Question: Limiting Which EC2 Instances a Users Can See

"Hello,I am trying to limit which EC2 instances a user can see.  My use case is that I am trying to setup a lab for a professor.  I want them to be able to see only their systems and be able to start / stop / reboot them as needed.  I am trying to limit them to their systems so they do not become confused as to what is and isn't theirs.I know this can't be done with tagging.  I saw this post https://repost.aws/questions/QUUaWdSykIREW4HYDd8T7J7Q/restricting-access-to-ec-2-instances-using-iam-policy where they are trying to do the same thing I am doing but had little to no luck.  I also know it can be done in some form or another because if you have ever used AWS Academy you know you don't see other student's instances.One suggestion I read was to create multiple AWS accounts and combine them into an organization.  While this may work it seems like I'm hitting a brass brad with a ten pound hammer.  So does anyone have any better ideas on how to do this?Thank you,TKFollowComment"

Answer: "2Accepted AnswerAs you have read, you wont be able to limit which instances are displayed in the console even with tags.  You can restrict what operations a user can perform like starting and stop;ping instances.  See https://aws.amazon.com/premiumsupport/knowledge-center/restrict-ec2-iam/Multiple accounts would be the best option to achieve what you are trying to do and you can setup a multi-account environment pretty easily with Control Tower.I dont think you can compare with AWS Academy as that seems to be a learning management system built on AWS which probably has its own mechanisms for filtering what can be seen between accounts.One other simple thing you can do is give the professors a URL that contains the filter for their EC2 instances.  For example, you can tag all of your instances with "Owner" with a value of the name of the Professor.  Then give them a URL like this:https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#Instances:v=3;tag:Owner=ProfessorNameWhere ProfessorName is their name.CommentShareEXPERTMatt-Banswered 10 months agoEXPERTBrettski-AWSreviewed 10 months ago0I had a similar request from a question from a customer a while back; what I suggested is that they build a self-service portal for their users - that way they could precisely control the visibility and the actions that could be performed. But it's more work for you to do this.In this particular case, my customer took some code I wrote as part of this blog post and modified the Workspaces component to control EC2 instead.That said (and to repeat): It's work that you have to do. I think that Matt-B's answer is better here because you're relying on native AWS constructs so you're not maintaining anything going forward.CommentShareEXPERTBrettski-AWSanswered 10 months ago0Thank you both for such quick replies.  I was hoping I had missed an easy solution but it looks like that is not the case.  I like Matt-B's idea of providing a like that is filtered.  It is not a perfect solution but should work.I find it amazing that AWS does not provide someway to limit what users can see based on tagging or some other method as it seems I am not the only one trying to do something like this.  Again thank you both for your help.CommentShareTKanswered 10 months ago"


Question: Faster failover time

"I have an app deployed across two regions;Route53 ----> ALB (Region 1) ----> ECS services        \---> ALB (Region 2) ----> ECS services I setup Route 53 with Traffic Flow using the Latency policy so incoming requests are sent to the region with lowest latency. It works.If one of my region loses connection, traffic is automatically redirected to the surviving region. However, it takes a few minutes for this to happen and my users are getting 503 in the meantime. Is there anything I can do to make the failover faster?FollowComment"

Answer: "1Accepted AnswerHi,You can create a Route 53 health check for each region to validate application health, and configure the request interval and failure threshold according to your use case requirements.In case of failure, Route53 will remove this record from the routing, while still resolving the DNS lookup using your latency based policy.CommentShareMikel Del Tioanswered a month agoCode Different a month agoThanks. This improves the response time somewhat. I still get 503 for a minute when one region is down. Is there a way to re-architect my application so that detect which regions are responding and only then direct the traffic to them according to latency?ShareMikel Del Tio a month agoWhat TTL have you configured for the Route53 record? In order to respond quickly to changes in health status, AWS recommends to specify a TTL of 60 seconds or less when a health check is associated to a latency record. Given your use case requirements, you could reduce this value and combine with a retry policy at the client side.ShareCode Different a month agoThanks. I set the TTL to 60 seconds in the Traffic Flow and it's failing over faster now.Share"


Question: InputColumns error: Allowed types for S3 physical table are [String]

"I am creating a DataSet from a CSV in QuickSight using the javascript SDK. Some of the columns are of string type, and others are integer. When using InputColumns in createDataSet, an error is thrown saying the only allowed types are string. When changing all types to string, the creation works. The documentation says "INTEGER" is an allowed type ( https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/QuickSight.html#createDataSet-property ), Can anyone help? I have attached the relevant code segment, an  example csv and the error it throws when ran on the example dataset. The sdk version is 2.927.0.Code:PhysicalTableMap: {[this.config.dataSourceId]: {S3Source: {DataSourceArn: arn,InputColumns: [{Name: "ID",Type: "INTEGER"}, {Name: "Name",Type: "STRING"}, {Name: "COUNT",Type: "INTEGER"}],}}Here is an example csv file which throws the error:"ID","NAME","COUNT"3435458,"JOHN",100342345352,"JACK",23014The error:InvalidParameterValueException: Input column ID in physical table example has invalid type. Allowed types for S3 physical table are [String]at Object.extractError (/project/node_modules/aws-sdk/lib/protocol/json.js:52:27)at Request.extractError (/project/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)at Request.callListeners (/project/node_modules/aws-sdk/lib/sequential_executor.js:106:20)at Request.emit (/project/node_modules/aws-sdk/lib/sequential_executor.js:78:10)at Request.emit (/project/node_modules/aws-sdk/lib/request.js:688:14)at Request.transition (/project/node_modules/aws-sdk/lib/request.js:22:10)at AcceptorStateMachine.runTo (/project/node_modules/aws-sdk/lib/state_machine.js:14:12)at /project/node_modules/aws-sdk/lib/state_machine.js:26:10at Request.<anonymous> (/project/node_modules/aws-sdk/lib/request.js:38:9)at Request.<anonymous> (/project/node_modules/aws-sdk/lib/request.js:690:12)Thanks for the help.Edited by: tstannett on Jun 14, 2021 7:49 AMFollowComment"

Answer: "0Fix:Create set of integer columns.During createDataSet force all columns in InputColumn parameter to STRING, and use a LogicalTableMap in the function call as follows:LogicalTableMap: {[demo-logical]: {Alias: "Test",Source: {PhysicalTableId: demo-physical},DataTransforms: Array.from(integerColumns, (c) => ({CastColumnTypeOperation: {ColumnName: c, /** required /NewColumnType: "INTEGER", / required **/}}))}},CommentSharetstannettanswered 2 years ago"


Question: Cannot access EC2 thru remote desktop.  Internal Error.

"I have an windows EC2 instance.   Today, I was not able to remote into it anymore.EC2 instance is running (status checks shows 2/2) and remote desktop brings up the login prompt.  But after entering the password, I get "Unknown Error". I tried remoting from another computer and got the same behavior.  Tried restarting EC2, Stop + start EC2 and could not get past "Unknown Error" thrown by remote desktop.If i DONT associate an elastic IP address, then remote desktop works and does not throw "Unknown Error".   Any one ran into this ?  Appreciate if you are able to share your experience on how this was resolved.Edited by: zebra on Oct 21, 2020 4:30 PMFollowComment"

Answer: 0Day 2 this resolved without any action.  I am guessing something on AWS platform was causing this yesterday.  Hopefully issue does not come back.CommentSharezebraanswered 3 years ago


Question: Cpu/Memory Low Cloud Watch Alarm for always in alarm state

"Hi,I have configured step scaling policies  for my ECS Service . The cpu & memory utilization always remain under utilization as we are not release  yet. I want the "scale in " cloud watch alarm to go in OK state if the desired number of ECS service is met . How to stop   "scale in "  the cloud watch alarm from staying in an "ALARM" state even though the desired number of instances in the auto scaling group has been met.FollowComment"

Answer: "0Hi, the alarm's state in CloudWatch only reacts to the metric's value - if the metric is breaching the threshold, the alarm stays in ALARM, even if the scaling group doesn't need to take any new action. There is no option to force the alarm in OK state if the metric keeps breaching the threshold.Are you concerned that seeing the alarm in ALARM state is giving you a false positive, because the scaling group has reached the configuration you wanted? Do you know you can hide the autoscaling alarms from the alarms list if you don't see value in listing them? I understand this is not your ask, just wanted to share this in case it would help you get a better view of your alarms.CommentShareJscanswered 4 months agorePost-User-4597206 4 months agoHi @Jsc Thanks for the reply,Are you concerned that seeing the alarm in ALARM state is giving you a false positive, because the scaling group has reached the configuration you wanted? Yes.I am not sure about hiding the auto scaling alarm from alarms list.Share"


Question: Strange CloudFront edge server selection for requests from Austria

"Hello,we noticed that customers from Austria (e.g. from IP range 213.47.160.0/19, which is Magenta) are no longer hitting the CloudFront edge servers in Vienna (VIE50-C1 and VIE50-C2) but now they hit the server in Berlin (TXL52-C1), which is rather strange because the server in Berlin is not the closest one and ping tests also confirm that latencies are now worse than before.Before, the RTT was about 14ms for VIE50-C1/2 and it has now increased to ~35ms for TXL52-C1.I don't see any problems mentioned at https://status.aws.amazon.com/#EU_blockWould be great if someone from AWS could investigate this. Thanks in advance!Best regardsClemensFollowComment"

Answer: "0Now, users from aforementioned IP range (all based in Austria) are routed to the edge location in Budapest (BUD50-C1) which is closer than Berlin but still not as close as Vienna.Can someone from AWS please look into why the VIE50-C1/2 edge locations are not used for requests from 213.47.160.0/19 even though it would be closer and have less latency?@ShwethaM-AWS@ruhisarAtAWS@Callum-AWSCommentShareClemensanswered 2 years ago"


Question: Can you make action execution for rulesets conditional?

"Hello,So I have a fairly simple email forwarder using the standard S3/Lambda way with python.I want to achieve that messages that eg. fail some condition in the Lambda script are bounced with ses actions.Currently these messages are just silently dropped.So I was wondering if I could just add a bounce action after the Lambda action that only gets executed is something is wrong.So when lambda thinks everything is alright it just stops the execution of the ruleset after the lambda action and when something is wrongit simply lets the ruleset continue to the bounce action?Is something like that at all possible or not? I do have some execution infos through the context object, can that be somehow used for this?Thanks for any ideasFollowComment"

Answer: 0well looks like i should read the doc properly :Dseems like exactly what i need can be achieved by synchronous RequestResponse invokation with the disposition propertyCommentSharejschulzanswered 2 years ago


Question: Unexpected error creating notebook job in Sagemaker

"I have a SageMaker notebook that I want to run as a notebook job (it takes a long time). Every time I try to Create Notebook Job...Create, I get "Unexpected error occurred during creation of job." Things I've tried:Making the IAM revisions suggested at https://docs.aws.amazon.com/sagemaker/latest/dg/scheduled-notebook-policies.html, including the "Add additional IAM permissions" inline policy, even though I'm using the Studio execution role.Removing all special characters from the job name.Trying different compute types, including one I know works for interactively running my notebook.Moving the notebook to my root user directory.Removing all special characters from the notebook filename.Adding a parameter, even though I don't need any parameters.Running on a schedule vs. running now.Confirming that the referenced S3 buckets in the advanced settings are there (they were auto-created).Trying a different notebook.Refreshing, closing and re-opening.Looking in the CloudWatch logs. I found "[E 2022-12-16 23:30:13.770 SchedulerApp] [Errno 2] No such file or directory: '/home/sagemaker-user/abc/abc/abc/abc/src/notebook.ipynb'" where the actual path includes only two "abc"s, not four. If I move the notebook file to the root directory, then the error has two "abc"s, still, and fails again because it's missing the "src".In the end, I couldn't get it to stop prepending "abc/abc/" to the path, so I had to:Create a "/src/notebook.ipynb" file off the root.Select to create a job to run that.Observe that it actually runs /abc/abc/src/notebook.ipynb, even though the UI claims it will be running /src/notebook.ipynb.This all seems completely insane, and I'm hoping there's some way to resolve this?Thanks,ChrisFollowCommentChristopher Robert 6 months agoI've tried to imagine how the abc/abc prefix could have come to be. My current directly, when I first tried to launch a job, was abc/abc/src, but the src part isn't included in the sticky prefix. That is the Git root, however: when I initially cloned from GitHub, I manually created an abc directory and then cloned the abc repo into there, which created another abc directory. So perhaps it's for some reason using the Git root as the user root, and then adding the path from there?Share"


Question: Is it safe to rely on versions ordering in ListObjectVersions response?

I have tried calling ListObjectVersions  several times and it looks like versions are always sorted from newest to oldest.Is it safe to rely on the assumption that ListObjectVersions will always return all object versions and versions will be sorted from newest to oldest?FollowComment

Answer: "0Accepted AnswerHello,The second example in the documentation states that objects are returned in the order they are stored:https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html#API_ListObjectVersions_ExamplesRegards,JonCommentShareEXPERTJonathan_Danswered 3 months ago"


Question: Trying to find security group rule ID matching filters using CLI; "describe-security-groups" versus "describe-security-group-rules"

"Using CLI version 2.11.20.  I'm trying to find the security group rule ID (sgr-XXXX) in order to form up the ARN required as a parameter in subsequent commands.The "describe-security-groups" subcommand is almost perfect for this, as it lets me give precisely the filters that narrow down the results.  A pseudocode example with all real numbers replaced with cultural references:aws ec2 describe-security-groups --filters \    'Name=group-id,Values=sg-8675309'   \    'Name="egress.ip-permission.protocol",Values="-1"'    \    'Name="egress.ip-permission.cidr",Values="a.b.c.d/n"' ...{  "SecurityGroups": [    {      "Description": "....",      "GroupName": "....",      "IpPermissions": [        {          "IpProtocol": ....,          "IpRanges": ....,        },        {          "IpProtocol": ....,          "IpRanges": ....,        },      ],      "OwnerId": "24601",      "GroupId": "sg-8675309",      "IpPermissionsEgress": [        ....      ],      "VpcId": "vpc-12345"    }  ]}Unfortunately, the individual rules ("IpProtocol", "IpRanges", etc) don't include the relatively new SecurityGroupRuleId field for a given rule.  So I have no way of identifying a rule once the --filters have narrowed it down, and nothing to extract with --query.In comes the "describe-security-group-rules" subcommand.  This has excellent output from a query:{  "SecurityGroupRules": [    {      "SecurityGroupRuleId": "sgr-2216862",      "GroupId": "sg-8675309",      "GroupOwnerId": "24601",      "IpProtocol": "-1",      "CidrIpv4": "a.b.c.d/n",      ... all the other rule parameters ...    }, { ... }, { ... }  ]}including the all-important sgr- ID code.  (Example here is the asteroid number where the Scopuli was hidden in the first book/season of The Expanse.)However, the supported --filters list for "describe-security-group-rules" is... anemic.  We can filter on the security group ID obviously, the security group rule ID (that's what I'm trying to find out), and... the tags.  That's it.I'm trying to think of a way of programmatically narrowing down and extracting the security group rule IDs, given that the most capable filtering command (describe-security-groups) has no support for rule IDs, and the most specific command (describe-security-group-rules) has minimal capabilities.  Right now I'm thinking to give a describe-security-group-rules command filtering on the security group ID (which I'll have available), then pipe the JSON into an annoyingly complicated jq command to do the same kind of filtering that I would have done in aws ec2 describe-security-groups --filters ....  My limiting factor with this solution is that trying to do filters/queries using jq is an exercise in coredumps and useless error messages.FollowComment"

Answer: "0Would something like this work?aws ec2 describe-security-group-rules \    --filter Name="group-id",Values="sg-1234567890abdcef" \    --output text \    --query "SecurityGroupRules[?IsEgress==\`true\` && IpProtocol==\`-1\` && CidrIpv4==\`a.b.c.d/n\`].SecurityGroupRuleId"CommentShareEXPERTkentradanswered 11 days agorePostReReadReTry 4 days agoI think your idea is right, but the "?" query fails to match anything as soon as I start introducing boolean operators like "&&".  Played around with syntax trying to group in parenthetical expressions and similar, but made zero progress.  But at least the output from "--query 'SecurityGroupRules'" is in a format that we can work with, so we're not blocked.  Cheers!Share"


Question: Regions for Rekognition Video Streaming

"Using the Rekognition service with everything based in the ap-southeast-2(Sydney) region, and just discovered that the Video Streaming component may be the only component I can't access with this region.There's an article discussing that it's being rolled out to more regions. Is there a timeframe for this?https://aws.amazon.com/blogs/machine-learning/amazon-rekognition-introduces-streaming-video-events-to-provide-real-time-alerts-on-live-video-streams/FollowComment"

Answer: "1Hi!Newer services tend to take a while to launch across different regions.As there is no official statement on the timeframe for RVS to launch in Sydney, I would advise you to contact your AWS account team or representative to discuss roadmap of the service! :)CommentShareDani Manswered a year ago"


Question: Server process run through command do not persist in my Amazon Lightsail Instance

"I created an Amazon Lightsail Instance of 512MB RAM,I have got all my production server files installed on my Amazon Lightsail Instance. Then I connected to the instance via SSH.Then I ran my database command in the background via the browser SSH window:mongod --dbpath=data &Then I ran my server command in the background:next start -H <private_ip> -p <port>Then I closed the browser ssh window. Then, after some time I found that the server was not able to be reached via the url.It was working when I had the ssh window open.I opened the ssh window again, and did ps to see if the processes were still running. I found that both the database process and the server process were closed.I want them to persist forever, i.e. the processes shouldn't close because I want to use my website at any time right.FollowComment"

Answer: "1Try this, after you start the process:ctrl+ zbgdisown -h or disown -aBasically running the process as background.There are options tmux, nohup, screen, byobu.PS: I am a beginner and I got this info after a bit of googling. I hope it helps. Please ignore if it doesn't or if you know this alreadyCommentShareSandeepVudataanswered a year agoAhmed Zaheer Dadarkar a year agoWill try it out thanks !ShareDavid G a year agoAlternatively, use "&" to disconnect the process from the login session.'nohup yourprocess &'Share"


Question: Greengrass group deployment

"Hi everyone, I am new to aws greengrass and still trying to learn the ropes around how it works.Is it possible to update a lambda function to a newer version/alias without redeploying the whole Greengrass group? From the documentation it seems as though redeploying the whole group is the only way to do it. If not, can someone explain why? The reason for asking this is because I am curious to see if I can send a small update (Like making a small change in the lambda function) from the IOT core without stopping the Greengrass core.Also, I would greatly appreciate any resources to understand AWS IOT Greengrass better. I read the documentation and some courses, but if you have any other suggestions I would love the advice?Edited by: rakibkamal on Nov 30, 2020 11:38 AMFollowComment"

Answer: "0Did some more research, and I don't think there is a straightforward way to alter a lambda function to a newer version without redeploying the whole group. The ObjectDefinition objects will be slightly different if a lambda function is updated to a newer version, so re-deploying the whole group is necessary.CommentSharerakibkamalanswered 3 years ago"


Question: isp blocked ip 168.197.12.0/22

"esteemed,I am facing a problem and would like some support from cloudfront, my internet provider asn 265463 with block of 168.197.12.0/22 cannot access the following domains that are hosted on cloudfront, https://www.kabum.com.br/ and https://www.tse.jus.br/ And I get the following response: Request blocked. What can I do to get unlocked?FollowComment"

Answer: "0Browsing to "https://www.tse.jus.br/" seems to be working fine.Browsing to "https://www.kabum.com.br/" returns a 403 http error cod, due to a WAF WEB Access Control List.If you are browsing to the above mentioned domains from the IP address 168.197.12.0/22 and you are getting a "Request blocked" message, then you might want to check this WAF ACL to make sure that it is not blocking this IP. Otherwise, if the WAF ACL is allowing this IP, you will need to get in touch with your ISP to figure out why it is blocking requests from getting out through this mentioned IP.Thanks!CommentShareMo Salahanswered a year ago"


Question: Is there a way to add 3rd party MX/SPF records while using AWS's custom DNS?

"ISSUE:Our domain name (Namecheap) is currently on custom DNS (AWS) and we are trying to use another email service provider which requires adding MX/SPF records. However, I can't control it with Namecheap because it's already on custom DNS (AWS)Is there a way I can add the MX/SPF records while using AWS's custom DNS? Does AWS allow 3rd party provider's MX/SPF records to be added?FollowComment"

Answer: "0Using Route 53 (the AWS DNS service) you can add custom records to the domain(s) that you are hosting. So yes, you can certainly add MX/SPF records to your DNS that point to other providers.Visit the Route 53 console to get started.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: using Oracle RDS 12.2 database as a GoldenGate REPLICAT target

"Has anyone had experience or encountered problems with using Oracle RDS 12.2 database as a GoldenGate REPLICAT target?While configuring the GoldenGate user on the target system, I am unable to complete the user privileges setup with DBMS_GOLDENGATE_AUTH.GRANT_ADMIN_PRIVILEGE.Executed as the database master account user:SQL> begin 2 DBMS_GOLDENGATE_AUTH.GRANT_ADMIN_PRIVILEGE (grantee=>'OGGADM',privilege_type=>'apply', grant_select_privileges=>true, do_grants=>TRUE); 3 end ; 4 / begin * ERROR at line 1: ORA-01031: insufficient privileges ORA-06512: at "SYS.DBMS_XSTREAM_AUTH_IVK", line 3666 ORA-06512: at "SYS.DBMS_XSTREAM_AUTH_IVK", line 93 ORA-06512: at "SYS.DBMS_XSTREAM_AUTH_IVK", line 84 ORA-06512: at "SYS.DBMS_XSTREAM_AUTH_IVK", line 123 ORA-06512: at "SYS.DBMS_XSTREAM_AUTH_IVK", line 3649 ORA-06512: at "SYS.DBMS_GOLDENGATE_AUTH", line 49 ORA-06512: at line 2 SQL> select version from v$instance ; VERSION ----------------- 12.2.0.1.0 SQL> This completes successfully in AWS RDS 12.1.FollowComment"

Answer: "0known issue in Oracle 12.2 prior to the April 2019 releaseuse engine version 12.2.0.1.ru-2019-04.rur-2019-09-04.r1replace DBMS_GOLDENGATE_AUTH with RDSADMIN.RDSADMIN_DBMS_GOLDENGATE_AUTH (with same arguments as DBMS_GOLDENGATE_AUTH) SQL> BEGIN RDSADMIN.RDSADMIN_DBMS_GOLDENGATE_AUTH.GRANT_ADMIN_PRIVILEGE (grantee=>'OGGADM',grant_select_privileges=>true, do_grants=>TRUE); end ; 2  /PL/SQL procedure successfully completed.CommentShareswellsanswered 4 years ago"


Question: Duration of outage for changing RDS storage type from io1 to gp2

"Hi people,I would like to know how much time it would take to change the RDS storage type from io1(Provisioned IOPS) to GP2(General purpose SSD). Storage volume is 1TB.Another question is: According to this documentation: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html there will be brief outage for carrying out this change. I'm assuming it's going to be few minutes(~10 min). Just want someone to confirm before I proceed.Thanks.Edited by: Srikanth9 on Feb 26, 2020 11:13 PMEdited by: Srikanth9 on Feb 26, 2020 11:26 PMFollowComment"

Answer: "1See Phil@AWS' reply at https://forums.aws.amazon.com/thread.jspa?messageID=900730&#900730TTSo a big part of answering your question would be if it is a legacy volume or not. For legacy volumes the data is copied by software running in your instance in the background while you continue to use the instance. So this operation is highly variable as it competes with whatever application I/O is going on, limits on your io1 (provisioned) or gp2 (baseline) IOPS and throughput, instance type characteristics, etc. Modern volumes use the EBS Elastic Volume capabilities to make the change, so from an instance-level perspective the switch occurs in a few minutes independent of volume size. The new volume in the new storage type will be in the modern geometry.When a brief pause is mentioned I believe it means seconds not minutes. The pause is only required in certain circumstances.CommentShareHalTempanswered 3 years ago0Thanks HalTemp.CommentShareSrikanth9answered 3 years ago"


Question: Session cookies between apps CloudFomration to CloudFront

"Hello, I'm new using AWS and don't have much experience with session cookies. I've built a web app using the Remix grunge-stack and deployed it to CloudFormation. The app sets the session cookie on user login and register. The web app itself is then embedded into an Iframe inside a different widget wrapper app same style they do at https://www.intercom.com/. The widget wrapper itself is then hosted inside an S3 bucket as a static bundled JavaScript file and distributed via CloudFront to be embedded on any website. All this works except for the session Cookie being passed between the apps. The session Cookie is created through the web-app when tested as a stand alone, however, it is not set when interacting through the CloudFront widget. I've tried playing around with the CORS permissions and stuff but I've had no luck. Is what I'm trying to achieve possible and if so what am I missing? Any help would be greatly appreciated, Thanks!FollowComment"

Answer: "0CloudFront is likely not passing your session cookie through to your web app. In your CloudFront origin request policy, make sure to add your cookie name to the list of cookies that are forwarded to the origin.Take a look at the article below, specifically the section on cookies.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.htmlCommentShareJeremyAWSanswered 4 months ago"


Question: error message when loading data: GENERIC_INTERNAL_ERROR: No enum constant org.apache.parquet.schema.OriginalType.2a

"Hi,I'm trying to load data from s3 to s3 in my current work. The source data has all fields in string data format whereas the destination has the right field formats (decimal, date etc). I can run the select command in the source data (with all the transformations) but when I put insert into statement to load data to another schema I get the error message: GENERIC_INTERNAL_ERROR: No enum constant org.apache.parquet.schema.OriginalType.2aIt doesn't give any specific information like what field is causing this issue. The same insert statement seem to work for all other tables except for just one. Please advise and let me know if any more clarifications is required.FollowComment"

Answer: 0The generic error you are receiving (GENERIC_INTERNAL_ERROR: No enum constant org.apache.parquet.schema.OriginalType.2a) is not accurately traceable without context of the data in the file you are processing and  the specific transforms that are being applied.Please check that the entire dataset you are transforming to parquet is actually convertible to the destination column type.You could manually check the source file or you could try using the type casting functionality in Athena to convert columns to a specific type to see that it is valid.CommentShareDarronDanswered 9 months ago


Question: WorkSpace and IIS Windows Authentication

"Hi all,We're in the process of implementing our Client based software on AWS WorkSpace.Our software configuration is pretty simple, one Application server and several Clients that connect to it using TCP protocol.I've used 2 separate WorkSpaces, one for the Application Server (that also has IIS installed via Windows Features), and one WorkSpace with our Client. We're also using simple AD (Amazon quick setup simple AD).After installing all the components and making sure that everything is working with internal users I've tried to use our Active Directory authentication option - I've added the Windows Authentication option under the IIS feature and verified that the Windows Authentication Providers under our realm is configured for Negotiate and NTLM (Negotiate first). Then I've tried to run a connection test to the application pool and I've got the followin message:"Application Server path is invalidThe HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'."After spending two days on google to try to figure out what the issue is I've tried to replace the Application Server hostname with the IP and then the Application Server test worked ok - but now we're facing different errors on our software login side.I've asked our R&D how the Application Server authentication worked and they told me that the software uses WindowsIdentity.GetCurrent().Name to get the username and the password field equals "not relevant".Since the AD authentication works perfectly well outside AWS, I'm trying to understand what's different on AWS regarding AD authentication.Any assistance will be highly appreciated as I'm getting frustrated over here.Thanks and stay safe.Edited by: lirant on Mar 4, 2021 2:55 AMFollowComment"

Answer: 0It seems that the issue was with the wrong Windows Credentials username UNC mappingCommentShareASIDevOpsanswered 2 years ago


Question: Roadmap of upgrading to active mq Artemis

As active mq classic will not be supported by upcoming spring boot 3. Any plan to support Artemis in MQ in near future?FollowComment

Answer: "1Hello,Tim here from Support Engineering. Currently I have no information regarding the roadmap for supporting Artemis in MQ unfortunately.Keep your eyes on this link https://aws.amazon.com/blogs/compute/category/messaging/amazon-mq/ should we release any news on new features or use cases.If you have a specific use case for using Spring Boot 3 with Artemis in MQ feel free to let me know, we'd love to hear more about it and I can share it with my team.CommentShareSUPPORT ENGINEERTim_Panswered a year ago1We continue to monitor adoption of Artemis in the industry. At this time we have no firm plans to add support for Artemis.CommentShareTrevor_Danswered a year ago"


Question: Automate Start or Stop of SAP HANA systems Ec2 instance  running on hybrid platform

"Hi,I want to Automate Start or Stop of SAP HANA Systems running on hybrid platform .SAP HANA System running  on Linux platformSAP APP and SCS are running  on windows platform.To perform start and stop operation of SAP Application and ec2 instance running on hybrid platform , Do you have any document and framework could be used for automation using SSM ?FollowComment"

Answer: 1Instructions are provided in the blog. https://aws.amazon.com/blogs/awsforsap/automate-start-or-stop-of-distributed-sap-hana-systems-using-aws-systems-manager/CommentShareDeep_Kanswered a year ago


Question: MWAA Private Airflow UI Web server can't be accessed through ALB

"I trying to setup an MWAA environment inside of a private subnet and using an internal ALB to allow users to access the VPC endpoint that is tied to the web server IP addresses in the environment's subnets.But, the MWAA UI through the console link can't be reached. And when accessing that I am sent sent to a page that says The site can't be reached and the URL has a syntax similar to (MWAA WEB TOKEN is created)https://####-vpce.c71.us-east-1.airflow.amazonaws.com/aws_mwaa/aws-console-sso?login=true<MWAA_WEB_TOKEN>If I replace the beginning of the URL with below I am able to get to the proper MWAA webpage.https://<INTERNAL_ALB_A_RECORD>/aws_mwaa/aws-console-sso?login=true<MWAA_WEB_TOKEN>I am not sure exactly where the issue is but it seems to be that I am not being re-directed to where I need to go.FollowComment"

Answer: 0From error message it looks like Private DNS name for Airflow UI is not resolvable  ...If you are using custom name server Please make sure Private DNS name (####-vpce.c71.us-east-1.airflow.amazonaws.com) is resolvable from custom name server.If above is not a case  then please create a support case with environment details and your detail use-case that helps us to provide more environment and network information for further troubleshooting.CommentShareSUPPORT ENGINEERSiddhika_Uanswered 2 months ago


Question: Cloud Shell cannot create environment

I just got AWS and I'm trying as my root user and created user with admin and Cloud shell privileges.FollowComment

Answer: "0Few things to check for such issue -Time Synchronization: Make sure Your machine time is accurate. It means its correct based on world time. did you try from another machine to see if its working there? may be any time sync related issue?Check in different regions..check AWSCloudShellFullAccess policy to ensure it has below JSON data.{"Version": "2012-10-17","Statement": [{"Action": ["cloudshell:"],"Effect": "Allow","Resource": ""}]}Check in different browser to see if it works in different browser or not. https://docs.aws.amazon.com/cloudshell/latest/userguide/troubleshooting.htmlDid you deleted cloudshell home directory or something? Try after resetting home directory. But it can DELETE all your data exists in home directory. https://docs.aws.amazon.com/cloudshell/latest/userguide/vm-specs.html#deleting-home-directorycheck if any DENY policy created for it. remove that.It is possible your account is not 100% verified. Try this: Create a CloudFront distribution if you get the below error it confirms your account is unverified or if you can create 2 distributions and can't create the 3rd one.CommentSharerePost-User-0720851answered 5 months ago0Did the the list this is not the fix. I won't create a distribution as I don't know what I am doing.CommentShareNeighborhoodHeroanswered 5 months ago0The possible reason is  user permission inappropriate. It is recommended that you first create an Admin level user from IAM console whom policy is "AdministratorAccess", and then log in with this user to start the cloudshell on the console.CommentSharerePost-User-0782469answered 5 months ago0I did it as Root userCommentShareNeighborhoodHeroanswered 5 months ago"


Question: Alarms failed to execute action - Empty error message

"Having issues with triggering scaling events, I've tried couple different ways to create the alarms and scaling policies, but none work. The "Received error" is empty, I'm guessing it's just hidden from me. How can I get help with this?Failed to execute action arn:aws:autoscaling:us-west-2:784417831348:scalingPolicy:fab38292-1d9f-4659-82f7-64e8f72e1fbb:resource/ecs/service/development-cluster/development-service:policyName/AggregatorScaleOutPolicy. Received error: ""I've used both cloudformation and the point and click interface to try to make the ECS Fargate cluster scale but always same result... I need help.FollowComment"

Answer: "0I ended up applying a autoscaling rule via CloudFormation, to test I just made the thresholds very small (I tested scaling on both memory and CPU). Once I did that I saw the scaling event where Fargate scaled up the number of containers I needed. I'm sure no one at AWS could have helped me... Thanks for all the replies and help AWS...CommentSharemrn55answered 3 years ago"


Question: Beanstalk platform updates remove the instances from their load balancer target groups

"Hello,We just transformed a system into a multi-tenancy one and we encountered an issue with Beanstalks automatic updates.There is one backend per tenant hosted in Beanstalk. We have a shared load balancer that uses one target group per instance to forward their traffic there based on custom ports.Everything worked fine until a platform update was applied to all Beanstalk instances, it removed all targets from the target groups and thus no instance was available after that. The targets had to be manually added back to each target group.This is not a sustainable solution in the long-term. I could set the Beanstalks update window on Sunday and then have a Lambda function verify that the target groups are not empty after it and populate them again if needed but I'd rather avoid using some custom logic here.Would there be a way to make the target groups always include these Beanstalk instances even after their platform updates?FollowComment"

Answer: "1Accepted AnswerIt sounds like the issue you are experiencing is due to the platform update process in Elastic Beanstalk creating new instances and then removing the old instances from the target group.To avoid this problem, you can create a custom target group for your Elastic Beanstalk instances that will not be impacted by platform updates. You can do this by following these steps:Create a new target group in the EC2 console.Configure the new target group to include the port(s) that your Elastic Beanstalk instances are listening on.Update your Elastic Beanstalk environment to use the new target group instead of the default target group.Add the new target group to your shared load balancer.By creating a custom target group, you can ensure that your Elastic Beanstalk instances are always included in the target group, even after platform updates. When a platform update creates new instances, they will automatically be added to the custom target group, while the old instances will remain in the group.Note that when you create a custom target group, you will need to update your Elastic Beanstalk environment to use it instead of the default target group. This can be done using the Elastic Beanstalk console or the AWS CLI.CommentShareAWS_Guyanswered 3 months agoXavier 3 months agoThanks, that seems to be exactly what I need here!I didn't know I could change a Beanstalk target group like this. I'll take care of it as soon as I have some time.Share"


Question: cuDNN error ml.g5.24xlarge

"I'm training a machine learning model on ml.g5.24xlarge:The following code:device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')model = Seq2Seq(encoder, decoder, device).to(device)when run through the model training code:model.train()for epoch in range(10):epoch_loss = 0for context_batch, question_batch, answer_batch in train_loader:padded_contexts = pad_sequences(context_batch, max_seq_len).to(device)padded_questions = pad_sequences(question_batch, max_seq_len).to(device)padded_answers = pad_sequences(answer_batch, max_seq_len).to(device)optimizer.zero_grad()output = model(padded_contexts, padded_questions)output_dim = output.shape[-1]output = output[:, 1:, :].reshape(-1, output_dim)padded_answers = padded_answers[:, 1:].reshape(-1)loss = criterion(output, padded_answers)loss.backward()optimizer.step()epoch_loss += loss.item()print(f'Epoch {epoch+1} loss: {epoch_loss/len(train_loader):.4f}')returns the dreading following error:/opt/conda/conda-bld/pytorch_1670525539683/work/aten/src/ATen/native/cuda/Loss.cu:242: nll_loss_forward_reduce_cuda_kernel_2d: block: [0,0,0], thread: [1,0,0] Assertion t >= 0 && t < n_classes failed.RuntimeError: cuDNN error: CUDNN_STATUS_INTERNAL_ERRORI'm running I'm running the conda_pytorch_p39 enviroment on Jupyter labAny ideas welcome!Thanks :)FollowCommentDurga_S 22 days agoThis error usually occurs if you have a value that's not in the range (0, n_classes) in your dataset. Can you re-check your data?Also, for future, you can use code blocks (on the GUI or start with ``` to use markdown) for posting code, for improved readability :)Share"


Question: Auth0 with amazon managed grafana

"I want to enable users to log in to a amazon managed grafana (AMG) workspace using an external SAML 2.0 Identity Provider, Auth0.  I would like to know if that is possible and if, yes, how can I do it.FollowComment"

Answer: "0AMG integrates with AWS IAM Identify Center (succcessor to AWS SSO) to provide identity federation. Please refers to AMG documentation at https://docs.aws.amazon.com/grafana/latest/userguide/authentication-in-AMG-SSO.htmlAWS SSO (AWS IAM Identify Center) can integrate with Auth0, for details please refers to https://auth0.com/docs/customize/integrations/aws/configure-amazon-web-services-for-sso.i.e. you will have to enable AWS IAM Identity Center support for AMG. And configure the integration with Auth0.CommentShareronald_lanswered 9 months ago0See my answer here: https://repost.aws/questions/QUAh6M10JLTgqg7V34sp6nZQ/direct-saml-to-managed-grafana-from-auth0-issueI am able to get Auth0 to work where the login flow is "Sign in with SAML" from AMG screen which redirects to Auht0I am however trying to get it to work without the need to start from AMG screen and just use Auth0, it seems to be missing UID in RelayState when I try that flow.  Will update when I get it solved.CommentSharerePost-User-4445203answered 24 days ago-1Amazon Managed Grafana now supports direct Security Assertion Markup Language (SAML) 2.0 integration, without the need to go through AWS Identity and Access Management (AWS IAM) or AWS Single Sign-On (AWS SSO). SAML authentication support enables you to use your existing identity provider to offer single sign-on for logging into the Grafana console of your Amazon Managed Grafana workspaces, manage access control, search your data, and build visualizations.Following are the steps to configure the Amazon Managed Grafana application on your IdP portal. Choose the section that refers to your IdP for detailed steps.Azure ADCyberArkOneLoginOktaPing IdentityI don't believe Auth0 is in the supported list as of yet.Link- https://aws.amazon.com/blogs/mt/amazon-managed-grafana-supports-direct-saml-integration-with-identity-providers/ -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoopensciencear 9 months agoThanks for the answer. I read that before asking. My question is about Auth0, which supports SAML 2.0. I just need some help from you to set up AMG with Auth0 PleaseShare"


Question: AWS Device Farm Appium 1.22.0 iOS 15 support for Appium python test?

Unable to start Appium server when selecting Appium 1.22.0 in testspec.yml for Appium python testserror :appium server never started in 60 seconds. ExitingFollowComment

Answer: "0Accepted AnswerDid you update the version of node first?  Try adding this to your test spec file before changing the appium version      - export NVM_DIR=$HOME/.nvm      - . $NVM_DIR/nvm.sh      - nvm install --ltsCommentShareAWS-User-9196591answered a year agoAkshay Khanore a year agoThanks it solved the Appium server not starting issuebut now iam getting Error code 65 No application is open error on iOS 15 devices(iOS 14 works fine), iam trying solutions but let me know if you have any solutions for it, Thank youShareAWS-User-9196591 a year agoPlease share the part of your code where you start appium driver.  Are you ensuring not to set desired capabilities when you run in device farm?ShareAkshay Khanore a year agohere is code where i start appium driver, Note : with this settings iOS 14 works as expected but iOS 15 does notyml file :version: 0.1install:commands:- cd $DEVICEFARM_TEST_PACKAGE_PATH- . bin/activate- export NVM_DIR=$HOME/.nvm- . $NVM_DIR/nvm.sh- nvm ls-remote- nvm install --lts- pip install --upgrade pip- pip install -r requirements.txt- export APPIUM_VERSION=1.22.2- avm $APPIUM_VERSION- ln -s /usr/local/avm/versions/$APPIUM_VERSION/node_modules/.bin/appium  /usr/local/avm/versions/$APPIUM_VERSION/node_modules/appium/bin/appium.jsfor desired capabilities I only set Remote urlShareAWS-User-9196591 a year agoThat's the .yml fileThere should be a place in your test where you start the driver.self.driver = webdriver.Remote(url, desired_caps)Please ensure that desired_caps is empty and that you aren't setting the platform version thereShareAkshay Khanore a year agoYes, iam using RobotframeworkOpen Application       http://0.0.0.0:4723/wd/hubiOS 14 works as expected but iOS 15 does notShare"


Question: Location of restored glacier archives?

"Hello,I used a 3rd part software called FastGlacier to upload some files (total ~230gb) into a glacier archive named ACD. Now a month later I want to retrieve said files and copy them into a s3 standard bucket so I can run some analysis on it.I already retrieved the inventory from the CLI (aws glacier initiate-job... inventory-retrieval) and retrieved the archives (aws glacier initiate-job... archive-retrieval). If i look up the status of the jobs, 9 archives in total, they come back as succeeded.I want to copy those files directly to an s3 bucket named ACDr. Is there a way to copy the files directly into s3 (ACDr) or do i have to first download to by EBS?FollowComment"

Answer: "0When an object in Glacier is restored, it's restored to an S3 bucket (https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects.html). To then move that data to another bucket (as a one-time event), try the aws s3 cp command (https://docs.aws.amazon.com/cli/latest/reference/s3/cp.html).CommentShareAWS-Harrisonanswered a month ago"


Question: Has SAS code ever been successfully ran on SageMaker?

Has SAS code ever been successfully ran on SageMaker?FollowComment

Answer: "0Accepted AnswerI’ve helped customers run SAS on a notebook through a kernel and that was their main use case, but we also showed them how they can containerize SAS. Worked wellCommentShareAWS-User-5221950answered 3 years ago"


Question: Amplify Studio not accessible for created IAM

"I created an admin user for my Amplify project and grant all permission on amplify / amplifybackend. When logged in as new admin user I can see apps in Amplify section, but after launch studio it shows me error.Is there any other permission I should grant to access Amplify Studio? ThanksFollowComment"


Question: VPN endpoint TLS Handshake error

I have problem of vpn endpointI tye many time for-Generate certificate via “EasyRSA”-Import to certificate manager-Configure VPN Endpoint-Configure vpn configure fileI try many certificate both server/client and re-create on windowsPlease adviseI follow thishttps://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-getting-started.htmlFollowComment

Answer: "1Hi,It is difficult to tell fully since the screenshot truncates the errors.  This looks like it cannot verify your certificate because it can't determine the CA (certificate authority).  I would check the console for ACM and potentially export your certificate information to update the OVPN Client/Config file.https://docs.aws.amazon.com/acm/latest/userguide/export-private.htmlCommentShareAWS-User-0357409answered 3 months ago0I follow generate certificate this line part of windowshttps://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authentication.html#mutualAnd import to ACM via AWS consoleCommentShareDopodanswered 3 months ago"


Question: EMR Serverless Custom Image failure

"Hi.I have set up an EMR Serverless application to run a simple Hello World spark job. I've configured everything properly and the job execution is successful.Next, I've created a custom image according to the official docs:https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/application-custom-image.htmlHowever, once I've updated the application to use the custom image and submitted the same Spark job it fails. No logs are available and no clue about the error cause.Please advise a possible solution.Thanks.FollowCommentdacort a month agoIf you're building on an M1 or M2 Mac, make sure you've added --platform=linux/amd64 to the FROM line in your Dockerfile or you've chosen arm64 architecture when you create your application.Share"

Answer: 0Thank you. That solved my issue.CommentSharerePost-User-2973553answered a month ago


Question: SSL/TLS Certificate

I have a certificate that is expiring soon. I went ahead and renewed the certificate via email validation but now I am stuck with where to upload the certificate in AWSFollowComment

Answer: "0Hi,If the certificate is email-validated then it should reside inside AWS Certificate Manager and so you would be able to see it in the console or via the list-certificates API. In other words, the 'import' operation would not come into play here.You are more than welcome of sharing more details about your use case and I would be happy to help further.Thanks.CommentShareNicholas Doropoulosanswered a year agoAWS-User-4819156 a year agoHi,Thank you for your answer, I do have the certificate I validated via email showing up in my AWS certificate manager along with the one that is about to expire. I the one I recently regenerated says its ineligible to be renewed and I don't know what step to take to make it eligible before the 29th when my other one expires.Share0Hello.You may try to import your new cert to AWS Cert Manager (https://docs.aws.amazon.com/acm/latest/userguide/import-certificate-api-cli.html).CommentShareJapanTakeAWSConsoleanswered a year ago0I haven't personally used AWS Certificate Manager before, however I recommend taking a look at the ACM documentation under Installing ACM Certificates. The documentation states that you must install the certs through the integrated AWS services you are using. See services integrated with ACM.CommentSharenewrustanswered a year ago0Hi,I am not 100% sure what you mean by the following:"I the one I recently regenerated says its ineligible to be renewed and I don't know what step to take to make it eligible before the 29th when my other one expires."If we are talking about how to make your email-validated certificate eligible for renewal you would need to satisfy two conditions:The certificate is associated with an AWS resource such as an ALB.You need to approve at least one validation email for every domain included in the domain scope of your certificate. Validation emails are sent by ACM automatically to the three contact addresses found in your WHOIS data and five common system addresses (i.e. admin@<yourdomainname>, administrator@<yourdomainname>, webmaster@<yourdomainname>, hostmaster@<yourdomainname>, postmaster@<yourdomainname>. These validation emails are sent automatically by ACM once on the 45th day prior to the certificate's expiration and they are only valid for 72 hours. If that time frame has passed you would need to call the resend-validation-email API  for every domain and acknowledge them all within 72 hours.If you are referring to another certificate altogether please share more details and I would be happy to help.References:CommentShareNicholas Doropoulosanswered a year ago"


Question: Not able to detach EBS Volume

"Although the EBS volume is not attached to any EC2 instsances, it is still showing in-use. I tried force detach from aws console but it is stuck.Force detaching the volume from AWS CLI shows following errorAn error occurred (InvalidParameterValue) when calling the DetachVolume operation: The volume ID 'vol-00402f84342cf78f' is malformedFollowComment"

Answer: "0The error message is clear - that the volume id you're passing isn't formatted correctly. Looking at a volume id that I have, it appears that yours is missing a character. Can you check and make sure it is the right volume id?That said: If it really is stuck, the best thing to do is to raise a support case. Here on re:Post we don't have access to your account details nor other personal information but the support team can help in these cases.CommentShareEXPERTBrettski-AWSanswered 6 months ago0An error occurred (IncorrectState) when calling the DetachVolume operation: Volume 'vol-00402f84342cf78fa' is in the 'available' state.Sorry about the wrong error message, this is the error I am getting. I am not able to detach the volume. This volume is not attached to any of the entity but still showing as available. Also, I tried detaching it via command line and AWS console, Below error message is from Command line and from AWS console, there is no error message but the process takes forever to complete.CommentSharerePost-User-1378681answered 6 months ago0A volume in available state means it's not attached to an instance; its already detached. Deleting a volume and detaching a volume are two different actions. As long as an EBS volume exists either as available or in-use you incur EBS related charges.CommentShareSydanswered 6 months ago"


Question: SSM agent syslog errors

New EC2 Ubuntu 18.04 AMI with IAM role AmazonSSMManagedInstanceCore attached. Seeing the following in syslog:Aug  2 15:42:00 www amazon-ssm-agent.amazon-ssm-agent\[929]: Error occurred fetching the seelog config file path:  open /etc/amazon/ssm/seelog.xml: no such file or directory  Aug  2 15:42:00 www amazon-ssm-agent.amazon-ssm-agent\[929]: 2019-08-02 15:42:00 ERROR Error adding the directory to watcher: no such file or directory  Should there be an /etc/amazon/ directory in the system? There currently isn't. Have tried rebooting system and restarting amazon-ssm-agent.FollowComment

Answer: "0Hi,I solved doing these steps#mkdir /tmp/ssm#systemctl stop snap.amazon-ssm-agent.amazon-ssm-agent.service#systemctl start snap.amazon-ssm-agent.amazon-ssm-agent.serviceAnd check you have activity in the log file tail -f /var/log/amazon/ssm/amazon-ssm-agent.logIf you are not sure, using console go to AWS System Manager --> Managed Instances and check it.Regards.CommentShareacamareroanswered 3 years ago"


Question: Tips for managing several ML project with similar framework

"Hi,I'm working on an end-to-end ml project which, for the moment, goes from training (it takes already processed train/val/test data from an S3 bucket) to deploy, passing through hyperparameter tunning. This project has been developed on SageMaker Studio and in the beginning, I decided to keep track on the project with a github's repository.So, my work has certain degree of maturity: I was able to successfully train, tune, deploy and infer over a dataset. But the troubles came when I try to replicate this work for another dataset (a new project with a similar framework).Let's say that I had a client "A" for which I developed this project and now I have a new client "B" with similar requirements than client A. I'm looking for the best way of "copy & paste" the project considering the following:a) I would like to keep working on the repository. The idea here is the repo been like a project's template ir order to clone the repository, make some few corrections (changing model's name, working bucket, etc) and then execute tuning, evaluation and deploy.b) There's a lot of changes and improvements that I should make in the future. So, I'd like those changes been reflected on both projects.If anyone could give me some tips, guidelines, share his experience with something like this I would be very grateful.Regards! :DFollowComment"

Answer: "1SageMaker Projects gives you the ability to quickly setup and standardize your environment for repeatability. Using SageMaker projects, you can define templates that bootstrap version control (Github in your case), automated ML pipelines, and other codes to quickly iterate over using different data sets.  SageMaker projects are provisioned using AWS Service Catalog products. Please refer this blog for more insights : https://aws.amazon.com/blogs/machine-learning/building-automating-managing-and-scaling-ml-workflows-using-amazon-sagemaker-pipelines/CommentSharemarancsanswered 4 months ago"


Question: Unable to delete MSK Cluster

"I have a MSK cluster I am unable to delete, it just gets to a failed state over and over. The only error I get is -There is an issue with your clusterCode: InternalServerError.UnknownMessage: The last operation failed because of a service issue. Retry the operation.And retrying doesn't seem to change the outcome, does anyone have any ideas?FollowComment"

Answer: 0Can you cut a ticket to AWS support with your cluster ARN? Support should be able to clear this up for youCommentShareAWS-User-5769575answered 2 years ago


Question: Restrict queues that supervisor can see in Real-time and historical metrics

"Is it possible to restrict the queues that a supervisor can see on Real-time dashboard and in Historical metrics?For example, supervisor for Team A should only be able to see metrics of queues related to Team A.Or supervisor only sees the queues that he/she is part of?I tried tags to restrict the queues that a supervisor can see, but in real-time metrics, all the queues are visible to supervisor regardless of tags.FollowComment"

Answer: "0Not possible out of the box. This is where a custom solution would have to come in play or save a report with only the specific information you're after.davidCommentSharedmaciasanswered 4 months ago0This is a much requested feature, please work with your Connect SA to add your requirements into this requestCommentShareClarenceChoianswered 4 months ago0Good news shzbmmn! Tag-based access control for the real-time metrics page was recently released: https://docs.aws.amazon.com/connect/latest/adminguide/rtm-tag-based-access-control.htmlCommentShareEXPERTAWS-samfredanswered 2 months ago"


Question: Cloudwatch insights

"Is it possible to setup cloudwatch Insight JSON rules on log groups that are in other AWS accounts? We have our monitoring stack setup in another account, we'd like for our service accounts to talk to monitoring accounts to pull out cloudwatch insight graphs on a dashboard in service accounts. Any help will be appreciated. I've tried following instructions in this article with no luck getting insight rules to display data - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.htmlBut since cloudwatch insight rules work with log group names and not ARNs, wondering if its even possible?FollowCommentyann_stoneman a year agoSo, to clarify, you'd like to query Account B's logs using Account A's CloudWatch Logs Insights?ShareRaghu a year agoyes that's correct.Share"

Answer: "0Since it sounds like you're centralizing your monitoring, I would recommend centralizing your logging as well. That's the way I see most customers with your goal go. This solution can help you do that.As far as "can you have CloudWatch Insight query logs in other accounts?", I don't believe that's possible, because I haven't seen anyone do that and because the docs don't mention anything about cross-account for CloudWatch Logs Insights queries. I'll try to update those docs to make that limitation clearer.CommentShareyann_stonemananswered a year ago"


Question: How to hosting in asp.net projet ...?

How to hosting in asp.net projet ...? any video link ...?FollowComment

Answer: "0AWS Elastic Beanstalk is probably a good place to start. Check out the documentation for the details, and there's a tutorial walkthrough too.CommentShareEXPERTJames_Sanswered a year ago"


Question: EBS-backed AMI policy

"Is there a way to set up a lifecycle policy utilizing EBS-backed AMI policy and share that EBS-backed AMI across accounts through the AWS Lifecycle Manager?  I see the guides for EBS backed snapshots but I do not see anything in the guide for cross account sharing automation in the EBS-backed AMI policy documents (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-policy.html).  I know how to share an AMI manually across accounts.  If there is not a way to do this through AWS Lifecycle Manager, could somebody describe another way to approach the problem (e.g. create a lambda function that finds the AMI that is backed up on a weekly basis and share it across accounts)?FollowComment"

Answer: "0Within the lifecycle manager, you cannot copy AMIs across accounts unfortunately.Depending on which accounts you are sharing with, there are different solutions.If you are sharing your AMI with accounts within your AWS organization, you can leverage AWS Backup and its native functionality to share within an organization. Creating backup copies across AWS accountsIf an AMI needs to be shared with individual accounts outside an organization, you can look into using EventBridge to listen to EC2 AMI events (image state = available) and invoke a Lambda function, for example, to configure the AMI's permissions/configurations. Monitor AMI events using Amazon EventBridgeAlternatively, if you are using an EC2 image builder to build AMIs, you can use its out of box features to share EC2 image builder built AMIs with other accounts. Set up cross-account AMI distribution with Image BuilderCommentShareTaka_Manswered 5 months ago"


Question: Using Amazon Elastic File System (EFS) with MacBook Pro for cloud drive..

Is anyone using  Using Amazon Elastic File System (EFS) with MacBook Pro for cloud drive..I am trying to find a way to setup a NFS for all my Mac's to access from the house and on the road... Would this workFollowComment

Answer: 0This would require a client VPN as well to get to the VPC where EFS is setup since it's not accessible from the internet.If you setup a VPN it would work though.CommentShareEXPERTRob_Hanswered 5 months agoJohnathanSmith 5 months agoThanks.. I was thinking I can add a VPN and just mount it very easy.. I am new to all this and just started the Cloud Quest game and I wanted to know how to do this so I can map all my Macs to a NFS...  Do you think doing this is hard for someone new?Share


Question: EC2 blue/green deploy with AutoScalingGroup fails

"As already pointed out in the old Developer Forum CodeDeploy B/G deploy is failing if the AutoScalingGroup has some AutoScalingPolicy attached because it looses the attachment to the original TargetGroup.Has anybody found a better solution than manually re-attaching it?Attaching the policies instead of the target is also a possibility, but it makes the management of the policies not in CloudFormation. BTW, the old workaround only worked with "classic LB", it can't be implemented with current ALBs.It is "funny" that AWS is aware of this severe bug but did not fixed it yet, after 5 years ;(FollowComment"


Question: Invalid operation when creating Stored Procedure

"Hi,I've been trying to create a stored procedure using SQL Workbench/J as well as directly in the Redshift Query Editor and I keep getting errors like "[Amazon](500310) Invalid operation: unterminated dollar-quoted string at or near "$$ LANGUAGE plpgsql" Position: 1;" from the query editor or "[Amazon](500310) Invalid operation: Create procedure is not supported for language plpgsql.;" from Workbench/J.I've read the note on https://docs.aws.amazon.com/redshift/latest/dg/stored-procedure-create.html so I assumed that doing it with Workbench/J wouldn't be a problem (I also made sure to update the JDBC driver to version 1.2.27.1051). To make sure the issue isn't with my procedure, I also tried running example procedures from the documentation and got the same error message.Anybody else experiencing the same issue and any ideas on how to solve it?FollowComment"

Answer: "0The current version of your Redshift cluster must be 1.0.7287 or later. You will probably be patched to a version with Stored Procedure support in your next maintenance window.Here is the version info from my cluster in the US West 2 region. It is on 1.0.7152 so it does not have SP support yet.SELECT version();                                                         version-------------------------------------------------------------------------------------------------------------------------- PostgreSQL 8.0.2 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 3.4.2 20041017 (Red Hat 3.4.2-6.fc3), Redshift 1.0.7152CommentShareAWS-User-2965899answered 4 years ago0You're right, the cluster was on version 1.0.7078, I upgraded it and now everything works fine.Thanks Joe!CommentSharelcoranswered 4 years ago0I'm running on an updated Redshift cluster. I receive the same error when using Aginity (4.9.3.2783) or when using SQL Workbench/J (Build 125). SQL Workbench/J  (Build 124) works fine.Changing the Redshift JDBC driver didn't make a difference for build 125. Build 124 worked fine with RedshiftJDBC42-1.2.16.1027 and RedshiftJDBC42-1.2.10.1009.Thanks,GlennCommentSharerotglennanswered 4 years ago"


Question: Setting up Microsoft Exchange Server on EC2

"I am trying to onboard AD and Microsoft Exchange (O365, Outlook) from a third party.So far, I have completed this ("Test Lab") step for AWS Managed AD: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_base.html.  This is the next: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_trust.html.I understand the above, two tutorials to be prereqs for this task - https://aws.amazon.com/blogs/modernizing-with-aws/how-to-run-microsoft-exchange-server-on-aws-using-amazon-ec2/ - however, I cannot find the second part indicated in that blog post.  If anyone knows where that is, it would help.Do I need AWS Managed AD in order to have a place to bring in the third party's AD Objects (users, groups, etc)? I want my organization to be able to take advantage of AWS SSO, as well as profiles available to associate with AWS Users and Groups, as well.Do I need to set up the trust between AWS Managed AD and the self-managed Active Directory installation on EC2? I am assuming the email server will run on that same EC2, right?FollowComment"

Answer: "1Accepted AnswerI believe you don't need to set up additional EC2 AD DS instances if you use AWS Managed AD.Follow these steps to set up AD using AWS Managed AD: https://fitdevops.in/how-to-setup-aws-managed-microsoft-active-directory/Once you have that in place you can install MS Exchange and connect it to your AWS Managed AD deployment.However, if this is a new setup, why not just use managed services for both AD and Exchange?Look at the instructions in this video starting with Architecture #3 - https://youtu.be/14BTX5gCs38With this setup, you can provide the same service, but you won't have to manage the Exchange configuration.CommentShareCarlos del Castilloanswered 25 days agojvg 24 days agoManaged services for both seems like a solid way to go.  Would you happen to know which pieces I need to bring from my current, third-party vendor in order to get these managed services looking and operating "the same" when I turn them on Day 1? EG, all my current users, groups (AD), and O365 applications and their content (Outlook, etc)? I have done a small AD migration in the past just for the developers in my org, and all that was really needed was the SAML config from the third party; but I have not done onboarded an email server and its contents before.ShareCarlos del Castillo 22 days agoThere is actually a document to walk you through the migration of both Active Directory and Exchange:Active Directory to AWS Managed Microsoft Active Directory - https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_migrate_users.htmlMicrosoft Exchange to AWS Workmail - https://docs.aws.amazon.com/workmail/latest/adminguide/migration_overview.htmlHope this helps and good luck!Share"


Question: how long to re-use bucket name?

i have delete bucket name and want to re-use name but I can't. how long to re use bucket name?FollowComment

Answer: "2If you want to reuse the name in different region, then you need to wait about an hour or so. If you are reusing in same region, it should allow you to create in few minutes.--SydCommentShareSydanswered a year ago"


Question: About SSO WorkSpaces by SAML2.0

"Setting up SAML 2.0(preview) are configured. After jumping to the WorkSpaces application at the end of Authentication workflow, only the user name is automatically filled in, do I still need to manually enter the password to login?FollowComment"

Answer: "0That is the intended behavior. The SAML attribute for NameID must but the sAMAccountName, which is used for the username field in the WorkSpace Client. There is no SAML attribute for password, hence why it is not filled in like the username field is.CommentShareEXPERTStevieStetsanswered 7 months agocolorline 7 months agoI think SSO should only validate credentials in a single provider. However, it is very confusing to have users authenticate both external credentials and AWS credentials to log in to WorkSpaces client. Is there a way to skip the second password verification?Share"


Question: AWS IoT Topic Rule Empty JSON Array BUG

"Hello,I think i've encountered a bug within the IoT Core topic rules. We have the following topic which invokes a lambda:'+/select'In our topic rule we've defined the following statement:"SELECT *, topic(1) as machineId FROM '+/select'"Then we send the following mqtt message to the topic:{"slots":[1,2,3],"session-id":"abcd"}However, when we get the event in the lambda the array is empty so the event looks as follows:{"slots":[],"session-id":"abcd","machineId":"123456"}How can we make it that the slots array isn't emptied?Thank youFollowComment"

Answer: "0Accepted AnswerHi,I've encountered the same problem with an IOT rule created with CloudFormation which set the sql version to "SQL version 2015-10-08".Editing the IOT rule and selecting "SQL version 2016-03-23" resolved it.Regards,HubertCommentShareHubertWagnerVEanswered 3 years ago0Hello Inspiro,Thank you for reaching out!I think maybe you missed quotes around https://forums.aws.amazon.com/?I created a rule with the sql you provided, and when I published the following payload, my lambda received the correct event.publishing{"slots":"https://forums.aws.amazon.com/","session-id":"abcd"}lambda logged:{"slots": "https://forums.aws.amazon.com/","session-id": "abcd","machineId": "12345"}Hope it helps.CommentShareAWS-User-0374256answered 3 years ago0Hello XinYiAtAWS ,Thank you for your response.I see now that i've made a typo in my question. The mqtt body i send is as follows:{"slots":[],"session-id":"abcd"}Where the slots array is filled with integers. (Aparantly aws forums changes my array of integers to a link)When we the topic rule is executed i receive the following event in the lambda.{"slots":[],"session-id":"abcd","machineId":"123456"}Here i need the integers in the array just as with the request above.Do you know what the problem could be?Edited by: Inspiro on Oct 5, 2020 12:35 AMCommentShareInspiroanswered 3 years ago"


Question: Sagemaker Ground Truth completes with labelling errors

"Hi all,I set a Sagemaker Ground Truth labelling task. All the labelled objects results with "Failed" status, though it is possible retrieve the labels from S3. Eventually, nothing apart from the job status is wrong - but I am worried that I could and I would like to resolve it. There are no logs in cloudwatch with anything FAILED. Would you know how to get rid of this issue? For start, it would be good to see a specific issue in cloudwatch and then try to resolve the problem with failed jobs.The logs show the following (I filtered out repeating events for different input objects):{    "labeling-job-name": "test-job51",    "event-name": "INPUT_REQUEST_VALIDATED",    "event-log-message": "Input request validated."}{    "labeling-job-name": "test-job51",    "event-name": "CREATED_WORKER_INTERFACE",    "event-log-message": "Human task UI created."}{    "labeling-job-name": "test-job51",    "event-name": "INPUT_MANIFEST_PARSED",    "event-log-message": "Input manifest parsed successfully."}{    "labeling-job-name": "test-job51",    "event-name": "PRE_HUMAN_LAMBDA_INVOKED",    "event-log-message": "Pre-human task Lambda invoked for line 6."}{    "labeling-job-name": "test-job51",    "event-name": "PRE_HUMAN_LAMBDA_SUCCEEDED",    "event-log-message": "Pre-human task Lambda returned successfully for line 6."}{    "labeling-job-name": "test-job51",    "event-name": "HUMAN_TASK_CREATED",    "event-log-message": "Human task created successfully for line 6."}{    "event-name": "HUMAN_TASK_COMPLETED",    "event-log-message": "Human task completed successfully for line 6.",    "labeling-job-name": "test-job51"}{    "labeling-job-name": "test-job51",    "event-name": "LABELING_JOB_PROGRESS",    "event-log-message": "Labeling job progress for batch number:1 | #Total data set objects:2 | #Data set objects completed:0 | #Data set objects waiting for humans:0 | #Data set objects failed:2 | #Data set objects expired:0 | #Data set objects cancelled:0"}The setup goes as followsusing VPCusing Private Labelling teamCORS set on S3 bucket (per suggestion from https://repost.aws/knowledge-center/sagemaker-ground-truth-errors)the execution role has permission to use cloudwatch (per suggestion from https://repost.aws/knowledge-center/sagemaker-ground-truth-errors)Cognito App callback url is https://XXX.labeling.us-east-1.sagemaker.aws/oauth2/idpresponse and logout URL is https://XXX.labeling.us-east-1.sagemaker.aws/logout (I noticed that when the labelling job/workforce is created from Console, there is an additional allowed callback https://XXX.cloudfront.net; I did not add it)FollowComment"


Question: "AWS Greengrass Local Debug Console 2.2.5 not compatible with Nucleus, CLI 2.8.0"

"Despite the changelog (https://docs.aws.amazon.com/greengrass/v2/developerguide/local-debug-console-component.html#local-debug-console-component-changelog) saying:2.2.5 Version updated for Greengrass nucleus version 2.8.0 release.The dependency (https://docs.aws.amazon.com/greengrass/v2/developerguide/local-debug-console-component.html#local-debug-console-component-dependencies) is actually set to < 2.8.0:Dependency                  Compatible versionsDependency typeGreengrass nucleus          >=2.1.0 <2.8.0HardGreengrass CLI              >=2.1.0 <2.8.0HardDeployment errors in greengrass.log:2022-10-12T15:05:41.445Z [ERROR] (pool-2-thread-3) com.aws.greengrass.componentmanager.ComponentManager: Failed to negotiate version with cloud and no local version to fall back to. {componentName=aws.greengrass.Cli, versionRequirement={aws.greengrass.LocalDebugConsole=>=2.2.0 <2.8.0, thing/greengrassv2_greglaptop-253==2.8.0}}FollowComment"

Answer: "2Accepted AnswerHi,The changelog is incorrect and has duplicated the version from below. Version 2.2.6 is compatible with the latest versions, please use the latest version.I'll get the changelog fixed ASAP, thank you for making us aware.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 8 months ago"


Question: Aurora serverless v2 minimum subnet size

"Are there any constraints regarding the size of private subnets for Aurora serverless v2 nodes? I've tested a scenario with /28 subnets, which seems to work without any problems, but I'd like to make sure I'm not missing something important.From the documentation:The CIDR blocks in each of your subnets must be large enough to accommodate spare IP addresses for Amazon Aurora to use during maintenance activities, including failover and compute scaling. For example, a range such as 10.0.0.0/24 and 10.0.1.0/24 is typically large enough.A /24 for a single node per AZ seems to be rather wasteful IMHO.FollowComment"

Answer: "1Accepted AnswerHi,This really comes down to the size and use case.  The best way to think about it is that Aurora Serverless v2 consume network resources just like a provisioned DB instance (1 ENI and 1 IP from your DB subnet group).  So, to answer your question, a /28 would work but you need to plan for scale.I agree that one node and a /24 would be perceived as wasteful, but make sure to consider what your future state may look like and if that /28 is appropriate.CommentShareAWS-User-0357409answered 3 months ago0x12df979 3 months agoThank you AWS-User-0357409Share"


Question: Automate the creation of EC2 instance from a VMDK in an S3 Bucket?

"Currently I'm using the VM Import/Export to manually stand up EC2 instances from VMDKs stored on an S3 bucket. While this is great for small scale use cases, I'd ideally like the ability to cram this into a CloudFormation template so I can scale/automate the process. My Google-Fu isn't strong enough for me to find the correct way of doing this, or if it's even possible so I'm hoping the folks that browse Re:Post might have some experience.The ideal workflow would be having an S3 bucket full of VMDKs. Then uploading a CFT stack that would build the VPC, route table, subnets, yadda, yadda, yadda, then spin up instances based on the VMDKs. Any and all help is appreciated. Thanks!FollowComment"

Answer: "0Accepted AnswerI imported via VM Import/Export, turned the images into AMIs, and used EC2 Image Builder console wizard to create an image pipeline. That made this work.CommentShareAWSJoeanswered a year ago"


Question: "I am receiving emails "Amazon SES Email Receipt Nofication" yet I have no SES service, how to stop it?"

"I have domail hosted in AWS and I am getting frequent "Amazon SES Email Receipt Nofication" for emails that were once existing for this domain, when it was at different service provider. However, I have no SES, so why I am getting it?How can I get rid of those emails?Looking at S3 I have I can see AMAZON_SES_SETUP_NOTIFICATION file which reads:"You received this message because you attempted to set up Amazon SES to deliver emails to this S3 bucket.Please note that the rule that you configured to deliver emails to this S3 bucket is only valid if the entire setup process is successful. For more information aboutsetting up email-receiving rules, see the Amazon SES Developer Guide at http://docs.aws.amazon.com/ses/latest/DeveloperGuide/Welcome.html .Thank you for using Amazon SES!The Amazon SES Team"Thank you!FollowComment"

Answer: "0Hi,Please open a case with Premium Support. Using your account ID, they will be able to inspect if there is any active sending access for you in any region. Alternatively, you can check your SES console in all of the regions to make sure that there are no verified identities in there, which eventually means that you are not using SES. After that, you should be checking your SNS topics in the various regions to make sure that there is no topic that uses the S3 bucket as a destination.By the way, SES receiving is enabled only in 3 regions. For more about that, please check this link.https://docs.aws.amazon.com/general/latest/gr/ses.html#:~:text=Email%20Receiving%20EndpointsHope this helps.Thanks!MoCommentShareMoanswered 2 months ago"


Question: VPN Client Endpoint - losing internet access even with split tunnel enabled

"Hi, I have been working with aws vpn client for some time and I have enough understanding of how it works and its config. The only thing Im having issues with right now is even when I have the split tunnel feature enabled, I lose internet access from my computer, at home. If I understand this correctly the whole idea behind the split tunnel is to make sure AWS traffic is only what goes through the vpn tunnel, to avoid extra charges,...etc.I have older endpoints created previously and are working as expected, both at home and at the office. All clients have the same configs with the CIDR being the only difference, and the new one was created using AWS CDK. My local routing seems ok, but when trying to access "amazon.com" for example I get DNS resolution error in my browser, simply nothing works.Following is my routing when connected to the vpn client im having issues with. I use 192.168.0.0/16 for my vpc.Internet:Destination        Gateway            Flags           Netif Expiredefault            10.0.0.1           UGScg             en0       10/24              link#15            UCS               en0      !10.0.0.1/32        link#15            UCS               en0      !10.0.0.1           f4:c1:14:8e:ad:16  UHLWIir           en0   119010.0.0.131         a4:93:3f:60:53:84  UHLWI             en0    66810.0.0.145         f8:28:19:3d:bb:b6  UHLWI             en0      !10.0.0.166/32      link#15            UCS               en0      !10.0.0.245         e:bf:67:db:69:3    UHLWI             en0      !10.0.0.255         ff:ff:ff:ff:ff:ff  UHLWbI            en0      !127                127.0.0.1          UCS               lo0       127.0.0.1          127.0.0.1          UH                lo0       169.254            link#15            UCS               en0      !192.168.0/16       192.168.100.1      UGSc            utun3       192.168.100/27     192.168.100.2      UGSc            utun3       192.168.100.2      192.168.100.2      UH              utun3       FollowComment"

Answer: "1Your route table looks fine but I think the problem here is DNS. What is your DNS server set to?You can check that the split tunnel is working correctly by doing a ping to a working external IP address. That's easy to find - when the VPN isn't running do ping www.amazon.com and take note of the IP address. With the VPN running do ping <IP address> and see if you get a response. If you do then DNS is definitely the issue.Make sure that you can reach your DNS server when on the VPN. If the DNS server is in the VPC then it needs to be able to resolve IP addresses and return responses to your computer via the VPN tunnel.CommentShareEXPERTBrettski-AWSanswered 9 months agoEXPERTToni_Sreviewed 9 months agoZiad 9 months agoThank you! I was able to resolve the issue. The idea behind using split tunnel for me is to avoid having non-aws traffic going through the vpn tunnel, as I have a private subnet with no internet access. I wanted to take advantage of the endpoint route table copied on the client side. Note that I have 3 different vpn client endpoints with split tunnel and they all work. After reviewing my work and some trial and error apparently having the client cidr overlap with the VPC, where the client is configured will cause this issue. Overlap documented but didn't realize will cause such issue.SharerePost-User-2822433 9 months agoI'm having this exact issue. In order to get internal DNS resolution to work, I utilized AWS Route53 Resolver. In configuring the Client VPN Endpoint, I specified the IP addresses of the AWS Resolver Inbound Endpoint. That enabled me to resolve internal hostnames while on the VPN. However, I am now not able to resolve external DNS queries. I have split tunnel enabled. I can resolve the issue by adding an Authorization Rule on the VPN Client to allow traffic to 0.0.0.0/0, but I don't want to do that for security reasons, and don't think I should have to with the split tunnel solution. Do you have any advice?ShareZiad 9 months agoHonestly I think AWS support need to look into this issue and do enough testing to understand the reason behind such an intermittent problem. Today suddenly everything is working fine. I was doing some testing with different vpn endpoints, and I haven't figured out the reason this is happening, yet. I would say first thing is avoid the 0.0.0.0/0 entry, since it will copy the client route table to your local machine, as with that you might have issues trying to figure out whats going on. I had to delete my answer below as now the CIDR overlap is no longer to be the issue I guess.Share0When you enable split-tunnel mode, all the routes in the Client VPN endpoint's route table are added to the client's route table when the VPN connection is established. This operation is different from the default behavior, which overwrites the client's route table with the entry 0.0.0.0/0 to route all traffic over the VPN.I am assuming the above route table is on your on-premise end. It is not recommended to add a 0.0.0.0/0 route to the Client VPN endpoint's route table when using split-tunnel mode.Can you confirm if you have added the same ? If yes, can you remove 0.0.0.0/0 and try ?CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago0For the benefit of others I will answer this as i was able to resolve it. The issue here was that I was not fully aware of the proper DNS setting when set vs left empty, to allow the DNS IP address configured on the end user's device to take care of resolving DNS queries. A good article that explains exactly the DNS settings can be found here. In my case it was completely optional as I didn't need to use any specific DNS for my setup, also only needed certain traffic to go through the vpn. I had other hardware routing issues, which could have been also contributing to part of the problem.CommentShareZiadanswered 5 months ago"


Question: Model Error calling the InvokeEndpoint operation for Autogluon model.

I have deployed an Autogluon model to enable be invoke a sagemaker endpoint on the lambda. I keep receiving this error in my CloudWatch. Any help will really be appreciated...FollowComment


Question: MediaConvert thumbnails colors

"Hello,I have a strange issue with MediaConvert, where thumbnails that MediaConvert generates appear to be of different color than the actual video that MediaConvert creates.On the left it's a frame of the video, on the right is the thumbnail generated. The behaviour is consistent for all videos, this is just an exampleI'm not doing any color corrections to the thumbnails, my config is simply                    Name: "File Group",                    OutputGroupSettings: {                        Type: "FILE_GROUP_SETTINGS",                        FileGroupSettings: {                            Destination: `${data.inputDirectory}/thumbnails/${data.name}`,                        },                    },                    Outputs: [                        {                            ContainerSettings: {                                Container: "RAW",                            },                            VideoDescription: {                                CodecSettings: {                                    Codec: "FRAME_CAPTURE",                                    FrameCaptureSettings: {                                        MaxCaptures: 1,                                        Quality: 80,                                    },                                },                            },                            Extension: "jpg",                            NameModifier: "-thumb",                        },                    ],                },Is this normal? Shouldn't the thumbs match the video at all times? Am I supposed to now do manual color correction with the settings?We recently switched from AWS Elastic Transcoder and did not have the same issues there with videos that were generated in the same wayOur videos are prepared with ffmpeg & hevc_videotoolbox before being sent to MediaConvertFollowComment"

Answer: "1Two things to consider when doing frame captures, the rate of capture and the resolution. Viewing your capture config, it show a limit of 1 capture max. That one capture seems to be at a different time than your video screen capture. (See bee in flower in frame capture not present in the video.) So colors and shading may be different. You may want to set capture to once ever X secs and compare those times with the video. Also, validate that your video encoding profile does not have color parameters set, which may be different than the frame capture.The resolution of the frame capture is typically lower than the video. This would provide a lower quality and averaging of luma/chroma over a large section. In this case, it seems that no resolution is set, so it would use the source resolution. Is that the same resolution as the video?Please see the following link for Frame Captures with AWS Elemental MediaConvert.https://docs.aws.amazon.com/mediaconvert/latest/ug/file-group-with-frame-capture-output.htmlCommentShareMike-MEanswered 9 days agoxtrinch 8 days agoI've updated the original post so you can see that it is the very same frame and the colors differ.You mean my encoding profile originally? I mean whatever the original video has set, that's what MediaConvert should generate thumbnails from, no? I'm not sure what color profile it is, I'm just using hevc_videotoolbox to scale down whatever the user supplies, is there anything other I need to do? The resolution exactly matches my input video and that is what I'd like, I'm using this as background while the video buffers intially, so the different colors are very noticable. The video comes out in correct colors, but the thumb does notShare"


Question: API Gateway mapping template transformation causes a precision error for exponential notation

"Hello AWS re:Post professionals.Thanks in advance and I would like to ask a question about API Gateway mapping templates.Situation:I have tried to post JSON that includes exponential notation API Gateway that uses mapping template and saw response below.posted valueMethod request body before transformations: {..."value": 5e+22}endpoint request body after transformations:     {...value: \"4.9999999999999996E22\" }In mapping template, I have found that after the line below, value: 5e+22 was converted to 4.9999999999999996E22#set($inputRoot = $input.path('$'))My Question is that is there any way to avoid this implicit transformation?Best regards, KeisukeFollowComment"


Question: AWS Trusted Advisor optimization checks for Microsoft SQL Server on Amazon EC2

Dear team.I would like to understand how AWS Trusted Advisor optimization checks for Microsoft SQL Server on Amazon EC2 are collected from my EC2 instances.As far as I understand Trusted Advisor is a agentless offering and I am not sure how it is possible to collect these metrics from my arbitrary SQL Server deployment on EC2.Should I install an agent for this or it is done automatically by some routine on EC2 instance itself?Thank you in advance.FollowComment

Answer: "1You don't need to install an agent for Trusted Advisor SQL Server optimization checks. Trusted Advisor inspects your EC2 SQL Server license include instances configurations such as vCPUs/version/edition and then gives recommendations based on the best practice, the same way as other checks. Learn more from technical documentation.CommentShareAlex_Zanswered a year agoAWS-User-1313951 a year agoThis I understood. What I cannot understand though is how Trusted Advisor gets information about version/edition. I do not see any other way apart from directly collecting this information from OS level.Share"


Question: Account name changes are not reflected in Cost Explorer

"I am using AWS Organizations. In the past I have changed the names of some of the accounts in my organization, but I have noticed that those changes are not reflected in the Linked Account on Cost Explorer. (They are showing under the old names).How can I fix this?FollowComment"

Answer: "0AWS Cost Explorer uses Account Alias per defined in IAM. Follow this link for the exact instructions on how to update an account alias.CommentShareEthan Ferdosianswered a year agoSimon Williams 6 months agoI have this same issue.I have three linked account in the same organization. I have renamed these over time, e.g. "Sandbox" became "Development". All the accounts have aliases but Cost Explorer still shows the original name, i.e. "Sandbox"?Share"


Question: problem in implementing BYOC in multi container under one end point

I am facing issue in implementing BYOC with multi container with one end point. I am training my own model in Container and when I am running this container singularly it is working but integrating with multi container it is giving issues in endpoint creation "ping health check not passed"FollowComment

Answer: "0If you're using a modest instance type to host multiple models, perhaps you might be struggling with CPU/memory resource contention as mentioned here in the docs? SageMaker recently launched configurable health-check time-outs, which may be interesting to you if your models or containers are particularly large / slow to set up (see the CreateEndpointConfig API)... But I'm not certain whether this configuration is supported for Multi-Container Endpoints at the moment.CommentShareEXPERTAlex_Tanswered 8 months ago"


Question: How can I get logs of my task failed container

"I am using docker compose to run my ecs fargate service, and got error AggregatorService TaskFailedToStart: Task failed to start.How can I get logs of my service and know why task failed?FollowComment"

Answer: "0Accepted AnswerSo you might want to check whether the log group was created and deleted as the service tasks failed to start. If the log group is created as part of the deployment in CFN, it might just have been deleted as it rolled back.Best way to figure out what's happened is to go to ECS -> cluster -> services -> Tasks. There, once you see your task pending, click on it. Expand the container, and you will be able to find a shortcut link to the container's log stream. Equally you will be able to see the exit code. If your app in docker failed before doing any logging, which is possible, then you can figure that out with the exit code (most likely, exit !=0).You could "patch" your dockerfile or entrypoint to print out "Hello, I am starting" right before your main app starts. That will tell you whether the task failed because of your app or due to something else, i.e, lack of permissions / wrong image .. etc.If you want to generate the CFN templates for your services to be deployed so that you can have a look into it and possibly tweak things, try out ECS Compose-X. Achieves the same thing as the docker ecs plugin, but does it in a very different way and has lots of different features. Either way, hope the guidelines above help.CommentShareJohnPrestonanswered a year agorePost-User-1679103 a year agoYes, I should not test in the docker compose file. I should test in the ecs cluster manually first.Share0Hello,You should be able to get logs for ECS in CloudWatch if you have logging setup in Container Definition. Please refer to https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html for using awslogs driver to log into CloudWatch.For error codes related to ECS, please see https://docs.aws.amazon.com/AmazonECS/latest/userguide/stopped-task-error-codes.html for more information.Thank you.Regards,FrankyCommentShareFranky Chenanswered a year agorePost-User-1679103 a year agoThanks for your help.I can't find any log in CloudWatch. Maybe because LogGroup will be deleted if there is error with docker compose up.I read the stoped task error code in https://docs.aws.amazon.com/AmazonECS/latest/userguide/stopped-task-error-codes.html, but I cannot find error code TaskFailedToStart: Task failed to start. The message prefix should be TaskFailedToStart, but I cannot find the suitable example.Looking forward to your thoughts.Share"


Question: Parameters available to SSM Automation when triggered by an AWS Service Catalog 'Service Action'.

"When an SSM Automation is triggered by an AWS Service Catalog 'Service Action',  are there any parameters available by default to the SSM Automation Execution that can help identify which "Provisioned Product" actually triggered the Service Action and in turn the SSM Automation? I analyzed the Trail and found that the "ExecuteProvisionedProductServiceAction" call contains provisionedProductId but the "StartAutomationExecution" call doesn't have any identifier that can link it to the provisioned product or the service action. Am I missing something here?FollowComment"


Question: Custom Connectors

Are there any plans to allow customers to create their own custom Greengrass connectors?FollowComment

Answer: "0Hi TiglathIII,I've created a feature request for custom connectors. Thanks for your request.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0+1 for this feature !!!CommentShareJips71answered 4 years ago"