaxError: Syntax error in module 'index': invalid syntax (index.py, line 125)Traceback (most recent call last):  File "/var/task/index.py" Line 125                aws_access_key_id=credentials['AccessKeyId'],FollowComment"

Answer: "1Hello,This is Tom from AWS Support.I see that Lambda function throws "UserCodeSyntaxError" while executing. This indicates the function is unable to execute because of unknown/incorrect syntax for current Python file. I would recommend check on line 125 (and the sections around this line) to see if there are any syntax issue with current file.Alternatively, you may try copying the entire Lambda function code into a local IDE, for instance, Visual Studio Code with Python extension [1], to see if the Python function has any syntax errors.I hope the above information helps. Have a nice day!Links and References[1] https://code.visualstudio.com/docs/languages/pythonCommentShareSUPPORT ENGINEERTom_Tanswered 4 months ago1Hello,As stated above, this seems more like a syntax error and thus the function is not able to be executed. It is best to check for any issues with respect to the syntax on or around line 125. And also as rightly said above you can try to check for any syntax related issues by copying the code to the Local IDE with which it will be easier to identify the error and work around resolving the same.Also there can be possibility of the credentials being configured incorrectly. It looks like there might be an issue with the format of the parameters being passed to the call on the125 line. To resolve the issue, you should check the code on line 125 to ensure that the syntax is correct and that the parameters being passed are properly formatted.[+]https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.htmlCommentShareSUPPORT ENGINEERZacchae_Janswered 4 months ago0Looks like the the credentials are not configured properly. Please refer https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html and configure your credentials accordingly ?CommentShareArunanswered 4 months ago0Thank you for your response! I found a missing comma in the code. I added the comma and redeployed the template file and have verified the transit gateway data collection is working now.CommentShareBijalanswered 4 months ago"


Question: SPARK Upgrade on EMR  best practices

Hello Team - Good Morning. My customer is using SPARK 2.4 on EMR for their batch workloads. They are planning for migration to SPARK 3.3 and looking for some guidance/best practices for this migration. Can you please share if any reference docs/blog posts etc.. related to this topic. Thanks in advanceFollowComment

Answer: "0You can use Spark section from this EMR best practices guide.Feel free to share here or create a specReq if customer has any specific question. Here are few basic things to keep in mind.Handle data skewMake sure there is no disk spill happeningOptimal partition size to make sure not too many tasks are createdUse the right data format for source and target (preferably parquet)Watch for excessive shuffle. Can be confirmed from Spark UI.Tune driver/executor size (memory, core) based on workload.CommentShareKashifanswered 4 months ago"


Question: S3 Rest API Cloudfront error 403 using OAC

"I followed the guide below to resolve a CloudFront 403 error, but am having no luck.https://repost.aws/knowledge-center/s3-rest-api-cloudfront-error-403Here is a screenshot of the exact error message I am receiving when I use the CloudFront domain to access the website:I checked the following settings following items that the guide suggested.The origin domain name is 2023-05-12-at-website.s3.us-east-1.amazonaws.comThe s3 bucket is using Amazon S3 managed keys (SSE-S3) with AWS KMS encryption enabledI am using OAC so Here is my S3 bucket policy giving CloudFront Access.  Amazon S3 Block Public Access is enabled.{    "Version": "2008-10-17",    "Id": "PolicyForCloudFrontPrivateContent",    "Statement": [        {            "Sid": "AllowCloudFrontServicePrincipal",            "Effect": "Allow",            "Principal": {                "Service": "cloudfront.amazonaws.com"            },            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::2023-05-12-at-website/*",            "Condition": {                "StringEquals": {                    "AWS:SourceArn": "arn:aws:cloudfront::(my-AWS-Account-Number):distribution/(my CloudFront Distribution)"                }            }        }    ]}The AWS account owns the object and the requested objects exist in the S3 bucket.  I also defined a default root object since the client will be requesting the root of my distribution to access the site.I verified that I can access and download the s3 objects from the AWS CLI.What am I missing here?FollowComment"

Answer: "1Accepted AnswerCheck that you have configured the signing behavior correctly for your Origin Access Control ID. Per the documentation, this should be set to "Always."If you have accidentally set it to "Never" this will effectively turn off OAC and require the bucket to be publicly accessible.CommentSharePaul_Lanswered 11 days ago0Something worth fixing that might solve it if you're lucky is changing your policy's Version field to "2012-10-17".As per https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html, "2008-10-17 - This was an earlier version of the policy language. You might see this version on older existing policies. Do not use this version for any new policies or when you update any existing policies. Newer features, such as policy variables, will not work with your policy."CommentShareEXPERTskinsmananswered 15 days agoalbert21 13 days agoTried it.  Unfortunately, no luck.Share0If you're using KMS encryption, make sure that CloudFront has permission to use the key to decrypt the object(s).You may need to add a statement to the KMS key policy - here is an example:{    "Sid": "AllowCloudFrontServicePrincipalSSE-KMS",    "Effect": "Allow",    "Principal": {        "AWS": "arn:aws:iam::<AWS account ID>:root",        "Service": "cloudfront.amazonaws.com"    },    "Action": [        "kms:Decrypt",        "kms:Encrypt",        "kms:GenerateDataKey*"    ],    "Resource": "*",    "Condition": {            "StringEquals": {                "AWS:SourceArn": "arn:aws:cloudfront::<AWS account ID>:distribution/<CloudFront distribution ID>"            }        }}CommentSharePaul_Lanswered 13 days agoalbert21 13 days agoFrom AWS console I am using:Encryption key typeAmazon S3 managed keys (SSE-S3)I didn't see any keys when I went to the KMS service.  Do I need to create a key for OAC to work?One thing I notice is when I access an object URL(https://2023-05-12-at-website.s3.amazonaws.com/config.js) directly I get the same error message.  This is expected, correct since I blocked public access?Share0That was the culprit!After changing Signing Behavior from "Do not sign requests" to "Sign requests" I can now access the S3 website through the CloudFront distribution URL.CommentSharealbert21answered 11 days ago"


Question: Connect my bucket as a Network Unit in Windows Explorer

I want to Connect my bucket as an additional Network Unit in my Windows Explorer so I can have direct access to my files. How can I do it?FollowComment

Answer: 0This is not supported natively with S3. You have some options though to make this happen.You can leverage a Storage Gateway: https://aws.amazon.com/storagegateway/ But it has costs of hosting the EC2 instance to get the file share and administration of such.Or you can use some third party software like CyberDuck to mount it as a drive: https://cyberduck.io/s3/CommentShareEXPERTRob_Hanswered a year ago


Question: IP Address for different region

"Looking at the global list of AWS IPshttps://ip-ranges.amazonaws.com/ip-ranges.jsonThere is an eu-west-2 Global Accelerator ip range.My home region is eu-west-2, but I can only create a GA in us-west-2 and that's where the static IPs are from. I would like a UK IP address for our predominately UK websites, otherwise ranking is negatively affected.Is this possible?FollowComment"

Answer: "0Global Accelerator is a global service and the static IP addresses you get with any accelerator are advertised from AWS Points of Presence (POPs) around the world. In the list of IP ranges that you shared, the entries that include "region": "GLOBAL" refer to those static IP addresses.If you want to filter for traffic through your accelerator that come from POPs in one area, you can filter for entries that include a specific geographical area, such as us-** or eu-**. So, for example, if you filter for "region": "eu-*", you will see only traffic coming through POPs in Europe.CommentShareAWS-User-5708333answered 3 years ago0OK, so just to confirm any static IPs assigned to a Global Accelerator will be from the GLOBAL, GLOBALACCELERATOR ip ranges? All of these ranges, when doing a GeoIP lookup, "appear" to be in Seattle, WA.When hosting a UK website, one with a UK IP address will rank higher than one with a US IP address, all other things being equal(!).So if use a GA then it will "appear" that my base of operations is always Seattle? Not from my home AWS region?CommentShareTimIncanswered 3 years ago0That's correct. All the ip ranges with entries that include "region": "GLOBAL" and "service": "GLOBALACCELERATOR" are advertised from edge locations around the world, but the GeoIP lookup shows them in the US.CommentShareAWS-User-5708333answered 3 years ago"


Question: Problem when connect to jdbc

"Hi everyone,I have a trouble when conncet to mysql in ec2. The problem is I don't know IAM role in this case should include which roles? Can someone suggest me? Everytime I test the new role I have this problem show upERROR : At least one security group must open all ingress ports.To limit traffic, the source security group in your inbound rule can be restricted to the same security group (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: InvalidInputException;I appreciate all of your answerThangFollowComment"

Answer: "0Try the following:in IAM console, create a role with the following policies:AmazonRDSReadOnlyAccess (or full access if you need to write to the db)AWSGlueServiceRoleAWSGlueConsoleFullAccessAmazonS3FullAccessAmazonEC2FullAccess (this might not be necessary)This should solve the IAM role problem.As for the security group, you need to have a self referenced security group. So create a new security group with a rule as follows:Type = All TCPProtocol = TCPPort Range = 0 - 65535Source =  *Description = whatever you want (e.g. self-reference rule)You put the security group ID (e.g. sg-096f6b7f4f2692t61) of the security group itself.Note: not sure you immediately have the security group ID at the time of the creation. If not, when creating the security group add a All TCP rule with your IP as source, then once created, add the above-mentioned rule.Now if you use that role and that security group in your Glue connection it should work.CommentSharefabioSamaanswered 4 years ago0Hi fabioSama,I have changed security group like you said, but right now I still get this error when I run my crawler with IAM console. Sorry for reply too lateERROR : At least one security group must open all ingress ports.To limit traffic, the source security group in your inbound rule can be restricted to the same security group(Service: AWSGlueJobExecutor; Status Code: 400; Error Code: InvalidInputException; ...)CommentSharephithang711answered 4 years ago0Find the way to correc this. First creat a Nat gateway and connect it with your rout table then it will work perfectlyCommentSharephithang711answered 4 years ago0Apparently you need a NAT Gateway if "your job needs to access both VPC resources and the public internet, the VPC needs to have a Network Address Translation (NAT) gateway inside the VPC."https://docs.aws.amazon.com/glue/latest/dg/start-connecting.htmlCommentShareDylan_Delportanswered 3 years ago"


Question: How can I remove "aswelb/2.0" in the HTTP Response Header?

How can I remove that "awselb/2.0" in the HTTP Response Server Header?FollowComment

Answer: "0Unfortunately, there is no option to remove the header at this time. If you deploy 3rd Party Solution like F5 WAF, you can cloak server information.CommentShareEunsu_Shinanswered 6 months agoRohithleo a month agoCan we hide or change that awselb/2.0 to other name.Share0It's not customizable at the moment. A workaround would be to front the ALB with CloudFront and use edge functions to override the Server header with none, as briefly illustrated here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html#lambda-examples-overriding-response-headerCommentShareweidianswered 6 months ago"


Question: Aws backup incremental copy of Windows Server with VSS

"I have a lot of Windows Server , and i want to backup all of them in consistent way with VSS enable.I notice taht all the backup job are full and not incremental. is there a way to have them incremental ?Thanks a lotFollowComment"

Answer: "0For volume snapshots Look at  creating a VSS Application-Consistent Snapshot in the Amazon EC2 User Guide for Windows Instances. https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/application-consistent-snapshots.htmlI recommend looking at the AWS Backup service which can make automating your backup process simpler.  AWS Backup supports Windows VSS backups. https://docs.aws.amazon.com/aws-backup/latest/devguide/windows-backups.htmlCommentSharetedtrentanswered 6 months agoGiuseppe_B 6 months agoThe problem is that i follow the AWS Backup step to enable vss , but my jobs are only full backup, i don't have incremental. 100 Gb of disk each jobs of backupShare"


Question: How to enable Amazon Agents to login with Custom Login to Amazon Connect?

"Hi, we are trying to abstract the login from being handled by Amazon for Customer Agents, we want to enable them to login using our custom login system, I imagine that would need us to leverage some credentials management to Amazon Connect/Do some tokenization. I have tried to check the JavaScript SDK for this but I can't see anything around the custom login? We are building custom control panel for agents but want them to login using our custom login system then the redirection to Amazon connect URL.FollowComment"

Answer: "0If your custom login system is a SAML 2.0 compliant identity provider, you can federate to Amazon Connect via AWS IAM. The configuration steps are described at https://docs.aws.amazon.com/connect/latest/adminguide/configure-saml.html.Some open source examples of SAML implementations are https://github.com/winstonhong/Shibboleth-SAML-IdP-and-SP and https://github.com/OpenConext/Mujina (I'm not aware of these specific implementations being used with Amazon Connect, though Shibboleth is one of the third-party SAML providers listed at https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd-party.html).CommentSharelukwarneanswered 5 months agodmacias 5 months agoBut I don't see how you can bypass going through the out of the box CCP to login to Connect which I believe is what the OP is trying to work around.Share0Not possible. You have to use the standard login process and then redirect to your app.davidCommentSharedmaciasanswered 5 months ago"