Question: How do I compose a BULK request to OpenSearch via AppSync resolver mapping templates?

"I have a pipeline resolver for an AppSync Mutation. It contains two functions, the first one is a Lambda sending updates to RDS, the second one should take the result from $ctx.prev.result and index it via OpenSearch datasource.In the request resolver mapping template of the second one, I am composing the bulk body in NDJSON similar to the following mannar:#set($bulk = $util.toJson({ "index": { "_id": "${$ctx.prev.result.id}" } }))#set($bulk = "${bulk}${util.toJson($ctx.prev.result)}"){  "version": "2017-02-28",  "operation": "POST",  "path": "/_bulk",  "params": {    "body": $util.toJson($bulk)  }}Lacking proper debugging tools, I have been using $util.error as a logging method to get my $bulk contents. And it looks like the following format, which seems correct.{"index":{"_id":"A8DEF210-C342-48CB-9A4A-DA7D1E4D6AF1"}}{"foo":123,"bar":999,"baz":1234567}But when I actually runs the mutation via AppSync, I got a MappingTemplate error Unable to transform for the body: $[params][body]. and I have no idea why.EDIT: I took a look at [re:Post] Appsync HTTP resolver supported content types, which inspired me to take another look at Resolver Mappping Template for OpenSearch (params). It seems POST body only accepts a single JSON object, NSJSON required by the bulk request is not supported yet. Am I correct?If so, is supporting the bulk API in the upcoming plans?Also, what is the currently recommended way to index multiple "normalized" documents from the same resolver?FollowComment"


Question: Cloudflare DNS not accepting my AWS Workmail MX Value

I am moving my email away from godaddy to AWS workmail for my domain. My domain is still registered at godaddy with DNS at Cloudflare.  I get the following error message "DNS Validation Error (Code: 1004) Content for MX record must be a hostname." When adding the MX value given my AWs workmail to my cloudflare DNS.  Below is the value from from AWS.10 inbound-smtp.us-east-1.amazonaws.com.FollowComment

Answer: "2Accepted AnswerHello,You may be putting the 10 into the wrong box, please set the Name to @ and the Priority to 10.  See below for an example:CommentShareEXPERTChris_Ganswered 10 months agoZukky21 10 months agoThanks! that seemed to have worked. I looked all over the internet and I couldn't find that simple fix anywhere.Share"


Question: AD Connector MFA Setup Completed but AD Connector not sending RADIUS

"I have had an AD Connector set up for some time with no issue.  This is being used by AWS Client VPN. We are now enabling MFA on this service.I am using DUO Auth_Proxy for RADIUS - it is only handling secondary authentication with primary auth being handled by AD.I have enabled MFA on the directory service and it completes successfully, and in the RADIUS logs I do see that the awsfaketestuser attempts to connect.However when attempting to connect the client VPN the secondary authentication challenge never reaches the RADIUS server.  I have tested that it is working correctly by standing up an EC2 instance in the same security group and subnet as the AWS directory endpoints - and the challenge does go to the RADIUS server as expected and is logged. Just the AWS AD Connector doesn't appear to be sending challenges.I have also set this up successfully in a separate environment. It just seems as though the AD Connector (Directory) is not forwarding the challenge to the RADIUS server. Oh, and the Open VPN configuration on the client HAS been updated with the static-challenge.I have confirmed with DUO that the solution is configured correctly.I am really scratching my head over this one. Any ideas?FollowComment"

Answer: "1The issue ended up being with the ovpn file downloaded from AWS. I downloaded it again from the self-service portal and it worked as expected. Comparing the first and second file, the section for the static-challenge was in the wrong section in the first file. I'm not sure why that would have been the case as they were both downloaded from AWS - the first from the VPN configuration page and the second from the Self-Service portal.Also, if anyone else runs into this, you can use the self-service portal to verify that MFA is working properly as an alternative to the clunky OpenVPN client.CommentSharejguidalianswered 2 years ago"


Question: Cloudformation times out with internal 500 error

"I'm creating 1 launch template, 6 autoscaling groups, and 6 target groups through 1 cloud formation template.  When I create these resources, everything works fine when they are unique, all resources are created. It takes about a minute to finish creating all resources. However, when I assign 1 target group to two auto-scaling groups, cloud formation times out after like 10 - 15 minutes, and it doesn't even finish creating auto-scaling groups either. Is this expected? My workaround has been to create all auto-scaling and target groups and then associate them individually. Has anyone else experienced this?FollowComment"


Question: How to Restrict an IAM role to a VPC using permission boundary

"While I am trying to set-up IAM roles, I want to have a default permission boundary set-up with each role which will allow access to only the permitted VPC i.e. by specifying the VPC ID in the boundary so that even if the roles defined may have access to all the VPCs within an account (where ever resource could be a *), this permission boundary will help ensure the role can not access anything outside the specified VPC.Or if there is any other way to achieve this VPC restriction on the IAM role without specifying it with every AWS resource within Policy document.FollowCommentNihal 4 months agoIs this regarding traffic within a VPC or restricting VPC configuration access to certain IAM roles?Share"

Answer: "1To restrict an IAM role to a specific VPC, you can use an IAM policy with a condition that specifies the allowed VPC ID. You can define this policy as a permission boundary for the role, which acts as an implicit denial for all actions not explicitly allowed in the policy.Here's an example of a policy that allows the role to access resources within a specific VPC (specified by the VPC ID "vpc-0123456789abcdef0"):{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "*",            "Resource": "*",            "Condition": {                "StringEquals": {                    "aws:SourceVpc": "vpc-0123456789abcdef0"                }            }        }    ]}To set this policy as the permission boundary for a role, you can use the AWS Management Console, AWS CLI, or AWS API. In the console, go to the IAM role details page, click on the "Permissions" tab, and then click on "Edit boundary". In the CLI or API, you can use the "PutRolePermissionsBoundary" API action or the "aws iam put-role-permissions-boundary" command.This way, the role will only be able to access resources within the specified VPC, even if the role's policies would otherwise allow access to resources in other VPCs.CommentShareMuhammad Imrananswered 4 months agoAmit 4 months agoThanks Muhammad. I will give this a try and let you know. This answers sounds about right also aligns with what I had in my mind to address this. Thanks for your responseShareNihal 4 months agoThe aws:sourceVpc condition key is only applicable if the AWS API call originates from within a VPC.Share0I'm not sure what you're asking. Could you please clarify? If you want to limit the traffic from an ENI (for EC2 instances, Lambdas, etc) to just one VPC, you can do so using network controls instead of IAM. One way to achieve this is by using a security group that restricts outbound traffic to a specific VPC. You can set up a security group rule that allows outbound traffic only to the CIDR block of the desired VPC.CommentShareNihalanswered 4 months agoAmit 4 months agoThis question was more from controlling the access rather than the network. In case we have users defining their own IAM roles, we want to have a default boundary set-up so that their IAM role (with any definition) can not access resources outside the specified VPC within the permission boundary.ShareNihal 4 months agoIn that case, you'll need to implement an ABAC approach using aws:ResourceTag condition key  in the permissions boundary policy. You also need to tag existing resources in the VPC and automate/enforce tagging for future resources.https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.htmlhttps://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/But if you have multiple AWS accounts, I think a better way to achieve what you want is to try VPC sharing where one account can administer the VPC and you can then share subnets with other AWS accounts where they use it to deploy resources. The participants won't be able to modify the VPC configuration by default:https://aws.amazon.com/blogs/networking-and-content-delivery/vpc-sharing-a-new-approach-to-multiple-accounts-and-vpc-management/Share0+1 for using multiple accounts to separate multiple actors/teams. But if you can not do that, you can use permission boundary and tags to put boundaries around VPC or anyother way you needs. Wrote an article how to implement this kind of generic tag-based boundaries while granting permission to create and edit your own IAM policies at the same time. This could be helpful when operating with shared accounts. https://carriagereturn.nl/aws/iam/policy/boundary/2021/10/07/iambound.htmlCommentShareKalluanswered 17 days ago"


Question: Connecting to AWS Managed Microsoft AD from a RHEL 6.x OS

"I know that only RHEL 7.x is "officially" supported by AWS Managed Microsoft AD, but I wonder if anyone was successful in connecting RHEL 6.x OS to the active directory using "adcli" commands.Thank you,GigaFollowComment"

Answer: "0I was able to configure RHEL 6.10 to use AWS Active Directory, using the following document as a guideline.https://access.redhat.com/articles/3023951CommentShareGigaanswered 4 years ago"


Question: How to determine VPC dependences?

"Hello. I have 4 PVC networks. 3 Networks are using one - no. I would like to delete the VPC which doesn't use, but I should be confident, that no resources were attached to this VPC. Unfortunately, I have the same name for the 1st and 4th VPC but a different VPC ID. I can manage all resources manually.Maybe there is a solution, how to determine it fast end effectively?FollowComment"

Answer: "2Accepted AnswerWhen you delete a VPC in the Console, the "confirmation prompt" will tell you which associated resources will be deleted with the VPC, so that's a quick way of getting the information you are looking for.Hope it helps!CommentShareCarl Ostrandanswered 7 months agoEXPERTBrettski-AWSreviewed 7 months agoKonstantinZ 7 months agoIt sounds easy, thank you!Share"


Question: Deploy stage failed: FileMagic v0.7.1 error

"I built a simple CodePipeline for a SpringBoot Java application with 3 steps:Source: get the source from GitHubBuild: a jar fileDeploy: to an AWS Elastic Beanstalk instance1 and 2 steps successfully pass while Deploy step fails. The only error I see in eb-activity.log:01_configure_application.sh] : Activity execution failed, because: Executing: /usr/bin/unzip -o -d /var/app/staging /opt/elasticbeanstalk/deploy/appsource/source_bundle  FileMagic v0.7.1: compiled magic version [5.21] does not match with shared library magic version [5.37]  Archive:  /opt/elasticbeanstalk/deploy/appsource/source_bundle    inflating: /var/app/staging/microservices/my-service/target/my-service.jar    Unable to launch application as the source bundle does not contain either a file named application.jar or a Procfile.  Unable to launch application as the source bundle does not contain either a file named application.jar or a Procfile. (ElasticBeanstalk::ExternalInvocationError)caused by: Executing: /usr/bin/unzip -o -d /var/app/staging /opt/elasticbeanstalk/deploy/appsource/source_bundle  FileMagic v0.7.1: compiled magic version [5.21] does not match with shared library magic version [5.37]  Archive:  /opt/elasticbeanstalk/deploy/appsource/source_bundle    inflating: /var/app/staging/microservices/my-service/target/my-service.jar    Unable to launch application as the source bundle does not contain either a file named application.jar or a Procfile.  Unable to launch application as the source bundle does not contain either a file named application.jar or a Procfile. (Executor::NonZeroExitStatus)My Buildspec:build:  commands:      - mvn -P ci --settings settings.xml install -DskipTestsartifacts:  files:     - microservices/my-service/target/my-service.jarIf I deploy this jar directly to AWS Elastic Beanstalk using AWS Web Interface, it works perfectly.Please, help me. I'm ready to share any other config on demand.Edited by: siden on Mar 24, 2020 7:14 PMEdited by: siden on Mar 24, 2020 7:22 PMEdited by: siden on Mar 24, 2020 7:24 PMFollowComment"

Answer: "0The problem was in artifact's sub-folders, it's impossible to use an artifact location as in my Buildspec:artifacts:  files:     - microservices/my-service/target/my-service.jarthe only correct way is folder/myapp.jar, for example:artifacts:  files:     - target/my-service.jarso you should specify outputDirectory in your maven config if it is different.CommentSharesidenanswered 3 years ago"


Question: User can't see 'Push notifications' option in the UI even though he has the 'AmazonSNSFullAccess' AWS managed policy

"As the title describes, the user can't see this option:Is this a lack of permissions?Using the CLI, the user is able to successfully run, for example aws sns list-platform-applications.FollowComment"

Answer: "0Accepted AnswerPossible region issue.https://docs.aws.amazon.com/ja_jp/sns/latest/dg/sns-mobile-push-supported-regions.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agoeduardomunoz 2 months agoMaybe change the link for an english version?Anyway, I can see the option. I am an admin. My user only has the AmazonSNSFullAccess aws managed policy.Share0I created an IAM with the same permissions and tried accessing it, but I could see "Push notifications" on my screen.My screen is in Japanese but it is displayed.CommentShareEXPERTRiku_Kobayashianswered 2 months agoeduardomunoz 2 months agoYou created a user which only policy is the AmazonSNSFullAccess AWS managed policy?ShareRiku_Kobayashi EXPERT2 months agoYes.I created only policy is the AmazonSNSFullAccess.Share"


Question: My domain on Route 53 is not reaching my server created on AWS Lightsail

"Hi AWS folk!I am trying to create my own website using AWS Route 53 and Lightsail.In Route 53, I registered a domain somedomain.com, and created a public hosted zone. The hosted zone configuration has four name servers that match the "Value/Route traffic to" of the NS record of the hosted zone.In Lightsail, I have created a Wordpress website. I provided a static IP to the Lightsail instance. Under Networking, I created a DNS zone (using the registered domain  somedomain.com from the previous step) which had also four name servers (different from the four name servers in Route 53).Now when I try to reach my website using the instance's static IP address it works perfectly. However, when I browse using my domain name I keep getting  "This site can’t be reached".Here's my configuration of the Route 53 Hosted zoneHere's the configuration of the DNS zone on Lightsail:Am I missing something or maybe have some wrong configuration?Any help is highly appreciated!FollowComment"

Answer: "0Accepted AnswerHi,Since you registered the domain with Route53, the nameservers listed in the hosted zone in Route53 take effect. But as per the information shared above, the A/CNAME records are created in DNS zones in lightsail and the site is unreachable.The quickest thing you can do is add the DNS records (A/CNAME) in Route53 also and verify that you are able to access the site via FQDN. If this works, it confirms that the nameservers from Route53 are used for lookup. Another alternative way to check which set of NS servers are used, you can do a DNS lookup for nameserver for the FQDN to confirm whether it's using config from Route53 or DNS zones in Lightsaildig <FQDN> -t NSHosted zones should either be created in Route53 or DNS zones but not both. If you want to use Lightsail DNS zones, then you need to change the nameservers using this link as reference--SydCommentShareSydanswered 9 months agomzamam 9 months agoThanks for the answer! I removed the Hosted zone in Route 53 and kept only the DNS zone in Lightsail. I added the DNS records (A/CNAME) in Lightsail and it worked!!Share"


Question: "Upload to S3 from Lambda doesn't create file in bucket, no error"

"I use serverless lambda to upload files to an S3 bucket with nodejs. When calling s3.PutObject nothing happens and none of my debug statements printed after that. The last line printed is '=== test 1 ==='. Please suggest possible solutions or how to track it down. Thanks.async function uploadFileToS3 (fileAttributes) {// call S3 to retrieve upload file to specified bucketconst uploadParams = { Bucket: bucket, Key: '', Body: '' };const fileStream = fs.createReadStream(fileAttributes.filepath);  fileStream.on('error', (err) => {      logger.error('File Error', err);  });  uploadParams.Body = fileStream;  uploadParams.Key = fileAttributes.filename;  logger.debug('Uploading to S3', uploadParams);  // call S3 to retrieve upload file to specified bucket  console.log('=== test 1 ===');  try {      const stored = await s3.putObject(uploadParams).promise();      logger.info('=== Upload Success ===', stored);  } catch (err) {      logger.error('=== S3 upload error ===', err);  }  console.log('=== test 2 ===');  }FollowComment"

Answer: 0The issue was that the uploadFileToS3 was called in a forEach loop which is not promise aware.CommentSharemarting456answered 2 years ago


Question: Problem with email

"Hello, I have problem with WorkMailI have solved the same problem with email several times, and they always told me that there is no problem, but the work emails don't always work for us 90% of the time. Either the message does not come, or the message goes to ads or spam. The other day I experienced an incredible shame when I sent important documents to a client and it didn't arrive several times and I had to send it from my personal gmail. It is absolutely unacceptable and I really don't know what to do anymore, it won't go on like this.
The support told me to re-verify my domain, so I did that. Can you give me any advice? have any of you had experience with this? Thanks for the answers
Thank youFollowComment"

Answer: "1I'm sorry to hear that you are having issues with WorkMail. Here are a few things you can try to resolve the issue:Check your spam and junk mail folders: It's possible that your emails are being filtered as spam by your recipient's email client. Ask your recipients to check their spam and junk mail folders to see if your emails are there.Check your email settings: Make sure that your email settings are correct, including the email address, SMTP settings, and DNS settings. You can find detailed instructions on how to set up your email account in the WorkMail User Guide.Verify your domain: As you have already done, verify your domain to ensure that your emails are being sent from a trusted domain. This can help reduce the chances of your emails being marked as spam.Whitelist your email address: Ask your recipients to add your email address to their email whitelist to ensure that your emails are not marked as spam.Contact AWS Support: If none of the above steps resolve the issue, you may need to contact AWS support for further assistance. They can help you troubleshoot the issue and provide recommendations on how to resolve itCommentShareAWS_Guyanswered 3 months ago1I'm sorry to hear that you are having issues with WorkMail. Here are a few things you can try to resolve the issue:Check your spam and junk mail folders: It's possible that your emails are being filtered as spam by your recipient's email client. Ask your recipients to check their spam and junk mail folders to see if your emails are there.Check your email settings: Make sure that your email settings are correct, including the email address, SMTP settings, and DNS settings. You can find detailed instructions on how to set up your email account in the WorkMail User Guide.Verify your domain: As you have already done, verify your domain to ensure that your emails are being sent from a trusted domain. This can help reduce the chances of your emails being marked as spam.Contact AWS Support: If none of the above steps resolve the issue, you may need to contact AWS support for further assistance. They can help you troubleshoot the issue and provide recommendations on how to resolve itCommentShareAWS_Guyanswered 3 months ago"


Question: Is it possible to allow a VPC in one AWS account to access an opensearch serverless collection in a different AWS account?

The docs for managed opensearch seem to support this:https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc-interface-endpoints.htmlbut not serverless:https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-vpc.htmlAlso the UI in the AWS console is different for both (https://us-west-2.console.aws.amazon.com/aos/home?region=us-west-2#opensearch/vpc-endpoints vs. https://us-west-2.console.aws.amazon.com/aos/home?region=us-west-2#opensearch/vpcEndpoint):FollowComment

Answer: "0Hi,It does not seem that OS serverless supports cross domain.It seems cross-account domain access for OpenSearch was recently releases for the non-serverless version in November 2022. (https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-opensearch-cross-vpc-connectivity-aws-privatelink/).OpenSearch serverless was released in preview at reinvent 2022 and made generally available in January 2023 (https://aws.amazon.com/blogs/big-data/amazon-opensearch-serverless-is-now-generally-available/).It could easily be that cross domain is not a supported feature for time being.Hopefully feature parity will be reached soon.Hope it clarifies.CommentShareEXPERTalatechanswered 4 months agorePost-User-2237608 4 months agoyea that's what I figured, could someone from AWS chime in about if this is in the works/when it would be released?With the min cost of $700 a month per AWS account for serverless (https://repost.aws/questions/QUAc9Mg6avRCy3e5kOF8v5fQ/pricing-strategy-for-open-search-serverless)  I was hoping to share one serverless setup in one AWS account, that multiple other AWS accounts (in the same region) could use via VPC connections to maximize cost savings.But if this is not supported, I wouldn't be able to do that and opensearch serverless probably wouldn't be feasible for my organizationSharealatech EXPERT4 months agoI see. If above helped anyway to make clear that is not possible, I d appreciate if answer could be accepted, to benefit clarity in community. ThanksShare"


Question: Issue with Transfer to Phone Number - External Attribute and Lambda

"Hello,Trying to set up a scenario, where an external number is grabbed from a Lambda function and then transferred to a phone number.In transfer to phone number Contact Flow block, I have it set as Use Attribute, Type External, then $.External.Address and I've logged it and it successfully is getting the number from Lambda, but when I check the log in CloudWatch there is a period (.) appended in front of it.Ex: "ContactFlowModuleType": "Transfer","Timestamp": "2020-06-28T00:14:03.276Z","Parameters": {"BlindTransfer": "false","PhoneNumber": ".+15555555555","TimeLimit": "30"}When it gets the attribute from the Lambda function it does not have the . in the ExternalResults.Example from CloudWatch logs:"ExternalResults": {"Address": "+15555555555"}The Transfer is initiated but my test phone doesn't receive the call, and the phone I'm calling from disconnects.Any ideas or suggestions on formatting would be great, been using this doc https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html#process-function-response to guide me and the Lambda function is in Python.FollowComment"

Answer: 0Amend ‘$.External.Address’To : ‘Address’CommentShareDanBloyanswered 3 years ago


Question: JITP cert not created with mbedTLS+ATECC608A (works with moquitto_pub)

"Hello,I have the following setup:ATECC608AmbedTLScoreMQTTThe certificate chain is the following: RootCA > SignerCA > DeviceCert. I've registered both RootCA and SignerCA as CAs in the AWS IoT ConsoleWhen connecting to my ats-endpoint with that stack, the TLS handshake is successul: the device cert and signerCA are presented and AWS presents its cert chain as well. mbedTLS seems to be happy.I then use the created mbedtls_ssl_context to connect coreMQTT.  From the log, coreMQTT is able to write on the socket but AWS closes the connection. I expect the first connection to fail. But in this case, the certificate does not appear in the AWS IoT console and subsequent connection attempts fail as well.I double checked the signerCA stored and its policy. They seem fine. To ensure that this confg is correct, I manually created a certificate on my machine and signed it with my SignerCA.I then used that certificate with mosquitto_pub. The process works and my certificate appears in the AWS IoT console with the correct policy attached.Another verification I've done is to check that my coreMQTT connection is correct. To connect without the JITP provisioning, I extracted the device certificate from the ATECC, manually uploaded its PEM and attached a policy to the device in the AWS console.That MQTT connection was successful (and I see the 'MQTT.Connect event in the AWS logs).Questions:mbedTLS seems to present the two concatened certificates. Would the handshake be successful if one them was not correct or if mbedTLS was misconfigured?Could the X509v3 extensions be responsible for the JITP failure? The device cert has them, while the manually-generated one has not.Is there a way to log mutual authentication failures in Cloudwatch?Is there anything that I missed?I could not attach any logs, I get the validation error "Your post contains inappropriate content. Please review and adjust before posting." when I try to include them. The full logs are available on the twin SO question: https://stackoverflow.com/questions/65735301/jitp-cert-not-created-with-mbedtlsatecc608a-works-with-moquitto-pubThanks!FollowComment"

Answer: "0I've noticed that if I don't add the signerCA to the chain when connection mbedTLS, the handshake is still successful but I get the same behaviour: AWS closes the connection and do not register any certificate. In this case this is expected because the signerCA cannot be identified.That looks like mbedTLS/cryptoauthlib does something wrong when connecting (I use atca_mbedtls_cert_add(&device_cert_chain, &g_cert_def_1_signer)) to add the signerCA to the chain).CommentSharefstephanyanswered 2 years ago0I've continued to explore the issue and can confirm that:A) a similar certificate (same x509v3 extensions, same naming scheme) sent by mosquitto_pub triggers the JITP process while my device certificates does not. After inspecting the TLS handshake with Wireshark, both send the two certificates (signerCA and end-device cert). Both have a succesful handshake, both receive a close notify message but only the mosquitt_pub one triggers the provisioning proces. This should validate that the JITP configuration (signerCA+policy) is correct.B) If I manually import the device certificate in the AWS console, attach a policy and a thing to it, the code is able to publish a message in a topic. This should validate that the TLS connection is correct and the ATECC chip works well.I don't know why the device cert chain does not trigger JITP. I've checked the TLS handshake in Wireshark and cannot see what is different between the two sessions.Edited by: fstephany on Jan 18, 2021 9:08 AM (formatting)Edited by: fstephany on Jan 18, 2021 9:18 AM (formatting)CommentSharefstephanyanswered 2 years ago0Found the issue !The problem was the AuthorityKeyIdentifier (which is 20 bytes in the middle of the cert) in the signerCA that was wrong. It is populated at runtime by the atecc. I'll double check my provisioning scripts to ensure that the signer cert def  and template regenerate the right CA out of the box.CommentSharefstephanyanswered 2 years ago"


Question: Lightsail Wordpress - Welcome to nginx!

"Hi Everbody,I have been using Bitnami Wordpress on AWS Lightsail for a year now.  When I go the home page (www.connorpek.com), now it now says "Welcome to nginx!".  I didn't change any configuration files in the terminal, and my wordpress content seems to be in the right file locations.My Wordpress installation lives at the same file path as everybody else with Bitnami wordpress, which is home/bitnami/stack/wordpress.  Research indicated my server isn't pointing my home page to the right file, which should be home/bitnami/stack/wordpress/index.php like everyone elses. Research also indicates I could make that change in the .htaccess file, but I am unable to locate that file in my Lightsail Bitnami Wordpress installation.  Research also indicates the PHP logs would give me more detail, but I'm unauthorized to access files inhome/bitnami/stack/php/logs.Thanks a bunch,ConnorFollowComment"

Answer: "0Accepted AnswerHi Gabriel,Thanks for the insight. Yes somehow I downloaded Nginx and I had to disable it then boom, the website worked again. I disabled Nginx by using the following command before rebooting.sudo update-rc.d -f nginx disableAfter rebooting, Nginx doesnt show up on the list with either of the following commands.sudo /opt/bitnami/ctlscript.sh statusps aux | grep -i nginxsystemctl list-unitsAt this point the website started working.  This problem was solved in part with assistance on Bitnami support people over on Githib.Thanks a bunch,ConnorCommentShareMichiganAndAgainanswered 8 months ago0The Bitnami WordPress image used on Lightsail works with Apache and PHP-FPM – not nginx. First disable nginx and confirm that apache is running, then try to access your site again.Typically an index.php is the default file called for a given folder, so it's unlikely adding it explicitly would fix your issue.The logs in home/bitnami/stack/php/logs/ are owned by root user so you need a command like sudo zless /home/bitnami/stack/php/logs/php-fpm.log-<date>.gz or just sudo less <some other non-gzipped log> for the most recent log files.CommentShareGabriel - AWSanswered 9 months agoMichiganAndAgain 8 months agoThank you for your attention Gaberial. We solved it between you and some Bitnami support folks on Github.  I'll be left wondering how Nginx was downloaded to my server but it's all good.Share"


Question: Which AWS load balancer type is the best for directing geographically different traffic to the nearest server?

"I am building an international web application that will primarily server American and European internet users upon launch. I plan on creating the same EC2/RDS/S3 setup in the regions Frankfurt(Europe) and North virginia(us-east-1). I want to place the EC2 servers behind one cross-region load balancer and this load balancer needs to redirect all the european traffic to the frankfurt server and all the american traffic to the N-virginia one.I've done a bit of research about Load balancers in general and i've found out that these balancers can direct incoming traffic based on different algorithm, such as Round robin, Least connections and the IP hash algorithm. The latter is the one my load balancers needs to employ because it directs network traffic to servers based on the traffic request's origin. Traffic is routed to the closest physical server for the lowest application latency.My webapplication uses a REST api to process requests. My guess is that the best load balancer for a REST webapplication would be an application load balancer because it has a wide range of routing rules for incoming requests based on host name, path, query string parameter, HTTP method, HTTP headers, source IP, or port number according to this web article. Its probably the only choice because the classic one is antiquated and the network one doesn't support HTTP. However the same article also states that for a REST webapplication an AWS API Gateway instead of an LB would generally be a better choice.  I'm not sure whether i would want to use that instead though because i've also read that API gateways can't process as much requests per second as load balancers can. (only 10,000 requests per seconds according to this article, also an API gateway still needs an LB to protect against Ddos attacks).So which setup is best if i want to serve content only from the server that is closest to the requesters location, in order to reduce latency? An application load balancer? Or would the API Gateway really be a better choice instead?Thank youFollowComment"

Answer: "4The idea using load balancer you mentioned is not that helpful to improve latency because the client must hit any load balancer prior to be redirected. And if a load balancer redirect user request to another region it would increase additional latency. Another issue you need to consider is how to maintain the regional public ip address.The better solution you can think of is using AWS Global Accelerator. Please refer to below.https://aws.amazon.com/global-accelerator/?nc1=h_ls&blogs-global-accelerator.sort-by=item.additionalFields.createdDate&blogs-global-accelerator.sort-order=desc&aws-global-accelerator-wn.sort-by=item.additionalFields.postDateTime&aws-global-accelerator-wn.sort-order=descAWS Global Accelerator is based on Anycast and it will improve latency of your application.The other option is using Amazon CloudFront. Amazon CloudFront can improve latency of your application as well.Here is difference between AWS GA and Amazon CF.Q: How is AWS Global Accelerator different from Amazon CloudFront?A: AWS Global Accelerator and Amazon CloudFront are separate services that use the AWS global network and its edge locations around the world. CloudFront improves performance for both cacheable content (such as images and videos) and dynamic content (such as API acceleration and dynamic site delivery). Global Accelerator improves performance for a wide range of applications over TCP or UDP by proxying packets at the edge to applications running in one or more AWS Regions. Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses or deterministic, fast regional failover. Both services integrate with AWS Shield for DDoS protection.ThanksEunsuCommentShareEunsu_Shinanswered a year agocloudandmedia a year agoThe other option short of using GA, is having ALB in each regions, and using Route53 geographical or latency routing to direct traffic to the nearest load balancer.ShareViridios a year agoThank you @Eunsu_Shin for your elaborate answer. However, like cloudandmedia said there is also another approach using latency routing. Could both approaches be used in tandem?Share1In AWS, an Elastic Load Balancer is not intended to route traffic outside a region. It is usually used to route to resources (EC2 instances in your case) across Availability Zones within a single Region.AWS Global Accelerator (from the other answer) is a great option. You also may want to look at Amazon Route 53, a highly available and scalable cloud Domain Name System (DNS), than can be used for routing. Route 53 offers multiple routing policies. For example, the geolocation or latency routing policies are good choices for active/active deployments like yours. For geolocation routing, you configure which Region a request goes to based on the origin location of the request. For latency routing, AWS automatically sends requests to the Region that provides the shortest round-trip time.Your data governance strategy helps inform which routing policy to use. Geolocation routing lets you distribute requests in a deterministic way. This allows you to keep data for certain users within a specific Region, or you can control where write operations are routed to prevent contention. See this to learn about different patterns for data governance. If optimizing for performance is your top priority, then latency routing is a good choice.CommentSharesetheliotanswered a year ago"


Question: How to create a TXT record in for Azure AD verification with Azure provided information.

"i have a domain registered in route53 and an Azure account that I would like to this domain for. Azure provided me with the necessary details to create the TXT record however, I am not able to create the txt records with the given information.For example:in route 53 when you want to specify an alias or hostname, when creating a txt record aws forces you to route traffic to another record in this hosted zone.There is no option to enter an Alias or hostname and the value for the Destination or points to address.My question is how can I create the TXT record with the information provided by Azure, I checked on Cloudflare and this process is relatively simple. Plug in the Details and everything works.Attached is a screenshot of a TXT record creation process that doesn't work with azure provided information.Thanks for your Help.FollowComment"

Answer: "0You don't want an alias, that's something else. More specifically, it's an AWS-specific thing to alias to explicit AWS resources. You simply want a text string, so switch the ALIAS button to off and paste your string in.CommentShareQuinnyPiganswered 6 months agorePost-User-1190270 6 months agoHi,I am afraid I am still getting the same error on Azure with the following message: Could not find the DNS record for this domain. DNS changes may take up to 72 hours to propagate, Please try again later.My txt records are as follows: Yes I switch the ALIAS button off and put the Microsoft @ symbol in quotation on separate lines as indicated by AWS.record name :something.comRecord type :TXTValue: "@""MS=************"Alias :NoTTL (seconds) :3600Routing policy : SimpleShare"


Question: Quicksight folder access

"Access to the quicksight shared folder was given as Viewer access with the Admin role. But I am being denied permission to add to the said folder. The owner of the folder tried different access and roles, but none allowed me to add to the folder. Please helpFollowComment"

Answer: "0Use the UpdateFolderPermissions operation to update the permissions of a folder. You can grant or revoke permissions in the same command. To use this operation, you need the ID of the folder whose permissions you want to view. The folder ID is part of the folder URL in QuickSight. You can also use the ListFolders operation to get the ID.Refer the below example:aws quicksight update-folder-permissions --aws-account-id AWSACCOUNTID--folder-id FOLDERID--grant-permissions Principal=arn:aws:quicksight:us-east-1:AWSACCOUNTID:user/default/USERNAME,Actions=quicksight:CreateFolder,quicksight:DescribeFolder,quicksight:UpdateFolder,quicksight:DeleteFolder,quicksight:CreateFolderMembership,quicksight:DeleteFolderMembership,quicksight:DescribeFolderPermissions,quicksight:UpdateFolderPermissions--revoke-permissions Principal=arn:aws:quicksight:us-east-1:AWSACCOUNTID:user/default/USERNAME,Actions=quicksight:CreateFolder,quicksight:DescribeFolder,quicksight:UpdateFolder,quicksight:DeleteFolder,quicksight:CreateFolderMembership,quicksight:DeleteFolderMembership,quicksight:DescribeFolderPermissions,quicksight:UpdateFolderPermissionsIf your region has already been configured within the CLI, it doesn't need to be included as an argument.You can also make this command using a CLI skeleton file with the following command. For more information about CLI skeleton files, see Using CLI skeleton files.aws quicksight update-folder-permissions--cli-input-json file://updatefolderpermissions.jsonIf your region has already been configured with the CLI, it does not need to be included in an argument.Refer to this link for understanding the same.Link- https://aws.amazon.com/blogs/big-data/organize-and-share-your-content-with-folders-in-amazon-quicksight/ -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months ago"


Question: Custom Nginx config not being included?

"I have a directory structure like so, and I want that Nginx partial to be included, but it looks like Nginx by default looks in /etc/nginx/conf.d, which.platform/hooksnginx-- conf.d--- 01_proxy.confIs it a naming convention thing? The docs aren't super clear. I'm just setting the locations to forward traffic to my React front-end server and Node back-end. I was able to do it manually but I'd rather it be fool-proof against restarting/redeploying.FollowComment"

Answer: "0The highest rated answer looks like a likely solution for AL2: https://stackoverflow.com/questions/61333676/how-to-extend-nginx-config-in-elastic-beanstalk-amazon-linux-2Basically, for location blocks use this: .platform/nginx/conf.d/elasticbeanstalk/location.confEDIT: Yup, that did the trick, and since 00_application.conf is generated by elastic beanstalk and has its own default / location block, I decided to remove that with a predeploy hook.Edited by: DoodlyDev on Dec 30, 2020 6:59 PMCommentShareDoodlyDevanswered 2 years ago0Thanks to all for looking!CommentShareDoodlyDevanswered 2 years ago"


Question: Can you combine S3 Transfer Acceleration with Horizontal Scaling & Request Parallelization?

Can you combine S3 Transfer Acceleration with Horizontal Scaling & Request Parallelization? I assume you'd just need to enable Transfer Acceleration on the destination bucket and then use the Acceleration endpoint when setting up a parallelization mechanism like TransferManager?FollowComment


Question: File Monitoring

I am trying to create a webapp that will monitor a local file and send information to a dynamodb table when a new file or folder is created.  What AWS service would be best suited for this?FollowComment

Answer: "0It is easy to implement if you are storing the files as objects in S3. S3 has a feature called Event Notifications - https://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.htmlYou can create a lambda function that will get invoked whenever an S3 Event Notification is received. This lambda function can go and create/update an entry in DynamoDB - https://docs.aws.amazon.com/lambda/latest/dg/with-s3.htmlNote that S3 does not have the notion of folders. S3 has the notion of prefixes that comprise the key to the objects and give the impression that they are like folders in a file system.CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago0Hi.@Indranil shows how to detect file creation on S3. I will answer how to detect local files.In this case, you do not need to use any special AWS services additionally.We'll look at how local file detection works, and then he'll simply use the AWS SDK to create records in DynamoDB.However, since it operates as a local monitoring process, it is better to run it as a server-side daemon program separate from the Web Application.For example, when implementing using .NET, you can detect the creation and modification of files and folders by using the FileSystemWatcher class. Hook that event and access Dynamo DB with the AWS SDK .NET.https://stackoverflow.com/questions/67214771/how-to-use-filesystemwatcher-on-linux-with-net-5-0https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CodeSamples.DotNet.htmlHowever, if the storage created can be offloaded to S3, an easier way is to use S3 Notifications to run the Lambda as @Indranil mentions.CommentShareEXPERTiwasaanswered 8 months ago"


Question: IVS - live streaming issue - Starvation start

"Yesterday I streamed a live event to IVS. most of the event was live, but between the live parts, we streamed pre-recorded video clips. Each time we played a pre-recorded video Amazon ivs console alert that we have "Starvation  start", when we switched back to the live part we got "Starvation  end"during the pre-recorded clips the audience complained that the video buffered and paused a lot. In the live parts, everything was good. can someone please help me understand why this happened each time I streamed pre-recorded video? thanks for all the help!FollowComment"

Answer: "0Please check the following to determine possible causesWhen switching to the pre-recorded content, make sure the live source is no longer connected to the IVS input. Simultaneous sources will cause ingest conflict.Is the pre-recorded content being sent to IVS with a bit rate less than 8Mbps? If a source is greater than 8Mbps this may cause problems with the IVS ingest process and a Starvation error could occur.CommentShareMike-MEanswered a year ago"


Question: Code Pipeline

So we have at least 60 projects and if we wanted to do CI/CD would we create service roles for EACH one of those projects or just one service role for the CI/CD to use to create and make stuff?Every example seems to have a single project and not a use case for a larger company.FollowComment

Answer: "0Hello!If all the pipelines are in the same account, then you can re-use the same pipeline role for all of them, no problem!MatthewEdit: You can also re-use the artifact bucket as well :)Edited by: mattsainsaws on Feb 19, 2019 2:44 PMCommentShareAWS-User-3346008answered 4 years ago0The security folks would like us NOT to reuse roles and have separation of security for each project.  Just wonder is that really what dev shops are doing?CommentShareWilliam Newsomanswered 4 years ago0Well, you can create separate roles for each pipeline too, if you prefer. I would recommend using CloudFormation if you have that number of pipelines because it would be quite arduous to create them all manually.Personally I would create a new role per pipeline that has just enough permissions to do what it needs. Although pipelines tend to have quite broad permissions in general so it's important to make sure only the codepipeline principal can assume them.I spoke to a colleague who speaks to a lot of CodePipeline customers, and he said that enterprise customers tend to have an automated process for creating pipelines (eg., CloudFormation or some custom tool) and that process creates a separate pipeline role (and sometimes even account) for that pipeline. Hopefully that gives you some ideas on how to create lots of pipelines in a secure way.CommentShareAWS-User-3346008answered 4 years ago0Thank you so much !CommentShareWilliam Newsomanswered 4 years ago"


Question: Elastic Beanstalk deploy error with specific package.json

"Elastic Beanstalk platform is Node.js 18 running on 64bit Amazon Linux 2/5.8.0.Deploy error with the message:2023-04-16 15:36:30    INFO    Environment update is starting.      2023-04-16 15:36:37    INFO    Deploying new version to instance(s).2023-04-16 15:37:12    ERROR  ** Instance deployment: 'npm' failed to install dependencies that you defined in 'package.json'.** For details, see 'eb-engine.log'. The deployment failed.2023-04-16 15:37:12    ERROR   Instance deployment failed. For details, see 'eb-engine.log'.2023-04-16 15:37:14    ERROR   [Instance: i-0aa2ec405f17059a4] Command failed on instance. Return code: 1 Output: Engine execution has encountered an error..2023-04-16 15:37:14    INFO    Command execution completed on all instances. Summary: [Successful: 0, Failed: 1].2023-04-16 15:37:14    ERROR   Unsuccessful command execution on instance id(s) 'i-0aa2ec405f17059a4'. Aborting the operation.2023-04-16 15:37:14    ERROR   Failed to deploy application.                                                                              ERROR: ServiceError - Failed to deploy application.The error shows:  'npm' failed to install dependencies that you defined in 'package.json'. But I yarn install on local machine with node version is v18.4.0 is success。The package.json is：{  "name": "aws-demo",  "version": "1.0.0",  "description": "aws demo to test package.json install ",  "main": "index.js",  "license": "MIT",  "dependencies": {    "parse-dashboard": "~5.0.x",    "parse-server": "~6.0.x"  },  "engines": {    "node": ">=16.x"  }}Can I get more details about the dependency error, or does anyone has some experience about this error? Thanks.FollowComment"

Answer: "0Accepted AnswerThere was a similar problem with the following.In that case, it seems that the instance was failing due to insufficient specs, so the specs were increased to solve the problem.If I deploy it once I have increased the specs, will it succeed?https://repost.aws/questions/QU5Nef-o8FT5uoDLO1YTho3w/elastic-beanstalk-npm-install-fails-without-error-messagehttps://stackoverflow.com/questions/71589818/why-npm-install-failed-only-in-elasticbeanstalkIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Websockets Golang Example

"I am using serverless framework to set up an AWS API Gateway websocket which calls a lambda function written in Go. Right now the handler only logs a message. I can connect to the websocket, and I can see the message is logged in Cloudwatch when I send a message through the socket, but I always get an error message that looks like{  "message": "Internal server error",  "connectionId": "eU3C1cE7CYcCJPw=",  "requestId": "eU3EQFX0iYcFysQ="}There are no errors logged for the lambda in Cloudwatch. The AWS API Gateway config looks good to me. I'm at a loss trying to think of what could cause this. Are there any examples of what a websocket handler in go should look like?My main.go:package mainimport ("fmt""github.com/aws/aws-lambda-go/events""github.com/aws/aws-lambda-go/lambda")func Handler(request events.APIGatewayWebsocketProxyRequest) {fmt.Println("default function ran")}func main() {lambda.Start(Handler)}Probably not super relevant but the serverless.yaml config:functions:  websocket-default:    handler: bin/ws    events:      - websocket:          route: $defaultThe payload I'm sending:{  "action": "whatever",  "data":  "{whatever}"}This is just a copy of my SO post but thought it might fit better here.FollowComment"

Answer: "0This method signature works. Would love some more docs/examples using golang. I have yet to successfully send a message through the socket.type Response events.APIGatewayProxyResponsefunc Handler(context context.Context, request events.APIGatewayWebsocketProxyRequest) (Response, error) CommentShareNateNanswered 4 years ago0Hey NateN, not sure if you've figured this out, but I think I have a working solution for now?I have one struct that I unmarshal the request body to EVERY TIME, no matter what the websocket action is (aside from connect/diconnect)type WebSocketRequest struct {Action string          `json:"action"`Data   json.RawMessage `json:"data"`}webSocketRequest := &models.WebSocketRequest{}if err := json.Unmarshal([]byte(request.Body), webSocketRequest); err != nil {return payloads.GenerateErrorResponse(500, err), nil}Then for the sendMessage lambda from the example they have, I use this request structtype sendMessageRequest struct {Message string `json:"message"`}sendMessageRequest := &sendMessageRequest{}if err := json.Unmarshal(webSocketRequest.Data, sendMessageRequest); err != nil {return payloads.GenerateErrorResponse(500, err), nil}And here is my test message{"action":"sendmessage","data":{"message":"sending a ws message to you! <3"}}Hope this helpsCommentShareAustinKanswered 4 years ago"


Question: How can I track down RedShift throwing errors when aggregating on an otherwise functioning query involving CTEs and UNIONS?

"I have a query (actual query is obv larger and more complex) like:INSERT INTO my_tableWITH a (SELECT timestamp, count FROM foo),     b (SELECT timestamp, count FROM bar),     c (       SELECT * FROM foo       UNION ALL       SELECT * FROM bar     )SELECT timestamp, count FROM c;SELECT timestamp, SUM(count) FROM my_table;This works fine. However when I change it  because I'm investigating the query results to:WITH a (SELECT timestamp, count FROM foo),     b (SELECT timestamp, count FROM bar),     c  (       SELECT * FROM foo       UNION ALL       SELECT * FROM bar     )SELECT timestamp, SUM(count)FROM cGROUP BY 1;It throws a Not Implemented error with code 1001. Now this is 100% a RedShift bug because it seems to not be able to track the types across my query, but my actual question is all I can see in STL_ERROR is:file,linenum,context,error../src/sys/pg_utils.cpp,2218,Not implemented,'value' - Ill formed PARAM_EXEC in expression                                                                                ../src/sys/pg_utils.cpp,2218,Not implemented,'value' - Ill formed PARAM_EXEC in expression                                                                                In STV_RECENT it doesn't even appear. How can I break down what RedShift is doing to track down the point where it's failing exactly? The only change to my original query is attempting to do a ... SUM ... GROUP 1 on the original query causing it to fail.FollowCommentjgrcloud EXPERTa year agotimestamp is a reserved word so it might be having trouble trying to associate the position alias of "1" with the reserved word "timestamp". Try using double quotes around the column name and/or explicitly using the column name in the group by rather than the position alias.Share"

Answer: "0Timestamp and Count are reserved words. It is recommended to avoid using these as column names. Else use double quotes around them in your code as shown below. Note that I have removed the table "a" and table "b" as you were not using them anywaysWITH c as (       SELECT "timestamp", "count" FROM foo       UNION ALL       SELECT "timestamp", "count" FROM bar     )SELECT "timestamp", SUM("count")FROM cGROUP BY 1;CommentShareMilindOkeanswered a year ago"


Question: Verifying Domain and Account Keeps Failing

"Hey team! I keep getting the following message...."We’re currently unable to verify your domain. You might need to wait longer for your domain host to update your information. If that doesn’t happen soon, try verifying again."I am NOT an IT professional by any means. With that said I cannot for the life of me get my domain verified. I have the right TXT type file, I did all of it but I have no clue why this is not working. Yes I have waited the 72 hours and nothing is working. I currently have 4 Types within the domain of MX, NS, SOA, and TXT. I have no idea if I need to delete them and just have TXT? No clue, but I need help please!!FollowComment"

Answer: "0I do not see an article, just a link and whatever it is you posted just takes me back to this page...CommentShareJCondlinanswered 4 months agoAWS-User-0357409 4 months agohttps://aws.amazon.com/premiumsupport/knowledge-center/route-53-verify-domain-with-third-party/Sorry about that, not sure what happened.  You should be able to copy/paste the link above.Share0Hi JCondlin,I'm making an assumption here, so please let us know if this is incorrect.  From what you described this could be verification from a third party (like for SSL).  Take a look at the following article, might be helpful.  If the context is different please let us know! Thanks!https://aws.amazon.com/premiumsupport/knowledge-center/route-53-verify-domain-with-third-party/CommentShareAWS-User-0357409answered 4 months ago0Hi, i had the same problem, did what the article said and it didn't work. What else can I do?CommentSharerePost-User-4520156answered 2 months ago"


Question: Can send but not receive email from AWS workmail.

"Hi,I can send mail fine from workmail but I am unable to receive anything. When I try sending email to the account I created under my domain admin@hallbrawl.com I recieve a response from mailer-daemon: "This message could not be delivered due to a recipient error. Please try again later.". All the records the domain verification in work mail are added to route 53 and verified. I purchased the domain through route 53.FollowComment"

Answer: "0Hi,I'm sorry to hear you're having problems receiving mail. I took a look at your account and everything seems to be in order. I do see that the Inbound rule that is configured in SES has been altered to just your email address instead of your domain. This means that just your user can receive mail and that your awsapps.com domain will not work.I recommend that you add your domain again in the WorkMail console (no need to delete it first) to set the inbound rule to the correct details.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 2 years ago0I readded the domain, and removed the ses rule to just the one email address and it can receive email now, thank you!CommentShareplawleranswered 2 years ago"


Question: Route 53 Resolver for On-Prem Access to Private API Gateway over Direct Connect Options

"I have API Gateway Private API using a VPC end point that will only be accessed by clients (browser and applications) from on premises over Direct Connect.   x-apigw-api-id:{api-id} Header is not an option as some application code can not be modified at this time.  The interim solution is NGINX on Fargate, but I want a solution without a proxy in the middle for operational simplicity.I have created a forwarder zone for {restapi-id}.execute-api.{region}.amazonaws.com on their on-prem DNS pointing to their deployed Route 53 Inbound Resolvers.  What I have found is that the first response for an API Gateway DNS name is a CNAME to execute-api.eu-central-1.amazonaws.com, which will never get resolved up to an A record by our DNS or internet forwarders.A request directly to the Route53 Resolver using the FQDN for the private API will work because a client will ask the same Route 53 Resolver again to resolve the CNAME.  However, I want clients talk to a local DNS server, which forwards to Route 53 Resolver, the returned CNAME is queried against local DNS which gets forwarded to internet instead of last used resolver.Options: Is there a recommended pattern?Option 1 - Create forwarding zone for execute-api.eu-central-1.amazonaws.com.  This will solve the problem, however that means prod/non-prod API-gateway requests will go through a single VPC.  However I want isolated prod / non-prod environments.Option 2 - Dedicated VPC with Private API Gateway, Route 53 Resolver, and VPC Endpoint used for all regional on-prem API access requests.Option 3 - A configuration (QiP / BIND) to re-ask last resolver for CNAME.Additional Questions1 - Is there an option I am missing or even better a recommended architecture for this use case?2 - Are there configurations I'm missing on Route 53 resolver to return the A record to the client?  Have Route 53 Resolver ask for A records when receiving a CNAME.FollowComment"

Answer: 0Accepted AnswerAll the options you've listed are valid although it looks like the first two are mixing prod and no-prod environments which you don't want to do.The 3rd option (if technically possible is the cleanest). You could configure the on-premise resolvers to either override the CNAME resolution ( example for BIND: https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html) or just create local zones for their private API hostnames ({restapi-id}.execute-api.{region}.amazonaws.com) and include A records directly to the IP addresses of the API endpoints (they don't change).One addition option that comes to mind would be to deploy ALBs in front of the Private API endpoints. It's still a proxy approach but at least using managed services instead of NGINX.API requests would go to an internal ALB first (using any domain/hostname) which would forward it to the IP addresses of  Private API endpoints (again IPs don't change).  One extra step required would be to create appropriate mappings under "Custom Domain Tab" of API Gateway and correlate the domain used on ALB with the actual API. Because private mapping is not included you would create it as regional or edge mapping and it would still work.TomCommentShareEXPERTAWS-User-7100868answered 4 years ago


Question: Is WorkDocs a good fit for transactional/customer-based organization of documents

"I work for a logistics company that has thousands of customers and thousands of transactions every day.Every customer and every transaction has important documents associated with it, and these are frequently passed around over email and difficult to locate.We are migrating our operational applications to AWS and wanted to know if integrating with the WorkDocs API would enable easy access to documents, searching by customer, transaction ID or other operational property.Has anyone dealt with a similar use case and can you share your experience/recommendations?FollowComment"

Answer: "0Yes James, you can. On this WorkDocs page we have a lot of use cases to help you understand and get ideas for your environment.https://aws.amazon.com/workdocs/And, to use APIs to improve your usability, you can integrate WorkDocs with another tools, like Kendra, to maximize capabilities of intelligent search in your company.https://aws.amazon.com/blogs/machine-learning/get-started-with-the-amazon-kendra-amazon-workdocs-connector/You can edit online, without need a Office editor in PCs or workstations:https://aws.amazon.com/blogs/aws/new-collaborative-editing-for-amazon-workdocs-powered-by-hancom-thinkfree-office-online/So, many options to help you.CommentShareBruno Lopesanswered a year ago0So after experimenting with WorkDocs for a bit, I'm not able to see how it or the integration with Kendra would satisfy some requirements.We have thousands of transactions in our company every day and each of these generates documents. We would need to be able to search for documents with a variety of parameters:Our internal transaction number that we generateThe customer's reference number that they generateCustomer nameTime rangeEtc.A possible solution would allow us to attach metadata to documents stored in WorkDocs, and then provide a search function by that metadata.Of course, we could build something like this using S3 for file storage and DynamoDB for metadata storage, but then we would need to build our own search interface and it would be a lot more work than a managed solution.Please let me know if I'm missing something with AWS's current offering.Thanks!JamesCommentShareJamesanswered a year ago"


Question: Attributes and Dimensions from Segments are empty values when retrieving data from Pinpoint API

"I am trying to get the column and rows for customers from an AWS Pinpoint segment. To do so I used the boto3 SDK. Its my understanding from the docs that the get_segment method will contain the data for the segment in the attribute and dimension keys .When I try to load the attributes and dimension from an AWS Pinpoint segment using boto3 in an lambda function the dimensions and attributes show up as empty.here is what my code looks like:client = boto3.client('pinpoint',region_name='us-east-1')response = client.get_segment(        ApplicationId=appid,        SegmentId=segment_id    )        print(response)the response I am getting is this:"SegmentResponse":{      "ApplicationId":,      "Arn":,      "CreationDate":"2023-05-25T13:48:41.464Z",      "Dimensions":{         "Attributes":{                     },         "Behavior":{                     },         "Demographic":{                     },         "Location":{                     },         "UserAttributes":{                     }      },      "Id":,      "LastModifiedDate":"2023-05-25T13:50:51.675Z",      "Name":"test 1",      "SegmentGroups":{         "Groups":[            {               "Dimensions":[                  {                     "Attributes":{                                             },                     "Behavior":{                                             },                     "Demographic":{                                             },                     "Location":{                                             },                     "Metrics":{                                             },                     "UserAttributes":{                                             }                  }               ],               "SourceSegments":[                                 ],               "SourceType":"ANY",               "Type":"ANY"            }         ],         "Include":"ALL"      },      "SegmentType":"DIMENSIONAL",      "tags":{               },      "Version":3   }As you can see the dimensions and attributes are empty. When I create an export for the segment, the csv file populates properly and the correct data is given out with the correct format as well. The segment created is dynamic and uses the imported static segment as the base. If there is an error with the format then it wont take the csv file as an upload.*ApplicationId, Id and Arn show up fine in the response. I took it off for security reasons.When I tried pulling the data with the static up csv as the input, the Attributes and Dimension fields dont show up. I created another segment using the static segment as the base since the new segment would end up being dynamic. The dynamic segment then at least had the dimensions and attribute fields show up, but it is still empty.FollowComment"

Answer: 0https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-segments.htmlGetSegment doesn't give you the actual data but the segment definitionCommentShareAnaAtAWSanswered 5 days agoaalnoor 5 days agoThen how do I retrieve segment data / values from Pinpoint into Lambda ?Share


Question: Unconfirmed email in cognito userpool

"I'm filtering email in pre-signup lambda function those emails are in cognito userpool can't be used again for sign up, but there is a situation if user leaves an email unconfirmed and latter user uses that mail for signup then pre-signup function will not allow. Tell me should I filter email in lambda or remove the lambda and allow duplicate entries?FollowComment"

Answer: "1Accepted AnswerI would suggest you 2 approaches:I would suggest to enforce “Allow Cognito to automatically send messages to verify and confirm - Recommended”**, this will avoid having spoof email users duplicated, as the email will require confirmation for account creation, mitigating duplicates with unverified emails.The second option is to have a scheduled Lambda to check and verify emails against unverified and clean up accounts that are not necessary; this is not a best practice as you may run into issues Lambda Timing out after 15 min (depending of the size/users inside of the UserPool), you may want to use this to clean the UserPool, but I would suggest you to look into a different Sign-up flow.CommentShareMaverickanswered 9 months ago"


Question: ErrorMessage: 'Destination ..... is not referenced

"Hi,I'm trying to manage MediaLive with AWS SDK(node.js).I have managed create MediaPackage Channel, MediaLive Input.But now I get weird error 'ErrorMessage: 'Destination "..." is not referenced' when I try to create MediaLive channel.here's my parameters passing to CreateChannelCommand.(I don't know how to make a code block so please forgive me about poor indented code.)const params = {Name: channelName || "TestChannel",ChannelClass: "SINGLE_PIPELINE",InputAttachments: [{InputId: mediaLiveInputId, // MediaList Input IdInputAttachmentName:"Default Input"}],InputSpecification: {Codec: "AVC",Resolution: "HD",MaximumBitrate: "MAX_10_MBPS"},Destinations: [{Id: output-${mediaPackageChannelId},MediaPackageSettings: [{ChannelId: mediaPackageChannelId || "TestMediaPackageChannel"}]}],EncoderSettings: {},OutputGroups: [{OutputGroupSettings: {Settings: [            ],              MediaPackageGroupSettings: {                  Destination: {                      DestinationRefId: `output-${mediaPackageChannelId}`                  }              }          },          Name: "MediaPackage-group",          Outputs: \[              {                  OutputSettings: {                      MediaPackageOutputSettings: {                          Destination: {                              DestinationRefId: `output-${mediaPackageChannelId}`                          }                      }                  }              }          ]      }  ]  I think I'm definitely referencing output-${mediaPackageChannelId} in MediaPackageOutputSettings under OutputGroupSettings and OutputSettings attributes.I can't figure out what am I missing.Please shed some light on me!Thank you for reading this! :)Edited by: netscout on May 4, 2021 12:34 AMEdited by: netscout on May 4, 2021 12:36 AMEdited by: netscout on May 4, 2021 12:41 AMFollowComment"

Answer: "0it was purely my mistake, I misplaced properties. :)CommentSharenetscoutanswered 2 years ago"


Question: Amazon connect claimed phone number is not released when instance deleted

Registered an Amazon connect instance for testing for few hours and deleted the instance.The claimed phone number is not released and the charges is keep counting about $0.05 per day.Raised case number 9272564611.Is there anyone facing this issue?FollowComment

Answer: "0My understanding was that you're charged like $1/day for that number for a month. So after a month the charge will drop off.davidCommentSharedmaciasanswered a year ago0Hi AllMy support case had been resolved.To update, the charges will still going on from nov to dec (cross month) until support team explicitly stop it.I will remind myself to always delete phone number before delete amazon connect instance next time to avoid this bug from ocurring.CommentSharefyhaoanswered a year ago"


Question: Why give a cached gzip object?

"HiI've added support for brotli enabled servers and already gzip too before times.and then was push to invalidation ALL contents.First case, contents fetch with "Accept-Encoding: br, gzip" first then got a response content encoded by "br", and then if I fetch with just gzip I get gzip OK.Second case, after invalidation, contents fetch first with gzip then got a response gzip content, then request with "Accept-Encoding: br, gzip", Edge has been responding with cached "gzip" content.https://i.imgur.com/1KTc87n.pngPlease investigate to this.Edited by: hedy on Oct 6, 2020 4:09 PMFollowComment"

Answer: "0I also saw this. gzip seems to take precedence in the edge cache. I think it's a bug, and I mentioned it on another thread, but there was no reply. I think this makes Brotli support useless currently.CommentShareHMOFanswered 3 years ago0well.. I've made sense throught that has been explained "When caching compressed objects is enabled for both compression formats" session in this document to behavior about enabled both type compression.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-understand-cache-policy-settingsIt hope you helpCommentSharehedyanswered 3 years ago0in myself, understood this behavior through docs.CommentSharehedyanswered 3 years ago0Thanks, yes I agree it makes sense to serve gzip out of the cache rather than to fetch brotli from the origin, which would take probably take longer at all. I think it should still prioritise br if it has both in the cache and I'm not sure it does but that is not so important.CommentShareHMOFanswered 3 years ago"


Question: "Creating CloudFront Distribution, where do I enter my domain name?"

"Hi,I am trying to create a CloudFront distribution for S3 bucket that has static website.For origin domain, I have selected the Bucket website endpoint address.How do I let CloudFront know my website address (like example.com or www.example.com format)?Also, are there any benefits to having an Origin path?FollowComment"

Answer: "1Accepted AnswerIn the console, you add them under "Alternate domain names". The field is "Aliases" in CloudFormation.CommentShareEXPERTkentradanswered 10 months agoEXPERTToni_Sreviewed 10 months ago"


Question: Nested quires for cloud insights

"I have two queries to run aws lambda cloud watch logs. The first query returns me the requestId of lambdas based on the condition used.fields @requestId|filter objectType=“filter-keyword"I want to use the requestId's returned by the above query to check lambda average duration for those request id's  only.filter @type = "REPORT"| stats avg(@duration), max(@duration), min(@duration) by bin(5m)Is it possible to achieve this in same query? does cloud watch insight query support nested queries?FollowComment"

Answer: "0Hello,I would like to mention that currently Logs Insights query does not support nested queries.We already have an internal feature request for the same and I have gone ahead and associated this query to it in order to further escalate this feature. However please note that I cannot provide you with an ETA as to when this will be available.As a possible workaround you can achieve this by programmatically running insights queries using StartQuery/GetQueryResults APIs[1][2] via custom code/script.I hope you find the above information useful.Stay safe and have a nice dayReferences:[1] https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html[2] https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.htmlCommentShareSUPPORT ENGINEERrePost-User-2839631answered 19 days ago"


Question: i passed aws cloud practitioner but havenot recevied any mail or update

"hii,i cleared my exam and as soon as it completely says you are passed aws cloud practitioner certification but now it is 4 hours have not received mail or update in certification platform .please have a look ...FollowComment"

Answer: "0Accepted Answerrohan099,Upon completing your exam, you will receive a pass or fail notification on the testing screen.Our exams use a scale-scoring method. You will receive an email confirming your exam completion. Your detailed exam results will be available within five business days of completing your exam on your AWS Certification Account under Previous Exams. Our practice exams use a percentage scoring method. You will receive an email after completing your exam, which includes your detailed exam results. Within five business days of completing your exam, your AWS Certification Account will have a record of your exam results under Previous Exams.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago"


Question: AWS S3: Live video streaming data storing into S3

"Hi,Need help on understanding AWS S3 side of it.Use case:We are looking to develop use case where from IP camera will going to send the continuousvideo streaming data and we are looking to store in AWS s3 bucket. So wanted to understand is that good fit. How AWS S3 how it will store live streaming video data into S3 bucket.-Also from Pushing live video streaming data into S3 bucket. Some other Object detector process will going to read from S3 bucket continuously.  Could you please help me on this points.FollowComment"

Answer: "0Amazon Kinesis Video Streams (KVS) was built to help with this kind of use case: https://aws.amazon.com/kinesis/video-streams/. With KVS you can publish your live streaming video from a camera, store the media for retrieval at a later time via a variety of APIs such as GetClip, and consume it via a live streaming session via HLS or DASH.A two-part video tutorial was recently posted about how to use KVS to publish video from an existing RTSP camera, and to then extract images from the live stream for use with Rekognition for object detection.KVS ingestion from RTSP cameras a Kinesis Video Streams tutorial: https://www.youtube.com/watch?v=nVxwX7Q9nPUKinesis Video Streams (KVS) RTSP Stream Part 2 - Image Extraction to S3 for Rekognition: https://www.youtube.com/watch?v=pUvxI76YnfASee the following documentation to get started with KVS: https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/getting-started.htmlCommentShareEXPERTDavid Maloneanswered 10 months agorePost-User-5246578 10 months agoThanks David for quick response.Actually we are building own object detection module and we just wanted to store the live video streaming data which is coming from camera and also object detected video/images into S3. In this context is that good solution to use S3?My main concern is how to store video feed into S3 bucket. Could you please help me on this.Share0Actually we are building own object detection module and we just wanted to store the live video streaming data which is coming from camera and also object detected video/images into S3. In this context is that good solution to use S3?My main concern is how to store video feed into S3 bucket. Could you please help me on this.CommentSharerePost-User-5246578answered 10 months agotranzmatt 3 months agoWere you able to get a solution?  I have need of the same capability.Share0Hello! Did you end up figuring out how to do this? Maybe something like https://vuild.io can help you. I'm happy to chat with you to see how I can help, reach out via the contact form on https://vuild.io.CommentShareirwinbanswered 6 months ago"


Question: AWS SSO with Microsoft AD as IdP

For our customer we want to use AWS SSO with an already existing Microsoft Active Directory on-premise infrastructure and therefore establish a trust relationship between AWS SSO and a self-managed Active Directory (on-premise). Is it possible to use an read-only domain controller (RODC) at the on-premise network or does it have to be a fully functional (writeable) domain controller on the on-premise network? I guess RODC will not work and would like to verify that. Thanks.FollowComment

Answer: "1In this case you have two options ,1: Use On-premises domain with AWS AD Connector ->AWS SSO2: Use AWS Managed AD two way trust with On-premises AD ->AWS SSO**With AD Connector : **AD Connector to RODC is not supported when used in combination with the Amazon EC2 domain-join feature only. If you are not using the AD for ec2 seamless domain joins then you can use AD connector with RODC.Few things to consider when it comes to RODC. An RODC is designed primarily to be deployed in remote or branch office environments.1: Read Only Domain Controllers have limitations around trust. "An RODC does not know the trust password. It will not be able to provide or decrypt referral ticket-granting tickets (TGTs). Access to writable domain controllers must always be available for cross-domain authentication to succeed."2: Example , If the ADC and RODC lose connectivity to full DC's (WAN outage), but both still have connectivity to AWS SSO ?Then as long as the RODC has been created with credential caching it may work. By default RODCs don’t cache credentials as it is sometimes considered a security flaw as the RODC is usually in an environment that is not considered fully secure and so the credentials can be stolen. But if you set it up with the caching option it should work.With Managed AD :You can create a Managed AD and setup a trust between their on-premises. The Managed AD would serve as a resource domain in a new forest. This is a recommended solution over AD connector and other options. See the whitepaper for more guidance. Note that Managed AD can be shared across accounts and regions with few clicks. https://d1.awsstatic.com/whitepapers/adds-on-aws.pdf & http://docs.aws.amazon.com/directoryservice/latest/admin-guide/setup_trust.htmlI will suggest to extend your On-premises writable DC on AWS to avoid single point of network failure and use AWS AD connector or AWS Managed AD with AWS SSO . Refer this blog to extend your domain controllers securely on AWS.  https://aws.amazon.com/blogs/security/securely-extend-and-access-on-premises-active-directory-domain-controllers-in-aws/Hope this is helpful.CommentShareMangesh Budkuleanswered a year ago0The AD connector is not an option here.For the Managed AD with two-way-trust to on-premise AD: Is using an RODC possible or does it have to be a writeable DC?CommentShareAWS-User-3705162answered a year agoCiaran Carragher a year agoThat would be a question for Microsoft, and not necessarily AWS. You would need to see if a 2-way Trust can be established between a DC and a RODC. The only way it would be a question to AWS would be if that it were possible, then would there be anything preventing the necessary configurations being made because AWS Managed AD is exactly that - managed.Share0Anyone here to answers my question? Thanks and kind regardsCommentShareAWS-User-3705162answered a year ago"


Question: Sagemaker Inference endpoint zero-downtime deployment

"Hello,Do you know how to deploy Sagemaker endopint with updated docker image using zero-downtime approach?Currently it looks like the only option to deploy new docker image is endpoint recreationThanks,OKFollowComment"

Answer: "0Hello,Thank you for using AWS SageMaker.Unfortunately, at this moment there is no such option/feature that can deploy Sagemaker endpoint with updated docker image using zero-downtime. The only way is to create a new endpoint using new docker image.CommentShareSUPPORT ENGINEERKartik_Ranswered 2 months ago"


Question: Account ************ is denied access while creating an aws glue crawler.

"Hello friends, i am creating a glue crawler that will create metadata tables of the csv files residing in my S3 bucket. I have created a role and give AmazonS3 full access and AWSGlueServieRole permissions to it. But when i create crawler it gives me error showing the account ************* is denied access. I have shared the photo of error too. Any guidance or help in this regard will be very appreciated. Thank you.FollowComment"

Answer: 0You have asked the same question here : https://repost.aws/questions/QU0Qx9IyiBSR-gH8j4P3jzZg/account-is-denied-access-whlile-creating-glue-crawler. There is a comment on that and that looks to be the issue. You are missing the trust policy for Glue service to assume the role you created.CommentSharevenky81answered 6 months agoMuhammad Imran 6 months agoThank you for your reply. Sir i am new to AWS can you please explain how can i set trust policy for glue service to assume the role. i will be very thankful to you.Share


Question: Can I have multiple DB sources for the same dataset?

"I'm evaluating different BI solutions and I have a specific requirement.Our setup has multiple DS with the same schema, e.g. Customer1DB, Customer2DB, etc.Can multiple DBs ingested all in the same dataset?FollowComment"

Answer: "0Accepted AnswerShort answer is YES, a dataset can use multiple data sources.One should simply do a full join that includes all records.The UI only allows selecting existing fields to match them, so you can't use a condition like 1=1Any help with that would be appreciated.UPDATE: The matching rule doesn't really matter, FULL JOIN will always include all records from both sides.UPDATE 2. Jan 2023 However, the result is a double set of columns, even if the two DBs and tables have identical column names."CommentShareGabriel Ranswered 5 months ago"


Question: Does Elastic Beanstalk require the use of a Default VPC?

Does Elastic Beanstalk require the use of a Default VPC? Is there a way around that (specifying a non-default VPC instead?)FollowComment

Answer: 0Accepted AnswerIt doesn't require the use of a Default VPC. You can choose any VPC.This is the step in the process when you create an environment via the console wizard where you can then choose the VPC :http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-create-wizard.html#environments-create-wizard-vpcconfigurationCommentShareEXPERTSteveS-AWSanswered 7 years agoEXPERTsedat_salmanreviewed 13 days ago0But your stupid Elastic BeanStalk solution is asking for a security group from the default VPC when the elastic beanstalk was created inside a customized VPCCommentSharerePost-User-1963437answered 3 months ago


Question: [Solved in LY 1.25] HARD CRASHES in 3D Visualization Project in LY 1.24

"I was working on my project in FBX Setting & Emotion FX (for 3D Visualization), then , I run the editor , Crash occurs 😤 😰I attached this zip file CrashDB.zip|attachment (861.1 KB)  🥺Follow"

Answer: "0Accepted AnswerHi AhmadKarami,I've created a trouble ticket for this LY-118706.SharerePost-User-8164888answered 3 years ago0I also tested it for LY 1.23, it crashes! 😭"Incompatibility" of components and slices in different versions 😱 😔SharerePost-User-8224505answered 3 years ago0@REDACTEDUSERSharerePost-User-8224505answered 3 years ago0Thank you @REDACTEDUSERSharerePost-User-8224505answered 3 years ago0Solved in LY 1.25.0.0 😍Thank you so much @REDACTEDUSERSharerePost-User-8224505answered 3 years ago"


Question: Amplify Backend only developments

"We have a unity game under development and we need to set up a  GraphQL API endpoint for being used in our frontend game.The server and frontend (unity) teams are completely separate teams. There are tons of resources on how to develop a full-stack app for instance via react and Amplify, Cognito, etc., but what if the backend team needs to develop a "Server only" implementation and be able to generate API docs for the separate client team to implement them in their frontend developments?Thanks in advance.FollowComment"

Answer: "0Hi,You could use AWS AppSync which is a managed service that uses GraphQL to make it easy for applications to get the data they exactly need. You could create an API in GraphQL and define schemas data sources, functions & queries etc. After this, you could just integrate this API with your Front End on Amplify. This way, the Backend team can manage AppSync & Backends and the Front end team would only need to develop/modify the queries to work with the GraphQL APIs on client side JS.Some articles which will be useful:https://docs.aws.amazon.com/appsync/latest/devguide/what-is-appsync.htmlhttps://aws.amazon.com/appsync/resources/https://aws.amazon.com/blogs/mobile/graphql-security-appsync-amplify/https://aws.amazon.com/blogs/mobile/appsync-microservices/ThanksCommentShareRamaanswered 3 months ago"


Question: Can I use Control Tower to automatically deploy infrastructure *other* than VPC

"I understand that Control Tower Account Factory can automatically stamp out VPCs with all the fixin's for each provisioned accountI ALSO understand I can use Service Catalog with Control Tower to give users of these provisioned accounts the ability to deploy additional infrastructure such as application stacksBUT, can I somehow configure Control Tower to deploy said additional infrastructure (such as application stacks) for me at the time I provision the account?FollowComment"

Answer: "2Accepted AnswerHere are the common approaches I've taken with customers, each has their pros and cons and it's really more about what the customer's preferred method is:Use Service-Managed StackSets that are tied to OU: this allows for a more managed approach where CloudFormation will trap events from Organizations and deploy and/or remove stack from accounts. That means, that once you create an account via Control Tower, these Stacks will be automatically provisioned.This is done using Service-Managed Permissions, you can control the behavior but when an account is added to an OU (created or moved) CloudFormation will automatically create a Stack Instance. You can control if you want these to be retained if an account is removed.Use Lifecycle Events to trigger off <something>, these are most commonly Lambdas that implement the logic (e.g. deploy CloudFormation template or add Stack Instances), but also sending an SNS notifications that'll be trapped by your preferred provisioner (say Terraform). This gives greater flexibility but requires more management/responsibility from the customer.(Somewhat related to #2) Defined Service Catalog Portfolios per OU or type and have both shared Products available to accounts but also some provisioned into accounts. This allows for a combination of control and management.I have done this using the Lifecycle Events and a (fairly) short Lambda that checks for a Portfolio matching the OU name, if found - it leverages the AWSControlTowerExecution Role to assume and provision into the target accounts. You may want to consider a different matching and/or clean up too.Customizations for Control Tower is an implementation of #2 and (IMHO) fits well for customers that have used the AWS Landing Zone solution previously or are familiar with it.P.S. Control Tower "on it's own" doesn't go into the deployment side.CommentShareEXPERTRaphaelanswered 3 years ago"


Question: "Rekognition has experienced service issue" while training in custom labels

I receive the following error when training a model with Custom labels with a  small dataset (around 500 images):Model Status: "TRAINING_FAILED"Status Message: "Amazon Rekognition experienced a service issue."I have received this error 6 times ranging in the past 3 days. The training process runs for a few hours failing.Any help will be appreciated on this issue.ThanksFollowComment

Answer: "0Hello AWS-User-4500359, thanks for using Amazon Rekognition Custom Labels. Our team has noticed these training jobs that failed due to service issues in the last few days, and is currently investigating what is the root cause.Thanks,aws-cdunnCommentShareaws-cdunnanswered a year ago0Hello,Thanks for your patience! To better assist you, do you mind open a support case following the instruction below? https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlThanks,aws-renjunCommentShareaws-renjunanswered a year ago"


Question: How to update Lambda Python 3.6 to 3.9

1 - How do i update in AWS console GUI dashboardFollowComment

Answer: "1Accepted AnswerWhen you are on the Code tab in your lambda function, scroll all the way down below your code.You will see "Code Properties" followed by "Runtime Settings".In "Runtime Settings" click on the Edit button and you should be able to change the Python version to 3.9CommentShareEXPERTIndranil Banerjee AWSanswered a year agoNomanM a year agoYes, when I updated the python version 3.6 to 3.9 then I got the error as below:[ERROR] Runtime.ImportModuleError: Unable to import module 'src/myLambdaFunction': No module named 'cv2.cv2'Traceback (most recent call last):However, when I reverted back to 3.6 it was working. I have deployed the zip package already with lambda. So what I need to update or change to fix it ?Share"


Question: "T3 Free Tier causes costs after 7 months, but nothing changed"

"I've created my amazon AWS account on 2022-08-28 for trying out the service under the free tier.I've created a  t3.micro instance back then in Stockholm, because t3.micro instances were available there which are covered by the free tier.I've been running this happily for the first 6 months. I was not charged during this time, as this is covered by the free tier.However, on 2023-05-02 I received an EMail from amazon aws with the title "Amazon Web Services Billing Statement Available", wherein it states that my account will be charged $34.19. The amount was billed to my credit card and I see it on my bank statement.This is a surprise to me. There should not be a bill. The billing information states that the billig amount is for $0.05 per vCPU-Hour of T3 CPU Credits, and that 574.569 vCPU-Hours were used, which amount to $ 28.73 before tax.This must be wrong. The T3 has a feature which can cause it to use more vCPUs. This feature is probably switched on, but this feature cannot have been used, because the t3.micro instance runs only a single-threaded process since I started using it last year. It's the same process. The process wasn't restarted. The process does number crunching only. It uses only one thread.The process has been running there for 6 months and I didn't get billed, and now suddenly amazon aws claims that the instance started to use more vCPUs. This is impossible.There is something wrong with how amazon AWS counts CPU usage. How to object the billing and notify amazon AWS about their failure?FollowCommentDaniel 16 days agoThe costs come from "Amazon Elastic Compute Cloud T3CPUCredits" and under that from "$0.05 per vCPU-Hour of T3 CPU Credits". The amount is 574.569 vCPU-Hours.Share"

Answer: "0What type of storage are you using for this EC2-Instance? Do you have Snapshots or any Backup method turned on? Cost Explorer should be able to share more information under the Sub-Service of EC2-Other and sort it by API Operation or Usage Type.https://aws.amazon.com/blogs/aws-cloud-financial-management/tips-and-tricks-for-exploring-your-data-in-aws-cost-explorer-part-2/CommentShareDavidanswered 16 days agoDaniel 16 days agoI had confused storage and traffic and removed that part of my question, because it is all right what happens there. The original main problem is still unchanged. Just for completeness: I don't have any snapshots. The storage is 29GB. It's one EBS.ShareDavid 16 days agoIt does sound like this instance is busting and expending the CPU credits. Have you checked out the CloudWatch records for CPU Utilization yet?Share"


Question: "Buildspec file, pass env var to Dockerfile?"

"Hi,I have a buildspec file. In prebuild I got:pre_build:commands:IMAGE_TAG=$(cd src && git rev-parse HEAD | cut -c 1-7)Then I have a build phase and in Dockerfile I have command go build, how to pass it rev-parse HEAD from pre_build to Dockerfile?Dockefile is building in a separate container which is not seeing git rev-parse HEAD from pre_build phase.RUN go build -v  -ldflags=" -X 'main.BuildSha=$(git rev-parse HEAD)'"FollowComment"

Answer: "1Accepted AnswerHi,You should use the the ARG option in Dockerfile along with --build-arg when building the image. You might find this blog helpful - https://blog.bitsrc.io/how-to-pass-environment-info-during-docker-builds-1f7c5566dd0e--SydCommentShareSydanswered 8 months ago"


Question: about AWS-Parameters-and-Secrets-Lambda-Extension for cross AWS account

I am developing a lambda function which retrieve the secret from another AWS account's secret manager. It works by granting assuming role in my own AWS account's lambda and editing the target AWS account trust policy.Now I would like to cache the secret in the lambda so as to lower the calling secret manager frequency. I find AWS-Parameters-and-Secrets-Lambda-Extension useful but lack of cross account example.  Is cross account workable for this extension?FollowComment

Answer: "0It looks like there's a missing piece for cross-account.  I see in https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html that the extension allows you to specify the secret by ARN as well as name, so you can reference a secret in another account.  Your execution role can be set up to assume a suitable role in that other account.  But the problem is getting the extension to do that role assumption - I don't see a way to make that happen.Depending on your lambda's calling frequency you can at least do some basic caching of the secret by retrieving it outside of the handler function so it's reused for multiple invokes over the lifecycle of the runtime container.CommentShareEXPERTskinsmananswered 10 days ago"


Question: AWS DRS uses Encrypted EBS volumes for the Failover and failback servers ?

"AWS DRS uses EBS Volume Encryption for Data Replication.However when I have launched Recovery Instance in the AWS DRS, it has EBS Volume which is encrypted.We do not want encrypted EBS Volumes in our servers so what the option?AWS DRS is not suitable for us in such cases?FollowComment"

Answer: 0My understanding is AWS DRS uses EBS Volume Encryption for Replication Servers not for the Server which would be launched in Failover or failback process.Please clarify. Need Urgent help on this.Thanks.CommentShareAWS-User-2560483answered 4 months ago


Question: Can't connect to Lightsail instance

"I wanted to connect to my database remotely and did some modifications to allow this. Followed the instructions in the Connect To MariaDB From A Different Machine page. Hit a bump in the first step; the ufw command was not recognized. So I tried to find a way to install it and followed the instructions in the -bash: ufw: command not found (ubuntu 18.04) page.I did all that and now I can't connect to my instance. The site in the instance is inaccessible. Can't connect using SSH or FTP. Can't ping the IP.Restarting the services and/or the instance did not work. If I click on the "Connect using SSH" button in the instance page (in the Lightsail console) and wait long enough, I get the following error:An error occurred and we were unable to connect or stay connected to your instance. If this instance has just started up, try again in a minute or two.UPSTREAM_NOT_FOUND [519]How can I regain access to my instance back? If the instance is not salvagable, is there a way to, well, salvage the database (and maybe the project files)?FollowComment"

Answer: "2Accepted AnswerHi Akinuri,Enabling ufw on a Lightsail instance can block you out of your instance. This has happened to me a while ago. You cannot ssh or connect to your instance through a browser-based ssh client. To recover my instance I took a snapshot of it since I did not create a backup on launch and created a new instance from it. You can use your backup if you have. When you launch the new instance via console add the following script as a launch script to disable ufw:sudo service ufw stopYou can also use AWS CLI to launch the new instance from a snapshot by running the following command:aws lightsail create-instances-from-snapshot --region <snapshot-region> --instance-snapshot-name <snapshot-name> --instance-names <new-instance-name> --availability-zone <preferred-AZ> --user-data 'sudo service ufw stop' --bundle-id <value>Alternately, you can export your Lightsail snapshot to Amazon EC2 by following the steps here and here.  Additionally, here is a video tutorial  on how to export Lightsail instance to Amazon EC2 instance.Hope this helpsCommentShareCebianswered a year agoakinuri a year agoHi. I tried creating a new instance from a snapshot (that is taken after the problem), but all I did was reboot the instance, which did not help. I tried the launch script approach twice, and it did not help, at first. Then I started looking into the EC2 approach. While doing that, I tried to connect to the instance (that run a launch script) again and it worked. I guess I had to wait some time. Exported the db and the files and moved to a new instance. So, thank you :)Shareakinuri a year agoAlso, since the instance with lauch script worked while I was halfway with the EC2 approach, there were some snapshots, volumes, etc. in the EC2 console. I started a clean up; deleted an instance, an AMI, a volume, and a snapshot. Then I checked the Resources card in the Dashboard and I saw one in Security groups.There seems to a resource, VPC. I'm not familiar with this. Was this created with the "Export to Amazon EC2" task? Or was it always there (and somehow related to Lightsail)? I'm not sure if I should delete it.Share"