Question: Our website is down (and so is our app connected to it)

"Hi! Can you help us? Our website: https://admin.bringme.cc has been down for a few hours now.You can access the site, but once we login with our account, it will just load for a long time.We're not sure what the problem is as we are not tech savvy and our developer hasn't been responding. This site is where we monitor our delivery orders and it is actually connected to our app. Hope you could assist us.FollowComment"

Answer: "0Troubleshooting this sort of problem requires a lot more information and access. Hopefully this has been resolved but if you need some consulting help, take a look at AWS IQ.CommentShareEXPERTkentradanswered 2 months ago"


Question: RDP Connection Issue

"I am not able to connect to EC2 Server via RDP after I accidently stopped the "Terminal Service", is there any method to run "Terminal Service" and enable the RDP? Thanks a lot for your help.FollowComment"

Answer: "0The RDP connection problem is resolved after I stop the Instance, then start the Instance after 10 minutes.CommentSharePeterZYSanswered 2 years ago"


Question: Distribute data on OpenSearch Data Nodes

"Hello Everyone,I have a small query related to AWS OpenSearch.We have create a OpenSearch Cluster with 4 Data Nodes and 3 Master Nodes with 2500GB Volume size.Now the issue is 1 data node shows available space is 232 GB and another 3 Data Nodes shows available space is 1345GB. 1329GB,1325GB.As per my understanding Data node 1 store more data as comparison to other Data Nodes.So is there any way that we can split equal amount of data among all the Data Nodes..?FollowComment"

Answer: "0This is a highly unusual distribution since Opensearch does a pretty good job with evenly distributing the data across the nodes. Check for the cluster state to identify if any shards are unallocated, if shards are evenly sized,  if shard allocation is disabled or any nodes are excluded from allocation (maybe accidentally). You also have the option of moving shards though this should be your last resort.You can also refer to this document - https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-rebalance-uneven-shards/ and some related links within the document--SydCommentShareSydanswered 8 months agoHimanshu Sharma 8 months agoThanks for the suggestionsI have investigated this issue and found that 1 data node store two times of same indecs due to that it's available space in 232GB.When i check indecs distribution to nodes i got below results=================================================================================testing_index              1     p      STARTED 53060777      1tb x.x.x.x  3ca476458dc48402b73b52f20b9b6be4testing_index               3     p      STARTED 53076189      1tb x.x.x.x  f0dea9df2df7c2c1a151502fafd29e28testing_index               4     p      STARTED 53085330      1tb x.x.x.x  f0dea9df2df7c2c1a151502fafd29e28testing_index              2     p      STARTED 53078362      1tb x.x.x.x 2b9c9b54732795e41836ab950066813atesting_index              0     p      STARTED 53070442      1tb x.x.x.x  42e5f2d7ba49896f5b13c0c458d0d47cShareSyd 8 months agoYour index is configured to have 5 shards where as you have only 4 data nodes. So one of the data nodes would have more data than the other since it has to hold the extra shard. The simplest thing to do is add a data node. Also from the info you shared I sense there is only one index with no replicas and each shard being 1TB in size. This shard size is way too large (50Gb is max recommended by AWS) and would affect the ability of the cluster to recover during any data nodes outages. Depending on your use case you should spilt the data into multiple shards / indices.Refer to this document https://docs.aws.amazon.com/opensearch-service/latest/developerguide/bp.html especially the Shard Strategy sectionShare"


Question: Multiple DB instance sync up

Can you please suggest the best approch for synching  two or multiple database instances .FollowComment

Answer: "0HiI understand you are trying to find a best way to sync two or  more  multiple instance.Instance per instance syncing you need to setup logical replication (one way) or physical replication (read replicas).well, you can sync database in RDS instance by implementing replication[1], remember that an RDS instance can have up to 5 read replicas. and if you setup your own logical replication you can have more, but for logical replication, it depends on storage available,CPU, memory etc.Reference link1.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.htmlCommentSharestevenanswered a year ago"


Question: DMS Migration project creation console does not show any source data providers

"I am trying to create a DMS migration project, but I cannot select any source data provider as the selection list is appearing as empty. Even though I have two data providers in the relevant region (US-EAST-1) neither of these are appearing the source data provider selection screen. On the other hand, both of those data providers are appearing as valid options for the target data provider. The two data providers I have are both Aurora Serverless MySQL databases .FollowComment"


Question: Aws ec2 instance  regulary not reachable

"Hi ,I am using free tier,  using EC2 instance and mounted extra 25 gb voulme to instance also,  my instance regularly getting not reachable,The status check log is :    Instance reachability check failed ,  please can anyone check what is this issue?FollowComment"

Answer: "0Hi,reasons can be many.I would suggest to look into following resources as could be a combination of network, memory or device issues. To troubleshoot:https://repost.aws/knowledge-center/ec2-linux-system-status-check-failurehttps://repost.aws/knowledge-center/ec2-windows-instance-status-check-failCommentShareEXPERTalatechanswered 13 days agorePost-User-3706207 13 days agohi @alatech,I was attached extra 25 gb of volume to intance , but now i am checking df -h   , the voulme is not showing?   how this vpolume automaticaly unmount from ec2?And also this ec2 can't reachable error is coming every 4 hoursShareRWC 12 days ago"df -h" won't show the new EBS device, this will only show the mounted filesystems."lsblk" should show all attached block devices.Share"


Question: Red ElasticSearch 5.5 cluster due to NODE_LEFT with running snapshot

"There is a cluster that, due to losing a couple of nodes has a single shard in UNASSIGNED state.TL;DR;: The shard can not be rerouted due to AWS limitations, index can not be deleted due to running snapshot (for over 18 hours now), cluster has scaled to double its regular size for no obvious reason and snapshot can not be cancelled because it is one of the automated ones.What could be done to get the cluster back to green health? Data loss of that single index should not be a problem.Detailed explanationSymptomCluster in red health status due to a single unnasigned shard. A call to /_cluster/allocation/explain returns the following:{    "index": "REDACTED",    "shard": 1,    "primary": true,    "current_state": "unassigned",    "unassigned_info": {        "reason": "NODE_LEFT",        "at": "2021-12-01T21:27:04.905Z",        "details": "node_left[REDACTED]",        "last_allocation_status": "no_valid_shard_copy"    },    "can_allocate": "no_valid_shard_copy",    "allocate_explanation": "cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster",    ...Cluster reroutingRegular troubleshooting on the matter indicates that one could take the data loss by reallocating the shard to empty using something like:$ curl -XPOST '/_cluster/reroute' -d '{"commands": [{ "allocate_empty_primary": { "index": "REDACTED", "shard": 1, "node": "REDACTED",  "accept_data_loss": true  }}]  }'{"Message":"Your request: '/_cluster/reroute' is not allowed."}But that endpoint is not available in AWS.Closing/Deleting the indexOther suggestions include closing the index for operations, but that is not supported by AWS:$ curl -X POST '/REDACTED/_close'{"Message":"Your request: '/REDACTED/_close' is not allowed by Amazon Elasticsearch Service."}Another solution is to delete the index. But, as there is a running snapshot, it can not be deleted:$ curl -X DELETE '/REDACTED'{"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[REDACTED][indices:admin/delete]"}],"type":"illegal_argument_exception","reason":"Cannot delete indices that are being snapshotted: [[REDACTED]]. Try again after snapshot finishes or cancel the currently running snapshot."},"status":400}Cancelling the snapshotAs the previous error message states, you can try cancelling the snapshot:curl -X DELETE '/_snapshot/cs-automated-enc/REDACTED'{"Message":"Your request: '/_snapshot/cs-automated-enc/REDACTED' is not allowed."}Apparently that is because the snapshot is part of the automated ones. Had it been a manual snapshot I would have been able to cancel it.Problem is that the snapshot has been running for over 10 hours and is still initializing:$ curl '/_snapshot/cs-automated-enc/REDACTED/_status'{ "snapshots": [    {        "snapshot": "2021-12-12t20-38-REDACTED",        "repository": "cs-automated-enc",        "uuid": "REDACTED",        "state": "INIT",        "shards_stats": {            "initializing": 0,            "started": 0,            "finalizing": 0,            "done": 0,            "failed": 0,            "total": 0        },        "stats": {            "number_of_files": 0,            "processed_files": 0,            "total_size_in_bytes": 0,            "processed_size_in_bytes": 0,            "start_time_in_millis": 0,            "time_in_millis": 0        },        "indices": {}    }]}As it can be seen from the timestamp, it has been that way for almost 20 hours now (for reference, previous snapshots show to have run in a couple of minutes).FollowCommentMatias a year agoUpdate: after the latest AWS outage in EC2, the snapshot was cancelled which allowed us to delete the index with the unallocated shard and the cluster is back in a healthy status :)Share"

Answer: "-1This seems a case in which AWS Support should be able to help you.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support depending on the urgency of your case.https://aws.amazon.com/premiumsupport/plans/CommentShareEXPERTFabrizio@AWSanswered a year agoMatias a year agoWhile I agree that this is an issue for AWS to look into, we did pay for support in the past and stopped doing so after 3 years of not opening a single ticket with them. I don't think that I should have to pay up to 10% for the privilege of opening a bug report to them.ShareFabrizio@AWS EXPERTa year ago@Matias, while I hear you, I am just stating that to solve this issue you best path is to (even if  temporarily) upgrade your support tier again even at developer  tier (29$ or 3%).ShareMatias a year ago@Fabrizio I understand, but do you think it would be reasonable to have to pay a few thousand USD (which would be a single 30-day period on developer support tier) to have AWS look at something that is evidently an issue on their side that we did nothing to trigger?Share"


Question: Mock a GET request for an image

"I'd like to mock a get request for an image so that it could be used in an html img element e.g. <img src="https://xyz.execute-api.us-east-1.amazonaws.com/test/log/ffs.png">In my Integration Response I've got a Mapping Template for Content-Type image/png{"isBase64Encoded":  true,"body": 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg=='}But the logs keep telling me:Execution failed due to configuration error: Unable to transform requestAll the examples out there seem to be around using S3 or Lambda to return the images rather than hard coding them.It maybe that I am attempting the impossible - but I can't see what I am doing wrong.FollowComment"


Question: Glue ETL Not Update Data Catalog

"Hi, I am creating a Glue Job that is transforming CSV files to partitioned Parquet files and I want to update the Data Catalog from the ETL. I am using this snipe of code to do that:    dynamic_frame: DynamicFrame = DynamicFrame.fromDF(final_data, glue_context, f"{file_type}_dataset")    sink = glue_context.getSink(        connection_type="s3",        enableUpdateCatalog=True,        updateBehavior="UPDATE_IN_DATABASE",        path=f"{target}",        partitionKeys=partition_cols)    sink.setFormat("glueparquet")    sink.setCatalogInfo(catalogDatabase=conf.get_db_name(),                        catalogTableName=conf.get_table_name_by_source(file_type))    sink.writeFrame(dynamic_frame)As you can see I am transforming a Spark DF to a glue DynamicFrame and later writing it to parquet.The output parquet files are written but I am getting this error and the tables are not created in the Data Catalog:Exception: Problem processing file type cdr_cs because An error occurred while calling o477.pyWriteDynamicFrame.: scala.MatchError: (null,false) (of class scala.Tuple2)at com.amazonaws.services.glue.DataSink.forwardPotentialDynamicFrameToCatalog(DataSink.scala:177)at com.amazonaws.services.glue.DataSink.forwardPotentialDynamicFrameToCatalog(DataSink.scala:135)at com.amazonaws.services.glue.sinks.HadoopDataSink.$anonfun$writeDynamicFrame$2(HadoopDataSink.scala:302)at com.amazonaws.services.glue.util.FileSchemeWrapper.$anonfun$executeWithQualifiedScheme$1(FileSchemeWrapper.scala:77)at com.amazonaws.services.glue.util.FileSchemeWrapper.executeWith(FileSchemeWrapper.scala:70)at com.amazonaws.services.glue.util.FileSchemeWrapper.executeWithQualifiedScheme(FileSchemeWrapper.scala:77)at com.amazonaws.services.glue.sinks.HadoopDataSink.$anonfun$writeDynamicFrame$1(HadoopDataSink.scala:157)at org.apache.spark.sql.execution.SQLExecution$.withSQLConfPropagated(SQLExecution.scala:253)at com.amazonaws.services.glue.sinks.HadoopDataSink.writeDynamicFrame(HadoopDataSink.scala:151)at com.amazonaws.services.glue.DataSink.pyWriteDynamicFrame(DataSink.scala:64)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)at py4j.Gateway.invoke(Gateway.java:282)at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)at py4j.commands.CallCommand.execute(CallCommand.java:79)at py4j.GatewayConnection.run(GatewayConnection.java:238)at java.lang.Thread.run(Thread.java:750)FollowComment"

Answer: "2Accepted AnswerThis does not give all the information. Given the error happens while writing to the DynamicFrame, there might be a difference in the file layout and the table definition in the Glue Data Catalog.In some situations this could be access issues as well. Check the IAM access and if Lake formation if turned on, check on Lake formation as well.CommentShareAnanth Tirumanuranswered 10 months agoRafael 10 months agoThanks for your answer. There are  no tables in the database in the Data Catalog so maybe the problem has to do with a connectivity or conf problem. The thing is that the error above is quite difficult to troubleshoot because has no meaning at all.ShareRafael 10 months agoFinally the problem was that Lake formation was not activated. Thanks @ananthtm for your help.Share"


Question: How delete application when backend is empty ?

"I want to delete the application from amplify, but an error appears :"Invoking remove all backends execution failed" How delete application if a backend compartment S3 is empty ? there is nothing compartments.FollowComment"

Answer: "0Accepted AnswerHave you tried the delete-app command in the AWS CLI?aws amplify delete-app --app-id <app id e.g. d0000000000000>CommentShareEdanswered a year agoFumex a year agoYes, I just made this request, it works perfectly. thanks youShare"


Question: What topics do CDK belong with?

"Where do CDK questions go? Dug for quite awhile and on more than one occasion.Landed on  AWS Cloudformation and maybe Developer Tools. Golly, I just found DevOps and CDK questions in there as well.What do you advise / recommend?FollowComment"

Answer: "3Accepted AnswerAs you already noticed, CDK is closely related to many topics (Developer Tools, DevOps, Infrastructure as a code) and tags (AWS Cloudformation). Depending on your question, you can choose any combination or all of these tags/topics.CommentShareMODERATORMohamed_Banswered a year ago"


Question: Finding source of TLSv1 call / Have IP from CloudTrail but not sure how to dig deeper

"Hello!I received a notice that there are connections within my AWS account using TLS v1. Over the last few days, I have set up CloudTrail to monitor connections and I finally had a TLSv1 connection show up in the Lake Query. It appears the majority of my access to AWS uses an appropriate TLS, as the TLSv1 connection took a while to show up, and as of this post, there have only been two TLSv1 connections.Although I have found the connection in CloudTrail, I am not quite sure how to move forward in linking that connection to a source. I'm not sure if it's a connection between AWS Resources, or if it's from something on my servers accessing AWS.Hopefully I can provide some information that will be helpful in guiding me in a direction to figure out the source, but if there's more info I can provide, please let me know.Original NoticeRegion: us-east-1S3 Bucket: <mybucket>APIAction: REST.GET.BUCKETCloudTrail Lake QueryEventSource: s3.amazonaws.comEventName: ListObjectsEventType: AwsApiCallSourceIP: 35.93.148.248 / 52.11.56.67It appears the SourceIPs belong to AWS us-west-2.compute services. My first theory was something pertaining to EC2 load balancer (which I have 2 of), but both of those use HTTP, not HTTPS. So I don't believe they are the culprit?I know there are guides on how to enforce TLS1.2 throughout AWS, but I'm not quite sure where that needs to be applied as I'm not sure where exactly the TLSv1 connection is originating from. I would like to know what the source is before I move forward in attempting to block the TLSv1 connections.Any help is greatly appreciated!FollowComment"

Answer: "0Accepted AnswerHello,You did the first part of finding the calls, the second part is indeed finding the source.Once you have the CloudTrail event, you can use the following fields to find the origin of the call:the sourceIp is useful if it's an elastic IP you own. You can see what it is associated it.the userAgent can indicate what service is doing the call (may show powershell, a SDK, curl or something else)the userIdentity field may indicate which principal and associated instance is usedDetails of the record are described here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.htmlNote that if your bucket is public, this IP may be an external public access and your options are:Enforce TLS 1.2 for this bucket: https://repost.aws/knowledge-center/s3-enforce-modern-tlsUse a proxy in front of the bucket: https://repost.aws/knowledge-center/s3-access-old-tlsHope it helps,JonCommentShareEXPERTJonathan_Danswered 2 months agoLanceVS 2 months agoThank you so much for your reply and help Jon!The userAgent is not provided unfortunately, and the userIdentity properties are all null.The bucket is public, so I'm guessing you are correct in that it is being accessed externally. I do already utilize CloudFront, but perhaps there's somewhere I'm accessing the bucket without CloudFront - I will have to dig around a bit more.The plan is to enforce TLS 1.2 once I am confident there aren't going to be any issues with blocking that TLS 1 connection. Thankfully the TLS 1 connections are very rare, so it makes me think it's something externally accessing the bucket, and blocking it off shouldn't affect my application.Share"


Question: User `arn:aws:sts::427373581819:assumed-role/amazon-workmail-mailing-agent-us-east-1/...' is not authorized to perform `ses:SendRawEmail' on resource

"My email service suddenly stopped working today. I have not changed my authorization policies. I can still receive email, but get the error below when sending:<Sending Email> User arn:aws:sts::427373581819:assumed-role/amazon-workmail-mailing-agent-us-east-1/aws-workmail.example.com' is not authorized to perform ses:SendRawEmail on resourceI have granted SendRawEmail permissions to arn:aws:iam::427373581819:user/amazon-workmail-us-east-1 and it still does not work.FollowComment"

Answer: "1Hi,I'm sorry to hear you're experiencing problems sending mail from your Workmail organization. The problem is that the required policy on your domain that allows WorkMail to send email with your domain was removed.There is an easy fix for this: Add your domain again in the WorkMail console. No need to remove it first. Adding the domain again will trigger checks to correct any problems. This will fix the missing policy on your domain.Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year ago0I found a temporary workaround. I added a policy with the "AWS" principal set to "*", like so:{    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "*" // this is the line you will have to change            },            "Action": [                "ses:SendEmail",                "ses:SendRawEmail"            ],            "Resource": ...  // your domain ARN here        }    ]}This seems like poor security to me. Does anyone have an alternative solution?CommentSharehalkonyanswered a year ago"


Question: What are the benefits of using Amazon CloudFront together with Amazon API Gateway?

"I want to know the benefits of using an Amazon CloudFront distribution in front of an API Gateway endpoint.In terms of performance, I understand that with API Gateway [edge-optimized API endpoints][1], you can terminate the API calls at the nearest CloudFront Point of Presence. Does API caching cache content at the Point of Presence or only at regional caches? Is caching a reason for using CloudFront together with API Gateway.Also, does using CloudFront in front of API Gateway provide benefits in terms of costs?[1]: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-endpoint-types.html#api-gateway-api-endpoint-types-edge-optimizedFollowComment"

Answer: "1Accepted AnswerThe main reason to deploy a CloudFront distribution in front of an API Gateway endpoint is to reduce latency. The latency is reduced because of the following reasons:The clients connect to a nearby Point of Presence. From the Point of Presence, the traffic traverses AWS' managed network, which might have a better performance compared to the internet.The HTTPS handshake negotiation happens against the local Point of Presence. This reduces the round-trip time required for the handshake.Another reason to deploy CloudFront along with API Gateway is increased security capabilities. Currently, AWS Shield Advanced doesn't support enabling protection on API Gateways, but supports CloudFront. Therefore, it's a best practice to place the CloudFront Distribution in front of the API Gateway and then enable protection on that distribution.CommentShareEXPERTUrianswered 3 years agoEXPERTalatechreviewed 2 months agoDiego 7 months agoDoes the point of presence provided by an edge-optimized API endpoint have the same advantages as a CloudFront distribution?Share0Caching definitely could be a reason to use CloudFront with API Gateway.  API Gateway's built-in caching mechanism is fast and easy and it works with API Gateway's authentication, but it has some serious limitations:It's only available for older REST APIs.It's priced by the hour.Its error handling behaviour has an unexpected surprise - if API Gateway returns an error, either from your backing service or from API Gateway itself, it will cache the error.  Amazon's recommended way to un-poison the cache is to get the client to make a follow-up request with a specific header - probably not something you'll want to do.If your service is returning cacheable results, CloudFront can return a cache hit right from the nearest edge location (point of presence).  The main downside of CloudFront is that it doesn't have built-in support for auth/auth.  If you want to authenticate requests and be able to return cached results, you're going to be building, deploying and paying for Lambda@Edge functions.CommentShareNathan Sutcliffeanswered a year ago0And what about CloudFront distribution in front of HTTP API Gateway. Does it provide the same benefits in terms of performance? As far as I'm concerned this type of API Gateway uses Regional API endpoints. I wonder if I would benefit from a CloudFront distribution pointing to a HTTP API Gateway in a single region?CommentSharerePost-6493930answered 3 months ago"


Question: Aurora Postgres Sequences Skipping Values

I am seeing my Aurora Postgres sequence values skip by 33 on a semi-consistent basis.I am aware of a thread from the PG mailing list saying that when PG recovers it can cause a sequence skip.Also if a large transaction rolls back then any sequence values updated during that transaction will remain at their new value and won't be rolled back. I get that - its the whole point of a sequence.But in my case nothing is happening and boom tomorrow morning the sequences have skipped ahead by 33.This article discusses other reasons that can cause a sequence skip: https://www.cybertec-postgresql.com/en/gaps-in-sequences-postgresql/But I am not seeing any of those events. This appears to happen randomly.Anyone else seeing this?I migrated from RDS/Postgres and never experienced this. This just started on the migration to Aurora Postgres.FollowComment

Answer: "0Most likely the sequence is setup with a CACHE (CREATE SEQUENCE my_seq  INCREMENT BY 1 CACHE 25). Sequence cache is stored in the database cache and it can age out, just like other information (data blocks, sql plans) from memory. If you set the CACHE to 1, you won't lose values, but you will incur a small cost every time the application needs to retrieve the sequence next value.CommentShareNaveen Garg - ProServeanswered 3 months ago0Hi Naveen - thanks for the answer but it turned out that wasn't the issue.For anyone else encountering this scenario; we created a support ticket and ultimately AWS Support provided us with this answer:The root cause of the gap in sequence values is a behavior caused by an implementation difference between Aurora Postgres and community Postgres. In community Postgres, these gaps in sequence values can occur during cancelled transactions or database crashes, but in Aurora, this behavior can additionally occur when sequence pages are evicted from the buffer cache. Increasing the parameter shared_buffers, may decrease the frequency at which these gaps occur, however there is no way to guarantee a true "gapless" assignment of sequence numbers.In our case we were also running our own pg_dump operations against the primary instance a couple times a day. This is safe to do on stock Postgresql. But it appears that during a pg_dump and experiencing large transactions / activity this can occur. We implicitly solved the problem by spinning up a replica and performing the pg_dump on that host and the problem went away.CommentSharecodyanswered 3 months ago"


Question: Service Limit Increase take too long

We have the Basic support plan and requested a service limit increase for MediaConverter queues limit in our account. Now it has been 13 days and the status is "Pending amazon action". We're currently blocked by this limit to provision our resources. Is there a way to bump up the severity?13 days is outrages for a service limit increaseFollowComment

Answer: 0How was your Limit Increase request for MediaConvert created? Was Service Quotas used for the request?Using Service Quota from the AWS console allows you to request Limit Increases for most AWS Services.https://us-east-1.console.aws.amazon.com/servicequotas/Did you receive an email with the AWS Support ticket for the Limit Increase request?Respond to that email with your need to move the Limits request forward.CommentShareMike-MEanswered a month agorePost-User-2524358 a month agoYes it was created with Service Quotas and yes I responded to all the requests for additional information in the ticket. Waiting ever since.Share


Question: EC2 ubuntu refused to connect

"I have an react app hosted on EC2 instance ubuntu /apache2.  About 3 days ago while working on git and pushing some changes it started displaying refused to connect.When i access using mywebsite.com it displays refused to connect.If i access using www.mywebsite.com i got the Ubuntu default page.I looked for solution and replaced with index.html from my site (id did not work , and now i have created a new html indicating site under constructionAlso, In Ec2 console :Public IPv4 address --> Open address its the same behaviorI tried the followingRestarting apaceh2 , Checking the 000-default.conf ,  disabling firewall, using all the commands / solutions specified in many websites.Security groups : inbound and outbound  are configured correctly.This being a generic question, i will be able to provide more details if required can this be resolved ?FollowComment"


Question: "Greengrass StreamManager error: "Unable to read from socket, likely socket is closed or server died""

"I have a sample lambda that uses the newly introduced StreamManager. The main idea is a device publishes data to a channel and Greengrass lambda is subscribed to that channel. When a data is received, it writes the data to StreamManager. StreamManager exports the data to Kinesis.Sometimes (after deployments) I get the following error in the lambda log:ERROR-streammanagerclient.py:177,Unable to read from socket, likely socket is closed or server diedMy lambda is pinned (long-running) and the code is (Python 3.7):import asyncioimport loggingimport randomimport timefrom greengrasssdk.stream_manager import (    ExportDefinition,    KinesisConfig,    MessageStreamDefinition,    ReadMessagesOptions,    ResourceNotFoundException,    StrategyOnFull,    StreamManagerClient,)stream_name = "FarmDataStream"iot_channel_name = "farmdatachannel"kinesis_stream_name = "farmDataKinesisStream"# Create a client for the StreamManagerclient = StreamManagerClient()try:    client.delete_message_stream(stream_name=stream_name)except ResourceNotFoundException:    passexports = ExportDefinition(    kinesis=[KinesisConfig(identifier="KinesisExport" + stream_name, kinesis_stream_name=kinesis_stream_name)])client.create_message_stream(    MessageStreamDefinition(        name=stream_name, strategy_on_full=StrategyOnFull.OverwriteOldestData, export_definition=exports    ))# initialize the loggerlogger = logging.getLogger()logger.setLevel(logging.INFO)def lambda_handler(event, context):    logger.info(event)    global stream_name    client.append_message(stream_name, event)    returnFollowComment"

Answer: "0Accepted AnswerThe issue was the object type that I was trying to write to the stream.This one doesnt work:client.append_message(stream_name, event)This works:client.append_message(stream_name, json.dumps(event).encode("utf-8"))CommentShareAWS-User-9565912answered 3 years ago"


Question: AWS IoT Core throttling cool down?

"Hi,we expect high traffic in our AWS IoT Core endpoint and performed load testing recently to understand its limits. After sending thousands of events it started to throttle and ignore our messages which is perfectly fine considering the limits defined here:{    "timestamp": "2022-02-04 15:55:46.100",    "logLevel": "ERROR",    "traceId": "-----------",    "accountId": "-----------",    "status": "Failure",    "eventType": "Publish-In",    "protocol": "MQTT",    "topicName": "-------------",    "clientId": "-------------",    "principalId": "-------------",    "sourceIp": "-------------",    "sourcePort": 55497,    "reason": "throttled"}The problem is it seems it never "cools down". If we give it one hour or days, the message is still rejected (Failure/throttled).I thought that maybe a new clientid could help it didn't.Is this known and expected? If so, how can we deal with it?It's been hard to understand what is being taken into consideration for the throttling once it's active, maybe the sourceIp?FollowComment"

Answer: 1Problem solved. The throttling was occurring because I had reached the limit of retained messages for the account.If I delete them all or start sending messages with no retain flag it all goes well.I wish the error message was clearer about it but I can't blame anyone else.CommentShareWillanswered a year ago0The "throttled" reason is quite common. How can we know the root cause of throttled? Do AWS have any monitor tools to figure out what the limit is reached?CommentSharePhamDuyanswered 9 months ago


Question: Run component asuser

"Hi All,I have a python package, packed as a zip, it is unarchived by greengrassbut greengrass runs the final component as ggc_userHow can I specify the user which has the correct environment variables for which the setup has been done???Note, that I am not sure, if that even will work, if the environment is correct, as in 'bash' when I run 'env' as that user. But that may be because of lack of linux experience.Currently I have this deployment.json. Any help appriciated!{"targetArn": "arn:aws:iot:eu-west-2:20404040404:thinggroup/mygroup","revisionId": "24","deploymentId": "d9f4ea87-a6b7-4911-9de7-66caec7467fc","deploymentStatus": "ACTIVE","iotJobId": "d66414c5-1141-4b7c-b8af-8895a0de0943","iotJobArn": "arn:aws:iot:eu-west-2:4949494949:job/d66414c5-1141-4b7c-b8af-8895a0de0943","components": {"com.helmet-detection": {"componentVersion": "1.0.17","configurationUpdate": {"merge": "{"runWithDefault":{"posixUser":"jetson:ggc_group"}}"},"runWith": {}}},"deploymentPolicies": {"failureHandlingPolicy": "ROLLBACK"},"iotJobConfiguration": {},"creationTimestamp": "2021-11-03T17:00:07.657000+01:00","isLatestForTarget": true,"tags": {}}FollowComment"

Answer: "0Hello,Please see the "runWith" portion in https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.html."runWith" is configurable on a per-component basis. In order to set it, you set the "runWith" key in the deployment under that component's key. It is not configurable as part of the configurationUpdate section of a deployment.If you wish to change the runWith user for all components and not just a single component, then you will do a configuration update for the aws.greengrass.Nucleus component instead. https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.html#greengrass-nucleus-component-configurationCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0thank you very much, I cannot seem to set the runWith in the console....Have tried 'create-deployment' using aws command but no solutionWhere do I set this???Thank you."components": {"com.helmet-detection": {"componentVersion": "1.0.18","runWith": {<------------> todo?}}},CommentShareenieropanswered 2 years ago0Hi,RunWith is settable in the console too. On the third page when creating a deployment you have a table listing the components to be deployed. Select the radio icon next to the component you wish to change, then click on the configure component button. At the bottom of the modal you can drop down advanced options and then change the runWith user.Have a look at the API docs for setting the runwith using the CLI: https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CreateDeployment.htmlCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Thank you, found that....Unfortunately the component is still being ran as ggc_user2021-11-04T08:08:57.115Z [WARN] (Copier) com.helmet-detection: stderr. WARNING:tensorflow:From /home/ggc_user/.local/lWhen I do aws greengrassv2 get-deployment I have this..."com.helmet-detection": {"componentVersion": "1.0.18","configurationUpdate": {"merge": "{"runWith":{"posixUser":"jetson:ggc_group"}}"},"runWith": {}}CommentShareenieropanswered 2 years ago0Hi,You still haven't set the runWith user correctly. You are still setting the "runWith" user as part of the "configurationUpdate", which is not correct; it is a separate key.You must set runWith in the deployment as shown below."com.helmet-detection": {    "componentVersion": "1.0.18",    "configurationUpdate": {    },    "runWith": {"posixUser": "jetson:ggc_group"}}CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0The point is, that the json I showed was created by the system after setting likecomponents": {"com.helmet-detect": {"componentVersion": "1.0.2","runWith": {"posixUser": "jetson"}}},But I found out, that at the bottom left, there is a link, I never saw before, where we can enter a user...This works.CommentShareenieropanswered 2 years ago"


Question: Ping times out on brand new EC2 instance

"I just launched a simple EC2 instance (AMI, Linux/UNIX, x86_64, m4.large), using the default Security Group.At the AWS console, system status checks are all green, and the instance is running.SSH from my home times out, and pings all time out -- even after stopping and restarting the instance. My home connectivity is fine: pings to www.amazon.com return packets.Ideas?FollowComment"

Answer: "1Accepted AnswerHave you checked the inbound rules? Default security group rules normally allow inbound SSH / HTTP / HTTPS. If you want to enable ping you need to add a corresponding rule.For SSH reconfirm if the inbound IP allows traffic from anywhere or if it's restricted to specific IP's your ISP's IP should be one of those.--SydCommentShareSydanswered 6 months agoPaul Sumares 6 months agoThank you, Syd. The additional rule for ICMP traffic fixed the ping issue. But SSH still times out.Timeout doesn't seem like a problem with the key pair; I'm doing ssh -i [path_to_pem_file] ip_address, using the pem file path and IP for my instance. So why else might it time out?ShareSyd 6 months agoWhat is the inbound rule for SSH. 0.0.0.0/0 or some specific IP? If specific IP does it match to your ISP IP?Can you set up a allow "all Traffic" rule as inbound rule and check SSH?Your correct that key pair wont cause a timeout.SharePaul Sumares 6 months agoYeah, it's been just the default security group this whole time, open to all traffic, all ports. No specific IP or masking. The instance is running. SSH just times out with that command above (using the actual file path and IP, of course). Ping still returns packets in a timely fashion.The "Network in (bytes)" monitor shows 1.2k bytes coming in on the last attempt.ShareSyd 6 months agoJust wanted to make a point that the default security group allows all traffic on all ports BUT the source is often the security group id itself. In which case traffic from outside is not allowed. It's something often overlooked. If as you say SG has been open to all traffic and all ports all this time, you would not need to have added a rule to allow ping also.Security rule is the most likely rule for timeout and SSH service not running is the other reason but highly unlikely. You can try to launch an identical instance with same SG and see if you yet get timeout. If so I'd rule out SSH service issue. Not much I can think of apart from this these two reasons.SharePaul Sumares 6 months agoThanks, Syd. You were correct: the source was the group ID itself; I didn't know what this meant. So I added another rule to the group, specifically allowing SSH using TCP on port 22 from my home IP. I can now successfully SSH into the machine.Much appreciated!Share"


Question: Amazon SSM agent service not starting

"Hi, I have a few Windows instances that are having issues with te Amazon SSM Agent service.The event log is showing the following:The Amazon SSM Agent service terminated with service-specific error Incorrect functionerror log is also showing:ERROR [HandleAwsError @ awserr.go.48] [instanceID=my_instance_id] [MessageProcessor] error when calling AWS APIs. error details - GetMessages Error: NoCredentialProviders: no valid providers in chain. Deprecated.For verbose messaging see aws.Config.CredentialsChainVerboseErrors2017-08-12 22:50:05 ERROR [HandleAwsError @ awserr.go.48] [instanceID=my_instance_id] [HealthCheck] error when calling AWS APIs. error details - NoCredentialProviders: no valid providers in chain. Deprecated.Please help, thanks!FollowComment"

Answer: "0Hello,The SSM agent error indicates that it is not able to find the credential to connect and authenticate with SSM APIs endpoints.On your instance make sure that you have an IAM Role attached or the Credential file (for AWS CLI) configured properly with necessary IAM policy. You may take a look at our below public document about configuring SSM agent:http://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.htmlRegards,Santosh KCommentShareSantoshK-at-AWSanswered 6 years ago0Hi.I have the same issue but the event viewer show " incorrect Function" thats the only log i have.regards!CommentShareGuerrerocz87answered 6 years ago0also the error log shows...ERROR error occurred when starting core manager: Failed to fetch region. Data from vault is empty. Get http://169.254.169.254/latest/dynamic/instance-identity/document: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)Please any suggestion?CommentShareGuerrerocz87answered 6 years ago0Hi everyone,My problemm was that i can not fetch metadata.and the solution was EC2 Launch.Here the solution:http://docs.aws.amazon.com/es_es/AWSEC2/latest/WindowsGuide/ec2launch.htmlregards!CommentShareGuerrerocz87answered 5 years ago0This forum is old, but I wanted to provide the reason for my failure in case anyone stumbles on this problem. I was also getting the metadata failure. I noticed I couldn't get to http://169.254.169.254/latest/meta-data/instance-id in a browser either. I had NMAP installed which installs a loopback network device. This network device was set with IP 169.254.x.x with a subnet of 255.255.0.0. So, all requests to 169.254.169.254 were being sent to that loopback device and not to AWS. Disabling the loopback adapter fixed it.CommentSharekg4ysyanswered 4 years ago0I had the same issue on my hyper-v instance. To get the amazon ssm agent working again I first disabled my hyper-v switch for testing. The SSM agent started right away.Next I enabled my hyper-v switch and ran the commands here for adding the metadata routes - https://repost.aws/knowledge-center/waiting-for-metadataPrior to doing anything I ran "Route print" from a command prompt. The metadata routes were there under persistent routes, but they were not in the "active routes" table.After adding the routes via the above commands my ssm agent service was able to start successfullyCommentSharerePost-User-7097110answered a month ago"


Question: How do I rotate an API gateway key keeping its current used quota?

"We need to allow our customers to refresh the AWS Gateway API key at any time using the SDK , unfortunately the only way  I can see of doing this is to delete the existing key and then create a new key.Is there any way of creating the new key but keeping the existing  daily quota used value? Or is there any other way of rotating the key?If there is no way of doing this then the customer could use their quota, refresh the key and get another daily quota.ThanksFollowComment"

Answer: "0Accepted AnswerThis is not possible today. You must create a new api key and delete the old one. The new key will start it's quota value at 0.Remember that API keys are not designed to be an auth mechanism, but used to provide access to developer portals, or throttling based on an associated usage plan. See Best practices for API keys and usage plans.Don't rely on API keys as your only means of authentication and authorization for your APIs. If you have multiple APIs in a usage plan, a user with a valid API key for one API in that usage plan can access all APIs in that usage plan. Instead, use an IAM role, a Lambda authorizer, or an Amazon Cognito user pool.As api keys are primarily used for throttling purposes you can set the key dynamically using a Lambda authorizer which had the benefit of not distributing new keys to the client. You can therefore fully automate the rotation process.CommentShareThomas_Manswered a year agoEXPERTToni_Sreviewed a year ago0Thank you for sharing 6CommentSharerePost-User-9835935answered a year ago"


Question: Glue Console Table GUI Needs Sort Functionality

"In the Glue Crawler console, Filtering by Name seems to be working now, though the UX could be improved.Select the Filter By Attributes Field to get a dropdown.Pick Resource Attributes: Name and enter in the keyword.But consider as a use case of pages tables with the same prefix that we would filter on. We should be able to sort by name in case we don't know the exact full table name.  Or if a user needs to find or group tables with the same status.Is there some way to sort by column?FollowCommentShantanu Oak a year agoThere is a sort icon that does nothing! https://i.stack.imgur.com/cU8GM.pngShare"

Answer: "0Thank you for providing your valuable feedback on the service. I have raised a feature request with the service team on your behalf. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New and Blog pages for any new feature announcements.CommentShareSUPPORT ENGINEERishan_etl_smeanswered a year agoEXPERTFabrizio@AWSreviewed a year agorePost-User-4612652 a year agoIs there any update on whether this feature has been released? I am using a crawler to create a table and its increasingly difficult to find the table without proper sort/ filter fucntionality.Share"


Question: Service Connect + ECS on EC2

"I tried to set up Service Connect on ECS based on EC2 instances.I created a task definition and service based on that task definition, in service I enabled Service Connect.Service failed to deploy with such a message:service *serviceName* was unable to place a task because no container instance met all of its requirements. The closest matching container-instance *containerInstanceId* is missing an attribute required by your task. For more information, see the Troubleshooting section of the Amazon ECS Developer Guide.How could I troubleshoot this issue? (Troubleshooting section of the Amazon ECS Developer Guide does not provide useful information)My container has enough resources and the service started successfully without Service Connect.I tried to check requirements using CLI tool but found nothing:% ecs-cli check-attributes --task-def *taskDefName*:*rev* --container-instances *taskInstanceId* --cluster *clusterName*Container Instance                   Missing Attributes*clusterName*  NoneAnd I am confused about how to understand specific Service Connect requirements, where I can find it in EC2 instance context?FollowComment"

Answer: 0Accepted AnswerIssue was fixed after updating to latest Amazon ECS-Optilized Amazon Liniux 2 (20230406)CommentShareKonHanswered 19 days ago


Question: Migrated domain to Route53 and changed nameservers to 4 AWS servers now site can't be reached

"Hi,Any help greatly appreciated with the below:I recently migrated my domain to Route53 from Uniteddomains.com and set up a hosted zone to route traffic to my Lightsail instance running a Wordpress site. I've changed the nameservers for the registered domain to the 4 AWS nameservers from the hosted zone, now the URL is inaccessible and Chrome returns an error: "This site can’t be reached".My Lightsail instance has a static IP assigned and the hosted zone is set up to route traffic there. I've tried the DNS propagation checker which shows availability for the SOA record but not the A record. Hopefully this is useful to finding an answer!Any ideas why the site can't be reached?Many thanks!FollowCommentiwasa EXPERTa year agoHi.Does the A record point to the Lightsail's static IP address in the nslookup / dig command?ShareAWS-User-2838826 a year agoHi there,I'm not sure how to check this?The A record has the static IP of the Lightsail instance in the column "Value/Divert traffic to".The SOA records value is:ns-207.awsdns-25.com. awsdns-hostm*ster.amazon.com. 1 7200 900 1209600 86400and the NS value is the 4 allocated AWS nameservers:ns-63.awsdns-07.comns-1594.awsdns-07.co.ukns-1099.awsdns-09.orgns-987.awsdns-59.netAny ideas what's not right?SharePavel - AWS a year agoDid you create the necessary A record in your R53 hosted zone? You can check like this (using correct values for after @ and as the domain name of instance):dig @ns-63.awsdns-07.com your-instance-domain-name AShare"


Question: Running greengrass-cli from a greengrass component; what's going on here?

"Hi All, my greengrass component needs to do additional health checks and decide to restart another component based on output.However, it does not do anything, even not an error message. What's going wrong here? I thought that gcc_user context is sufficient?When manually ran, it works.sudo /greengrass/v2/bin/greengrass-cli component restart -n com.MyComponentWhen ran from within an existing running GG component, no error, but also no effect?? <--- please advise/greengrass/v2/bin/greengrass-cli component restart -n com.MyComponentFollowComment"

Answer: "1Hi, have you authorized ggc_user to use the greengrass-cli? You need to do that as described here https://docs.aws.amazon.com/greengrass/v2/developerguide/install-gg-cli.html and https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-cli-component.html#greengrass-cli-component-configuration i.e. add the ggc_user to a group and set that group as the AuthorizedPosixGroups in component configuration for aws.greengrass.Cli component through a deployment from your AWS account. Let us know if you face any issues with that or still can't get it to workCommentShareshagupta-awsanswered a year ago0Hello,Yes, ggc_user's profile should be enough to run greengrass-cli component restart in another component's lifecycle.However, please note that greengrass-cli component restart only works on a non-broken component.When ComponentA errors, greengrass will retry its lifecycle 3 times and transition it to broken state if all retries fail. After ComponentA is in a broken state, running greengrass-cli component restart -n ComponentA cannot restart the component. The only way to resurrect it is via deployment.CommentSharejunfucAWSanswered a year agoenierop a year agoThe component is not dead, it responds to SIGTERM. Also, manually running component restart works, but from code, using a a shell from ANOTHER componet, the gcc_user context, does not help. It does nothing, no error, just the log fact that it 'ran'.Share0Thank you but this makes no sense to me. When GreenGrass-cli is installed as a component, it defaults to gcc_user to use that user, also the user greengrass is being managed is say 'myadmin'. Manually I can execute greengrass-cli using sudo and that 'myadmin' account.When my software runs it shells using sudo -u myadmin -S etc so it has exactly the same context and security as when manually.ggc_user is already member of ggc_groupand the 'myadmin' is member of ggc_group.So, greengrass_cli is by default not executed by ggc_user?CommentShareenieropanswered a year agoshagupta-aws a year agoCorrect, ggc_user is intended for running components. If you want to be able to run the  greengrass_cli with ggc_user you should authorize it as described above. This exists because greengrass-cli has more capabilities than components such as deployments and starting/restarting/removing componentsShare0I'm having a similar issue where I'm not able to use the Greengrass cli. Every time I get a:Caused by: java.io.IOException: Not able to find auth information in directory: /greengrass/v2/cli_ipc_info. Please run CLI as authorized user or group.I've been looking everywhere but I can't seem to find a feasible answer for this issue. I tried doing the following:Set the GGC_ROOT_PATH environment variable to /greengrass/v2.Add the --ggcRootPath /greengrass/v2 argument to your command as shown in the following example.As recommended by AWS documentation (https://docs.aws.amazon.com/greengrass/v2/developerguide/gg-cli-reference.html) but I get nowhere.Any help would be appreciated!CommentShareEdanswered a month ago"


Question: How to debug chalice application with VS Code (on Mac)

"Hi )))I am developing a chalice application with a lot of lambdas, SNS, S3 and so on...I would like to know of someone already find out a way to debug such application under VS CODE (Mac OS environment)It is quite long to debug such application with AWSAny idea ?Thanks guysFollowComment"


Question: Ideal Wordpress memory limit on 16 GB RAM

"Hello!First time question here, and probably a pretty basic one. I have a pretty busy single install Wordpress website on a 16 GB RAM, 4 vCPUs, 320 GB SSD lightsail instance and I am wondering what is the ideal memory limit I should set on the wp-config file? Currently it is set to 512mb.Any thoughts or ideas on best practices using the above instance are much appreciated.FollowComment"

Answer: "0Hello and thanks for choosing Lightsail!I did some reading on the memory_limit php.ini option. As indicated by the documentation, the memory limit is applied on a per-script basis. I think that in WordPress that would also imply per-page-request because each request for a page results in a script execution. With that in mind, my advice would be to increase this value only if you know that the plugins you are using might need more than the 512MB limit set by default. I do not think that the size of the instance's memory would or should affect this decision.I hope this helps!CommentSharedonleyatawsanswered 8 months ago"


Question: What is the com.amazonaws.vpce Endpoint service?

"In my VPC -> Endpoints page, I have an Endpoint a with a service name that starts with "com.amazonaws.vpce...". It's in 2 of my subnets, and I don't remember creating it. I also can't find much information about the "com.amazonaws.vpce." service, so I don't know what it is for, and I'm afraid to remove it.Is this an automatically-created Endpoint that I need to leave up? How can I determine what it is used for?FollowComment"

Answer: "0Accepted AnswerI think I've figured it out.It appears to be an aws-generated Endpoint for my RDS serverless instance. I was able to determine this from 2 things: 1) the network monitoring of the endpoint correlated to my RDS network traffic, and 2) the security groups attached to the network interfaces attached to the endpoint both had rules that were associated with my RDS instance. Another hint was that RDS requires a minimum of 2 availability zones (for Multi-AZ), which is why there were exactly 2 subnets in this Endpoint.I was able to confirm this by logging onto an EC2 instance in the VPC, and running nslookup against my RDS instance's private DNS name. It had a CNAME of the Endpoint, and the A record IPs associated with the CNAME were the same IPs listed in the Endpoint's subnet listing. Mystery solved, and good thing I didn't delete this.CommentShareamoffatanswered a year ago0Head into the VPC console and click on "Endpoints". In there you'll see the endpoints that have been deployed in your VPC. The name you've given isn't too helpful - it's the last part which determines which service the endpoint has been created for.CommentShareEXPERTBrettski-AWSanswered a year agoamoffat a year agoHi, thanks for the quick response. The full service name is (redacted, not sure if necessary): "com.amazonaws.vpce.us-west-2.vpce-svc-*************", with the asterisks appearing to be a random hash.FWIW, the network traffic on the "Monitoring" tab of the endpoint seems directly tied to the network traffic of a serverless RDS instance. Does this give a clue as to what the endpoint is for?Share"


Question: How to configure CloudWatch Agent to use EC2 service VPC Endpoint for EC2 Metric Dimensions

"We are setting up CW Agent on EC2 to send EC2 metrics to Cloudwatch. A VPCE has been set up for the Cloudwatch services endpoint and an endpoint_override has been added to the metrics section of the agent configuration file.Similar to this override or similar to using the aws ec2 command line using --endpoint-url https://vpce-xxxxxxxxxx.ec2.us-gov-west-1.vpce.amazonaws.com,  is there a way to set the VPCE url for the EC2 services endpoint to override the public endpoint when using the append_dimensions and aggregate_dimensions in the agent configuration file?When these 2 fields are added to the configuration file, we receive a timeout for the public EC2 service endpoint because we don't set a proxy to the endpoint.FollowComment"

Answer: "0When you invoke an AWS Service, under the covers it's via an AWS Query API call to the service's domain name. This is a public domain name that normally resolves to a public IP address, but a Private Hosted Zone (PHZ) for the Endpoint is used to override the domain name so it resolves to the private IP address of the Endpoint instead.  Assuming you're accessing the VPCE from the same VPC as it's in, you need to set PrivateDnsEnabled=true for the VPC Endpoint when you create it, which sets up an AWS-managed PHZ associated with the VPC.  If on the other hand you're going cross-VPC then set PrivateDnsEnabled=false and create a self-managed PHZ that can be shared across VPCs & Accounts, and ensure network connectivity is in place.  See https://www.linkedin.com/pulse/how-share-interface-vpc-endpoints-across-aws-accounts-steve-kinsman/ for more info.CommentShareEXPERTskinsmananswered 7 months agoaramsdell 7 months agoBoth VPCEs (the Cloudwatch monitoring and the EC2 services) are set to PrivateDnsEnabled=true. The issue comes in when the CW agent configuration has the optional append_dimensions and aggregation_dimensions settings in the metrics section of the JSON file. Those 2 use ec2tagger / ec2 metadata  "Unable to describe ec2 tags for initial retrieval: RequestError: send request failed caused by: Post "https://ec2.us-gov-west-1.amazonaws.com/": dial tcp xx.xx.xxx.xx:443: i/o timeout  (It uses the public service endpoint, not the VPC endpoint that I set up for EC2 services) I was wondering if there was an additional setting that can be used in the CW agent config that points this query to the VPCE. But maybe something is missing in the set up of the EC2 metadata ( (IMDSv1) .Share"


Question: Amazon Workspaces Error: We can't sign in to your account

"When I log into a specific AWS Workspace I get the windows error:  We can't sign in to your accountThe fix for this is to login to the account via safe mode... which obviously isnt possible via Workspaces. Is there any way that I can fix this (other than to delete the workspace and rebuild)?This happned after I made two changes:Upgraded to more CPU/RAMChanged from AutoStop to AlwaysOnI spent most of the day setting this machine up with the software needed, and I would hate to have repeat this (especially indefinately).Any suggestions?FollowCommentrePost-User-2418486 5 months agoAny solution so far? I too facing this issue.Share"

Answer: "0If you can't sign in to the WorkSpace, it has to do with either the credentials are not authenticating against the Domain Controller correctly (e.g. wrong password), or the WorkSpace has lost it's domain membership. Have you attempted a rebuild?CommentShareEXPERTStevieStetsanswered 10 months ago0This happened to me after I changed my Compute Type from 'Value' to 'Performance'.I manually rebooted the workspace using the AWS Console for Workspaces in order to fix it.CommentSharestewHauanswered 4 months ago"


Question: Problem in EC2 image creation

I've tried to create images from the instance two times and waited more than 2 hours but the AMIs are not created/not showing in the console(AMI).But I can see that the Volume Snapshots for the AMIs were created successfully.Please help me with this.Thank You.FollowComment

Answer: "0When you create an AMI from an instance, Amazon EC2 powers down the instance before creating the AMI to ensure that everything on the instance is stopped and in a consistent state during the creation process.If this is causing an issues you may want to manually shutdown the instance and create a snapshot that you then turn into an AMI.The below link has details on how both turn a running instance into and AMI and how to turn a snapshot into an AMI.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.htmlCommentSharetedtrentanswered 6 months ago"


Question: Unable to connect to EC2 using SSM.ap-southeast-1.amazonaws.com

"Dear all Gurus,I am facing some issue on EC2 connect.When I am using the viaservice condition ssm.ap-southeast-1.awazonaws.comIt prompt me that I do not have permission.When I remove this condition, i can access the EC2 without any issues.any idea that I can use other service name to limit the condition?Thank you in advance.FollowComment"

Answer: "0What IAM policies are you actually using?Also, are you using Systems Manager Session Manager to connect to EC2?CommentShareEXPERTRiku_Kobayashianswered a month agoMcDs23 a month agoIAM currently is full access administator. cause I am doing some testing. Yes I am using System Managers Session Manager to Connect to EC2. Currently, I need to encrypt the ssm session with kms key with viaservice or condition limited. May I know which via services or condition that I can put in for testing? TYIAShareRiku_Kobayashi EXPERTa month agoCan you please share the IAM policy you have set up for EC2 and the full text of the connection error?Is the EC2 running on a private subnet?If so, are KMS VPC endpoints and NAT gateways configured?Share0IAM is full administrator rights.when i added this condition"kms:ViaService": "ssm.ap-southeast-1.amazonaws.com"I cannot (connect) button in Connect to Instance (Session Manager), the error said that I do not have the kms:GenerateDataKey in key policy which it is in place.Once I remove this permission "kms:ViaService": "ssm.ap-southeast-1.amazonaws.com"I am able to connect to the EC2.I am trying to limit the key usages by using the condition of via service.CommentShareMcDs23answered a month ago"


Question: Collect output of all steps from a single SSM document

"I got a SSM automation document, which does have 5 steps/codes.right now it works perfect. once i ran it, i can click on each executed step-ID , check its output.but i want to know is there any way to accumulate all 5steps output and send everything as an email once ssm finished running ???oranyway to collect outputs from all 5step-id's and put it in a 6th step and send it as email as part of the ssm document itself. ?FollowComment"

Answer: "0Automation, a capability of AWS Systems Manager, integrates with Amazon CloudWatch Logs. You can send the output from aws:executeScript actions to the log group you specify. You can read about enabling the CloudWatch logging on this documentation page.To monitor the execution status of your automation document, you can use Amazon EventBridge. Amazon EventBridge is a serverless event bus service that allows you to connect your applications with data from a variety of sources. EventBridge was formerly called Amazon CloudWatch Events. EventBridge can add events from dozens of AWS services to your rules, including Systems Manager. EventBridge also supports events from the Systems Manager's Automation capability. See an example of an Automation event pattern here.You can define an AWS Lambda function as the target of your EventBridge rule. This Lambda function will gather the CloudWatch logs and send them via email. You can use the Amazon SNS service to send emails. A similar solution is described in this blog post.CommentShareDmitry Balabanovanswered 3 months ago"


Question: A/B Partitions with AWS EC2 instances

"Is there a recommended way or guides on how to use the A/B partition upgrade scheme with AWS EC2 instances. This the scheme used by Android/ChromeOS for seamless upgrades of the operating system.  References: 1,2The requirement to specify the specific partition as the root volume makes it difficult for software running within the instance to change these values. Also if there is only one root instance specified how would a fallback boot work?  I am looking for guidance and experiences of others in implementing this.Thanks in advance.FollowComment"


Question: How to get logout url in .well-known/openid-configuration endpoint?

How can I get /logout endpoint in .well-known/openid-configuration endpoint. I have also given logout redirect url too.FollowComment

Answer: 0The Cognito Hosted UI does not currently support OIDC IdP logout.If you need to add that functionality you'll have to redirect to your application on logout using the logout_uri request parameter and have your application call the logout endpoint for the OIDC provider.https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.htmlCommentShareRajarshi_Danswered 2 months ago


Question: php mail function not working in Lightsail Linux Bitnami WordPress

"Hello Team,I am trying different ways to make the mail function work on my lightsail server. I tried to install sendmail but still not working. I followed the steps mentioned https://community.bitnami.com/t/why-cant-i-use-phps-mail-function-on-this-bitnami-server/13319 but no luck. If anyone faced the same issue and got any resolution, it would be a great help.I am using the contact us WordPress plugin. Even the mail for the admin email confirmation is not working.Thanks,SandipFollowComment"

Answer: "0Hi SPViradiyaFrom the note, I understand php mail function not working in Lightsail Linux Bitnami WordPress, you tried to install sendmail but still not working. Please correct me if my understanding is wrong.Please note AWS does not support Wordpress or PHP, see here [1]. I recommend not to use "sendmail" for sending emails. Amazon limits the number of the outgoing emails from the instances. "In order to maintain the quality of EC2 addresses for sending email, we enforce default limits on the amount of email that can be sent from EC2 accounts". I suggest to use a SMTP configuration with an email provider. You can find how to configure mail() function in a LAMP to send emails through a GMail account in the link below: http://wiki.bitnami.com/Components/PHP#How_to_send_email_via_external_SMTP_account 3.5k In the WordPress case, you can find a guide to configure with a plugin. You can find more info at[2]. You may also need to involve a Dev/SysAdmin.I hope it helps.References:1.https://aws.amazon.com/premiumsupport/third-party-applications/2.http://wiki.bitnami.com/Applications/BitNami_Wordpress#How_to_configure_the_email_settings_of_WordPress.3f 2.0kCommentShareNonkululekoanswered a year agoSPViradiya a year agoThank you for the help @NonkululekoI will try the SMTP configuration as you suggested and hopefully, it will work.Share"


Question: "Athena returns "FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTask. null""

"Following the well architected labs 200: Cost and usage analysis I get the following error when adding partitions in Athena Query Editor:MSCK REPAIR TABLE `cost_optimization_10XXXXXXXX321`;and it returned the following error:FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTask. nullThis query ran against the "costfubar" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 856e146a-8b13-4175-8cd8-692eef6d3fa5The table was created correctly in Glue withNamecost_optimization_10XXXXXXXXX21DescriptionDatabasecostfubarClassificationparquetLocations3://cost-optimization-10XXXXXXX321//ConnectionDeprecatedNoLast updatedWed Apr 20 16:46:28 GMT-500 2022Input formatorg.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormatOutput formatorg.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormatSerde serialization liborg.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDeSerde parametersserialization.format 1Table propertiessizeKey 4223322objectCount 4UPDATED_BY_CRAWLER costfubarCrawlerSchemaSerializerVersion 1.0recordCount 335239averageRecordSize 27exclusions ["s3://cost-optimization-107457606321/**.json","s3://cost-optimization-1XXXXXXXX21/**.csv","s3://cost-optimization-107457606321/**.sql","s3://cost-optimization-1XXXXXXXX321/**.gz","s3://cost-optimization-107457606321/**.zip","s3://cost-optimization-107457606321/**/cost_and_usage_data_status/*","s3://cost-optimization-107457606321/**.yml"]CrawlerSchemaDeserializerVersion 1.0compressionType nonetypeOfData fileand has the following partitions shown in Glue:partition_0partition_1yearmonthdetailed-cur-1XXXXXXXX57detailed-cur-1XXXXXXXX57201812View filesView propertiesdetailed-cur-1XXXXXXXXX57detailed-cur-1XXXXXXXXX5720224View filesView propertiesdetailed-cur-1XXXXXXXXX57detailed-cur-1XXXXXXXXX57201811View filesView propertiesdetailed-cur-1XXXXXXXX57detailed-cur-1XXXXXXXX57201810View filesView propertiesFollowComment"

Answer: 1the error was that the prefix in the S3 bucket was emptyCommentShareAWS-User-3957779answered a year ago0Can you please check the troubleshooting section here - https://docs.aws.amazon.com/athena/latest/ug/msckrepair-table.html#msck-repair-table-troubleshooting. Its mostly due to permission issues like missing glue:BatchCreatePartition or KMS permissions or s3:GetObject.CommentShareEXPERTGokulanswered a year agoAWS-User-5995037 a year agoRunning as Admin Role.Share


Question: Sharing application catalog across regions

"Hi,I have created workspaces in two regions - N. Virginia and Ireland.  I packaged two applications and created a catalog in N. Virginia.  Can I deploy this catalog to workspaces in Ireland?  Without going through the full packaging & validating process again?FollowComment"

Answer: 0Accepted AnswerYou can copy your image to another Region. https://docs.aws.amazon.com/appstream2/latest/developerguide/administer-images.htmlOnce you have the image you can create a new fleet and stack.CommentShareJeremy_Sanswered a year agoTedF a year agoThanks Jeremy!Share


Question: How to install openSSL 1.1.1 on AWS EC2 linux system?

"I have a script (unchanged in 4 years) that has been used to access an API that is behind an https URL.  It is used each Jan-Feb.  My AWS server is an EC2 dedicated server.  This year, I suddenly find that script is not working (cannot verify certificate).  (It is a perl script using HTTP::Request in the LWP family.  And yes, the LWP::Protocol::https module is appropriately installed, along with SSLeahy.)  I've checked the target site with my browser and with online cert checkers, and it is fine.  So I'm pretty sure the problem is the expiration of openssl 1.0.2 last September.  The target site is probably using only the 1.3 protocol version.  However, my efforts to find a way to upgrade to openssl 1.1.1 have been unsuccessful.  I found a note that AWS had posted the package openssl11, but when I try to get that using "sudo yum install," it doesn't find the package.  So how do I get the new version installed on my EC2 server?  Help please!  This is an urgent issue.FollowComment"

Answer: "0Please post the exact error message you are seeing. Also, which Linux distribution are you using, exactly? (cat /etc/os-release).If the site you are connecting to uses an SSL certificate from Lets Encrypt, you could be running into this issue as well: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-expired-certificate/CommentShareCoreyLaneanswered a year ago0The error message is what I posted above: "cannot verify certificate."  Further investigation suggested the site (which has been accessed by this identical script for years) might be requiring the newer version of the protocol which requires an update of openssl.  But I can't install it.  (I note that I was able to get the script to run finally by disabling host verification, but obviously that's only an emergency measure since we had to get this working).The linux version info:NAME: Amazon Linux AMIVersion: 2018.03ID: amznID_LIKE: rhel fedoraPRETTY NAME: Amazon Linux AMI 2018.03CPE_NAME: cpe:/o:amazon:linux:2018.03:gaCommentShareAWS-User-1611029answered a year ago"


Question: Aws Aurora RDS Mysql instance unusual  cpu spike pattern

"Since past few week we are facing unusual  spike on our rds cpu with only 2 to 5 user sometime it's getting  upto 100 which is we never faced , so it is really helpful if we can know what is the reason behind that spikes , which ultimately really urgent as we are on it since past few day also revert mine code to older version but still same thing happening  .please guide on this , it is really helpful.FollowComment"

Answer: "0Hi, Have you tried these optionshttps://aws.amazon.com/premiumsupport/knowledge-center/rds-instance-high-cpu/CommentShareAWS-User-4659371answered a year agoAWS-User-5529590 a year agoyeah, I am investigating that as well but there some query which is from INFORMATION_SCHEMA which is taking high cpu sometimes , there is mine main concern because till now didn't notice that kind query taking that much cpuSELECT LOGFILE_GROUP_NAME , FILE_NAME , TOTAL_EXTENTS , INITIAL_SIZE , ENGINE , EXTRA FROM INFORMATION_SCHEMA . FILES WHERE FILE_TYPE = ? AND FILE_NAME IS NOT NULL AND LOGFILE_GROUP_NAME IS NOT NULL AND LOGFILE_GROUP_NAME IN ( SELECT DISTINCTROW LOGFILE_GROUP_NAME FROM INFORMATION_SCHEMA . FILES WHERE FILE_TYPE = ? AND TABLESPACE_NAME IN ( SELECT DISTINCTROW TABLESPACE_NAME FROM INFORMATION_SCHEMA . PARTITIONS WHERE TABLE_SCHEMA IN (?) ) ) GROUP BY `LOGFILE_ShareRob_H EXPERTa year agoDid you recently upgrade DB Engines by chance? Such as from MySQL 5.6 to MySQL 5.7? There are some difference in how the two choose query executions plans. So if you recently upgrade you may want to check that.ShareKadu Borges a year agoHi! Did you resolve this issue? If yes, could you tell me how?If not, here is my issue and a finding to help you troubleshoot yours.Currently, I am facing something like that. I was using an RDS Postgresql instance, and it was working well. But, after migrating to Aurora, we started to face some CPU spikes. We investigated all queries, indexes, application code ... everything. As an ultimate resource, we created another RDS instance to see if the behavior would be the same and, to our surprise, the spikes were gone. So, now, we are trying to figure out what configurations we should change/set to make it work on Aurora.It seems to be a widespread problem with RDS and Aurora. A quick search on Google brings a lot of questions throughout forums about it.Share"


Question: .bashrc file not loaded in AWS Cloud 9

"The issue is I lost my terminal prompt colors and formatting. I prefer the old c9.io formatting. I can see the formatting is in there in the new AWS c9 .bashrc file, but the file is not loading.It appears to be because .bash_profile loads instead... which I think is meant to load some Ruby scripts. If I rename/remove the .bash_profile file then the .bashrc file loads and all is well. But I am sure that's not advised and I'm at the limit of my knowledge here. Any suggestions for how how to make sure the .bashrc file loads?Edited by: DanOlson on Apr 22, 2019 12:46 PMFollowComment"

Answer: "1Accepted AnswerHello Dan!I assume you're using Ubuntu environment, am I right?If so, you can add following line to .bash_profile[[ -f ~/.bashrc ]] && source ~/.bashrcCommentShareanester-awsanswered 4 years ago0Yep, that worked! Thanks.CommentShareDanOlsonanswered 4 years ago"


Question: Aws-SDK node.js modules--savings moving from V2 to V3?

I've seen some aws blog posts about cutting node module bundles by 50%+ moving to version 3 and then further cuts with optimizations.Is the cpu/clock time savings linear?  How about memory?  I am not familiar with more bare metal concepts.  TIA.FollowComment


Question: Upcoming OS upgrade for RDS mysql instances - Mandatory?

"We are currently on mysql 8.0.16 on a t2.2xlarge instance. We have automatic updated turned OFF.According to the documentation here:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#Mandatory_OS_Updateswe are not affected by this. however....We have tried creating a new replica on the new minimum required mysql version (8.0.23). We are in a situation where replication is broken due to collation problems (even through the replica is based on a fresh snapshot of our primary).It appears to be a problem with the scenario:primary (8.0.16) -> replica (>= 8.0.23)We are now worried that we will be forcibly upgrades (OS and mysql version) next month, leaving us in a broken state.Can anyone shed some light on this and what course of action we must take?Many thanks.FollowComment"

Answer: "1Hello,I would recommend reaching out to AWS Support since they might be able to manually lock the same & enforce the same software version on the replicas.However, if the range of the dates mentioned is passed, you can either request an extension or plan for the automated updates as per the schedule.In any case reaching out to the RDS Support team at AWS looks like the best retort at this time.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year ago"


Question: ec2 import-image fails with "ClientError: Unknown OS / Missing OS files"

"Hi,I am trying to get images that I run in VMWare Workstation Pro, to be running in EC2...Steps taken:Export from VMWare Workstation as OVFUsed ovftool to pack files into one OVA file locallyUploaded OVA to S3, setup roles and policies as documentedrun "aws ec2 import-image" with the folling config file:This results in an error shown by "aws ec2 describe-import-image-tasks":     "Status": "deleted",     "StatusMessage": "ClientError: Unknown OS / Missing OS files.",     "Tags": []Any idea what is missing here?The image is:Debian 11not encryptedFollowComment"

Answer: 0You want to make sure you meet the requirements in the AWS VM Import/Export document. Based on information provided Debian 11 is supported just make sure the kernel is the same.Additional if this fails it might be better to import just the VMDK file method instead of OVA. You can find it in Example 2 on this Import VMDK file.CommentShareAWS-User-EPanswered 3 months ago


Question: "Code 400, message Bad request version ('18.0} from Network Load Balancer"

"My problem is that I am in the process of moving from the IoT-Core/Lambda services to a ECS docker doing containing a Mosquitto broker. This is because AWS IoT-Core does not support basic authentication and we really need this to be supported - our IoT devices have very limited resources, so we struggle very much to perform the encryption you require on the IoT-Core service. Now I have setup the docker and implemented the network load balancer, but sometimes (only sometimes) the load balancer fails to handle a simple JSON message. The MQTT message I am sending is always the same, but sometimes the load balancer fails with "code 400, message Bad request version" and other times everything is fine. When I am sending the messages directly to the Containers public IP things are always working. Also when I have the exact same docker running on my localhost and there things are also working fine. So, I think this is a problem caused by the load balancer and I am out of ideas on how solve this?Log from where the load balancer rejets the message:2022-10-28 06:50:3410.0.0.196 - - [28/Oct/2022 04:50:34] code 400, message Bad request version ('18.0}')8a1c1c7e0e5d4353ac68e974ce4adb9910.0.0.196 - - [28/Oct/2022 04:50:34] code 400, message Bad request version ('18.0}')2022-10-28 06:50:3410.0.0.196 - - [28/Oct/2022 04:50:34] "2MQTTÂ< publisherdmrfOOgG5%@2hSV8DOF1nPa80Ócanister/outgoing{"clientid": "786523DB50583837372E3120FF181243", "elapsedHours": 1, "powerUpCounter": 1, "pressure": 1024, "valveState": 1, "stepPressureTarget": 1000, "rtcTemp": 21.0, "batteryVoltage": 18.0}" 400 -8a1c1c7e0e5d4353ac68e974ce4adb9910.0.0.196 - - [28/Oct/2022 04:50:34] "2MQTTÂ< publisherdmrfOOgG5%@2hSV8DOF1nPa80Ócanister/outgoing{"clientid": "786523DB50583837372E3120FF181243", "elapsedHours": 1, "powerUpCounter": 1, "pressure": 1024, "valveState": 1, "stepPressureTarget": 1000, "rtcTemp": 21.0, "batteryVoltage": 18.0}" 400 -FollowComment"

Answer: "0Accepted AnswerFound the problem: I had configured both port 80 and port 1883 targets in the target group, so sometimes the MQTT messages were routed to port 80 on the container. I had a HTTPServer running on port 80 in the container, which was logging the problem.CommentSharerePost-User-5277957answered 7 months ago"


Question: failing was glue job after upgrade

"hey. I have upgraded (using the default code) an old glue job running on 1.0 Glue version due to the fact that it was not copying all the rows between a Postgres database and Redshift, which happened randomly. Unfortunately the job doesn't work now and I'm getting lots of errors in the log that I cannot solve. Could someone have a look?FollowCommentFabrizio@AWS EXPERTa year agoCould you please post some of the errors from the logs here?Share"

Answer: "0Hello,If possible, please post some logs here or please feel free to open a case with the support. If it helps, you can find the AWS Glue migration guide here which would explains the prerequisites to check before upgrading to newer versionsCommentShareSUPPORT ENGINEERChiranjeevi_Nanswered a year ago"


Question: How to automate the creation of Greengrass Core Device Shadow with fleet provisioning?

"Hi all,So I have managed to create a fleet provisioning template which I use to register Greengrass Core V2 devices and it works fine with the only exception that it does not create the greengrass core device if a shadow does not exist before that I get this error in the cloud watch logs:"details": "No shadow exists with name: 'MyGreengrassCore2'Then I manually add the device shadow and then everything works fine but creating the shadow manually is not desired. I checked different places in the aws documentation but I did not find how to add device shadow creation as part of the fleet provisioning template. Is that possible? If yes, how to do that?Thanks in advance.EDIT: Added some more context - cloud watch logs, IoT PolicyCloud Watch Logs:{    "timestamp": "2021-12-18 19:56:06.050",    "logLevel": "ERROR",    "traceId": "a4003747-a168-1956-ab44",    "accountId": "account_id",    "status": "Failure",    "eventType": "GetThingShadow",    "protocol": "MQTT",    "deviceShadowName": "Prefix_MyGreengrassCore2",    "topicName": "$aws/things/Prefix_MyGreengrassCore2/shadow/name/AWSManagedGreengrassV2Deployment/get",    "details": "No shadow exists with name: 'Prefix_MyGreengrassCore2~AWSManagedGreengrassV2Deployment'"}IoT Policy{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "iot:Publish",        "iot:Subscribe",        "iot:Receive",        "iot:Connect",        "greengrass:*"      ],      "Resource": [        "*"      ]    },    {      "Effect": "Allow",      "Action": "iot:AssumeRoleWithCertificate",      "Resource": "arn:aws:iot:region:accoun_id:rolealias/GGCV2TokenExchangeRoleAlias"    }  ]}FollowComment"

Answer: "1Hello again,I looked into the issue and it seems that device shadow is not the root cause.FleetStatusService (FSS) is responsible for creating a new core device in cloud. If fleet provisioning is not finished when FSS starts, FSS goes offline during fleet provisioning and is not notified to restart, which fails to create a greengrass core in cloud and leads to the shadow error message you see in cloudwatch.It is a recently discovered bug of FSS and we are working on a fix. In the meantime, you shouldn't have needed to create the shadow topic manually. Restarting greengrass nucleus alone after provisioning will restart of FSS and create a greengrass core in cloud, which is run the greengrass core software installation again as you mentioned.Could you confirm that restart nucleus alone can fix your issue? If yes, then it's this known issue we are fixing right now.Let me know if you have any other questions.JunfuCommentSharejunfucAWSanswered a year agoAWS-User-2130413 a year agoHey,Thank you again.Sadly, for some reason I cannot reach the AWS IoT section of the AWS management console. I get a black half circle on the screen and nothing is accessible thus I cannot test and confirm what you said. It is very weird that I have this and it is only for IoT, all other AWS services are accessible. Do you have any idea why is that?SharejunfucAWS a year agoDo you see any javascript errors in your browser console? if so could you paste the errors here and also a screenshot of the page? if not then it might be a server-side rendering issue but highly unlikely.ShareAWS-User-2130413 a year agoHey,Just managed to fix that issue and now tried what you advised me to but I got an authorization failure error without literally changing anything. Very strange. Do you have any idea why that would be?{     "timestamp": "2021-12-21 20:59:22.486",     "logLevel": "ERROR",     "traceId": "0cdb55f5-2d44-7057-e224-a28735791",     "accountId": "accound_id",     "status": "Failure",     "eventType": "Connect",     "protocol": "MQTT",     "clientId": "b99f2af6-4195-4145-86c4-",     "principalId": "d4ef80aa40cbed0388db1b682198e9879fd009b8f89cf2037a9853fe",     "sourceIp": "80.57.107.22",     "sourcePort": 52891,     "reason": "AUTHORIZATION_FAILURE",     "details": "Authorization Failure" }ShareAWS-User-2130413 a year agoI just ran the command for installing greengrass just like I did before but instead of the Device Shadow error I got this one now.Share1Hello,By default, fleet provisioning does not require creating the shadow manually; classic shadows are created automatically. Could you share with me your configuration of IoT policy and shadow manager to help me reproduce your issue?You mentioned that you found this error in Cloudwatch log. Could you also share which service is logging this error and some context around this log?Thanks,JunfuCommentSharejunfucAWSanswered a year agoAWS-User-2130413 a year agoHey,Thanks for reaching out. I updated the question with the logs and the IoT Policy.I have no shadow manager in use. I just install the greengrass core software on the edge device and then supposedely I need to get the greengrass core device in the console management but I do not. Instead, the core device is created as a thing and I need to go there and manually create a named device shadow with the name of the thing, then run the greengrass core software installation again and that would create greengrass core thing and show it in the AWS console management. I hope that gives you more details.Share0You can set up an IoT topic rule that listens to thing events and execute a Lambda function when a thing is created.Here's an example CloudFormation template with the IoT rule and Lambda function.AWSTemplateFormatVersion: '2010-09-09'Transform: 'AWS::Serverless-2016-10-31'Resources:  ThingEventRule:    Type: AWS::IoT::TopicRule    Properties:      RuleName: !Sub "ThingEvent"      TopicRulePayload:        RuleDisabled: false        Sql: SELECT * FROM '$aws/events/thing/#'        Actions:          - Lambda:              FunctionArn: !GetAtt ProvisioningFunction.Arn  ProvisioningFunctionRole:    Type: AWS::IAM::Role    Properties:      RoleName: !Sub "${AWS::StackName}-provisioning"      AssumeRolePolicyDocument:        Version: 2012-10-17        Statement:          - Effect: Allow            Action: sts:AssumeRole            Principal:              Service:                - lambda.amazonaws.com      ManagedPolicyArns:        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole  ProvisioningFunction:    Type: AWS::Serverless::Function    Properties:      FunctionName: !Sub "${AWS::StackName}-provisioning"      Role: !GetAtt ProvisioningFunctionRole.Arn      Timeout: 5      Handler: index.handler      Runtime: python3.9      MemorySize: 512      CodeUri: ./thing-event-function  ProvisioningFunctionPermission:    Type: AWS::Lambda::Permission    Properties:      FunctionName: !GetAtt ProvisioningFunction.Arn      Action: lambda:InvokeFunction      Principal: iot.amazonaws.com      SourceAccount: !Ref AWS::AccountId      SourceArn: !GetAtt ThingEventRule.ArnHere's the code for the Lambda function.import boto3import jsonimport loggingiotdata = boto3.client('iot-data')def handler(event, context):    if 'operation' not in event or event['operation'] != 'CREATED':        logging.warn('Ignoring non CREATED event')        return    # Add your properties here    properties = {}    # And finally update the thing's shadow    iotdata.update_thing_shadow(        thingName=event['thingName'],        payload=json.dumps({'state': {'desired': properties}})    )    logging.info("Wrote shadow to thing")Make sure to enable thing events in your AWS account as documented here https://docs.aws.amazon.com/iot/latest/developerguide/iot-events.html#iot-events-enableCommentSharesupergillisanswered a year ago"


Question: How to search data in AWS amplify datastore using @searchable in android(java)?

I read this documentation: https://docs.amplify.aws/cli-legacy/graphql-transformer/searchable/#definition But how to impliment the query in android studio using java.What are the methods of Amplify to get search query? Can any one share documentation?FollowComment


Question: How to access output from Crowd Entity Annotation

"I'm creating a task on AMT using the Crowd entity annotation Elements that let reviewers label each word in a text block.I want to ensure that the reviewer selects a label for every word/character in the text before submitting the job. What I am trying is to use onsubmit and a validation function in the script section to check whether the length of the labeled entities added together is equal to the total length of the text block but I can't access the output of the crowd entity annotation. This is what I tried but failed:const answers = document.querySelector('crowd-entity-annotation').value.entities I also tried this, which return 'undefined':const answers = document.querySelector('crowd-entity-annotation').entities I appreciate any help.FollowComment"


Question: To use simple self-service scripts that make it easy to generate CloudWatch Dashboards

I am trying to follow the instructions fromhttps://aws.amazon.com/blogs/media/cs-quick-and-easy-media-services-dashboards/ but unable to access the scripts soecified in this post.The intention is to use scripts to generate Cloudwatch dashboards quickly.FollowComment

Answer: "0Accepted AnswerYou can still download the scripts by using the command as mentioned in the blog post:wget  https://dlcc9uvp8v2in.cloudfront.net/LATEST.zip && unzip *.zipCommentSharejoahnaanswered 10 months agorePost-User-0981058 10 months agoHi @Joahna, unable to execute wget command in my AWS CLI, error message is "wget is not a recognizable command2 and I have limited rights to install anything on the machine. And CloudShell is also not enabled in the region.Sharejoahna 10 months agoYou can also actually just paste the link in your browser https://dlcc9uvp8v2in.cloudfront.net/LATEST.zip, it should download the zip file.Share"


Question: Workspaces will not launch

"Downloaded and installed Windows 64-bit from https://clients.amazonworkspaces.com/When I try to start Amazon Workspaces nothing happens (no screen, no error presented).Found this error in Windows Event ViewerFaulting application name: workspaces.exe, version: 5.2.1.3123, time stamp: 0x625dbd9dFaulting module name: MSVCR80.dll, version: 8.0.50727.9672, time stamp: 0x5db26b72Exception code: 0xc000000dFault offset: 0x000000000001da44Faulting process id: 0xb04Faulting application start time: 0x01d8b61ef051ba42Faulting application path: C:\Program Files\Amazon Web Services, Inc\Amazon WorkSpaces\workspaces.exeFaulting module path: C:\WINDOWS\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dllReport Id: eb28b684-4c2b-40dc-9548-cfa38034f9abFaulting package full name:Faulting package-relative application ID:It does not look like workspaces.exe installed the files in c:\windows\WinSxS, so why is it trying to use these files?FollowComment"

Answer: "0Hi @Jake, I hope you tried re-installing client to repair the installation.CommentSharerePost-VivekPophaleanswered 9 months agojake 9 months agoI tried reinstalling the client many times.  I also ran multiple antivirus, made sure C++ redistributables were updated, disk defrag, and uninstalled anything I could find that also used MSVCR80.dll.Same error every time.Using Web Access may be an alternative but does not address why this application will not install correctly.Share0It appears your installation is corrupt, just clean it, reboot your system and try installing it again.Also, make sure to enable Web Access option as seen in image below, so that you can try to access WorkSpaces using Web browsers too.CommentSharerePost-VivekPophaleanswered 9 months ago0The workspace client version 5.2.1.3123 does not seem stable (some of our users are not automatically connected to their machine since the update)Try using an older version. You can download from there:https://clients.amazonworkspaces.com/VersionsCommentShareAWS-H-Tanswered 9 months ago0I reinstalled from 4.0 to current.  I uninstalled and reinstalled every C++ redistributable.  I ran dism, defrag, chkdsk, and a full virus scan.Same error.I installed workspaces on another laptop and noticed at the end of the install I was prompted re: a certificate.  This never happens when installing on the 'broken' laptop.  Does this hint at anything?CommentSharejakeanswered 9 months ago"


Question: Architectural Diagram for EV charging Station

"Can someone please help me in my Architectural diagram of EV charging station?What all three-tier services can I use to make it more scalable, reliable, safe during a disaster.This is what I have created....FollowComment"

Answer: "1There are a couple of things I would consider if this is a greenfield (brand new) development:For the mobile application, go serverless and use API Gateway as your front-end and Lambda/Step Functions to take care of the API's. You can scale this solutions to millions of requests with little to no effort, plus it removes your need to manage all of those EC2 nodes.For the charging station, again consider using AWS IoT services to facilitate the communication. You can easily control the stations, as well as gather metrics and report against those all within the IoT framework.Here is a case study that is similar to what you are proposing that uses the services I mentioned above: https://aws.amazon.com/solutions/case-studies/easee-case-study/CommentShareEricPullenAWSanswered 3 months ago"


Question: Execution failed due to configuration error: General SSLEngine problem

"When I configure a vpc proxy in the api gateway I always get the same error when pointing to different https endpoint. I have tried amazon.com and various others which all have valid certs. The vpc call goes thru a nlb which is using tcp as protocol so no tls termination should be handled here. It's very hard to see what the problem is with that error message, don't have any clues on how to fix this or to be able to get more detailed information.Anyone have any idea on how to solve this or at least to get some more detailed error messages?FollowComment"

Answer: "0Turns out there was a certificate problem, api gateway does not supprt sni and the default certificate on the web server was a fake certificate. Updating the default certificate solvved the problem.CommentSharejoasunanswered 4 years ago"


Question: AWS SES domain verification failure with BYODKIM

I've followed the docs. I've tried via the console and via the API.Both times verification has failed.I can get the TXT record if I do dig -t txt selector._domainkeydomain.com. The record is in GoDaddy.How could I debug the issue further?FollowComment


Question: Update/Create Governed Table from Glue job

Currently It's possible to create or update catalog tables from Glue job. https://docs.aws.amazon.com/glue/latest/dg/update-from-job.htmlTwo questions :Is it possible to create or update Governed table from Glue job ?How crawler can create Governed table ?Thanks!FollowComment

Answer: "0Hello,Answering to your queries:Is it possible to create or update Governed table from Glue job ?Yes, it is possible for your to create and update Governed table from Glue job using the CreateTable and UpdateTable API calls.In addition, there are restrictions on the UpdateTable API operation. You can't update the table type, change partition keys, or change the table location.How crawler can create Governed table ?No, crawler does not support Governed tables.Please refer to https://docs.aws.amazon.com/lake-formation/latest/dg/governed-table-restrictions.html for complete details on the restrictions. You can view the answers for your above queries in this link as well. It also provides the details on what APIs are not allowed on the governed tables. I hope this information helps and answers your queries.Thank you!CommentShareSUPPORT ENGINEERManish Kumar_Nanswered 8 months agoChintanPatel 8 months agoHello Manish, Thanks for your answers.I can create Non-Governed table as belowsink = glueContext.getSink(    connection_type="s3",     path="<S3_output_path>",    enableUpdateCatalog=True,    partitionKeys=["region", "year", "month", "day"])sink.setFormat("json")sink.setCatalogInfo(catalogDatabase=<target_db_name>, catalogTableName=<target_table_name>)sink.writeFrame(last_transform)Is there any way to add TableType option in this so It can create governed table automatically? Because I think in CreateTable we need to send schema as well which I don't know how to grab it from dynamicframe in Glue job.Share0You cannot add the TableType option in the setCatalogInfo() method.If you know the column names at this stage, you could use createTable or updateTable methods suggested by the other answerer.As you have mentioned that you would not know the column names, my suggestion is to use the AWS Wrangler library.awswrangler.s3.to_jsonwr.s3.to_json(    df=df,    path=f"s3://{bucket}/{database}/{table}/",    dataset=True,    database=database,    table=table,    table_type="GOVERNED",    transaction_id=transaction_id)CommentShareAnanth Tirumanuranswered 8 months ago"