Question: ECR:The security token included in the request is expired

"I'm trying to push my image to ECR, it has 7G in one layer, and my internet connection is not very good, so it may take more than a day to upload it. But at the end I got a token expired prompt. Is there a way to extend the life of the token, or solve my problem?FollowComment"

Answer: "0You are probably using HTTP API authentication, the token is valid for 60 seconds by default. You could alternately authenticate to an Amazon ECR private registry with the CLI. Here you could find further info https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.htmlget-login-password -> https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login-password.html#get-login-passwordCommentSharegilbertoanswered 2 months agorePost-User-9749730 2 months agoThank you, in fact I am using private registry. Its time limit is 12 hours. But the upload time I need is more than 24 hours. I've now written a loop to periodically update my tokens, I'm not sure if this is possible.Share"


Question: New console of Glue does not allow us to change table schema.

"I have realized that the schema changing functionality does not work as it planns.Selected options are not applied when clicking Edit. Anybody having same issue or solutions?I know the availability of old design console, looking however, workaround applicable on the new design.FollowComment"

Answer: "0After selecting the required table that you wanted to edit, you have to click on Actions -> 'Edit schema' for editing the structure of your table. By structure I mean that you will have the option to add new columns, delete existing columns and change the datatype of existing columns.To add a new column, you can straight away click on the 'Add' button present on the console.To delete a column, you first have to select the column and then click on 'Delete' button which is also present on the console itself.To edit the datatype, first select the column and click on 'Edit' button which will open another dialog box prompting you to change the datatype of the column. Be sure to click on 'Edit' at the bottom of the dialog box to save your changes.After making all the required changes to the table's schema, please be sure to click on 'Update schema' button present on the bottom right corner of the page. If you do not do that then you won't be able to save the changes made by you.Even after following the above mentioned steps, if you still face any issue with the console, please elaborate on the steps that you have followed that has lead to the unexpected behavior.CommentShareSUPPORT ENGINEERChaituanswered 9 months ago0Hi Chaitu,Thank you for guiding me precisely the steps required.Yes, I have followed the third bullet point to Edit schema, but the newly selected data type is not reflected in the screen before clicking Update Schema, staying the original data type.In the old console screen, the change of schema has been tentatively applied to the table and finlised when clicking the save button.I hope you might be able to reproduce this issue in your environment too.CommentShareAWS-User-2884985answered 9 months ago"


Question: What services should I use if I want to do live monitoring the data?

"Hello,I'd like to make an IoT system and do live monitoring of data from the connected things.For example, I have an array of pressure sensors and want to gather the data from each pressure sensor with 10Hz frequency. I connected the pressure sensor array with my Raspberry Pi and used the embedded C SDK. Finally, I want to monitor the real-time data on a web dashboard and analyze the real time data.In this case, what services of aws should I use for the gathering, analyzing, and monitoring data?I heard that aws rule engine can be used to do those tasks at once, but have no idea what and how services should be used.Hope to hear your suggestions.Thank you.FollowComment"

Answer: "0Thanks for a great question,You should send the data over MQTT to IoT Core [1] and yes, use Rules Engine [2] to direct the messages to the appropriate components.You absolutely could configure an action in Rules Engine to send the data to IoT Analytics and then explore and visualize [3] the datasets with Amazon Quicksight however if you really need the data in real-time, you may want to consider still sending the data to IoT Analytics, but using a Lambda function to route some of the traffic you are interested in to CloudWatch so that you can see it in real time and set alarms etc with CloudWatch [4]. This can give you a great mix of some real-time visualization combined with longer term storage and analysis with IoT Analytics.Another alternative from Rules Engine would be to route the data to Elastic Search [5] which has the built in Visualization / Dashboarding options from Kibana. Depending on your analysis requirements this can work well too, but it can be harder to operationalize your analysis (make it easy to do on a recurring schedule) which is where IoT Analytics can be helpful. IoT Analytics also has some powerful integrations with SageMaker and Jupyter Notebooks which make more advanced analysis and visualizations possible.Hope some of these references help. I note that you want to gather the data at 10Hz - whilst it's totally fine to send all of that to the cloud, you may want to consider maintaining a moving average (or min / max for the time period) on the device and only sending data to the cloud at a lower frequency.Roger[1] https://aws.amazon.com/iot-core/features/[2] https://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html[3] https://docs.aws.amazon.com/iotanalytics/latest/userguide/getting-started.html#aws-iot-analytics-explore-data[4] https://aws.amazon.com/blogs/iot/real-time-metrics-with-aws-iot-analytics-and-amazon-cloudwatch/[5] https://aws.amazon.com/elasticsearch-service/CommentShareAWS-User-9304989answered 4 years ago0Thanks for your great and prompt reply. I will work with the IoT Analytics first.Regards,Geon-HongCommentSharegeonhonganswered 4 years ago"


Question: Default ext-x-version in AWS generated manifest files

Is the default value of #EXT-X-VERSION tag in a manifest file currently 5 and do you have any plans to increase it? If so then do you have any roadmap or schedule for that?Do you have any recommendations about how to limit the maximum #EXT-X-VERSION number in manifest file in case the player device doesn't support some newer features?Or is there a possibility to specify a maximum #EXT-X-VERSION value in generated manifest files?FollowComment

Answer: "0There is no default value of EXT-X-VERSION. MediaPackage configure EXT-X-VERSION base on the feature being used. If it is an encrypted endpoint, it will have a higher EXT-X-VERSION. If it is a clear endpoint, it will have a lower EXT-X-VERSION.The default behaviour of MediaPackage is to use an EXT-X-VERSION as low as possible for the feature-set selected. This is not configurable.-SamCommentSharesamuelAWSanswered 3 years ago0To elaborate a little on what Sam said, here's a link to the relevant part of the HLS spec:https://developer.apple.com/documentation/http_live_streaming/about_the_ext-x-version_tagIn summary, the usage of certain features will determine this value, if you must see a higher value, you'll need to include the features/parameters detailed in the above specCommentSharecraigataws182answered 3 years ago"


Question: Amplify AccessDenied with PDF file in root folder

I'm trying to host a PDF file in the root folder of an otherwise empty Amplify app. I'm deploying the app through GitHub. For some reason I'm getting an AccessDenied error when reaching the PDF file like so: https://www.example.com/myfile.pdfEverything was setup using the default configuration. index.html in the root folder works just fine. Leaving the PDF is a subfolder also works fine.What could be wrong? ThanksFollowComment

Answer: 0Good question!  I would check your Amplify build settings to see how you have set up your artifacts and the structure for that: https://docs.aws.amazon.com/amplify/latest/userguide/build-settings.htmlThe “Access Denied” error tells me that the folder is not initialized correctly.CommentSharejsoncanswered a year ago


Question: EB Ruby migration to AMI 2

"We are in the Migration from "Puma with Ruby 2.6 running on 64bit Amazon Linux" to the new AMI2 Images for the Version "Ruby 2.6 running on 64bit Amazon Linux 2".  We were able to Update all related configs but it seems that Puma wont start after an successful deployment. Our Problem is, we do not get any useful ouptut from the Logs except this one:[8886] /opt/rubies/ruby-2.6.9/lib/ruby/site_ruby/2.6.0/bundler/runtime.rb:309:in `check_for_activated_spec!'[8890] + Gemfile in context: /var/app/current/Gemfile[8888] ! Unable to start worker[8888] /opt/rubies/ruby-2.6.9/lib/ruby/site_ruby/2.6.0/bundler/runtime.rb:309:in `check_for_activated_spec!'[8892] + Gemfile in context: /var/app/current/Gemfile[8890] ! Unable to start worker[8890] /opt/rubies/ruby-2.6.9/lib/ruby/site_ruby/2.6.0/bundler/runtime.rb:309:in `check_for_activated_spec!'[8890] Early termination of worker[8894] + Gemfile in context: /var/app/current/Gemfile[8892] ! Unable to start worker[8892] /opt/rubies/ruby-2.6.9/lib/ruby/site_ruby/2.6.0/bundler/runtime.rb:309:in `check_for_activated_spec!'[8907] + Gemfile in context: /var/app/current/Gemfile[18563] === puma shutdown: 2022-03-18 13:10:25 +0100 ===[18563] - Goodbye![18563] - Gracefully shutting down workers...[8894] Early termination of worker[8907] Early termination of workerIs there any proper way to figure out why it fails there?FollowCommentPatrick King a year agoI'm experiencing the same issue, also with a migration of a Ruby 2.7.x / Puma 3.x app to Amazon Linux 2.I had hoped to get more debugging info by shutting down the web service, and running Puma in an SSH session. Instead, the server came up successfully. So, my best guess is that it has to do with how the systemd service is configured or launched. Any insights?Share"

Answer: "0I was able to resolve a similar issue, which as it turns out has been discussed elsewhere.The heart of the issue is: Elastic Beanstalk instances have a pool of system gems, and also install the app's bundle of gems in /var/app/current/vendor/. The default Procfile lets gems from these two sets be intermingled, which can result in version inconsistencies for loaded gems, and crashes.The crashes only happen in Puma worker processes, and the details don't appear in any ordinary EB logs, which made this particularly tricky to debug. You can get more debugging info about issues with Puma workers by modifying the Puma config file to run in single process mode.sudo nano /opt/elasticbeanstalk/config/private/pumaconf.rbdirectory '/var/app/current'# Commented default configuration:# threads 8, 32# workers %x(grep -c processor /proc/cpuinfo)# Temporary debugging configuration:threads 1, 1workers 0bind 'unix:///var/run/puma/my_app.sock'stdout_redirect '/var/log/puma/puma.log', '/var/log/puma/puma.log', trueRestart the web service to have these settings take effect: sudo systemctl restart web.serviceNow the full exception will appear in Puma's logs, follow the web service's logs with: sudo journalctl -u web.service -b -fThere are two ways you could choose to resolve this problem, both with tradeoffs.One option is to fix the version of the mismatched gem (in this case, nio4r) in your Gemfile to match the version installed in EB (see this version with gem list). The drawback to this solution is that the crash will reappear if the gem is updated when AWS updates the Ruby platform (or, if the gem version later changes in your Gemfile).A second option is to exclude the system gems from execution, and require that only the bundled gems be used. This could still result in problems after a future AWS platform update, but only if the gems in your bundle are incompatible with the EB platform in some way. This seems like the more stable solution, and it's the one I opted for.At this writing, the default Ruby Procfile is:web: puma -C /opt/elasticbeanstalk/config/private/pumaconf.rbTo implement the second option, add a Procfile to the root of your app with bundle exec instead:web: bundle exec puma -C /opt/elasticbeanstalk/config/private/pumaconf.rb(If you modified pumaconf.rb, don't forget to reverse the debugging changes and restart the service!)CommentSharePatrick Kinganswered a year agoAWS-User-5063398 a year agoHey Patrick,Many Thanks for the Reply, i wasn't able to tackle it again since now,  i will try that this Month, i'll let you know how it will go ;)Share"


Question: Multiplayer VR using UE5.1 and ec2 linux instance

I was creating a multi-player experience for quest using unreal engine and AWS because I saw https://aws.amazon.com/blogs/spatial/building-an-openxr-enabled-unreal-engine-vr-server-on-aws/  .I created a aws account just because of this documentation for VR multi-player.I followed the whole documentation uploaded linux.zip to my ec2 instance created apk for my 2 quest 2 devices and side loaded it with side quest.But I have a problem when I open the map and press the connect button my position and the whole map just resets for both of my devices (Not at the same time but after few seconds) and they don't see each other and they don't even see the object interaction. In short words I don't think the multiplayer is working. There are no errors while building or launching the apk.I am using  Unreal Engine 5.1.1 and meta quest 2.Thanks for reading and I would really appreciate everyone's help because I am not familiar with aws much and using it because I found this documentation.If you need any other info do tell me.FollowComment

Answer: "0This solution is not intended to sync object interaction between users. All of the synchronization is done in part 4 (just the head and left and right controllers).As for the map resetting, I would first check to make sure that in your WidgetMenu the Open Level node for your Connect button is correctly opening the EC2 instance you created (by putting its public IP in the Open Level node).If that is configured correctly, I would next take a look back at part 2 section 4 to make sure your maps are set up correctly in the settings.CommentShareAlex Pierianswered 3 months ago"


Question: data not being uploaded to s3 from zeppelin notebook.

"I have a Zeppelin notebook for analysis and I want to insert the data analyzed into s3 bucket, but previously I was able to insert data and I was able to view all the data but now I am not.these are the connectors for the tableWITH (   'connector'='filesystem',   'path' = 's3://firehose-test-kin/data/',   'format' = 'csv',   'sink.partition-commit.policy.kind'='success-file',   'sink.partition-commit.delay' = '1 min');this is the insert command%flink.ssql(type=update)insert into s3_joinSELECT * FROM test JOIN test1ON test1.seq_num = test.seq_numpublic access is disabled on the ss3 bucket but it made no difference when it was turned onFollowCommentvtjean 9 days agoHave you verified the S3 bucket policies? Do you use AWS Access keys for Zeppelin to access the S3 Bucket?Share"

Answer: "0IAM Policy: Please ensure that the IAM role or user associated with Zeppelin has the necessary S3 permissions. This includes the s3:PutObject, s3:PutObjectAcl, and s3:PutObjectVersionAcl permissions for the S3 bucket. If you are using AWS access keys, ensure they are correctly configured in Zeppelin.Bucket Policy: The bucket policy should allow the IAM role or user to perform s3:PutObject actions. If the bucket policy denies this action, the IAM policy won't be able to override this.S3 Block Public Access settings: If all public access is blocked, including public access granted by ACLs, you might need to add specific IAM permissions for the entities that need to access the bucket.Network Connectivity: Please ensure that the Zeppelin server has network access to S3. If the server is in a VPC, ensure that the necessary VPC endpoints are created.S3 Path: Check if the S3 path mentioned in the 'path' attribute is correct. Please ensure that the path includes the correct bucket name and the key prefix (if any).CommentShareEXPERTsdtslmnanswered 9 days ago"


Question: KMS Limits and free-tier

"Hi forum;     Today I received aws email, alert about 85% of my AWS Key Menagement Service limit is near to end it's free-tier.   So, as I deploy some extra AWS Services to production environment late Dez/2019, I'm having difficulties to isolate what service is consuming extra KMS requests;    Here list of some new services started Dez/2019 examples:       Android AWS-SDK  (lambda calls)        Cognito        SQS sending messages and reading by lambda trigger        RDS Performance insight         Pinpoint push features       **Also I've created and immediately deleted one code commit repository**  Searching this group , I've noticed that cod commit and kms requests, has some issues.Please; I'll appreciate some help to drive me for answer two questions      Service(s) who are consuming extra requests        What level of pricing (I saw,  doc for  extra 10.000 requests ) will be charged  Advanced Thanks;Edited by: mortega on Jan 24, 2020 5:24 AMFollowComment"

Answer: "0Accepted AnswerAWS KMS pricing is listed here: https://aws.amazon.com/kms/pricing/One way to know which service is using KMS is to go to CloudTrail in your account. Then click on "Event History" on the left hand side of your screen.In the Filter, select "Event Source" and search for "kms" in "Enter event source" and select "kms.amazonaws.com". Adjust the time range for December. This will give you a list of events. You can then look at which services might be calling KMS on your behalf.Another way is to start with the services you mentioned and look at which services have been configured to use either customer managed CMKs or AWS managed CMKs. That will also tell you if those services might be calling KMS.From your list, Amazon SQS and AWS Lambda might be the ones making KMS calls.CommentShareAWS-User-1849807answered 3 years ago0You Rocks;I Realize that lambda's environment variables are been encrypted ; and as each lambda has a set of then, they are been decrypted on each invoke call;  Environment variables are been used in new deployment at Jan/2020;  As I do not set any encryption option for then, it appears that my development framework does it for me !  Thanks so much !CommentSharemortegaanswered 3 years ago"


Question: Exclude reader instance from Aurora RDS Autoscaling policy

"We have an Aurora RDS cluster with replica autoscaling.For analysis intensive tasks, we want to temporarily launch a separate reader until the analysis job is done.How can we exclude this reader from traffic from the cluster reader endpoint, and exclude its load from affecting the autoscaling actions?We can do it by script or cli if necessary.FollowComment"

Answer: "0For your use-case, it sounds like you want to separate one particular reader from the other readers. You can accomplish this by using a custom endpoint. Please see the link for additional info. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html#Aurora.Endpoints.CustomCommentShareAWS-User-7983507answered 4 months ago"


Question: How to akses prefix S3 while auto record with IVS ?

"Today i try use IVS service with auto record to s3 bucket. the problem is after live streaming ended i want to get the video recorded in s3.I follow the documentation then I get  path/prefix like bellow:/ivs/v1/<aws_account_id>/<channel_id>/<year>/<month>/<day>/<hours>/<minutes>/<recording_id>at the path I can find in response json excpet<recording_id>FYI the recording_id create when I start live streaming, but I cannot get response.so how i can get recording id with response JSON to access the path of video recorded in s3ThanksFollowComment"

Answer: "1You may need to retrieve the recoding_ending.json to be able to access the recording in S3. Also make sure the recording didn't fail (recording_failed.json).Please refer to the following link for additional information on IVS Record to S3.https://docs.aws.amazon.com/ivs/latest/userguide/record-to-s3.htmlTake particular note of the following sub sectionsDiscovering the Renditions of a RecordingPlayback of Recorded Content from Private BucketsCommentShareMike-MEanswered a year agonas a year ago {  "version": "v1",  "recording_started_at": "2022-04-09T07:22:01Z",  "recording_ended_at": "2022-04-09T07:39:10Z",  "channel_arn": "arn:aws:ivs:ap-northeast-1:043177020963:channel/GNQAcgyM7LM0",  "recording_status": "RECORDING_ENDED",  "media": {    "hls": {      "duration_ms": 1032204,      "path": "media/hls",      "playlist": "master.m3u8",      "renditions": [        {          "path": "480p",          "playlist": "playlist.m3u8",          "resolution_width": 852,          "resolution_height": 480        }      ]    },    "thumbnails": { "path": "media/thumbnails" }  }} ```thanks for your answer Mike-Me, I already following the documentation and check the recoding_ending.json like above but in the file still don't have <recording_id> to access path according the documentation you share, or we don't need recording_id to access it...?Share0To add on to the above solution, the Amazon IVS team recommends using the "Recording State Change" Amazon EventBridge events (https://docs.aws.amazon.com/ivs/latest/userguide/eventbridge.html#eventbridge-examples-recording-state-change) to gather the recording_id (or recording_s3_key_prefix). These events are produced at the start and end of a recording session, which includes the recording_s3_bucket_name (ie: which S3 bucket the content was stored in) and the recording_s3_key_prefix (ie: the bucket/folder path of where the content was stored within the S3 bucket). Hopefully this helps achieve the information that you are inquiring about.CommentShareriley-awsanswered a year ago"


Question: Permission boundary on IAM role trust policy

"Is there any way I can restrict IAM role trust policy, just like what Permission boundary  do?The reason I'm asking is that when creating IAM role for 3rd party OIDC provider, the most common way to validate the requestor identity is by sub claim, e.g."Condition": {  "StringEquals": {    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",    "token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/octo-branch"  }}If the sub condition is omitted, the role will be open to all users in that 3rd party provider (in this case, all GitHub user).I want to give flexibility to our developer on creating their own IAM roles, but having a guardrail to prevent them creating wide-open IAM roles (just like why we have Permission boundary).Edit:Or at least allowing us to set the default subject value for the identity provider, and let us select when creating IAM role, just like how we do for audience nowSo instead of going back to edit the trust policy every time we create IAM roles, we can set the default subject condition upfrontFollowComment"

Answer: "-3Take a look at this workshop, IAM PERMISSION BOUNDARIES DELEGATING ROLE CREATION. This shows how to grant access but require the delegated role to use your permissions boundary.CommentShareEXPERTkentradanswered a year agoRichardFan a year agoThanksBut this seems to be restricting the role policy, not the trust policyI am not going to restrict what the role can do but who can assume the roleCan permission boundary do that?Share"


Question: COMPONENT_BOOTSTRAP_ERROR when deploying aws.iot.lookoutvision.EdgeAgent to a Linux aarch64 platform

"When trying to deploy a vision model generated using lookout for vision to a GreenGrass core device I get the following error from the aws.iot.lookoutvision.EdgeAgent component:COMPONENT_BOOTSTRAP_ERROR: FAILED_ROLLBACK_COMPLETE: Fail to execute bootstrap step for aws.iot.lookoutvision.EdgeAgent, exit code: 1Error code hierarchy• DEPLOYMENT_FAILURE• COMPONENT_UPDATE_ERROR• COMPONENT_BOOTSTRAP_ERRORI am using an aarch64 device running Debian Linux and can successfully deploy other components to the device. The greengrass.log file on the device gives no additional information about the error. Please help if anyone knows what could be the cause of the error and a solution? Thanks!FollowCommentMichaelDombrowski-AWS EXPERT2 months agoLook at the log file for that component in particular.SharerePost-User-0812764 2 months agoThanks, I didn't realise there were component specific log files. Found a missing dependency (python venv) when I looked at the log file for the component and that solved the problem. Thanks for the help!Share"

Answer: "4Accepted AnswerTo resolve the COMPONENT_BOOTSTRAP_ERROR with the aws.iot.lookoutvision.EdgeAgent component on your aarch64 device, try the following steps:Verify the Lookout for Vision model's compatibility with your device.Check and install all required dependencies for the EdgeAgent component.Examine bootstrap logs for error messages or clues.Double-check your Greengrass Core configuration, device architecture, and OS compatibility.Deploy a different component to confirm the issue is specific to the EdgeAgent.Consult AWS documentation, forums, or contact AWS Support for further assistance.CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Where did my brand-new Cloud9 environment go? There are none listed for my users.

"I just created my first Cloud9 environment on the 26th, under an IAM user I created for that purpose. It was working fine for a few days, but now I found that when I log in -- under either my root user or the IAM user -- and go to Cloud9, no environments are listed. It does give me the option to create one. Is this a known problem? Is my environment hiding somewhere and I'm just missing it?FollowComment"

Answer: "2Accepted AnswerIt could just be that you are in the wrong region on the AWS console. Can you confirm that the region is correctly selected?If yes, then are you the only one that has admin access to this AWS account? Is it possible that another administrator has deleted your Cloud9 environment?Check the EC2 console as well to make sure you can see the EC2 machine attached to the Cloud9 environment.CommentShareEXPERTIndranil Banerjee AWSanswered a year agoechristopherson a year agoYes, I was in a different region from before -- I created the environment in N. Virginia but when I logged on today it was the Ohio region. I guess it was a difference in ISPs perhaps.Share1Click on "Account environments" in the left menu if you are not logged in as the user of the cloud9 environment.CommentShareEXPERTkentradanswered a year ago"


Question: How to increase wordpress file upload size for site migration

"Hello,I am new to amazon aws service, so please dont mind if my question is too neive.I wanted to migrate my old Wordpress site to amazon was. I installed a bitnami Wordpress and configured domains and https. Now I want to upload my backup file through 'all in one wp migration' plug-in. However, I am only allowed to upload 80 mb file maximum.I searched the net for solution and updated the php.ini file accordingly. Also restarted the apache server.But still the values remain at 80 MB. Any help will be greatly appreciated.Regards,DipGFollowComment"

Answer: 0I found the solution myself.need to update php.inirestart all services. Restarting only the apache won't work.Thanks a lot and have a great day.CommentShareAWS-User-7086528answered 2 years ago


Question: Route53 .be dns host verification issue

"After paying for registration of a domain name on .be,I received a verification email from dnsbelgium.be and 4/5 of the verification options were only by a belgium eID.Although it seems odd I tried to verify my identity through the fifth option, hoping it would work for me as I have no belgium eID, and the verification failed.And so, The dns I paid for through the Route53 domain registration doesn't propogating.How can I get this domain to propogate? is it possible?Should I contact support to get a refund and try another domain name which is not a .be domain?FollowComment"


Question: LISTAGG on svv_redshift_columns - Gives error because it can only be run on compute nodes - Looking for a workaround

"I am trying to perform a LISTAGG on svv_redshift_columns (below query), however I receive the error ERROR: One or more of the used functions must be applied on at least one user created tables. Examples of user table only functions are LISTAGG, MEDIAN, PERCENTILE_CONT, etc.From a StackOverflow post, I learned that  it is probably because LISTAGG can only be used on compute nodes, and svv_redshift_columns is on the leader node.With that said, what would be the best workaround? I am thinking a stored procedure may be the best option to return the results that I need.Queryselect    schema_name,    table_name,    listagg(column_name, ', ') within group (order by ordinal_position) as columns_combinedfrom svv_redshift_columnsgroup by schema_name, table_name;FollowComment"

Answer: "1no, you cannot create a user table based on svv_redshift_columns due to infamous "Specified types or functions (one per INFO message) not supported on Redshift tables" error.However, it works for svv_columns view. I am not sure what is the difference between these views except column names.CommentSharerePost-User-6875974answered 3 months ago0If this is a one-time thing then you can create a user table with the data. Once you have such table you should be able to execute the listagg function.CommentShareMilindOkeanswered a year ago"


Question: "[obsolete] CNAME records already present, but ACM still marks the certificate as "Pending validation""

"We have a certificate generating warnings about its validation status (three common names, three CNAME records required for validation).The problem is those exact CNAME records were existing all this time (I have re-created the same records, using shorter TTL, but ACM still generates same warning).How can I handle this without deleting the certificate (which will render related services unusable) and re-creating it anew?Update of December 25. I had to replace the certificate instead of wasting more time on attempts to understand why ACM fails to conclude the validation (all the CNAME records were valid and in place for weeks, yet ACM refused to conclude the validation).Honestly, I am very disappointed. ACM could provide the exact problem, so I could look into it, instead of giving vague pieces of advice (of the type "something is wrong").FollowComment"

Answer: "0Could be the third case fromhttps://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-pending-validation/"The CNAME record is added to the correct DNS configuration, but the DNS provider automatically adds the bare domain to the end of its DNS records"CommentShareJaccoPKanswered a year agoKonstantin-6348871 a year agoThanks for the prompt response.The above is unlikely. I have tested every created CNAME record with a command like$ dig _4490328cbd8989384cf7fcf77df2f2f2a02.example.com CNAME(the CNAME record above is changed to exclude the actual domain name)and the response was exactly matching what ACM expects in domain details.ShareJaccoPK a year agoSome DNS providers can take 24–48 hours to propagate DNS records. Did you also check for trailing period added by DNS provider?Share"


Question: aws redshift - how to retrieve out parameters of stored procedure

Please give a query to retrieve out parameters for a particular stored procedure by using a sql query in aws redshift . thank you.FollowComment

Answer: "0Please look at the answers to this question.An example of query from one of the answer is:SELECT p.proname sp_name , n.nspname sp_schema , p.proargnames sp_args FROM pg_catalog.pg_namespace n JOIN pg_catalog.pg_proc p ON p.pronamespace = n.oid WHERE p.proowner > 1 AND p.prolang = 100125 ;CommentShareEXPERTFabrizio@AWSanswered 9 months ago0Here is an example from our documentation:CREATE OR REPLACE PROCEDURE inner_proc(INOUT a int, b int, INOUT c int) LANGUAGE plpgsqlAS $$BEGIN  a := b * a;  c := b * c;END;$$;CREATE OR REPLACE PROCEDURE outer_proc(multiplier int) LANGUAGE plpgsqlAS $$DECLARE  x int := 3;  y int := 4;BEGIN  DROP TABLE IF EXISTS test_tbl;  CREATE TEMP TABLE test_tbl(a int, b varchar(256));  CALL inner_proc(x, multiplier, y);  insert into test_tbl values (x, y::varchar);END;$$;CALL outer_proc(5);      SELECT * from test_tbl; a  | b----+---- 15 | 20(1 row)  The inner_proc has an INOUT parameter and you can see that the outer_proc called it with "y". This variable started out as 4 but was modified with inner_proc to now be 20.https://docs.aws.amazon.com/redshift/latest/dg/r_CALL_procedure.htmlCommentShareEXPERTjgrcloudanswered 9 months ago"


Question: About the error

"dear sir ,Actually i am using  another aws account and  migrate the data sql server to S3... but sometime that error are showing:Last Error Replication task out of memory. Stop Reason FATAL_ERROR Error Level FATALPlease give me update on this error...FollowComment"

Answer: 0Looks like you will need to vertically scale your DMS instance. Refer to this guide - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago


Question: What principal to set to create analysis for Active Directory admin/editor users in QuickSight by CLI?

"Hi,I made a template of QuickSight but can't create analysis by CLI using the template.The CLI read the json input which has "Permissions>Principal" section, but the value seems to be for IAM users.https://awscli.amazonaws.com/v2/documentation/api/latest/reference/quicksight/create-analysis.htmlI think Active Directory users doesn't have IAM privilege and don't know what to set "Principal" for the users.Could you share the info about principals for Active Directory users?Thank you,FollowComment"

Answer: 0Accepted AnswerJust set"arn:aws:quicksight:ap-northeast-1:<account_id>:user/default/<ad user id>"CommentShareMichihiro Otaanswered 7 months ago


Question: Changing Workspace AD from SimpleAD to AWS Managed AD

A customer wants to switch Workspace + SimpleAD to Workspace + AWS Managed AD. Is there a way for them to do it without rebuild the existing Workspace?FollowComment

Answer: "0Accepted AnswerThe direct answer is, no it's not possible to 'migrate' a WorkSpace from one Directory to another Directory. You will have to create a new WorkSpace for each user on the new Directory.Depending on the customer, their use case and their deployment size I've got some suggestions here:-For a handful of WorkSpaces you could look at cutting a custom "image". The default limit for the number of images a customer can have is 40 Images per Region. And then launch a new WorkSpace for the user based on the image. There are some things that wont follow the user though, but it's a good option for a small number:https://aws.amazon.com/premiumsupport/knowledge-center/create-image-workspaces/For a larger number of WorkSpaces the best approach is to look at a 'user' migration where you can either self enable the user to migrate between their old and new WorkSpace (perhaps a Windows SMB file share on EC2 or even FSx) or a more orchestrated migration approach using Windows Roaming Profiles (sync to that file share) or a Profile Migration solution such as LiquidWare ProfileUnity:https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/deploy-roaming-user-profileshttps://www.liquidware.com/products/profileunityI hope this helps you and your customer here!CommentSharePhil_Panswered 3 years ago"


Question: ECS Rolling Deployment Kills Tasks before ALB Deregistration

"During our rolling deployment, I'm finding that ECS always stops an existing task before issuing the command to deregister it from the ALB. As a result we tend to get small bursts of 502s from the ALB during deployments. Did some behavior change recently? This doesn't seem to align w/ what the documentation would suggest.FollowComment"


Question: How do I get trigger broker topic's routing key on lambda function

"Hello,I am coding now AWS lambda function, and I connected it to RabbitMQ broker. I created a queue on RabbitMQ and I connected this queue to topic by Routing Key. When I send message to RabbitMQ topic, it sends message to the queue and it is triggered to the AWS Lambda function and now I need 'routing key' in the lambda function. How can I get this routing key?Regards,CanFollowCommentEduardo a year agoCould this page help you?https://app-int-with-amazonmq.workshop.aws/en/7-lambda-integration/lambdaintegration-lab-setup-broker.htmlShare"

Answer: "0Hi Can,You can pass the routing key value in a header property when sending the message and that will be passed on as an event header to the target Lambda function. The value would be sent as a byte array. Currently, we do not propagate the routing key to the target Lambda function.Thanks,MithunCommentSharemithunm-awsanswered a year ago"


Question: Cannot upgrade RDS MySQL 8.0.31 to 8.0.32

"Region: ap-northeast-1Trying to upgrade RDS MySQL 8.0.31 to 8.0.32 failed with following error:RDS does not support creating a DB instance with the following combination: DBInstanceClass=db.t4g.micro, Engine=mysql, EngineVersion=8.0.32, LicenseModel=general-public-license.The MySQL instance is running normally: db.t4g.micro / mysql / 8.0.32 / general-public-license.Is this intentional restriction? or something wrong in RDS?Note: I ran aws rds describe-orderable-db-instance-options.In region ap-northeast-1, db.t4g.micro/8.0.32 is not in list, but in us-east-1, it is in list.FollowCommentHoltkamp 3 months agoGot the same issue in eu-west-1: when using the console to modify the database instance, MySQL DB engine version 8.0.32 can be selected.But when trying to actually apply the changes, the error occurs.Share"

Answer: 1Accepted AnswerConfirmed db.t4g.micro / mysql / 8.0.32 is now available in ap-northeast-1.CommentSharerePost-User-8901928answered 3 months agoHoltkamp 3 months agoFYI: confirmed db.t4g.micro / mysql / 8.0.32 is now also available in eu-west-1Share


Question: AWS VPN Client - Helper tool is required error

"When i try to connect, it says "AWS VPN Client is trying to install a new helper tool." i enter my password and within a sec i get this popup "AWS VPN Client Helper Tool is required to establish the connection.".When i try to uninstall vpn client it says "Uninstallation failed."FollowComment"

Answer: "0Hello,Have you looked at the below troubleshooting instructions for MacOS?https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos-troubleshooting.htmlThe other thing is, you could try Tunnelblick VPN client and see if that works properly if you have issues with the current client.https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos.htmlCommentShareAnjali_Vanswered 4 months ago"


Question: "ResourceOwnerCheckException Error in firewall updating Delete protection, so cannot remove firewall"

"I use AWS CLI -- "aws network-firewall update-firewall-delete-protection --firewall-name FMManagedNetworkFirewallfirewallXXXXXXXXXXXXXXXX --no-delete-protection", i get this error "An error occurred (ResourceOwnerCheckException) when calling the UpdateFirewallDeleteProtection operation: Requested resource owner is invalid."FollowComment"

Answer: "0hi Asisipho,Thank you your response. I have read and follow your provided links. However, i find they are general guides how to use the CLI command for firewall which same to my posted command, those links only tell us this is a error for "Unable to change the resource because your account doesn't own it", but do not cover a solution for this error.So, i am still getting stuck in this error.P.S. my account is "management account" and all firewall settings were performed by this same account.CommentShareyan-Avaronanswered a year agoAsisipho a year agoI have acknowledged that you were doing this operation using a management account, which lead to me assuming that you were talking about firewall manager account. Because if this is the firewall manager account, customer cannot perform activity on the network-firewall that was created on child account by using firewall manager master account, but the account that actually owns the resource.As a workaround:You can update the network-firewall policy that was created via firewall manager with PutPolicy https://docs.aws.amazon.com/cli/latest/reference/fms/put-policy.html, firewall can be created with any proprieties of your choice, or you need to assume the child account that has the firewall, and make the changes from that side.Shareyan-Avaron a year agohi Asisipho,I am mess for account role(s) from your answer, we setup one account in AWS which is management account, we did all the setting by this one account only.However, for my understanding of your answer, it seems many account roles: firewall manager account, child account, etc."customer cannot perform activity on the network-firewall", I cannot understand the meaning of "customer", we only have one account to setup all setting. For our point of view of what is customer, they use our System running in ubuntu Linux OS - VM Instance setup - all data go through this firewall. So they do not need to modify the setting of firewall.I guess your meaning of "customer" who have lower permission power under firewall-manager (your meaning of child account). I would like to declare clearly, we only apply one account as "management account", i guess including the power as firewall-manager.So, i still in the situation as the system said i have no power for the resource in changing the firewall protection flag.Share0Hi,I understand that you want to  UpdateFirewallDeleteProtection and you are encountering an error “ResourceOwnerCheckException”.This is due to making a request on resources that your account  does not own. Please find the attached document [1] for more information on this error.To complete this operation on an account that owns the resources please do refer to attached document[1][2].I have attached a third party documentation[3] that you can look into to list the firewalls on your resources and be able to perform the UpdateFirewallDeleteProtection operation on.I hope this helpsResources:-[1] https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallDeleteProtection.html[2] https://awscli.amazonaws.com/v2/documentation/api/latest/reference/network-firewall/update-firewall-delete-protection.html[3] https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/NetworkFirewall/enable-deletion-protection.htmlCommentShareAsisiphoanswered a year ago0hi,Finally got the solution from AWS,go to AWS Firewall Manager at: https://us-east-1.console.aws.amazon.com/wafv2/homev2Select any active resources, and choose Actions > Delete.I delete to delete "Firewall Manager" before delete Firewall. Their error message does not clearly show me this error during delete Firewall.Finally, AWS guys let me to wait a few days to return back this solution to me, and pointed me some wrong direction to test during these few days. It seems they also do not so familiar to their system.CommentShareyan-Avaronanswered a year ago0Warm Greetings Everyone!*I am having a similar situation with my account . I am unable to delete my Network Firewall , Network Interface, VPC, Endpoints . When trying to delete Network Firewall, this is the error received :1 * For Firewall : " Cannot DeleteFirewall because at least one of the firewall endpoints are missing the AWSNetworkFirewallManaged:true tag: [vpce-00957b459fe0dec1b] "2 For endpoints: "vpce-00957b459fe0dec1b - Operation is not allowed for requester-managed VPC endpoints for the service com.amazonaws.vpce.us-east-2.vpce-svc-0f427de517c75a430."3 * Network Interface: "Network interface is currently in use by ela-attach-xxxxxxxxxxxx"Kindly note that i have released all elastic IPs, NAT, Internet Gateway.I need your assistance please because the bill for Network interface keeps increasing for a service i don't use.CommentSharerePost-User-4193731answered 4 months ago"


Question: "pod-identity-webhook, 1.22 migration, removed api admissionregistration.k8s.io/v1beta1"

"I have 3 eks clusters, and on all of them the:MutatingWebhookConfiguration  pod-identity-webhookis created with apiversion: admissionregistration.k8s.io/v1beta1which will be removed in 1.22Is it my responsability to re-create the whole pod-identity setup with something supported in 1.22+, or will the upgrade managed this and the admission webhook will still be running on the managed api servers ?FollowComment"

Answer: "1Even though you can see the Pod Identity Webhook mutatingwebhookconfigurations resource in the EKS cluster, you should also notice that the pods are not running on your nodes. In an EKS cluster, the Pod Identity Webhook pods run on the managed control plane. So, yes, when the cluster is upgraded, the new api versions will be set for you.CommentSharejimmyrayanswered a year ago"


Question: Is CloudWatch "Vended Log" cost for VPC Flow Log delivery to S3 calculated on GB before or after compression?

"BackgroundWhen VPC flow logs are enabled and delivered to S3, you incur a CloudWatch "Vended Log" cost for "each GB of Data Ingested". CloudWatch delivers these flow logs to S3 as gzip-compressed text by default and you can instead optionally choose Parquet. In either case, this means stored S3 object size will be smaller than the raw log files.QuestionAt what point in the data flow does CloudWatch calculate the size (in GB) of flow logs delivered to S3? i.e is it before or after the results are compressed?The pricing docs say its based on "Data Ingested", which to me suggests pre-compression logs. However, when I look at an example line item from the AWS Cost & Usage Report, the line description says "$0.xxx per GB of log data delivered to S3", and to me, "delivered", would imply usage is measured post-compression.Before anyone asks, I do not currently have the ability to look at the destination bucket  myself; otherwise, I could just compare size of objects in S3 to the corresponding flow log billing detail.FollowComment"

Answer: "0Hello,It should not matter whether the data is Pre/Post compressed. S3 operates and calculates the data cost on the data it has as you already mentioned the data stored is already compressed.However, if you want to consider, you can consider it as post compressed from the cost perspective. The charge would be for per GB data in the S3 (post compressed). Hope this helps :)CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year agomwrb a year agoYou misunderstand, I am not asking about the GB-mo storage cost of S3. When VPC flow logs are delivered to S3, CloudWatch charges a one-time "vended logs" fee per GB delivered... and this is what I am referring to in my question. Please see "Vended Logs" section of "Logs" tab at https://aws.amazon.com/cloudwatch/pricing/Share"


Question: Webhook data missing from cloudwatch logs and API Gateway

"I'm having an issue with receiving 100% of the webhook notifications sent from Authorize.net. Currently, our infrastructure is in AWS and includes API Gateway and a Lambda function.We set up our webhooks to listen to "authCapture" events and have those notifications being sent to our API endpoint from API Gateway. When we receive the webhook notification, the lambda function is triggered and returns a response.While doing an assessment comparing the data from Authorize.net and data received and processed in AWS, there are some discrepancies. Some requests are just completely missing seeming like we didn't receive the webhook event for it at all.We use cloudwatch to log all received requests that come through our lambda, and this is how we noticed that some are completely missing.Using cloudwatch metrics, i've verified that there are no throttling errors. I've also increased the memory of the lambda function from 128MB to 512MB and have AWS X-RAY for the api gateway which shows that all received requests (100%) are in the OK status and a response gets returned on average in 3 seconds.I've also tried Lambda function URLs, but seeing pretty much the same data come through that we receive with API Gateway, so I don't think it's a time out issue.Authorize.net claims that they have successfully sent the webhook notification and received a 200 response from our server, but i'm not sure how that's the case if it seems like we haven't received the notification at all since they're missing from our logs.I'm wondering if anyone knows why this could be happening? Is this likely an API Gateway issue? or Lambda issue?FollowComment"


Question: Can I have the game (in Editor) NOT pause when the LY Editor window goes out of focus?

"Hello,I would like to be able to enter gamemode (Ctrl+G) and then Alt-Tab to a different window and have the game not pause.Is that possible?Thank youEDIT: Deleted a paragraph because I misremembered something and it was not relevant after all.Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0Good question @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0Thanks for that, will be useful to have it!SharerePost-User-4023949answered 6 years ago"


Question: Need to create a step function with above state machine workflow using terraform.

using terraform.FollowComment

Answer: "0AWS Step Functions orchestrate a state machine workflow. State machine workflows are defined using Amazon States Language.Terraform exposes the underlying AWS public API for Step Functions through the aws_sfn_state_machine and aws_sfn_activity  resource types. For example code, the Terraform registry has resource documentation and examples.It is important to note that for state machines, the definition of the workflow is in the Amazon States Language, a JSON-based, structured language used to define your state machine, a collection of states, that can do work (Task states), determine which states to transition to next (Choice states), stop an execution with an error (Fail states), and so on.This means that any workflow example in JSON will work, regardless if you find it for CloudFormation, AWS CLI, or Terraform.Terraform documentation for Step Functionshttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sfn_state_machineSample projects for Step Functionshttps://docs.aws.amazon.com/step-functions/latest/dg/create-sample-projects.htmlHere is a basic example from the Terraform documentation:resource "aws_sfn_state_machine" "sfn_state_machine" {  name     = "my-state-machine"  role_arn = aws_iam_role.iam_for_sfn.arn  definition = <<EOF{  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",  "StartAt": "HelloWorld",  "States": {    "HelloWorld": {      "Type": "Task",      "Resource": "${aws_lambda_function.lambda.arn}",      "End": true    }  }}EOF}CommentShareawstyleranswered 3 months ago"


Question: SSL certificate with S3 bucket

"I created 2 buckets in S3, one is main domain and the second one is subdomain both in the region of Mumbai. I want to include SSL certificate on my domain for that I acquired SSL certificate from ACM (Origin is Virginia) and made a cloudfront distribution to create connection between S3 bucket and SSL certificate, I successfully created distribution and linked it with main domain and created its records in DNS but still my domain is running on http instead of https.FollowComment"

Answer: "1Hello,When your origin is an Amazon S3 bucket, your options for using HTTPS for communications with CloudFront depend on how you're using the bucket. If your Amazon S3 bucket is configured as a website endpoint, you can't configure CloudFront to use HTTPS to communicate with your origin because Amazon S3 doesn't support HTTPS connections in that configuration.If you want to require HTTPS for communication between CloudFront and Amazon S3, you must change the value of Viewer Protocol Policy to Redirect HTTP to HTTPS or HTTPS Only.Can you confirm if the above 2 requirements have been checked ?Check the below articles and you ll be able to better configure and understand the same.[1] https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-https-requests-s3/[2] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-s3-origin.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoEXPERTChris_Greviewed 10 months ago"


Question: "After a year or two with Lightsail, my site was down today"

"In the Lightsail console, it shows Unknown for status and trying to stop it doesn't seem to be working. The AWS dashboard shows Lightsail services are all green. Yeah, I don't think so. Trying to stop it again I get an Error dialog saying cannot stop an instance in transition!?!?!?!!?!?!?!?!!!?!!?!??!?!?!?!?!?!?!?I might be headed back to Linode. This is service from a multi-billion dollar company?I used my snapshot, had to update a few files that the super smart cloud config blindly overwrites in its wisdom.Edited by: smoothSailing on Apr 12, 2019 6:33 PMEdited by: smoothSailing on Apr 12, 2019 7:39 PMEdited by: smoothSailing on Apr 12, 2019 9:35 PMFollowComment"

Answer: "0Shopping for a new provider.CommentShareawsIsAlrightanswered 4 years ago0DELETECommentSharemotiontvanswered 4 years ago0Hello,Thanks for using Lightsail and we are sorry for what you met...From our record, there is only one instance up and running in 'us-east-2', which was created at Apr. 12, 2019. Do you still meet problem with Lightsail? You can contact customer support and cut us a customer ticket so that we can provide more supports. We can provide more personal and detailed info in customer ticket :)Best,YiranCommentShareYiran-AT-AWSanswered 4 years ago"


Question: NLB TARGET IP OVER PEERED VPC CONNECTION

"Hello Experts, every document says NLB target IP can be any IP either from peered VPC or on -prem. However while testing I see no such option is available, it only gives options to choose IP from targeted VPC.In case no such option it gives you same functionality as instances option. is something got changed ?FollowComment"

Answer: "1Accepted AnswerHello,That is definitely supported, please make sure to use 'IP Address' as a Target type when creating a Target group.In the Register targets you would need to select 'Other private IP address' in the dropdown.CommentShareEXPERTTushar_Janswered a year agoEXPERTToni_Sreviewed 10 months agorePost-User-1687975 a year agoI exactly did the same and getting error "IP address must belong to an existing subnet" please check my screenshot it ask choose a network and only option is to define VPC & that does not make sense to me since I was trying to mention IP address from peer VPC which is not an option to choose.ShareTushar_J EXPERTa year agoHello, I modified my answer and added 1 more screenshot, you need to select "Other IP address" in the dropdown for Register target. After that as long as Peering is setup properly, routing, SGs, NACL etc the Target should come Up healthy in NLB.SharerePost-User-1687975 a year agoMany thanks Tushar. Overlooked this option :)Share"


Question: Database Connection Pooling with Aurora Serverless & Lambdas

"Hi - I am having issues with high latency in connecting lambdas and a Postgres Aurora Serverless cluster via the Data API. After some research, it looks like Connection Pooling is the best solution. However, it looks RDS Proxy (the AWS native connection pooling solution) doesn't support Aurora Serverless. Does anyone know a workaround for this (while still using Aurora Serverless)?FollowComment"

Answer: "0Hello AWS Customer,Yes you are correct, RDS Proxy is not supported for Aurora serverless as of now. As the document: https://aws.amazon.com/blogs/database/best-practices-for-working-with-amazon-aurora-serverless/ mentions, You have two choices with Aurora Serverless: manage your own application connection pooling or use the Amazon RDS Data API. The Data API reduces the effort of managing database connections or connection pools. The Data API doesn’t require a persistent connection to the DB cluster. Instead, it provides a secure HTTP endpoint, backed by a connection pool. So, you can choose between them for connection management. From the above document, apart from application connection pooling and data api section, you can also refer sections such as Minimizing pause and resume time, Pre-warming.For more information on Data API, you can refer: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.htmlI hope this helps! If you are facing latency issues with your lambdas or any other issues, i would recommend you to open a new support case with AWS Premium support so the latency can be troubleshooted to see if there any issues.CommentShareKunal_Manswered a year ago"


Question: How can i reboot MSK Cluster

"Is there a way to reboot MSK cluster, it got stuck at updating, and we needed to reboot one of our brokers. Please help this is a production cluster. This has took more than 2 hours updatingFollowComment"

Answer: "0Hello,Here is the link to follow for rebooting the broker.It has options to do it via Console, CLI & API. Check it out and this should help.Link- https://docs.aws.amazon.com/msk/latest/developerguide/msk-reboot-broker.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 7 months agoYusufVendii 7 months agoI tried it, and i got the below response.An error occurred (BadRequestException) when calling the RebootBroker operation: This operation is only valid for resources that are in one of the following states :[ACTIVE]Share"


Question: How to handle schema changes and versions in the Glue Data Catalog?

"Given a dataset with a temporally changing schema, how do you:Specify a schema version when running a job/query? i.e. I want to specify version X of a table because I know that the data I am querying against was created when version X was current.Query data across versions? i.e. Data in January has slightly different schema version than data in February and I want to run a query across both.For scenario 2, I've run some tests with an evolving schema and adding or dropping columns creates no issues. If the column type changes though (i.e a TIMESTAMP changes to a STRING), then queries against data that don't match the catalog fail. I've tested this behavior in both Athena and Glue (DynamicFrame can handle some data type inconsistencies).My thought would be to do separate queries and then UNION the results, but that requires the answer to scenario 1...FollowComment"

Answer: "0Accepted AnswerVersion by itself is not available as a column to Athena. In Athena/Presto, you can use the typeOf function to determine the type of a column and choose how you want to process that. A Case statement would also work. e.g.SELECT  x, typeof(x)  from (select timestamp '2012-10-31 01:00 UTC' as x)where typeof(x) like 'timestamp%'UNIONSELECT date_parse(x,'%Y-%m-%d %h:%i:%s'), typeof(x)from (select '2012-10-31 01:00:00' as x)where typeof(x) like 'varchar%'But ideally even if you have a varying schema in your raw data tier, you should be resolving that schema in the etl layer so that in the analytics tier you have a single schema with perhaps 2 columns - one for the original column, one for the changed column.Then at the serving layer it is easy to build a view to coalesce the columns if needed e.g.: if a string column is being changed to timestampSELECT coalesce(new_column, date_parse(old_column,'%m/%d/%Y %h:%i:%s %p')) as timestamp_columnCommentShareAWS-User-4669487answered 4 years ago"


Question: Do we lose any DDoS protections from CloudFront by turning caching off and forwarding all headers to origin?

"We are trying to best protect our backend service from DDoS attacks and have setup WAF in front of CloudFront in front of our service.A few AWS white papers (such a this) mention using CloudFront as a way to improve DDoS resiliency: Benefits of using CloudFront, AWS Global Accelerator, and Amazon Route 53 include:• Access to internet and DDoS mitigation capacity across the AWS Global EdgeNetwork. This is useful in mitigating larger volumetric attacks, which can reachterabit scale. • AWS Shield DDoS mitigation systems are integrated with AWS edge services,reducing time-to-mitigate from minutes to sub second. • Stateless SYN Flood mitigation techniques proxy and verify incomingconnections before passing them to the protected service. This ensures that onlyvalid connections reach your application while protecting your legitimate endusers against false positives drops.We want to disable caching and forward all headers from the original request that hits CloudFront to our backend service, basically using CloudFront as a reverse proxy. Do we still maintain the AWS Global Edge Network DDoS mitigation and protections of CloudFront by doing this?FollowComment"

Answer: "1Accepted AnswerIn short: If you disable caching you lose very little protection. Perhaps a tiny bit but not that much.Regardless of whether caching is enabled or not, CloudFront terminates the request from the browser and then performs a new request towards the origin - assuming all things go well: WAF; Lambda@Edge; CloudFront Functions; etc. So if there is some sort of mailicious activity or DDoS event happening CloudFront will see that traffic first and you can choose to (say) block it using WAF or have the other mechanisms in CloudFront (such as SYN flood mitigation) protect you.Caching helps here because it means that requests that are cached don't hit your origin. In a "high load" event this can reduce the amount of traffic that is sent to your application which is (in general) always a good thing. With caching disabled, all valid requests will be handled by the origin - increasing load, cost and delays to the original requester. Of course, that's up to you but if you can cache things in CloudFront it is well worth it.CommentShareEXPERTBrettski-AWSanswered 5 months agoEXPERTTushar_Jreviewed 5 months ago"


Question: "Upgrading RDS SQL Server from db_m4 to db_m5, but worth it?"

"Hi Friends,I'm considering moving from RDS SQL Server databases DB.m4 to DB.m5, but I do not have a clear idea of what to expect when I push the button.Could you please advise me on what to expect If I remain in DB.m4 machines?What am I missing?Thank you,Best Regards,FollowComment"

Answer: "0Simply stated, m5 offers better performance as compared to m4 since it's running on latest hardware. It would also have a marginally lower cost as compared to m4. Larger instance types are also supported in m5. You can also continue running RDS on m4 but given a choice it's always better to make use of the latest instance types.--SydCommentShareSydanswered 7 months ago0Luis - what regions are you in? We also offer M6i which is more price-performant than M5. M6i instances are powered by 3rd generation Intel Xeon Scalable processors.  '-i' nomenclature stands for Intel processor to differentiate from Graviton.CommentShareWaiwaianswered 7 months ago0M5 in general pack more performance than M4. Also think of the instance class support. For current, please refer DB instance class support for Microsoft SQL ServerFor what to expect when you 'push the button' i.e. actually modify the DB instance type, please refer Modifying an Amazon RDS DB instance. It is recommended that you test any changes on a test instance before modifying a production instance.CommentShareAWS-User-2870192answered 7 months ago"


Question: How do I permit access to S3 via EC2 role and EC2 instance tagging

"I'm trying to create a policy that will allow an EC2 instance access to a s3 bucket and prefix controlled via the Name tag on the EC2 instance. It feels like I should be able to create a policy similar to the below, but it isn't working. I get a 'PutObject operation: Access Denied' when I try and create an object.My EC2 instance has a non-blank Name tag. If the ${aws:RequestTag/Name} portion from the Resource list, the EC2 instance can put files, but with the variable, the action fails. I'm trying to limit the s3 object prefix to include the value of the EC2 instance tag nameThe policy I'm trying to use is:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::my-backups-sn/${aws:RequestTag/Name}/*"        }    ] }From my ec2 instance I've executing the following, where the instance has Name=inst_name defined in the AWS control panel:aws s3 cp my_file s3://my-backups-sn/inst_name/my_file.txtAny guidance is gratefully acceptedFollowComment"

Answer: "1Accepted AnswerThe IAM Policy variable for "aws:RequestTag/${TagKey}" is used when you are creating a tag for a resource. For example, if you want to specify the key/value pairs that a resource is allowed to be tagged with, you can use the  "aws:RequestTag/${TagKey}" variable in an IAM Policy to allow/deny specific tags.For example, the following policy would allow you to apply the environment/prepod tag on an EC2 instance:{  "Version": "2012-10-17",  "Statement": {    "Effect": "Allow",    "Action": "ec2:CreateTags",    "Resource": "arn:aws:ec2:::instance/*",    "Condition": {      "StringEquals": {        "aws:RequestTag/environment": [          "production"        ]      }    }  }}The "aws:RequestTag/${TagKey}"  variable will not send the tags attached to an AWS resource to S3. For more information about this policy variable, please refer to the following link:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttagHowever, you can send the tags that are attached to a IAM Role to S3 using the "${aws:PrincipalTag/Name}" variable. For example, if you have an EC2 instance that is using an EC2 instance role, you can tag the EC2 instance role with the appropriate tags. Then, attach the following policy to the IAM Role:{  "Version": "2012-10-17",  "Statement": {    "Effect": "Allow",    "Principal": "*",    "Action": "s3:GetObject",    "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/${aws:PrincipalTag/Name}/"  }}For more information about the "${aws:PrincipalTag/Name}" variable, please refer to the following link:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltagCommentShareAWS SA Neilanswered 4 months ago1The devil is in the detail!I've been setting the Name tag on the EC2 instance, thinking that the principal is the EC2 instance, but it's the IAM Role that's the principal. Once you realise this and reread the docs, it clearly states that it needs to be there.Anyway, thanks for the help.CommentShareStuart Roeanswered 4 months ago"


Question: Extend Windows Ebs volume

Is there automated way with SSM or powershell to extend ebs volume on a ec2 instanceFollowCommentMayank 7 months agoyou can use the below powershell script to extend the EBS volume from AWS as well as from OS endhttps://www.magicpowershell.com/2022/07/extend-live-ebs-volume-on-aws-ec2-instance.htmlShare

Answer: "0Hi, our environment does not allow to automate the resize. can only resize when requested. My task is now to extend it but I am looking for the automated way to do this via powershell or ssm?CommentSharerePost-User-5364312answered 8 months agoMatt-B EXPERT8 months agoYou can use the method in the blog I mentioned above, step 5Extend the file systemExtend the file systemThe most critical (and challenging) part of this automation is the ability to “extend” the file system on the OS layer. It is relatively easy to expand an EBS volume on the AWS layer. However, this additional space is useless unless the file system on the OS is extended to take advantage of the newly provisioned space. This process requires a good understanding of the various scenarios that you might come across, for example, different operating systems and volume types. Then, write the appropriate scripts to extend the volume on the OS layer.For Windows, we wrote a PowerShell script that used DiskPart, and for Linux our bash script used growpart. For more information about how to extend the file system after resizing the EBS volume, see the following:Extending a Windows File System after Resizing a VolumeExtending a Linux File System After Resizing a VolumeWe followed the same approach used in earlier steps to deploy the scripts to the instance:Write the script and store in S3.Write an SSM document that downloads the script from S3 and executes it.In your Lambda, use the SSM client and the send_command method to run the SSM document on the instance.ShareMayank 6 months agoyou can refer the below blog for the powershell script that will extend the EBS volume by providing the drive letter, size to increase and instance name as an input and it will extend  the EBS volume from AWS end as well as from OS endhttps://www.magicpowershell.com/2022/07/extend-live-ebs-volume-on-aws-ec2-instance.htmlShare0on the EBS volume side, I did these powershell commandsnew-ec2volume -VolumeType gp2 -size 10 -AvailabilityZone us-west-1bAdd-EC2Volume -InstanceId xxxx -VolumeId vol-xxxxxxxxxx -Device xvdbThen on the guestI am using these commands and put in a powershell script.$diskNumber = (Get-Disk | ? { $_.PartitionStyle -eq "RAW" }).NumberInitialize-Disk -Number $diskNumber -PartitionStyle "MBR"$part = New-Partition -DiskNumber $diskNumber -UseMaximumSize -IsActive -DriveLetter "e"Format-Volume -DriveLetter $part.DriveLetter -Confirm:$FALSEI am able to run these commands on the guest and it creates the drive fine.But When i try to run using send-ssmcommandnothing happensSend-SSMCommand -InstanceId i-xxxxxxxxxx -Parameter @{commands = "/Users/xxxxxx/powershell/ssm_add_drive.ps1"} -DocumentName "AWS-RunPowerShellScript"any idea?CommentSharerePost-User-5364312answered 8 months agoMatt-B EXPERT8 months agoAssuming you pre-loaded the ssm_add_drives.ps1 on your instance, can you try putting the full path to the script (ex c:\users\username\script.ps1)  instead of "/Users/....."Share0Hi ThereYou can use Powershell to extend an EBS volume using the resize-partititon cmdlet.  Just be aware that it is always recommended to backup your  data before changing the volume size.See https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/recognize-expanded-volume-windows.html#recognize-expanded-volume-windows-powershellCheck out this blog for a fully automated solution for extending EBS volumes using Step Functions and SSM.1. Monitor when a volume reaches 80% capacity and trigger the automation.2. Run through a series of checks before proceeding, because certain systems were excluded. Some EC2 instances in our fleet had custom-built applications that required manual disk expansion. Other EC2 instances were managed by teams that had specific governance policies requiring tighter control of any infrastructure changes.3. Take a snapshot of the volume as a safety measure in the unusual event that data corruption occurs.4. Expand the volume by 20% on the AWS layer using Lambda.5.  Extend the file system on the OS using Systems Manager documents that download and execute scripts stored in Amazon S3.6. Check the status and make sure that the volume expanded and extended correctly.7. Send an email notification summarizing the action that the automation performed successfully using Amazon SES.https://aws.amazon.com/blogs/storage/automating-amazon-ebs-volume-resizing-with-aws-step-functions-and-aws-systems-manager/√ If my answer addressed your question adequately, please consider clicking the ACCEPT button. It helps the community find answers to similar questions more quicklyCommentShareEXPERTMatt-Banswered 8 months ago0if I ran following commands from aws console, it works. but not from send-ssmcommand$diskNumber = (Get-Disk | ? { $_.PartitionStyle -eq "RAW" }).NumberInitialize-Disk -Number $diskNumber -PartitionStyle "MBR"$part = New-Partition -DiskNumber $diskNumber -UseMaximumSize -IsActive -DriveLetter "e"Format-Volume -DriveLetter $part.DriveLetter -Confirm:$FALSECommentSharerePost-User-5364312answered 8 months ago0I did not preload the script to my instance. IS there a way to run the script from my laptop?CommentSharedragoanswered 7 months ago0ok I uploaded the powershell script to a s3 bucket. How do i specify the send-ssmcommand to get it from the bucket?CommentSharedragoanswered 7 months ago0you can refer the below blog for the powershell script that will extend the EBS volume by providing the drive letter, size to increase and instance name as an input and it will extend  the EBS volume from AWS end as well as from OS endExtend EBS Volume Using Powershell ScriptCommentShareMayankanswered 6 months ago"


Question: AWS Job is loading with old code

"We created a job in aws glue, and did python script code implementation. After our changes we saved the job and it has saved successfully, but upon reloading it is loading with old script which we created initially(initial script). We did changes multiple times, but same is happening. We can notice that some notebook server related error like below:Notebook couldn't be terminatedThere was an issue trying to terminate the notebook server. Please try again or contact support if the problem persists.Same kind of issue in another job also.What would be the issue here?FollowComment"

Answer: "0How did you save the script? In the UI or some other way?CommentSharetjtollanswered a year agoAWS-User-2414105 a year agoIn the UI, using save button.Share0See my answer in https://repost.aws/questions/QUtF9ALsuJTqi1XOBgZD6e0A/custom-script-cannot-be-saved-in-glueCommentShareJuraj Misuranswered a year ago"


Question: Kinesis video stream Webcam access to Docker

During kinesis video steam using Docker setup when I try to  run the Docker (below command) and I am getting the expectation.I want to stream video from PC webcam. How to give Docker access to PC webcam?sudo docker run -it --network="host" --device=/dev/video0 546150905175.dkr.ecr.us-west-2.amazonaws.com/kinesis-video-producer-sdk-cpp-amazon-linux /bin/bashError:-docker: Error response from daemon: error gathering device information while adding custom device "/dev/video0": no such file or directory.ERRO0000 error waiting for container: context canceledFollowComment

Answer: "0Hello there,The error that's being returned by docker indicates that it is unable to find a video device mapped to /dev/video0. This could be due to the video device being under a different location in the /dev directory. If you are using Docker on Linux, you can use ls /dev/ to examine the contents of the directory and replace /dev/video0 with the proper file name if the device is mapped to another location. If there is no device listed, then this may indicate an issue with the connection between the webcam device and the computer.If you are using a different OS (such as macOS or Windows), please ensure you're using the correct Docker image and running the command that corresponds to your OS from here: https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/examples-gstreamer-plugin.html#examples-gstreamer-plugin-dockerCommentShareSUPPORT ENGINEERMichael_Lanswered a year ago"


Question: Route domain to specific directory in Cloudfront

"We have a software sold in installs and each install has a ton of images.  The plan was to move those images to a single CloudFront distribution and each install's images would simple occupy its own directory.  Definitely would work but we would loose SEO credit.Question, is there a way to use a "alternate domain" that points to a sub-directory rather that the distribution itself?  That would be too easy, probably need to sacrifice the SEO for a single distribution or create a distribution per install?FollowComment"

Answer: "0Might need more information to gauge the SEO impact.With regards to the question, it would be easier to create a distribution per install as we could simply rely on Origin Path parameter [1] to append the directory name into URI. For instance, example.com/a.img would be example.com/path/a.img sending back to the origin.On the other hand, we could also use CloudFront Functions or Lambda@Edge to dynamically adjust the request URI based on the needs. For example, the following CloudFront Functions would modify the URI according to the host name (alternate name):function handler(event) {    var request = event.request;    var headers = request.headers;    var host = request.headers.host.value;    var uri = request.uri;    if (host === 'example.com') {        // If the host is example.com, prepend /example to the URI        request.uri = '/example' + uri;    }         return request;}Lastly, I would also recommend reading this article [2] for SEO optimization with Amazon CloudFront.[1] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath[2] https://aws.amazon.com/blogs/networking-and-content-delivery/optimize-seo-with-amazon-cloudfront/CommentShareweidianswered 15 hours ago"


Question: Can't connect to EC2 instance via ssh

"I can't access my ec2 instance via ssh, when I try to I get returned "sign_and_send_pubkey: no mutual signature supported" I have the .pem in the directory I'm working in and I have done the "chmod 400 .pem" Can anyone help me with this please?FollowComment"

Answer: "0Hello,This error means that the hash algorithm your key uses is not compatible with the server.   Is there a chance you're using the wrong key file? Can you try and connect using EC2 Instance Connect or AWS Systems Manager Session Manager?CommentShareEXPERTChris_Ganswered 8 months ago"


Question: [Bug?] IAM Role Trusted Entities' "External ID" More Permissive than STS Service

"I believe I have found a disparity between how IAM and STS each treat the "External ID" condition that can be added to the trusted entities (assume-role-policy) of an IAM role.TL;DR seems like IAM allows for spaces to be in the "ExternalId" but the STS service/api rejects AssumeRole requests that have spaces in the external id.Steps to reproduce - you need 2 AWS accounts:In account A (say account ID 123456789012) create an IAM role with the following "Trusted entities" (assume-role-policy) allowing account B (say account ID 567890123456") to assume it:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::567890123456:root"                ]            },            "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "sts:ExternalId": "something with a space"                }            }        }    ]}Then using an IAM entity in account B (567890123456) (can be an IAM user with full admin permissions for example - or any other IAM entity with permission to sts:AssumeRole the role we created in account A), try the following:AWS_PROFILE=bug_reproduction aws sts assume-role --role-session-name something-$(date +%s) --role-arn arn:aws:iam::123456789012:role/MyRole --external-id "something with a space"The CLI will error out with the following error from the STS API:An error occurred (ValidationError) when calling the AssumeRole operation: 1 validation error detected: Value 'something with a space' at 'externalId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w+=,.@:\/-]*Not a question but perhaps this forum post will help AWS folks either reject ExternalIds with spaces in the trusted entities policies OR will change the STS service to allow spaces.FollowComment"

Answer: "0It does seem like there is a discrepancy between the IAM Role Trusted Entities' "External ID" condition and the STS service's validation of the "externalId" parameter.As you noted, the IAM Role Trusted Entities' "External ID" condition allows spaces in the value, while the STS service requires that the "externalId" parameter satisfy a regular expression pattern that does not allow spaces.While this may not be a bug per se, it does seem like a potential inconsistency in the AWS platform's behavior. I recommend reporting this to AWS Support, as they will be able to investigate this issue further and determine if any changes need to be made to address this discrepancy.CommentSharehashanswered a month ago"


Question: Greengrass StreamManager dependency problem

"Hello!I created a Greengrass core device through the online tutorials. On step 5b I followed the recommended option, so I think it uses sts:AssumeRole for authentication.Everything is working fine and I tried to install and use the AWS StreamManager Component. I updated my deployment and Stream Manager was successfully installed on my core device. But when I created a stream and appended data to that stream, I got errors in /greengrass/v2/logs/aws.greengrass.StreamManager.log about Stream Manager not being able to connect to IoT Analytics.The full debug logs of Stream Manager can be found in this gistI found following issues in this logs:Line #140: 2022-03-04T08:30:35.708Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. 2022 Mar 04 08:30:35,707 [DEBUG] (pool-7-thread-1) com.amazonaws.auth.AWSCredentialsProviderChain: Unable to load credentials from WebIdentityTokenCredentialsProvider: To use assume role profiles the aws-java-sdk-sts module must be on the class path.. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=STARTING} Line #167: 2022-03-04T08:30:36.085Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. 2022 Mar 04 08:30:36,074 [ERROR] (pool-7-thread-1) com.amazonaws.iot.greengrass.streammanager.export.destination.IOTAnalyticsDestination: Encountered error while exporting data to AWS IoT Analytics. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=STARTING} When I created the file /home/ggc_user/.aws/credentials using basic credentials[default]aws_access_key_id = ******aws_secret_access_key = *******Stream manager works perfectly.As I read in the logs, the Stream Manager package should have the aws-java-sdk-sts module as a dependency in order to work with this method. Because the Stream manager component is not open source, I'm unable to create a PR. So I hope this message will reach the Stream Manager developers.Here are the component versions used in my deployment:Component Name: aws.greengrass.StreamManager    Version: 2.0.14    State: RUNNING    Configuration: {"JVM_ARGS":"","LOG_LEVEL":"DEBUG","port":"8088","runWithDefault":{"posixUser":"ggc_user:ggc_group"},"STREAM_MANAGER_AUTHENTICATE_CLIENT":false,"STREAM_MANAGER_ENABLE_LOCK_ON_METADATA_STORE":"false","STREAM_MANAGER_EXPORTER_MAX_BANDWIDTH":"2147483647","STREAM_MANAGER_EXPORTER_S3_DESTINATION_MULTIPART_UPLOAD_MIN_PART_SIZE_BYTES":"5242880","STREAM_MANAGER_EXPORTER_THREAD_POOL_SIZE":"5","STREAM_MANAGER_SERVER_PORT":"8088","STREAM_MANAGER_STORE_ROOT_DIR":"."}Component Name: aws.greengrass.TokenExchangeService    Version: 2.0.3    State: RUNNING    Configuration: {"port":0.0}Component Name: aws.greengrass.Nucleus    Version: 2.5.3    State: FINISHED    Configuration: {"awsRegion":"eu-central-1","componentStoreMaxSizeBytes":"10000000000","deploymentPollingFrequencySeconds":"15","envStage":"prod","fleetStatus":{"periodicStatusPublishIntervalSeconds":86400.0},"greengrassDataPlanePort":"8443","httpClient":{},"iotCredEndpoint":"c18zy2f9lrcrq0.credentials.iot.eu-central-1.amazonaws.com","iotDataEndpoint":"a3sh1t0ug8wcry-ats.iot.eu-central-1.amazonaws.com","iotRoleAlias":"GreengrassV2TokenExchangeRoleAlias","jvmOptions":"-Dlog.store=FILE","logging":{},"mqtt":{"spooler":{}},"networkProxy":{"proxy":{}},"platformOverride":{},"runWithDefault":{"posixShell":"sh","posixUser":"ggc_user:ggc_group"},"telemetry":{}}Best regards,HacorFollowComment"

Answer: "1Hacor,You should delete the credentials file that you created, that's not how Greengrass should be getting credentials. Instead, Greengrass provides credentials to components including Stream manager using the Token Exchange Service component. https://docs.aws.amazon.com/greengrass/v2/developerguide/device-service-role.htmlGreengrass uses the IoT Credentials Provider service which retrieves credentials from an IoT Role Alias which you configured. This role alias must point to an IAM role which has the necessary permissions for Stream manager such as IoT Analytics.CommentShareEXPERTMichaelDombrowski-AWSanswered a year ago0Hello Michael!Thanks for the answer. I know I should delete the credentials file, I just created it in order to test whether I was capable of getting Stream Manager to work or not.I provisioned the Greengrass core device with the installer option provision=true so it created the policies, role and the role alias automatically as a part of the installation.I also updated the role to use the iotanalytics:BatchPutMessage as mentioned in the description of the component here. Stream Manager should be able to access IoT Analytics.I do want to put the attention to line #140 again of the gist mentioned above. Stream manager complains in the starting stage about being unable to assume roles. I really do think that's causing the problem.The Token Exchange service seems up and running fine, my custom components are getting the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable perfectly.I hope we can find a solution, so I can delete the credentials file.Best regards,HacorCommentShareHacoranswered a year agoMichaelDombrowski-AWS EXPERTa year agoThe logs are with or without the credential file?Please remove the credential file.SharesushantAtAWS a year agoHi Hacor,As Michael mentioned, Stream Manager should get the credentials from Token Exchange Service.To understand why Stream Manager is getting 400 (com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@6b0072bc: Bad Request (Service: null; Status Code: 400; Error Code: null; Request ID: null; Proxy: null)]), we want to get access to the greengrass logs. Can you please share the contents of greengrass.log from the same timeframe as the stream manager logs you shared.ThanksShareJoeAtAWS a year agoHi Hacor -I want to address your confusion here. STS is not used by the device. The device uses iot:AssumeRoleWithCertificate and then sts:AssumeRole gets used on the backend cloud service. So, Michael's answer below is correct and you likely have an issue with the role which your role alias points to. If you attach those logs we can better assist. ThanksShare0Did this ever get resolved?   I am trying to use StreamManager 2.1.0 with a custom component and seeing similar behavior.   I too had questions about whether I needed the .aws/credentials file versus Token Exchange Service. ThanksCommentSharettnickbanswered 8 months agoMichaelDombrowski-AWS EXPERT8 months ago@ttnickb. Please remove any credentials you have on the device. Only Token Exchange Service credentials should be used for Stream Manager.Share0Hello AllThanks for all the suggestions and advice. @ttnickb I assume all the AWS suggestions are probably right and it would have something todo with roles/permissions.On my end, I never got to solve my issue without a credentials file (only allowing Stream Manager to do things of course). And now the project moved in such a way I didn't need the Stream Manager anymore.So I kind of lost sight of this problemSo if you did find a solution, please post it here and it can certainly help others.Thanks!Kind RegardsHacorCommentShareHacoranswered 8 months ago0Hi all,After spending a bit more time on this, we did confirm that .aws/credentials file is not required.Our app is streaming to Kinesis via StreamManager using only the device cert and Token Exchange Service.The confusion was mainly due to StreamManager performing batching, so it takes a few minutes for data to start showing up in AWS...even though the logs on the device show data being appended to the stream much earlier.CommentSharettnickbanswered 8 months ago"


Question: SSL CERTIFICATE

FollowComment

Answer: "0Hello,What exactly is the question here ?This error means that the connection between the client (the user's device, such as a laptop or tablet) and the server (the website host) is not encrypted, even though the client device expected it to be encrypted.What are you using on the Client end to encrypt ?CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months ago"


Question: AWS Signature version 4 on Node.js

"Struggling with Authenticate on AWS SigV4.Any Examples to use? I could only see Python GET, POST examples.Packages found on npm didn't work at all. (aws4)FollowComment"

Answer: 0Hello!There is an example in the OpenSearch docs (scroll down): https://docs.aws.amazon.com/opensearch-service/latest/developerguide/request-signing.html#request-signing-nodeCommentSharemasseanswered 6 months agoQuestion 6 months agoThanks! I'll try that way.Share


Question: Can't launch ec2 spot instance with hibernation for instance type c5.18xlar

I'm trying to launch a spot instance with the following settings:AMI: ami-06f2f779464715dc5Instance type: c5.18xlarge (72 vCPUs and 144 GiB of memory)Storage: root EBS with 100 GiB and added an encryption keyVolume type: General Purpose SSD (gp2)As far as I can tell the above settings meet all the requirements for hibernation interruption behavior as described in https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html#hibernating-prerequisites but still I see the message: "Selected instance type does not currently support 'hibernate' interruption behavior."Changing the instance type to be c5.9xlarge (36 vCPUs and 72 GiB of memory) with the same settings does allow me to choose hibernate as interruption behavior.Any idea what is missing?Thanks.FollowComment

Answer: "0I missed the conversion between GiB to GB.The memory limit in the description is listed in GB but the instance details are in GiB.CommentShareberzonanswered 2 years ago0Hi,The prerequisites for hibernating a Spot Instance are slightly different to the prerequisites for hibernating an On-Demand Instance.For the instance RAM size:Spot Instances – must be less than 100 GBOn-Demand Instances – must be less than 150 GBThere are different pages in the EC2 User Guide that describe the hibernation prerequisites for Spot Instances and On-Demand Instances.Hibernation prerequisites for Spot Instances: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-interruptions.html#hibernate-spot-instancesHibernation prerequisites for On-Demand Instances: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html#hibernating-prerequisitesKind regards,MarilynCommentShareMarilynAWSanswered 2 years ago"


Question: Node container dns resolve fail with  getaddrinfo EAI_AGAIN in App runner

"HelloWe have a problem with the App runner service.Sometime after deployment, we get:19:32:05 0|kultr  | SequelizeConnectionError: getaddrinfo EAI_AGAIN xxxxxxxxxx.xxxxxxx.us-east-2.rds.amazonaws.com19:34:17 1|kultr  | Error: getaddrinfo EAI_AGAIN logs.us-east-2.amazonaws.comAfter a couple of redeploying this problem is gone.Following https://github.com/nodejs/docker-node/issues/1030node:12.13.0-alpine was changed to node:12.13.0-stretch butthe problem still exists.Something similar was mentioned on this topichttps://forums.aws.amazon.com/thread.jspa?threadID=346652&tstart=0Could somebody advise how we could fix this error and make the service more stable?Thank you!FollowCommentAWS-User-3070013 a year agoSeems like I got the same issue -> https://repost.aws/questions/QUAC3CfympT5SizfvCJBEFEQ#ANEgz8sZ9LTfS2oVcrlhV5ZQ . Switching from node:16-alpine to node:16-slim fixed the issue (which is what you did basically)Share"


Question: "codedeploy blue/green deployment fails on AWS, it leaves dangling instances. How do I ensure that new instances are terminated?"

"Each release creates a new autoscaling group and therefore new instances. If a release goes well, a replacement instances is created, code is deployed there and traffic is shifted over.If a release fails, however, the instances created still remain, and so if we have multiple failures, we can have a very large number of heavy instances running without reason. Is there a way we can easily clean up these instances, or prevent it altogether perhaps? Am I doing something wrong?FollowComment"

Answer: 0Could you add the AWS CodeDeploy tag to this to increase visibility for that team?CommentShareASGDudeanswered 9 months ago


Question: SQS SendMessage Timeout or failing randomly

Hello. We have a serverless application for handling email messages.I have a Node Lambda function triggered by SES that is sending a message to SQS with some information about the email in order to process it later with another lambda function. The application is already running as expected.But we are receiveing some alerts randomly about timing out on SQS SendMessage (sqs.sendMessage()) sdk call or failing with "write EPIPE"Connection timed out after 120000ms"write EPIPE {<message>}"The last message failed was a json string of about 10kb size. So should not be a problem. Also the lambda function is runnign on a VPC but its not having issues on 99% of emails received.I have no clue why this is happending so any help is greatly appreciated.ThanksFollowComment

Answer: "2What you're probably finding is that you're getting that message when the Lambda function sends a message to SQS successfully; but the next message is a few minutes later. Under the hood, the Lambda function will have been suspended (waiting  for the next message) but the TCP session between the Lambda function the SQS has timed out. This happens when the Lambda service keeps the function "warm".If your function was triggered more often then it's unlikely that you'd see this message because the Lambda suspension time would be less than the TCP session timeout.I'm not sure what runtime language you're using but it's likely that you're initialising the SQS connection at function start - instead, consider doing that right before the SQS message is sent.CommentShareEXPERTBrettski-AWSanswered 6 months agoJean Rumeau 6 months agoThanks for replying and giving some light.My function is writen for NodeJS on TS. https://gist.github.com/rumeau/936b924c8a43c4116a12fcbea7034a92/revisionsAnd though I have another function failing with similar errors, this one seems to be very simple.It consists of a SES action triggered function, wich sends the messageId and the message headers to SQS in order for a later function process the received message.I'm switching my function now in order to fix the async request to sqs and initialising the SQS connection right before sending the message to see if that fixes the issue.ThanksShareJean Rumeau 6 months agoHello. Well, unfortunately the problem persists for the EPIPE exception.Of what I see is that the exception is thrown on the following Lambda invocation. I'm attaching a screenshot of the Cloudwatch log: https://pasteboard.co/1IaCsmRwzZI3.pngAs you see, the exception on 63ecb8bd-3cb4-4f85-ac88-0ddb9fd4c9b2 is thrown once 733241e3-d1ef-4ab9-bbe8-97972b3ac050 has started and actually, after 63ecb8bd-3cb4-4f85-ac88-0ddb9fd4c9b2 has already enqueued the message without errors apparently.ShareBrettski-AWS EXPERT5 months agoBe careful with async code in Lambda functions. Once the "main" code returns in Lambda, the function will be suspended. You need to ensure that you wait for all of your async threads to come back. I know that's vague (I'm not a Javascript expert) but I've seen it happen - that's probably why you're seeing the exceptions in the following invocation because that's when the function is "woken up" again and that's when the threads continue running.Share"


Question: sam generate-event - How to set isBase64 to false?

"Hope you are doing well!I have been learning a bit on AWS and trying to test lambda locally. Currently I am trying to test the lambda by generating an event as if it comes from the API gateway.I am using the following command after building my lambda application.sam local generate-event apigateway aws-proxy --path retrievestatus --**body {"email":"abc@gmail.com"} **| sam local invoke -e - AppThe event gets generated and the lambda is invoked. However I have a small issue here. The event generated has the following -{"body": "e2VtYWlsOmJ1bHVzdXNhc2hhbmtAZ21haWwuY29tfQ==","resource": "/{proxy+}","path": "/retrievestatus","httpMethod": "POST","isBase64Encoded": true,My lambda is not really expecting a base64 encoded string. So I am looking for any suggestions to turn isBase64Encoded to false when I use SAM locally.I have tried to check the options supported by running  - "sam local generate-event apigateway aws-proxy -h" and couldn't find anything to turn it off.Appreciate any help here.FollowComment"

Answer: "1Accepted AnswerBased on the code in github, the event is always generated with base64 encoding. What I would suggest is to create the event once and modify it manually. Then use the saved event when you invoke the function using the -e parameter in sam local invoke.CommentShareEXPERTUrianswered a year agoAWS-User-401 a year agoThank you for confirmation!I have done it as per your suggestion and it works as expected.I have generated a local event and stored it in a filesam local generate-event apigateway aws-proxy --path retrievestatus --body {"email":"abc@gmail.com"} > test.jsonMade modifications in test.json to set the isbase64 flag to false and body as per my requirement.Then I used sam local invoke to accept the saved eventsam local invoke -e test.jsonThanks again and have a great day!Share"


Question: What is these IPs related  to 13.212.3.X

"In my nat VPC flow logs, I am able to see a huge transfer to 13.212.3.X serious IPs. When I checked about these IPs those are from AWS ISP itself. How do I know much more detail about this transaction is it genuine? Which service is involved in that time of the transaction?FollowComment"

Answer: "0Hello,The IP's are likely to be AWS edge network IP's or the IP's from the NAT Gateway depending on how have you set up the network & configuration. To answer it exactly, I would recommend you to open up a support case and discuss the same with an AWS engineer, however, the security of the data depends on which services are being used on your end. Are you doing these transactions over the internet or are you involving VPN/CVPN/DX ?The best bet here would be to open up a support case or discuss the same with your TAM and discuss the scenario with them.Hope this helps.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago0Have a look in the EC2 console under "Network & Security / Network Interfaces".  You should be able to find those IPs in the table's "Public IPv4 address" column which will tell you more about the resources & services involved.CommentShareEXPERTskinsmananswered 9 months ago"