Question: Client VPN on Linux : Connection failed - sql lite error ?

"The only clue is in /var/log/syslog which saysMar 23 11:55:17 lego AWS VPN Client: SQLite error (5): database is locked in "PRAGMA max_page_count = 5000"The AWS client logs says2022-03-23 12:03:03.870 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_GENERAL_ERROR 0 to MetricsTable2022-03-23 12:03:03.870 +00:00 [DBG] Starting OpenVpn process2022-03-23 12:03:04.150 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_ATTEMPT 1 to AnalyticsTable2022-03-23 12:03:04.151 +00:00 [DBG] Shutting down metrics agent2022-03-23 12:03:04.151 +00:00 [DBG] Metrics agent shut down2022-03-23 12:03:04.157 +00:00 [DBG] OvpnGtkServiceClient connected. Calling StartVpnAsync2022-03-23 12:03:04.178 +00:00 [DBG] OvpnGtkServiceClient received OpenVPN process PID: -12022-03-23 12:03:04.178 +00:00 [DBG] DeDupeProcessDiedSignals: Unknown error caused OpenVPN process to not start: -12022-03-23 12:03:04.178 +00:00 [WRN] Acs did not stop correctly!2022-03-23 12:03:04.178 +00:00 [ERR] Process died signal sentACVC.Core.OpenVpn.OvpnProcessFailedToStartException: Unknown error caused OpenVPN process to not start: -1   at ACVC.Core.OpenVpn.OvpnGtkProcessManager.Start(String openVpnConfigPath, String managementPortPasswordFile, Int32 timeoutMilliseconds) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnProcessManager.cs:line 696   at ACVC.Core.OpenVpn.OvpnConnectionManager.Connect(OvpnConnectionProfile configProfile, GetCredentialsCallback getCredentialsCallback, Int32 timeout) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConnectionManager.cs:line 8612022-03-23 12:03:04.180 +00:00 [DBG] Received exception for connection state Disconnected. Show error message to user2022-03-23 12:03:04.180 +00:00 [ERR] Exception received by connect window view modelACVC.Core.OpenVpn.OvpnProcessDiedException: The VPN process has stopped unexpectedly.2022-03-23 12:03:04.539 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_GENERAL_ERROR 1 to MetricsTable2022-03-23 12:03:04.856 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_GENERAL_ERROR 1 to AnalyticsTable2022-03-23 12:03:05.212 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_ATTEMPT_FAIL_VPN_PROCESS_DIED 1 to MetricsTable2022-03-23 12:03:05.497 +00:00 [DBG] Inserted event UI_APP_VPN_CONNECT_ATTEMPT_FAIL_VPN_PROCESS_DIED 1 to AnalyticsTable2022-03-23 12:03:05.497 +00:00 [DBG] Clean up connections. Connection state: Connecting2022-03-23 12:03:05.498 +00:00 [INF] Validating schema for OpenVPN config: /home/falken/.config/AWSVPNClient/OpenVpnConfigs/AWS JumpCloud2022-03-23 12:03:05.801 +00:00 [DBG] Inserted event CONNECTION_PROFILE_TYPE 1 to AnalyticsTable2022-03-23 12:03:06.500 +00:00 [DBG] Caught exception when getting connection status. Exception information: System.TimeoutException: The message did not respond within the expected timeframe or was cancelled   at ACVC.Core.OpenVpn.OvpnConnectionManager.SendMessage(String message, Int32 timeout, CancellationToken cancellationToken) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConnectionManager.cs:line 1140   at ACVC.Core.OpenVpn.OvpnConnectionManager.GetConnectionStatus() in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConnectionManager.cs:line 1228   at ACVC.Core.Metrics.MetricsClient.RecordBytesMetricsAndAnalytics(IConnectionManager connectionManager) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/Metrics/MetricsClient.cs:line 136/var/log/aws-vpn-client/falken/gtk_service_aws_client_vpn_connect_20220301.log2022-03-23 12:19:36.142 +00:00 [DBG] [TI=9] Start method called: OpenVPN validation file: /home/falken/.config/AWSVPNClient/OpenVpnConfigs/current_connection.txt, management password file: /home/falken/.config/AWSVPNClient/acvc-8096.txt2022-03-23 12:19:36.146 +00:00 [ERR] Drive type Network not supported.2022-03-23 12:19:36.146 +00:00 [ERR] [TI=9] Unhandled exceptionACVC.Core.OpenVpn.ReferencedFilePathInvalidException: File: /home/falken/.config/AWSVPNClient/OpenVpnConfigs/current_connection.txt may be a path to an unsupported drive type, which is not allowed for security reasons   at ACVC.Core.OpenVpn.OvpnConfigParser.CheckSupportedDriveType(String path) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConfigParser.cs:line 795   at ACVC.Core.OpenVpn.OvpnConfigParser.ValidateReferencedFilePath(String path, String flag) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.Core/OpenVpn/OvpnConfigParser.cs:line 689   at ACVC.GTK.Service.DBus.OvpnGtkService.StartVpnAsync(String ovpnConfigValidationFile, String managementPortPasswordFile) in /home/ubuntu/Jenkins/workspace/GtkBuild/SecureConnectClient/ACVC.GTK.Service/DBus/OvpnGtkService.cs:line 46How can I find out what's up or what DB this is ?v2 seemed to work fine.I've purged and reinstalled the package, and renamed ~/.config/AWSVPNClient to no avail.Ubutn 20.04 LTS, all updated.FollowCommentTom a year agoIt mentions "Drive type Network not supported" but there isn't a network drive on this entire machine, never mind for that file$ mount|grep home/dev/sdb1 on /home type ext4 (rw,relatime)/home/.ecryptfs/falken/.Private on /home/falken type ecryptfs (rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=959895dd933f5f08,ecryptfs_sig=9662ae9c28ad292f,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)Share"

Answer: 1Accepted AnswerRebuilt whole machine with per-partition LUKS instead of per-user encfs and that seems to have fixed it.CommentShareTomanswered a year ago


Question: AWS SSO in Control Tower / Organisations with Systems Manager Run As

"Have a Control Tower Setup and in main account have set ABAC - SSMSessionRunAs = ${user:name} in AWS SSO.  In one of the Workload accounts, I have configured Systems Manager Preferences with "Run As" but with empty user.  The expected behaviour is that sessions in System Manager will be created with the AWS user account (not ssm-user).  However error "Invalid RunAs username. Set default username in Session Manager Preferences page." is displayed.  Of course, if I set the Run As in Systems Manager Preferences to ssm-user the Systems Manager session connects as ssm-user (not the AWS user account).   A matching user account has been added to the Linux Amazon OS.  It appears the ABAC variable isn't passed through to Systems Manager?  The strange thing is this worked yesterday?  I have also tried ABAC ${path:userName}.FollowComment"

Answer: "1Hey there,Sounds like this blog may be exactly what you need.CommentShareCiaran Carragheranswered a year ago"


Question: SMTP Gateway for Workmail.

"I'm trying to setup SMTP gateway for Workmail. I'm a novice with AWS. I'm pulling my hair out. I've looked at youtube videos and I can't figure it out. Everything I try, gives me the error that it can't find it. I have several staff that won't use the program unless they can go through Outlook or Thunderbird, so I need a way to link it.I've made a smtp in SES (user name and pw). I think it has to do with the name,address or port. ?? Thank you for the help. VFollowComment"

Answer: "0Hi,You do not need a "SMTP gateway" to connect Outlook or Thunderbird. To configure Outlook you can check this page and for Thunderbird you can find instructions here.The SMTP gateway in the console can be used to route your mail via another SMTP service before sending the mail.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months ago"


Question: how to achieve LISTagg functionality

"Redshift gives me the errorselect table_schema,table_name,LISTAGG(column_name,', ')within group (order by ordinal_position asc)from information_schema.columnswhere table_name = 'abcde'and table_schema = 'xyz'group by 1,2i tried to create  mytableinsert into mytableselect table_schema  , table_name  ,  ordinal_position as colpos,column_name as ColumnNamefrom information_schema.columnswhere table_name = 'abcde'and table_schema = 'xyz'group by 1,2gives me error:Function "has_column_privilege(oid,smallint,text)" not supported.Function "has_column_privilege(oid,smallint,text)" not supported.Function "has_table_privilege(oid,text)" not supported.Function "has_table_privilege(oid,text)" not supported.Function "has_table_privilege(oid,text)" not supported.i would want to acheive this which would will be later used in my stored proc.table_schema , tablename, distkey,   sortkey,          columnsxyz                     abcde           col1        col2,col3        col1,col2,col3,col4,col5,col6,col7i also tried withselect schema_name as databasename,table_name as tablename,ordinal_position as colpos,column_namefrom      pg_catalog.svv_all_columns where database_name='prod123' and schema_name='xyz' andtable_name='abcde' order by 1,2,3,4get the error:Function "has_column_privilege(oid,smallint,text)" not supported.Function "has_column_privilege(oid,smallint,text)" not supported.Failed to get redshift columns from *******thanksKNFollowComment"

Answer: "2LISTAGG is a "User table only function" which means you cannot apply this function on the catalog tables.You should get the below error if you apply LISTAGG function to information_schema tables:One or more of the used functions must be applied on at least one user created tables. Examples of user table only functions are LISTAGG, MEDIAN, PERCENTILE_CONT, etcCommentShareSrikant Dasanswered 2 months ago"


Question: why instance is automatically stopping and website is going down ?

My website is going down every time and it will start running after the instance is re runned ....FollowComment

Answer: "0Can you please add more details about the issue? Eg: what is running on the instance, are you using a auto scaling with this EC2, what is the network traffic to this application, if you noticed any error message in CloudWatch logs or instance logs. Please share the instance logs as well.CommentShareAWS-User-9533668answered 8 months ago"


Question: Aurora PostgreSQL - recommended maximum number of databases (for a multi-tenant data layer)

"Hello,TL;DR - I have a customer who has a SaaS solution which includes multi-tenant data layers. They want to improve their tenant isolation by creating a logical DB per tenant.Aurora Postgres is a main component of the architecture. In order to create better isolation, they would like to create a database per tenant (to clarify: multiple logical databases within the same cluster). They ask whether a single Aurora PostgreSQL cluster can hold 10K DBs.Is this a reasonable requirement from Aurora Postgres (and fromPostgreSQL at all)?In which point (regarding DBs number) solutionslike sharding will make sense? (talking only about the number of DBs in a cluster. To clarify - I'malso discussing with them about each DB performancerequirements, availability requirements, etc..)In addition, I am discussing with the customerabout other considerations, like dividing the DBs in order to createbetter maintenance / operations abilities and limit the blast radiusof one cluster).Many thanks in advance.FollowComment"

Answer: "0Accepted AnswerMulti-tenant DB architecture will come down to their use case, as you've hinted to. There are lots of papers/articles out there that discuss tradeoffs with alternative approaches when it comes to isolation, maintainability, migrations, development pain, schema changes, and other factors.Given that, I'll try and focus my answer on 1&2 in your question: We certainly have customers on both Aurora and RDS Postgres with 10k databases. Some even orders of magnitude more. It works. However, they'd certainly want to think about their future plans for scaling. There is a point where even just the sheer number of files generally causes Postgres (or the OS) grief. If their schema is complex, with many relations per database, then they could run in to issues much sooner. It's tough to give solid numbers, but at 10k you could say it's feasible enough for them to put in the effort to do a real evaluation.Another potential sticking point is connection management. If their workload calls for frequent access to many customers/databases, it's worth mentioning that Postgres is connection-per-database. Even at 10k, they won't realistically be able to pool connections for all customers. Creating and tearing down connections will introduce overhead they wouldn't otherwise encounter with something like table-per-customer.There are a lot of other things to consider as I mentioned, but yes, people do 10k databases. As always, they should test using something representative of their specific workload.CommentShareAWS-User-4014941answered 4 years ago"


Question: AWS MGN: Data replication stalled

We have installed agent in virtual machine successfully but getting error error is- Data replication stalled Failed to launch Replication Server. We already allowed the port 443 and 1500 to local windows firewall and their existing pfsense. Can someone explain why I get this error and where I can look to correct it? The "How can I solve this?" takes you to general troubleshooting and none of the troubleshooting topics have this error.. Thank you!   Enter image description hereFollowComment

Answer: "0This is likely caused by a permissions issue from MGN service to launch the Replication Instance. Noting, that the problem here is in launching the server that receives the data from your on-prem server, and not an issue with your on-prem server.Try checking the logs, usually it'll say if there is a IAM Role or permission missing.CommentShareOrsenQuertieranswered a month ago"


Question: Will db.t4g be available for reservation on RDS?

"Are there any plans to permit the reservation of t4g-class instance types on RDS?  Currently, t4g is omitted from the reservation pricing page, at least for MySQL in us-east-1: https://aws.amazon.com/rds/mysql/pricing/?pg=pr&loc=2Both the AWS web console and direct usage of the API show no offerings for db.t4g:$ aws --output=json rds describe-reserved-db-instances-offerings --db-instance-class=db.t4g.medium{    "ReservedDBInstancesOfferings": []}FollowComment"

Answer: "3Accepted AnswerT4g RIs are now available for RDS and AuroraCommentShareYagyaVir_Sanswered a year agoMax a year agoHey, will t4g.micro also become available for reservation?Share2Hello Paul,db.t4g instance type is in works to be included under RDS reservation but we don't have a timeline when it will be available. I will recommend to keep an eye on AWS What's new[1] where we update about new launches.Hope this helps.[1] - AWS What's new - https://aws.amazon.com/new/CommentShareYagyaVir_Sanswered a year ago"


Question: Is it possible to force PostGres Database from 9.6.23 to 10.x even though receiving a must be upgraded to 12 or higher?

"Is it possible to force PostGres Database from 9.6.23 to 10.x even though receiving a must be upgraded to 12 or higher?Message:"The RDS for PostgreSQL 9.6 end-of-life date is approaching. Your database is using a version that must be upgraded to 12 or higher as soon as possible. We plan to automatically upgrade RDS for PostgreSQL 9.6 databases to 12 starting April 26, 2022."FollowComment"

Answer: 0Version 12 is the version AWS is advising you to upgrade to. Here is a list that show valid upgrade paths. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.PostgreSQL.html Scroll down  about a quarter of the way down to see the list.CommentShareByron_Ganswered a year ago


Question: IoT Log Errors - Publish-in error

"Hi,I'm noticing some random disconnections on my IoT Things.When looking in the IoT logs on Cloudwatch, I'm getting error logs about "Publish-In" but I can't figure out why they happen.How can I dig into it to understand whats up ?These are the logs (private data deleted) :FieldValue@ingestionTime1654587159327@log{id_deleted}:AWSIotLogsV2@message{"timestamp":"2022-06-07 07:32:29.807","logLevel":"ERROR","traceId":"{deleted}","accountId":{deleted},"status":"Failure","eventType":"Publish-In","protocol":"MQTT","topicName":"{deleted}","clientId":"{deleted}","principalId":"{deleted}","sourceIp":"{deleted}","sourcePort":{deleted}}@timestamp1654587149807accountId{id_deleted}clientId{id_deleted}eventTypePublish-InlogLevelERRORprincipalId{id_deleted}protocolMQTTsourceIp{deleted}sourcePort{deleted}statusFailuretimestamp2022-06-07 07:32:29.807topicName{deleted}traceId{deleted}```FollowComment"

Answer: "0Hi,you should check the IoT policy which is associated to your device (either via a thing group or a certificate) if it allows publishing to the topic which is highlighted in the log entry.KR,PhilippCommentSharePhilipp Sanswered a year ago"


Question: x-api-key  for Usage Plans

"I am planning to write a custom authorizer which returns in one of it's response, the api-key for usage plans purposescan our client send the x-api-key in the path parameter?e.g.https://our.api.amazon.com/api/v1/greetings/<this-is-x-api-key>/sayHellois there any security risk of having it in the path parameter?FollowComment"

Answer: "0can our client send the x-api-key in the path parameter?You do have access to the path parameters in a request authorizer, so yes. You could also have your customers send a completely distinct value from the api key and do a cross reference in an internal data store if you so choose, meaning that your customer would never send the actual key directly.is there any security risk of having it in the path parameter?Only if this is the only form of authentication you are using on your API (which we do not recommend). URLs are logged in most proxy server implementations, meaning that if a customers traffic is going through a proxy of some kind their keys would be exposed to the proxy owner.Regards,BobCommentShareEXPERTAWS-User-0395676answered 4 years ago"


Question: Transit Gateway shared with AWS Resource Access Manager (AWS RAM) identify all accounts as external

"Customer has an AWS Landing Zone (ALZ) implementation where they are sharing a Transit Gateway (TGW) between accounts. Sharing a TGW results in error unless Allow external accounts is checked, even though the account is in the same organization.The account that they are trying to share the TGW with, is under the same root Organization by ALZ and AWS Control Tower configuration  Why these accounts are considered externals?. Once allow external accounts is checked the TGW can be shared and the principal type shows "Account (External)"FollowComment"

Answer: "0Accepted AnswerAWS RAM must be integrated with AWS Organizations. Once this is done from the management account, RAM will have permissions to access AWS Organizations and enable sharing with Organization IDs and OUs. It will also properly identify accounts within the Organization and no longer require you to enable External sharing if the account is within the same Org. Enable sharing with AWS Organizations docs cover how to enable from the management account.CommentShareAxel Larssonanswered 4 years ago"


Question: Role is not stabilized

"I'm trying to create a very simple role through CDK:return new Role(this, "[REDACTED]", {  assumedBy: new AccountRootPrincipal().grantPrincipal,});The role gets successfully created (I can see it in IAM console), but Cloudformation never reports its creation and throws a timeout after 30 minutes with the following message:Role [REDACTED] is not stabilized.All non-dependent resources are created successfully, and no further messages or errors are given. I've already tried to add a simple inline policy but it still doesn't work (role and policy appear on IAM console). Also, I've tried adding more non-dependent roles, and all of them report exactly the same error message (despite being used for LogGroup, Lambda, etc.).I'm using the new eu-south-2 / Europe (Spain) / ZAZ region.It's the first time I've encountered this error, and there are no results online besides a comment mentioning there were error rates and latency increases some time ago. However, this issue has been appearing for the entire day, so I'm not sure if it's temporary.FollowComment"


Question: Query Plan EXPLAIN

"Hi !I have two tables in redshift with a one to many relation, each table has ~ 300K rowsIf i execute this request :EXPLAINSelect Table1.field, Table2.fieldFROM Table1 INNER JOIN Table2 On Table1.Reference = Table2.ReferenceTable1Here is the query planXN Hash Join DS_DIST_ALL_NONE  (cost=3929.08..29669880.27 rows=323034878 width=104)  Hash Cond: (("outer".Reference )::text = ("inner".ReferenceTable1)::text)  ->  XN Seq Scan on Table1 e  (cost=0.00..3143.26 rows=314326 width=104)  ->  XN Hash  (cost=3143.26..3143.26 rows=314326 width=17)        ->  XN Seq Scan on Table2 o  (cost=0.00..3143.26 rows=314326 width=17)I don't understand what does it mean rows=323034878 ?FollowComment"

Answer: "0Nice and interesting oneThe rows estimate in the query plan refers to the estimated number of rows that will be produced by the query. In this case, the query plan estimates that the INNER JOIN operation will produce a total of 323034878 rows.This estimate is based on the number of rows in the two tables that are being joined and the distribution of the join keys. The query plan uses statistical information about the distribution of data in the tables to make this estimate.It is important to note that this estimate is just that – an estimate. The actual number of rows produced by the query may be different.CommentShareSeanSianswered 5 months ago0You mentioned there is a one to many relation. Maybe that is the reason for such big number of result rows.You can check it this way to see how many rows are actually returned:Select COUNT(*)FROM Table1 INNER JOIN Table2 On Table1.Reference = Table2.ReferenceTable1I guess it will be much more than 300K.XN Seq Scan on Table1 e  (cost=0.00..3143.26 rows=314326 width=104)it reads all rows from Table 1. ~ 300KXN Seq Scan on Table2 o  (cost=0.00..3143.26 rows=314326 width=17it reads all rows from Table 2. ~ 300KXN Hash Join DS_DIST_ALL_NONE  (cost=3929.08..29669880.27 rows=323034878 width=104)Hash Cond: (("outer".Reference )::text = ("inner".ReferenceTable1)::text)joins the tables, applies the condition and returns ~ 323034878 rows. Maybe it is somehow related to distribution key.I wonder what COUNT(*) in above example would return.Let me know if it helps :)CommentShareMaxanswered 5 months ago"


Question: EMR cluster gets terminated with error

"Hello, AWS support community,I have an issue with creating an EMR cluster. Every time I implement the launch, the cluster gets terminated with the error message "terminated with error" I don't know why this happens. Could you help me to solve this issue? Thank you.FollowComment"

Answer: "0Hello,Thank you for raising your question in re:Post.Based on what I can gather from your question, your attempts to create EMR Cluster fails with an error with no clear message on why or what the root cause is.Cluster creation constitutes multiple steps, starting from requesting EC2 instances, installing the required services that coordinates the nodes in the cluster, installing bootstrap if you had any and at the very end installing the application you had selected.Since there are no indicator from your question at what step this is failing, I would suggest you raise a case with AWS Support and our support engineers can take a look at your cluster and advise you on what would help.While creation of the cluster you would have selected S3 path for cluster logs, if you did, do you see any logs in those directory? If not that would mean it is failing much earlier stage and could be related to the configuration you had selected eg: Custom AMIIf you do have logs in that location, have a look at the log files puppet.log.gz or stderr.log.gz in the location s3://<full-path-to-cluster-logs>/node/<Primary node instanceId>/provision-node/apps-phase/0/*/. If you have not worked with puppet logs before it may not be straightforward to find the error there and hence I would recommend you raise a case with us.Hope this helps.CommentShareSUPPORT ENGINEERKrishnadas Manswered a month agorePost-User-2201973 a month agoHello Krishnadas,Thanks for your response. Here are the steps that I took to take.Enter EMR serviceClick "Create Cluster"Gave a "Name", and chose "Core Hadoop", took the other setting as isSelect "size 2" at Cluster scaling and provisioningChose "Manually terminate cluster" and "Use termination protection"Specified Amazon S3 location from the existing S3 log folder's directory at Cluster logsAt Tags, gave "Key: name", "Value: my cloud cluster"Created EC2 key pair for SSH at Security configuration and EC2 key pairInitially, I couldn't see "EMR_DefaultRole" and "EMR_EC2_DefaultRole" at Identity and Access Management (IAM roles), so I gave a command that I found in AWS's documentation to the shell command, then those two options popped upCreate clusterGet thePlease let me know if you see any skeptical steps that potentially cause the error. ThanksSharerePost-User-2201973 a month agoAlso, since my AWS plan is Basic, I don't have a clue to raise the case for support.Share0Hello,Thank you for replying. Basic plan does not include premium support so you will not be able to raise a case with AWS Support. re:Post is public and hence we cannot discuss anything specific to a customers account here.From the steps alone it is not clear what could cause the issue. Please navigate to the EMR console and locate the failed EMR cluster and click on it to look into the details. Once you are in Cluster details page do you see any additional error message when you click on the "Terminated with errors" status message? If yes, that should give us a hint of possible causes but please understand that it alone may not be enough to get to the root cause of the issue you are facing.Also, do you see logs in the S3 path you configured for Cluster logs?CommentShareSUPPORT ENGINEERKrishnadas Manswered a month ago"


Question: Loft vcluster support for IRSA on top of EKS

"Hi everyone,We are currently studying the use of vcluster  https://www.vcluster.com/ on top of our EKS clusters to provide self-service Kubernetes clusters for dev teams,Our backend microservices use IRSA to access AWS resources such as RDS, Secrets, Parameters, SES ...My question is, is it possible to get use of AWS IRSA from within a virtual cluster (vcluster)I really appreciate any help you can provide.FollowComment"

Answer: "0Good Day!Thanks for connecting with us at re:Post.As per your notes, I can understand that you wish to connect virtual cluster with other AWS Services such as RDS, SES etc. within the same. Please correct me if I have misunderstood your concern.Please note, as vcluster is a 3rd party tool, hereby I will able to respond at my best-efforts what I found via their resources and AWS integration possibilities with it.As test-replicated the vcluster at my end before replying you here, I found that vcluster itself is limited to a single namespace on a host cluster (let's say EKS Cluster A). When being created, it creates below resources:serviceaccount/vc-my-vcluster | serviceaccount/vc-workload-my-vcluster | configmap/my-vcluster-coredns | configmap/my-vcluster-init-manifests | role.rbac.authorization.k8s.io/my-vcluster | rolebinding.rbac.authorization.k8s.io/my-vcluster | service/my-vcluster | service/my-vcluster-headless | statefulset.apps/my-vclusterPost-checking the RBAC permissions and architecture of vcluster > It's clear that permissions need to be routed via host cluster only. As mentioned already, vcluster is out of expertise for us, a best approach is to reach vcluster team by creating issue [1]. If you think there can be a follow-up required at AWS End, please feel free to create case from the account where you have the host cluster at [2].Thanks for your understanding & cooperation! Have an AWSome Day Ahead & Stay Safe!References:[1] https://github.com/loft-sh/vcluster/issues[2] https://aws.amazon.com/contact-us/CommentShareSUPPORT ENGINEERRamneek-Kalraanswered 6 months ago"


Question: Copying Quicksight analysis with same data but different datasets

"Hi, I have been using Quicksight for a short time.I'm trying to copy a quicksight analysis from one region to another. The regions refer to datasets that have the same data but different table and column names. I'm using AWS CLI. I have made several attempts like this:aws quicksight create-analysis --aws-account-id xxxxxxx --analysis-id xxxxxxxx --name "New analysis" --source-entity=file:/path/to/modified_analysis.json --region <new region>.Any suggestions?FollowComment"

Answer: "0Hi. Here are some steps you can follow to copy the analysis from one region to another:Export the analysis from the source region: Use the "get-dashboard" command to export the analysis JSON file from the source region:aws quicksight describe-analysis --aws-account-id <source_account_id> --analysis-id <source_analysis_id> --region <source_region> --output json > analysis.jsonOpen the analysis.json file and replace all occurrences of the source dataset name and column names with the target dataset name and column names. Import the modified analysis to the target region.Use the create-analysis command to import the modified analysis to the target region:aws quicksight create-analysis --aws-account-id <target_account_id> --analysis-id <target_analysis_id> --name "New Analysis" --source-entity=file://analysis.json --region <target_region>Hopefully, It should work!CommentShareStefanoBanswered 24 days agoEXPERTFabrizio@AWSreviewed 23 days agoClaudio 24 days agoParameter validation failed:Unknown parameter in SourceEntity: "Status", must be one of: SourceTemplateUnknown parameter in SourceEntity: "Analysis", must be one of: SourceTemplateUnknown parameter in SourceEntity: "RequestId", must be one of: SourceTemplateNow I have this problem. In the file.json there is no reference to the SourceTemplate and SourceEntityShare0Hi,To import an analysis from a JSON file, you can try the "update-analysis command" instead. Here is an example command:aws quicksight update-analysis --aws-account-id <your-account-id> --analysis-id <analysis-id> --source-entity=file://path/to/modified_analysis.json --force-embed-dataset --region <region>Make sure to replace the placeholders in the command with the actual values for your account, analysis ID, JSON file path, and region.Note the use of "file://" to specify the path to the JSON file. Also note the use of "--force-embed-dataset" to embed the dataset in the analysis. This is necessary because the dataset in the new region may have a different name than the dataset in the original region. With this command, you should be able to import the analysis from the JSON file in the new region.Let me know if it works!CommentShareStefanoBanswered 23 days agoClaudio 23 days agoI just tried but the error it returns is: Unknown options: --force-embed-dataset.I'm starting to think I have some permission problem because I don't have admin access.When I run the command you told me in the first message, it returns an error of "Unknown parameter in SourceEntity". The problem is that in the file.json I have no reference to SourceEntity and SourceTemplate.However worst case scenario I do it manually.Share"


Question: Using EC2 vs Lightsail for consistent compute heavy workloads

"I've been using Lightsail for a consistent compute heavy workload and it's (for the most part) always in the "burstable" zone when I have "burstable" credit. If I use an EC2 instance instead, will I be able to use the whole vCPU?For example, when the Lightsail instance (2 vCPU and 4GB RAM) is running the workload, it's generally around 40% of CPU according to the Lightsail metrics and running top in the terminal, which places it in the "burstable" zone. And then, from my limited understanding, it seems like it gets throttled until the total vCPU consumption is within the baseline once the "burstable" credit is exhausted.If I switch to an EC2 instance, will I be throttled similarly, or will I be able to sustain something like 90% of 1 vCPU?FollowComment"

Answer: "0A burst type instance type with the same performance as Lightsail would have a similar CPU transition.In the case of EC2, you can choose the instance type, so it is better to change to the appropriate one depending on the application workload.CommentShareEXPERTRiku_Kobayashianswered 2 months ago0You can choose to run a burstable EC2 instance like T3 or T2 in "unlimited" mode so it doesn't ever throttle.  However if your workload is regularly taking the instance into the burst zone then it would be more cost effective to run so other instance class like M, C or R depending on the balance you need between CPU and memory.  You can run these at whatever % CPU you want without extra costs.CommentShareEXPERTskinsmananswered 2 months ago"


Question: RabbitMQ - Support for Prometheus

"Hello,I was wondering if the RabbitMQ Prometheus metrics are available (https://www.rabbitmq.com/prometheus.html)? The default port 15692 does not seem to be exposed. This would allow us to integrate these metrics into our existing alerting system.ThanksJonasFollowComment"

Answer: "0Hi Jonas - Confirming that currently Amazon MQ for RabbitMQ supports only the federation, shovel, and management plugins - and not Prometheus. We we will be evaluating additional plugins for a late 2021 launch. Prometheus is a plugin which is under consideration.CommentShareAWS-Jamieanswered 2 years agodarragh a year agoIt's pretty late in 2021? any additional plugins being launched?Share0Hey guys, we need that monitoring(prometheus) plugin to be enabled for our instance. Please provide me some roadmap for it.CommentShareDmitry Gubinanswered 10 days ago0Any idea when in 2023 this might happen?CommentSharemiklanswered 3 days ago"


Question: "Network Failure" when using "Login with User Pools"

"Yesterday I changed my AppSync API to Auth Mode AMAZON COGNITO_USER_POOLS. I created a Cognito user pool and was able to use the "Login with User Pools" button on the "Queries" section to authenticate via group-membership (@aws_auth(cognito_groups: ["groupname"]))Today I'm getting a "Network Failure" message when trying to authenticate with my User Pool login.All services are running in us-east-1.Any idea why this is happening?Edited by: vossberg on Dec 27, 2017 1:11 PMFollowComment"

Answer: "0Hi Jeffthank you very much for your reply.It is showing the same error also with a fresh setup:Region: us-east-1 (same happens with us-east-2)Create a User Pool with Default settingsCreate a new AppSync API ("Custom schema")Change Authorization type to "Cognito User Pool" and configure the new pool from aboveOpen "Queries" pageThe "result" window on the right now shows this message in red:e.exports@https://d1owibxkfb9jfd.cloudfront.net/c170c3d5cba9771150547efa6d42c0cab5dcf71c/main.js:131:61094e.exports@https://d1owibxkfb9jfd.cloudfront.net/c170c3d5cba9771150547efa6d42c0cab5dcf71c/main.js:147:217017e.exports/</d[h]@https://d1owibxkfb9jfd.cloudfront.net/c170c3d5cba9771150547efa6d42c0cab5dcf71c/main.js:131:59856This is same message I'm getting when I open the Queries page with my API that had already worked. Is this expected bevavior or an indication for case 1 from your email?My ReactJS app is able to authenticate a user from a Cognito user pool with aws-amplify, when trying to use the received Jwt Token to access the AppSync API I'm also getting the mentioned "Network Failure". I'm using aws-appsync to access the API.Thanks again for looking into this,LucasCommentSharevossberganswered 5 years ago0Hi,Sorry for the issues. It could be one of two things, I believe.As the error message implies, a temporary networking issue on our end. Are you still seeing the issue? If not, it was probably this.If you have seen issues consistently, then it's probably related to your configuration. Double check that the Cognito configuration (user pool id...etc.) is valid and the same as the one you're using on your client. We'll work on cleaning up the error message, as this is admittedly counter intuitive given the error message you received.Thanks,JeffCommentShareAWS-User-4365954answered 5 years ago0Hi,Sorry, I had a typo above (fixed it). It should have said it was the networking issue if you weren't still seeing it, so the fact that you were probably means it was option 2.Are you 100% sure your client side Cognito stuff is exactly what you provided your api when creating it? If so, can you DM me what those were?CommentShareAWS-User-4365954answered 5 years ago0Hi,I found the reason for the error: The "Queries" page uses changing Cloudfront hostnames and I missed the fact, that my NoScript extension from Firefox had not been authorized for the changed hostname. Parts of the JS were not executed.Very obvious ones I realized my mistake. Sorry for the trouble. I appreciate your efforts to help!Best regards and a great start for 2018 to everyone!LucasCommentSharevossberganswered 5 years ago0Happy to hear that's up and running, but did it also resolve you seeing that issue from the react/amplify app?CommentShareAWS-User-4365954answered 5 years ago0Hi,yes, sorry for the partial update. The "Error: Network error: Network request failed with status 500" in my React/Amplify web app indeed was caused by using a different User Pool than I had configured in AppSync. Now the app is authenticating fine and the access rules configured with "@aws_auth(cognito_groups: ..." are working.I'm still getting this error"https://cognito-identity.us-east-1.amazonaws.com/ 400 (Bad Request)"when runningAmplify.configure({    Auth: {        identityPoolId: 'us-east-1:xyz',         region: 'us-east-1',         userPoolId: 'us-east-1_xyz',         userPoolWebClientId: 'xyz',     }});If I leave out the "identityPoolId" line, the error doesn't show up and the app still works.On the pool dashboard I can see several anonymous identities handed-out from the Pool, so the pool itself is working. Though here is says the line is required:https://github.com/aws/aws-amplify/blob/master/docs/media/quick_start.md#configurationI've yet to understand the reason it is necessary to configure it. I'll do some more reading and open a new thread when I've more questions about the identityPoolId.LucasCommentSharevossberganswered 5 years ago"


Question: Commit message and Pull Request Details in E-Mail or SNS notification

"I am sharing my release message notification on Slack via SNS, EventBridge and Lambda functions. I have accomplished it successfully, but we do not get the commit message or PR link or the PR details which triggers the deploy. Is it possible already in someway? Or is there some feature in progress? Or is it not possible?Also, my repository is in BitBucket.FollowComment"


Question: ParallelCluster config file - SharedStorage mount options

"Quick Question!When mounting a FSX OpenZFS on the cluster via the yaml. config file during cluster creation, does the SharedStorage section takes care of mounting this filesystem using optimal settings?I was reading we should use 'nconnect=16', for example, for better performance. I wondering if this mount option is already taken care of via the config file. If not, how to can it be added?https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/performance.htmlThanks,DaniloFollowComment"

Answer: "1You may have more luck asking at the Github repo - https://github.com/aws/aws-parallelcluster - but I don't see any evidence for mount options in the documentation for any filesystem, not even ZFS.Poking around the Chef cookbooks (which do the instance mounting/unmounting), options for ZFS looks hardcoded - https://github.com/aws/aws-parallelcluster-cookbook/blob/develop/cookbooks/aws-parallelcluster-common/resources/lustre/partial/_mount_unmount.rb#L124CommentSharehpc-in-aws-workerbeeanswered a month ago0Unfortunately , the performance tips from FSx are not applied and there is no way to customize it with cluster configuration file.CommentSharerePost-User-7640917answered a month ago"


Question: DNS not working after connecting to AWS VPN on MacOS

"Hi everyone,I had this setup working for a couple of weeks but now suddently it stopped working. Basically, I can connect to the AWS VPN using the AWS VPN Client, but as soon as I connect, the DNS stops working and I cannot resolve anymore. I can perfectly ping external IPs, so I do have connection. I can also ping EC2 instances in my VPN. The problem is that the DNS on my MacOS stopped working.I have a co-worker using the Windows client and it works for him. Another co-worker, also on Mac and it works. So there is something in particular with my machine.If I run scutil --dns I can see something like:DNS configurationresolver #1  nameserver[0] : 10.0.2.1  flags    : Request A records  reach    : 0x00000002 (Reachable)Same IP is written in /etc/resolve.conf. Notice that it is not even the same IP every time I connect to the VPN. For example, once I got 10.0.0.1 as well. In that other coworker on Mac where it works, the /etc/resove.conf is not changed at all. It keeps the original value before connecting to the VPN.The command nslookup www.amazon.com answers:;; connection timed out; no servers could be reachedI also tried adding DNS servers on the VPN Client endpoint. I tried adding 10.0.0.2 as the DNS server. But still, nothing changed.Of course, if I go to the Network settings on the Mac, I go to the Wifi connection, then to the DNS section and change 192.168.7.1 (my correct DNS before connecting to the VPN) to 8.8.8.8 (Google's DNS), then everything works. But this is a workaround. I want to understand what is going on and find a correct solution. Same thing if I execute in the terminal networksetup -setdnsservers "Wi-Fi" 8.8.8.8I also got into the log directory and did a grep -R "DNS" and I got this:./aws_vpn_client_20230510.log:; EDNS: version: 0, flags:; udp: 512./aws_vpn_client_20230510.log:2023-05-10 10:24:46.907 -03:00 [DBG] Starting DNS monitoring thread for Mac./aws_vpn_client_20230510.log:2023-05-10 10:24:46.913 -03:00 [DBG] DNS servers for OpenVPN with pid 7920: ./aws_vpn_client_20230510.log:2023-05-10 10:24:46.914 -03:00 [DBG] DNS is not configured for this connection. Quit DNS monitoring thread./aws_vpn_client_20230510.log:2023-05-10 10:24:46.922 -03:00 [DBG] Mac DNS monitoring is already in progress. SkipNot sure if it is useful at all.Some details of the VPN:Split tunnel is enabledThe CIDR is 10.0.0.0/22AWS VPN Client version is 3.3.0 (latest)MacOS version 13.3.1Any ideas of what may be happening?Thanks in advance!FollowComment"

Answer: "0Follow this fix and see if it resolves your issue https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/troubleshooting.html#resolve-host-nameYou can also manually enter your ISP DNS in your machine and test.Check AWS VPN Client logs to get more more insight of what's happening https://docs.aws.amazon.com/vpn/latest/clientvpn-user/macos-troubleshooting.html#macos-troubleshooting-client-vpn-connectCommentShareMatt_Eanswered 25 days agorePost-User-9342809 25 days agoThanks for your response!I already had that fix in place but didn't helpYes, if I manually change the DNS from my router's IP to...say, 8.8.8.8 then it works. But of course, this is no the solution I am looking for.I just look at the logs. I will update the question with such findings.Thanks!Share0We had the same experience.  For us the issue was the client was not updating the DNS servers that it should use when you are VPN'ed in, so it couldn't reach internal resources.It could be as simple as you manually adding DNS entries that won't resolve things that are internal to your private network.  You can make sure that there are no entries in your network DNS settings.Set it to automatic.However, we switched to the Viscosity Client (https://www.sparklabs.com/viscosity/) which has some additional capabilities like enforcing DNS changes etc.Hope this helps.CommentShareCarlos del Castilloanswered 25 days ago"


Question: Intermittend InvalidSignature error when retrieving object from S3 Object Lambda accesspoint in lambda@edge function

"We have created a lambda@edge function  (nodejs 14 with default aws sdk) that retrieves an object from an S3 Object Lambda accesspoint. Most of the time everything works correctly, but from one moment to the other the lambda@edge function fails the call to S3 with an "InvalidSignature" error.We create the S3 client once during the lambda@edge during the startup of the lambda@edge function and only do an s3.getObject call to the S3 Object Lambda accesspoint and return the results.Any idea what could be the cause?FollowComment"

Answer: "0For this type of problem, I'd strongly recommend creating a support case. The support team is able to bring in the Lambda@Edge service team, look at the logs, correlate the time/date of when you're seeing errors and work with you to fix the issue.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: AWS MySQL RDS Restore loses data

"Hello,We have a mysql RDS and I had to move it from classic to VPC environment. Everything looked good until next day, when the databases in the instance disappeared. I had to restore from a backup and create a new instance and the same thing happens the next day. The only event I see is a rds backup and restore activity. Anybody encountered this issue?Thanks!FollowComment"


Question: How can I lock my Lambda function to prevent accidental changes?

Is there an easy way to lock a specific AWS Lambda function to prevent accidental changes? [Some functions] [1] that are used in the production environments for maintenance purposes are not a part of the development cycle. I'm looking for a way (similar to termination protection) to lock these functions to prevent changes.[1]: https://aws.amazon.com/blogs/security/how-to-automatically-update-your-security-groups-for-amazon-cloudfront-and-aws-waf-by-using-aws-lambda/FollowComment

Answer: "0Accepted AnswerYou can create aliases or versions for your Lambda function's production version. If you make changes to the created alias or version, the production version doesn't get affected.CommentShareEXPERTUrianswered 4 years ago"


Question: Can Device Farm Desktop browsers support WebGL 2.0?

"Hi!  I'm trying to set up automated QA for a Unity WebGL product, but when we build it with the WebGL 2.0 graphics API, and load our test page in Device Farm with Firefox,  we get the following error:UnexpectedAlertOpenError: Dismissed user prompt dialog: Your browser does not support graphics API "WebGL 2.0" which is required for this content.The latest Firefox definitely supports WebGL 2.0 at this point, so I'm assuming that Device Farm is turning it off intentionally, and I can't find any Selenium WebDriver commands to affect it either way.So: is there some way to enable it, or will we be forced to use a different solution for our testing?FollowComment"

Answer: "1Accepted AnswerHello,This is Tom from AWS Support Team. I see that this is a question on WebGL 2.0 compatibility with Device Farm Desktop Browsers (Firefox).Device Farm desktop browser instances are based on the c5.large instance type [1]. This type of EC2 instances does not offer GPUs, and thus use the CPU for all graphical computations. As a result, graphics-intensive applications such as those from Unity may not work as expected. Therefore, I would recommend alternative solutions for testing builds with WebGL 2.0 API integrations.I hope the above information helps. Have a nice day!Links and References[1] https://aws.amazon.com/ec2/instance-types/CommentShareSUPPORT ENGINEERTom_Tanswered 5 months agosjkl_praxislabs 5 months agoWonderful, thanks so much for this response!  This explains so much about our device farm tests and is great to know going forward!Share"


Question: connect to cluster - key not accessible

"Hello,I have created a cluster following this workshop ([https://catalog.us-east-1.prod.workshops.aws/workshops/21c996a7-8ec9-42a5-9fd6-00949d151bc2/en-US/hpccluster/hpc-connectpcluster]) but unfortunately I can't connect to it. Here the error message:Warning: Identity file XXX.pem not accessible: No such file or directory. Permission denied (publickey,gssapi-keyex,gssapi-with-mic).FollowComment"

Answer: "0Hello,From the error message, it looks like either your pluster ssh or pcluster dcv-connect command is unable to find the .pem identity file that you have created as part of the Create a SSH key section.If the .pem file is in a different location, you can provide the full path of the .pem with the -i flag as shown below.pcluster ssh --cluster-name cfd -i /path/to/KEY_NAME.pem(OR)pcluster dcv-connect --cluster-name cfd --key-path /path/to/KEY_NAME.pem --show-urlIf you are still facing issues  after making sure that the file is present, you can open a issue on aws/aws-parallelcluster github project with detailed steps to reproduce or open a support case for further investigation.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago"


Question: Can't download file from S3 bucket in another account

"I'm using the aws:downloadContent Command Document plugin to download a file from an S3 bucket.  It works fine when the S3 bucket is in the same account as the instance, but when the bucket is in a different account, the step fails with "Access Denied".  The bucket is public, and I've given the instance full S3 permissions to access it.  Is this a build-in restriction of SSM?FollowComment"

Answer: 0nm - it was a problem with my permissions.CommentShareIchabodanswered 3 years ago


Question: How can I set a custom setting on a Postgres database?

"Setting a custom value works fine in Aurora. For example:SET jwt.claims.email = 'user.email@example.com';SET my.custom.setting = 'yes';In vanilla Postgres, one can also associate custom settings with a database object:ALTER DATABASE mydb SET my.custom.setting = 'yes';But in Aurora, I get the response:ERROR: permission denied to set parameter "my.custom.setting"; SQLState: 42501even though the current user is the database owner. Why does this disparity between standard Postgres and Aurora (and presumably RDS) exist? This breaks compatibility with a current setup that we're trying to migrate to AWS.FollowComment"

Answer: "0Amazon Aurora and Amazon RDS for PostgreSQL are managed database services. Both offer very high level of combability with existing open source offering.  Some administration level actions are restricted  to allow AWS to manage the database infrastcture. Setting parameters can be done using parameter groups as explained here: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Reference.ParameterGroups.html. You can see the list of supported parameters in the console or using CLIIn general if you are looking to migrate, you should approach your AWS account team. They  will be able to provide you more in-depth guidance and assistance.CommentShareAWS-yl-lfcanswered 4 months ago"


Question: Amazon Polly  Response Time

"Hi,We're using Amazon Polly ( boto3 Python client ) for production  TTS. We have a "fixed" test text that we're using to monitor our system. Usually this text takes a few seconds to be completed. I've noticed that sometimes it takes more than 1 minute (!!) to complete successfully.As we're using it as part of an IVR system where user is waiting on a phone, I would like to know if there is a way to speed it up or to prioritize such operations as well as to know how to audit/log/troubleshoot such operations (via cloudwatch or any other method). thanks in advanced !!FollowComment"

Answer: "1Hi,The 1 minute mentioned here is really close to the default boto3 connection timeout which is 60 seconds. I think what's happening here is that the client which is using boto3 tries to connect to the Polly endpoint but is unable to do so due to intermittent/transient networking issues. These are normally resolved by retrying the request. In the case of Boto3, it has to wait for 60 seconds before retrying the request again.You can enable boto3 debug logs and follow the steps here in this documentation to check if all of the instances that are taking more than 1 minute is due to retries -> https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html#validating-retry-attemptsPlease read this page for more information about this -> https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-retry-timeout-sdk/. This mentions Lambda but it can occur to any client which is invoking  any AWS API via the SDK.You can update the default boto3 settings by following the example in the above article# max_attempts: retry count / read_timeout: socket timeout / connect_timeout: new connection timeoutfrom botocore.session import Sessionfrom botocore.config import Configs = Session()c = s.create_client('s3', config=Config(connect_timeout=5, read_timeout=60, retries={'max_attempts': 2}))The idea here is to "fail fast" and ensure that boto3 times out quickly and retries the request immediately instead of waiting for the default timeout. Please make sure that the connection timeout is around 3x your expected or normal timeout to ensure healthy requests are not considered as timeouts.That said, this behavior should only happen for a small number of requests. If a large number of your requests are experiencing timeouts or if the requests are taking more than 60 seconds without any retries then I would recommend logging the RequestID's and creating a support case with us so that a log dive can be performed on these requests.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoAWS-rsos-zf a year agoThank you Ryan.It makes sense.  will definitely do as you propose .Thank YouShare"


Question: Why can I not RDP into my Windows EC2

"I created an EC2 on a t2.micro using the Windows_Server-2019-English-Full-Base-2021.11.10 AMI. I have an elastic IP setup with the instance as well. I went into the Connect section and downloaded the remote desktop file. In addition, I retrieved the password without issue using the associated key pair the instance was created with.I have an inbound rule for port 3389 to allow all traffic.I have tried including a '' in front of the username Administrator I have also tried copy and paste of the password along with typing in the password. Each time I get an error of login attempt failed.Is there something I am missing that would prevent me from being able to RDP?FollowCommentSriram a year agoHi - Can you check if you can do a telnet <elastic IP> 3389 port to see if you are able to access?Sharecdharma a year agoHi, Try to telnet to the external IP of the windows instance on port 3389. Also please check your security group's inbound and outbound rules.ShareMG a year agoYou can also check if the subnet is public and validate access in NACL.I think you can also analyze this problem using VPC Reachability Analyzer.ShareAWS-User-9716657 a year agoI am able to telnet with no issue.Share"

Answer: "1I use the format ".\Administrator" (be sure to include the period) when I want to authenticate as the local Administrator user of the instance. If that still doesn't work and you are familiar with the AWS SSM service, you could attempt to connect to the instance via the SSM Session Manager component, which would give you a PowerShell session. There, you can create a new local administrator account by issuing the following commands:net user <NEW_USER_NAME> <PASSWORD> /addnet localgroup administrators <NEW_USER_NAME> /addFor more information about how to setup SSM Session Manager, please take a look at the following link https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.htmlCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago0Try using this format, internal ip\administrator (example 192.168.0.1\administrator) as the username.Also it sounds like the networking is correct if you can telnet, but just for reference this is how public and private subnets work within your VPC: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html If you do not have a subnet with a proper route to an IGW you will not be able to RDP in from the internet. Make sure the Route table(s) are setup with the correct 0.0.0.0/0 routes.I assume the instance has been up for a while now, but also as an FYI a t2.micro Windows Server 2019 will take some time before it will be ready to receive inbound RDP connections after boot up.CommentSharePaul_Canswered a year ago"


Question: How to download image using java sdk from s3?

I have a program which print image contents but does not know how to download image file in the best way. Can somebody help please?BufferedReader reader = new BufferedReader(new InputStreamReader(s3objectResponse));String line;            while ((line = reader.readLine()) != null) {                System.out.println(line);}FollowComment

Answer: "0Below is the code of a Java console program that downloads a file from a bucket on S3, and then saves the file on disk:package net.codejava.aws; import java.io.BufferedOutputStream;import java.io.FileOutputStream;import java.io.IOException; import software.amazon.awssdk.core.ResponseInputStream;import software.amazon.awssdk.services.s3.S3Client;import software.amazon.awssdk.services.s3.model.GetObjectRequest;import software.amazon.awssdk.services.s3.model.GetObjectResponse; public class S3DownloadFileExample {         public static void main(String[] args) throws IOException {        String bucket = "your-bucket-name";        String key = "Your file.png";                 S3Client client = S3Client.builder().build();                 GetObjectRequest request = GetObjectRequest.builder()                        .bucket(bucket)                        .key(key)                        .build();                 ResponseInputStream<GetObjectResponse> response = client.getObject(request);                         BufferedOutputStream outputStream = new BufferedOutputStream(new FileOutputStream(key));                 byte[] buffer = new byte[4096];        int bytesRead = -1;                 while ((bytesRead = response.read(buffer)) !=  -1) {            outputStream.write(buffer, 0, bytesRead);        }                                     response.close();        outputStream.close();    }}CommentShareAhmed Abudayehanswered 8 months agoankit1122 8 months agoIt worked, thanks.But can you please refactor this to use new FILE I/O ?ShareAhmed Abudayeh 8 months agoYour welcome Ankit.You can check this article http://www.javaroots.com/2013/05/how-to-upload-and-download-images-in.html?m=1Share"


Question: Can API Gateway be used as Websocket client?

"Hello,Is it possible to initiate a WebSocket connection from AWS Gateway, or otherwise set up a Serverless/lambda-based connection to an AWS-external Websocket interface? And if so, how?Any API Gateway/Websocket question/article/tutorial/example I've come across is about hosting a WebSocket API and having clients connect to it, and not the other way around.The only related question Ive seen is this one but it has not been answered yet: https://stackoverflow.com/questions/69173955/can-i-connect-to-websocket-api-as-a-client-from-aws-api-gatewayAny pointers or help would be much appreciatedFollowComment"

Answer: "0Accepted AnswerNo, API Gateway only supports incoming web sockets (and also REST) connections. If you want to initiate a connection to some other service, you will need to write code, using some web sockets library, that runs in a container, to establish the connection. You can't use a Lambda function to run this code, unless you expect the connection to be short lived (up to 15 minutes).CommentShareEXPERTUrianswered 8 months ago"


Question: User defined groups and blue prints in Lake Formation

"HiWe are currently investigating Lake Formation and it looks promising.There are a few things which we can't figure out to do. Either because we don't know how or because they are not yet developed for Lake FormationUser defined groupsWe cannot see our IAM groups in the grant permission to data access.We have a large group of analysts divided into different divisions. We would like to give a specific access to each division, but not having the overhead of doing this for each analyst. I can only find the "everyone" group, which doesn't suit our needsUser defined blueprintsCurrently the number of blueprints is limited to databases and cloudtrail-logs. It would be a nice feature to be able to create your own blueprints in order to recreate userdefined datalake ingestions.I don't know if anyone has some workarounds for these issues or there is a wish-list somewhere to propose new featuresBest and ThanksFollowComment"

Answer: "0Thanks for using AWS Lake Formation and for the feedback. Both permissions for IAM groups and user defined blueprints are not yet supported, but the team is aware of these product requests.In the meantime, a workaround for groups is to create a role to which you grant Lake Formation and querying permissions, then allow members of the IAM group to assume that role. Remember that when they assume the role, they only have that role's permissions. See here:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.htmlRemember to make the AWS account from which you are calling AssumeRole a trusted entity for the role:https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_cant-assume-roleCommentShareAWS-User-5623776answered 4 years ago0Thank youGuess this was our conclusion tooCommentSharemortenestrupanswered 4 years ago"


Question: instance stuck in shutdown state

"Hello,One of my instances is stuck in stopping state. I tried Forcefully Stop several times without success,ID Instance i-05b86d43b092bb1dclondon regionThanks in advance!!FollowCommentSyd 5 months agoEither you need to raise a support ticket with AWS (needs a support plan) or some AWS Support engineer needs to see this post and assist.Share"


Question: Can't find EBS Volume

Hi there.Setup:I have EC2 instance running that according to linux commands has 3 volumes attachedWhen I'm checking the AWS Console I can see only two volumes attached.https://user-images.githubusercontent.com/3293183/229754240-0239dc54-73aa-4a0b-9498-5df96e8e1d9b.pngsudo lsblk -oNAME          MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT          nvme1n1       259:0    0    75G  0 disk /var/opt/mssql/backup nvme2n1       259:1    0 139.7G  0 disk /mssql-tempdb         nvme0n1       259:2    0   125G  0 disk├─nvme0n1p1   259:3    0   125G  0 part /                     └─nvme0n1p128 259:4    0     1M  0 partI can't find nvme2n1 in the console. I've also checked all volumes in our account and there are no volumes with this size.Please give me a hint how I can find the attached volumeFollowComment

Answer: 0Can you share what instance family and size are you using? Its possible the instance has local NVMe/ Instance store.CommentShareEXPERTVijay Shekhar Raoanswered 2 months agorePost-User-0593786 2 months agoThe instance I'm using "z1d.xlarge"SharerePost-User-0593786 2 months agoI've checked "z1d.xlarge" should have 1 x 150 NVMe SSD. How come it's 139.7 then?Should it be shown in the console?Thanks for the direction anyway :)Share


Question: "The method toJSONPretty() is undefined for the type Map<String,AttributeValue>"

"Hello I've a jsp with code (from https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ScanJavaDocumentAPI.html) :...<%@ page import="com.amazonaws.services.dynamodbv2.AmazonDynamoDB" %><%@ page import="com.amazonaws.services.dynamodbv2.AmazonDynamoDBClientBuilder" %><%@ page import="com.amazonaws.services.dynamodbv2.document.DynamoDB" %><%@ page import="com.amazonaws.services.dynamodbv2.document.Item" %><%@ page import="com.amazonaws.services.dynamodbv2.document.ItemCollection" %><%@ page import="com.amazonaws.services.dynamodbv2.document.ScanOutcome" %><%@ page import="com.amazonaws.services.dynamodbv2.document.Table" %><%@ page import="com.amazonaws.services.dynamodbv2.model.AttributeValue" %><%@ page import="com.amazonaws.services.dynamodbv2.model.ScanRequest" %><%@ page import="com.amazonaws.services.dynamodbv2.model.ScanResult" %>...<%AmazonDynamoDB client = AmazonDynamoDBClientBuilder.standard().build();        DynamoDB dynamoDB = new DynamoDB(client);        String tableName = "TicketsWalletUsersDev";        // Table table = dynamoDB.getTable(tableName);                Map<String, AttributeValue> lastKeyEvaluated = null;        do {            ScanRequest scanRequest = new ScanRequest()                .withTableName(tableName)                .withLimit(10)                .withExclusiveStartKey(lastKeyEvaluated);            ScanResult result = client.scan(scanRequest);            for (Map<String, AttributeValue> item : result.getItems()){                                              System.out.println(item.toJSONPretty());            }            lastKeyEvaluated = result.getLastEvaluatedKey();        } while (lastKeyEvaluated != null);%>It gives the error:The method toJSONPretty() is undefined for the type Map<String,AttributeValue>I want the string containing the true json and not the string  returned from item.toString() that is :{addresses={M: {mobile+75@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1583142338893,}, verified={BOOL: true}},}, federico+11@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1581332986414,}, verified={BOOL: true}},}, federico+signup3@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1581330211793,}, verified={BOOL: true}},}, federico+33@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1581330013122,}, verified={BOOL: true}},}, mobile@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1583162677615,}, verified={BOOL: true}},}, federico+12@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1581333042026,}, verified={BOOL: true}},}, federico+2@nearit.com={M: {requestId={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6_1581332941950,}, verified={BOOL: true}},}},}, created={S: 2020-02-05T10:40:17.887Z,}, userName={S: 909b1963-0ed4-4ac1-9b71-846239ed5bf6,}}Thanks!FollowComment"

Answer: "0Accepted AnswerThere is no toJsonPretty() for Map<String, AttributeValue> in your code.To get json, you should get Item first from the table.You can refer the code example below Specifying Optional Parameters part here https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/JavaDocumentAPIItemCRUD.html#JavaDocumentAPIGetItemCommentShareSUPPORT ENGINEERStewyn_Canswered a year ago"


Question: Why it isn’t re-assigned a public IP address and public IP DNS for a Instance in a public subnet after stopped and started in case of attached 2 eni.

Problem Description:It isn’t re-assigned a public IP address and public IP DNS for a Instance  in a public subnet after stopped and started in case of attached 2 eni.Symptom with screenshotStep 1. Initialized InstanceStep 2. Stopped InstanceStep 3. Re-Started InstanceStep 4. Rebooted InstanceQuestion #1. Is that normal?Question #2. Why it isn’t re-assigned a public IP address and public IP DNS with this caseQuestion #3. How I can prevent with re-assigned public IP address and public IP DNS with this this caseFollowComment

Answer: "1Accepted AnswerSee below 2 points from the documentation; what you are seeing is expected behavior. You can use Elastic IP instead of Public IP if you want persistent behavior.We release your instance's public IP address when it is stopped, hibernated, or terminated. Your stopped or hibernated instance receives a new public IP address when it is started.You cannot auto-assign a public IP address if you specify more than one network interface. Additionally, you cannot override the subnet setting using the auto-assign public IP feature if you specify an existing network interface for eth0.CommentShareEXPERTTushar_Janswered 9 months agoEXPERTChris_Greviewed 9 months agoFelix 9 months agoThank you for your answers. Can I ask 2 more questions from your answers?Why it can't be auto-assigned a public IP address in case of 2 more eni on an instanceDo you mean it will keep the elastic IP on the primary eni although it has 2 more eni?ShareTushar_J EXPERT9 months agoThink of Public IP as ephemeral entity (temp) if you want persistent IP use Elastic IP which you can attach/detach to any of the ENI on-demand.Share"


Question: How do you set data retention policy on IoT Sitewise time series store?

"Going off this suggested architecture. https://pages.awscloud.com/Building-an-End-to-End-Industrial-IoT-IIoT-Solution-with-AWS-IoT_2020_0216-IOT_OD.htmlThe suggested architecture for industrial IoT applications is IoT SiteWise for operational "hot" data store and IoT Analytics -> S3 for the "warm/cold" data lake. IoT Analytics allows you to set the data retention policy on its data stores. We don't want the "hot" data store to contain historical data when IoT Analytics -> S3 already handles that for us. Also, we want to avoid siloing data between SiteWise and IoT Analytics. Is there a way to set the data retention policy on IoT SiteWise?I've already looked through the documentation for SiteWise, not sure if I missed something.FollowCommentiotivity a year agohttps://docs.aws.amazon.com/iot-sitewise/latest/userguide/manage-data-storage.html it is available now.Share"

Answer: 0Accepted AnswerAs of today IoT SiteWise doesn't have such an option. Data stored in IoT SiteWise persists forever.CommentShareAWS-User-5069882answered 3 years ago


Question: How to get heap dump on s3 location after getting OOM exception in aws lambda function

"I can store hprofile heap file whenever there is a OOM exception in java application. So I want similar type solution in aws lambda that whenever any OOM exception occur during running java application jar in aws lambda, heap file will stored in s3 location. So that it can be used for further analysis.FollowComment"


Question: Beta testing/Kickstarter

"Hello! So I noticed under the service terms that games made with Lumberyard cannot be distributed for beta testing.I wonder if that's true, and if I'm allowed to publicize content(videos, demos) pre-release, in hopes of Kickstarter fundraising.Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERTo help clarify some details, it’s fine to distribute your game to yourcustomers whether it’s in beta, alpha, or full production, and you can do iton Kickstarter, Steam, Amazon, wherever you see fit; that’s covered in 57.2(b) of our terms.I would like to make sure I'm understanding your question though. What’s the specific requirement you’re looking at?For example, are you wanting to distribute the source code for your game? If you are trying to include source code, then there is a restriction on that. We do not allow the redistribution of more than 50 lines of source code, except as a forkof our github repo, which has to be parented to our repo on github.Let us know if that helps or if you have additional questions or concerns.SharerePost-User-7951591answered 6 years ago0Seems that I had a big misunderstanding of the 1.10 section.Well, thanks for your answer!SharerePost-User-9686089answered 6 years ago0No worries, happy to help clear things up!SharerePost-User-7951591answered 6 years ago"


Question: Get revision id or commit message from code pipeline source stage

"Is there a way to get the revision id or commit message from AWS code pipeline source stage when source stage is  InProgress state.I have tried using get-pipeline-stage, get-pipeline-execution & list-pipeline-execution AWS cli commands. I'm getting the I'd once stage is succeeded.FollowComment"

Answer: 0You can leverage the list-action-execution CLI command to obtain this information from your CodePipeline Source stage. This information will be noted in the output.outputVariables section of the response.CommentShareBrent Everman AWSanswered 2 months ago


Question: Amazon Linux 2 Apache package version update

"Hello,As we have been working on Amazon Linux 2 for a couple of years now, we have noticed that it's sometimes slow when it comes to releasing new version updates on packages. For example currently the latest Apache version is 2.4.52 (there has been 2 security vulnerabilities fixed CVE-2021-44224 and CVE-2021-44790) and yet the latest available version is 2.4.51. Therefore I wanted to ask:Is there any estimate on when the latest Apache version will be available for installation on Amazon Linux 2 default repo?How can we install the latest Apache version on Amazon Linux 2, so that we don't have to wait for the Amazon Linux 2 team to make the latest version available? Obviously we don't want to install it from source, as we want to still manage it using yum package manager.Thanks in advance for your help!FollowComment"

Answer: "0For questions or concerns about security in Amazon Linux or any AWS service, please reach out to our security contact: aws-security@amazon.comCommentShareEXPERTMichael_Fanswered a year ago"


Question: Lambda SSL error UNABLE_TO_VERIFY_LEAF_SIGNATURE posted on forums by  Shikasta_Kashti

"Hi,I'm trying to connect to my mail server from Lambda but when I do I get this error: UNABLE_TO_VERIFY_LEAF_SIGNATURE and it happens intermittently.I found one post here in the AWS Lambda forums with same error and it indicates it was some DNS error. Here's the link to that post: https://forums.aws.amazon.com/message.jspa?messageID=608080Any ideas as to what's wrong here? It was week fine until last week. I checked the SSL of the server with ssllabs.com and it doesn't indicate any issue with it.Original: https://forums.aws.amazon.com/thread.jspa?threadID=235965FollowComment"

Answer: "0Found an article: https://levelup.gitconnected.com/how-to-resolve-certificate-errors-in-nodejs-app-involving-ssl-calls-781ce48dadedSuggestions are:Quick fix:  Add rejectUnauthorized on request or ENVIRONMENT settingAdd CA certificate to requestAdd to request:https.request({       ....,      rejectUnauthorized: false,    },...)or environment variable:NODE_TLS_REJECT_UNAUTHORIZED=0Alternatively and safer solution is CA certificate:   ca: [fs.readFileSync([certificate path])],   rejectUnauthorized: true,}```CommentSharePieteranswered a year ago"


Question: How to allow a role to attach role to an instance?

"How do I allow a role to attach role to an EC2 instance without having Administrator Access??  Below is my IAM policy.  Something appears to be missing.{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["iam:List*","iam:Get*","iam:CreateRole","iam:CreatePolicy","iam:PutRolepolicy","iam:CreateServiceLinkedRole","iam:AttachRolePolicy","iam:CreateInstanceProfile","iam:AddRoleToInstanceProfile","iam:PassRole","sts:AssumeRole"],"Resource": ["arn:aws:iam:::role/service-role/","arn:aws:iam:::policy/service-role/"]}]}FollowComment"

Answer: "0I figured it out. The ARNs were not being called out correctly:"arn:aws:iam:::role/NameOfRole","arn:aws:iam:::policy/NameOfPolicy"CommentShareiamdifficultanswered 2 years ago"


Question: ACCOUNT_THROTTLED in BulkEmailEntryResult

"Hi,I used sesv2.sendBulkEmail (@aws-sdk/client-sesv2) to send 18000+ emails but have a problem with ACCOUNT_THROTTLED error that returns in BulkEmailEntryResult. How can I handle this case?(My daily sending quota is 50,000 emails per 24-hour period and My maximum send rate is 14 emails per second.)I use sleep(5000) to slowdown my request, it work for first 500 emails but my service can't wait that long.FollowComment"

Answer: "1Accepted AnswerNevermind, I let it error and make cron-job to resend it later.CommentShareTeerapong-janswered a year ago"


Question: Switch from credit card payment to invoice

"Hi there!I have a landing zone multi account environment, and I need to pay via invoice rather than credit card.I have a credit card assigned as the default payment right now, how can I ensure that my accounts team can pay by invoice and not have the costs deducted from the credit card?I have already set up my account team as the billing contact, so they are ready to pay the invoices once received. I just need to make sure they have time to pay them and that the credit card won't be charged instead / or result in a duplicate payment.Thanks,GavinFollowComment"

Answer: "0I suggest reaching out to your account team (account manager) with this request. If you don't know who's your AWS account manager, you can open a request here: https://aws.amazon.com/contact-us/Alternatively, open a billing support case from your Management Payer account, and the support team will be able to provide you more information regarding this.CommentShareEXPERTNataliya_Ganswered a month ago-1Go to the AWS Billing and Cost Management console.Click on "Payment Methods" in the left-hand navigation menu.Click on the "Edit" button next to the credit card that is currently assigned as the default payment method.Change the default payment method to "Invoice."Confirm the change by clicking on "Save changes."Contact AWS support to request that they disable the automatic charge feature on your account to prevent the credit card from being charged automatically.Make sure to provide your account information and the reason for the request.Once your request is processed, your account team will receive invoices from AWS for payment.They can then pay the invoices by the due date provided on the invoice.CommentShareYurii Banswered a month ago"


Question: Chime SDK meeting with Cognito user pool

"HiCan anyone share the code flow for chime sdk serverless meeting with cognito user pool?Step-by-step process would be a great help as we tried, but we lost.ThanksSiddharthFollowComment"

Answer: "0I know u asked for code sample but I dont have it :( . Have you seen these two resources?amazon-chime-sdk-multi-meeting-managementIntegrate your Identity Provider with Amazon Chime SDK MessagingCommentShareNikoanswered 2 months agoupon cloud 2 months agoHi Nikemany thanks for a URL .I've looked at both the URLs for the Chime SDK serverless meeting and the Chime SDK serverless messaging, but I noticed that their file structures are different. As a result, we're having difficulty figuring out how to implement them.if you can provide some highlights would be a great help.ThanksShareNiko 2 months agooh man, I messed up with my links. The first one was supposed to be a sample code with github. I just updated it, see if this helps.https://github.com/aws-samples/amazon-chime-sdk-multi-meeting-managementShareupon cloud 2 months agoHi Nikothanks againbut your mentioned URL is too complicated for us do you have any simple flow for usShareNiko 2 months agoWhat exactly r u trying to do? I maybe be able to create something but the request is very broad..so help me to help you:)Shareupon cloud 2 months agoHi NikoWe want to secure access to our serverless Chime SDK API URL by requiring a username and password.Here are the steps we have taken so far:Step -1 We deployed the serverless Chime SDK from this GitHub repository: https://github.com/aws/amazon-chime-sdk-js/tree/main/demos/serverless.Step -2 We mapped the API URL to our domain name using API Gateway.Step - 3 We set up authentication for the API Gateway using Cognito.However, when we try to access the Cognito URL with a username and password, we receive an "Unauthorized" message in the browser. We are not sure how to pass the token in the URL header.Please advise  steps to fix thisThanksShare"


Question: Working only new data in aws glue

"Hi everyone,I have a math need to solve. I have new data importing to s3 everyday, Right now I have to run all data include old one everyday which is costly but the thing is I only need to convert the new data. Can anyone know how to just only run new data in ETL job in Glue? And how to Glue know and skip all the things it done and only run the new things - which haven't done yetI appreciate all your commentRegardsThangEdited by: phithang711 on Jan 29, 2019 2:25 PMFollowComment"

Answer: 0discover the job bookmark in aws glue. Hope it helps me. Close this topic right hereCommentSharephithang711answered 4 years ago


Question: How to get dark mode in Amplify UI work?

"I am following an example from the official document to setup dark mode. But it only apply dark mode to the ToggleButtonGroup, and does not apply to entire page. Does anyone has used dark mode in Amplify UI?FollowComment"

Answer: 0Select dark mode from the Account drop down on top right> Settings > Visual mode> select dark mode.CommentSharerucsethianswered 6 months ago


Question: Training Job Failed "ClientError: Mask image is not a 8-bit"

"Hello,I am working on a Semantic Segmentation training job.  I have used the Ground Truth semantic segmentation labeling GUI and have labeled about 900 images.  Everything with the Ground Truth Labeling job seemed to work just fine.  However I noticed the output images in the s3 output path are of type .png.I am now trying to build a training job using the Pipe - augmented manifest input format.  When I kick off the job, after a few minutes I see this error: "ClientError: Mask image is not a 8-bit single channel image. Please check the label image dataset"I downloaded the output images or "masked images" to photoshop and they do appear to be 8bit "index color".If I used the built in Semantic Segmentation - Ground Truth Labeling job, how would I end up with the incorrect output format?I don't remember specifying or having the option of output image format.  Did I miss that somewhere?Here are a couple line items from the output.manifest file{"source-ref":"s3://rigbypotato-2/segmentation-validation/MyImage - 20190201122850904.png","potato-features-validation-ref":"s3://rigbypotato-2/segmentation-validation/output/potato-features-validation/annotations/consolidated-annotation/output/0_2020-04-14T02:38:26.487862.png","potato-features-validation-ref-metadata":{"internal-color-map":{"0":{"class-name":"BACKGROUND","hex-color":"#ffffff","confidence":0.79952},"1":{"class-name":"pressure-bruise","hex-color":"#2ca02c","confidence":0.79952},"2":{"class-name":"potato","hex-color":"#1f77b4","confidence":0.79952},"3":{"class-name":"old-bruise","hex-color":"#ff7f0e","confidence":0.79952},"4":{"class-name":"black-skin","hex-color":"#d62728","confidence":0.79952},"5":{"class-name":"green","hex-color":"#9467bd","confidence":0.79952},"6":{"class-name":"scab","hex-color":"#8c564b","confidence":0.79952}},"type":"groundtruth/semantic-segmentation","human-annotated":"yes","creation-date":"2020-04-14T02:38:26.563488","job-name":"labeling-job/potato-features-validation"}}{"source-ref":"s3://rigbypotato-2/segmentation-validation/MyImage - 20190201122852921.png","potato-features-validation-ref":"s3://rigbypotato-2/segmentation-validation/output/potato-features-validation/annotations/consolidated-annotation/output/1_2020-04-14T02:21:27.433381.png","potato-features-validation-ref-metadata":{"internal-color-map":{"0":{"class-name":"BACKGROUND","hex-color":"#ffffff","confidence":0.82409},"1":{"class-name":"pressure-bruise","hex-color":"#2ca02c","confidence":0.82409},"2":{"class-name":"potato","hex-color":"#1f77b4","confidence":0.82409},"3":{"class-name":"old-bruise","hex-color":"#ff7f0e","confidence":0.82409},"4":{"class-name":"black-skin","hex-color":"#d62728","confidence":0.82409},"5":{"class-name":"green","hex-color":"#9467bd","confidence":0.82409},"6":{"class-name":"scab","hex-color":"#8c564b","confidence":0.82409}},"type":"groundtruth/semantic-segmentation","human-annotated":"yes","creation-date":"2020-04-14T02:21:30.556262","job-name":"labeling-job/potato-features-validation"}}ThanksEdited by: tetontech on Apr 16, 2020 7:07 PMFollowComment"

Answer: "0Total user error.My problem was that I was only giving the semantic segmentation algorithm 1 attribute from my output.manifest file which was "source-ref". This algorithm of course needs 2 attributes from the the output.manifest file which are the source images and masked images.  Once I provided the second attribute "potato-features-validation-ref", everything worked fine.From the few lines of the output.manifest file I posted earlier, you will notice these two attributes.hope this helps someone else.CommentSharetetontechanswered 3 years ago"


Question: How to pass parameters from an event rule through a glue workflow trigger to a job

"I have an event rule rule that triggers a glue job.  I would like to pass information from the event details as a parameter to the Glue job.  For example, say my event contains:{"details": {"database_name": "my_database"}} and and my job has a parameter --DATABASE_NAME.  Is it possible to pass database_name from the event as the --DATABASE_NAME parameter in the job?  I haven't been able to find anything in the documentation or online on how to do it.Thanks!FollowComment"

Answer: "0To pass a parameter to a workflow, use StartWorkflowRun[1] API with RunProperties which takes key-value pairs and it can be accessed in the any job in the workflow using GetWorkflowRunProperties[2]. Further, if required, it can be modified in any job in the workflow using PutWorkflowRunProperties[3].If triggering an ETL job instead of a workflow, use StartJobRun[4] and set the job arguments. To access these job arguments in the script, use getResolvedOptions[5][1] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-StartWorkflowRun[2] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRunProperties[3] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-PutWorkflowRunProperties[4] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-StartJobRun[5] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-pyspark-extensions-get-resolved-options.htmlCommentShareSachin_Kanswered a year agorePost-User-6206294 9 months agoHi Sachin,The one part that isn't clear to me from your answer is if I have a trigger configured in glue based on an EventBridge event, how would you map the event contents to the job as params? The example in the question is the field database_name. If that value can be different for each event how do you configure the trigger to take that field and pass it in as a key \ value? If you can't configure it in the trigger is there a way once the job starts to get the event body in the job to extract the info?Share0There is no native option to pass EventBridge event details to Glue job. But  I used the following workaround to do this:You need to get an event ID from Glue workflow propertiesevent_id = glue_client.get_workflow_run_properties(Name=self.args['WORKFLOW_NAME'],                       RunId=self.args['WORKFLOW_RUN_ID'])['RunProperties']['aws:eventIds'][1:-1]Get all NotifyEvent events for the last several minutes. It's up to you to decide how much time can pass between the workflow start and  your job start.response = event_client.lookup_events(LookupAttributes=[{'AttributeKey': 'EventName',                                                         'AttributeValue': 'NotifyEvent'}],                                                         StartTime=(datetime.datetime.now() - datetime.timedelta(minutes=5)),                                                         EndTime=datetime.datetime.now())['Events']Check which event has an enclosed event with the event ID we get from Glue workflow.for i in range(len(response)):      event_payload = json.loads(response[i]['CloudTrailEvent'])['requestParameters']['eventPayload']      if event_payload['eventId'] == event_id:                event = json.loads(event_payload['eventBody'])In the event variable you get the full content of the event that triggered Glue workflow.CommentShareChildishGirlanswered 5 months ago"


Question: AWS Datasync mount.nfs: Connection timed out

"Hi -Attempting to test a local environment with AWS DatasyncRunning AWS Datasync Agent in Windows Hyper-VCreated the agent record in AWS console and registered the AgentIDNFS is running locally using: haneWIN NFS Server (https://www.hanewin.net/doc/nfs/nfsd.htm)I have some NFS shares that I can mount successfully in a windows cmd prompt.Every time I create a task, I get a Task Status of "Unavailable"mount.nfs: Connection timed outHow can I fix this?FollowComment"


Question: IPtables isn't working on Amazon Linux 2

"Hi,After years of using Amazon Linux 1, I'm making an effort to start using Amazon Linux 2, which (I get the impression) is what Amazon would like us to use going forward.I'm running into a problem with iptables. On Amazon Linux 1, iptables is already installed. On 2, it is not, but I figured out how to install it using these commands:sudo yum install iptables-services -ysudo systemctl enable iptablessudo systemctl start iptablesFrom there, I was able to issue the iptables commands I need. However, they don't work. For example, I am running a web server on port 8080 and I want to redirect 80 to 8080 so I can hit it from the internet. It doesn't work. Iptables says the route is defined, but I get no response from a web browser. (Yes, I checked to make sure the port is open in the firewall, and I have done this many times with Amazon Linux 1, so I know how it's supposed to work).Is there something else I need to do here?FollowComment"

Answer: "0I had a problem with this too but found that the AWS Linux 2 AMI has rules that come preconfigured in /etc/sysconfig/iptables that are set to reject any incoming traffic except SSH (port 22). It makes sense. What I did, and I don't know if this ultimately what you'd want to do long term, is flush the rules with iptables -F, add the rules I wanted for port forwarding and then saving those over /etc/sysconfig/iptables.ex:sudo iptables -Fsudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEsudo iptables -t nat -A PREROUTING -p tcp -d 10.0.20.172 --dport 1433 -j DNAT --to-destination 10.0.1.160:1433sudo iptables-save|sudo tee /etc/sysconfig/iptablesThis at least got me to where things were working. Hope this helps.Edited by: ericdred-pixsys on Feb 26, 2021 4:30 PMCommentShareericdred-pixsysanswered 2 years ago"


Question: Spread placement group limit per AZ using ECS

A spread placement group can span multiple Availability Zones in the same Region. You can have a maximum of seven running instances per Availability Zone per group.source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html#placement-groups-spreadDoes this stand true when I'm setting up the placement strategy for an ECS cluster ?FollowComment

Answer: 0To answer my own question after contacting support:The quote only stands true for Placement Groups as it is only relevant for placement groups.CommentSharepesymanswered 3 years ago


Question: Cloudwatch SDK using putLogEvents() works locally but 504 Gateway timeout on my server (EC2)

"I have a function that uses putLogEvents() method and it works fine locally but not when we push it out to our server (EC2 instance).  We are always getting 504.  I checked our LB and its allowing all traffic.  I am running out of ideas why it is timing out on our server.FollowCommentrePost-User-0097562 8 months agoAlso, when I do aws logs put-log-events ... on my EC2 server, it never responds back and I think that's why I'm getting 504 on my API but I'm not sure how to debug or see why its causing that to not respond.SharerePost-User-0097562 8 months agoI noticed that I can't telnet logs.us-west-2.amazonaws.com 443 on my EC2 instanceShare"

Answer: "0If it is a timeout, check whether your EC2 has outbound internet access. And after that if the EC2 has sufficient permissions, then it will work.CommentShareManikandananswered 8 months agorePost-User-0097562 8 months agoI can curl within that EC2 which means I have outbound internet access.  What permission shall I be looking for on that EC2 instance?Share"


Question: Trigger area not work ... what am I doing wrong?

"this is how I connect to the bus on the OnActivate in the Lua script:self.triggerHandler = TriggerAreaEntityNotificationBus.Connect(self, self.entityId)this is my method to handle the event:    function triggerDoor:OnEntityEnteredTriggerArea(entityId)Debug.Log("------- TRIGGERED.")endThe trigger component is configured using default settings, with capsule or boxshape.But the event does not trigger...What else should I configure?Thanks a lot!Follow"

Answer:
"0Accepted AnswerHey @REDACTEDUSERCheers!SharerePost-User-5738838answered 6 years ago0@REDACTEDUSERI have changed, but still not triggering the OnTriggerAreaEnteredThis is the Lua Script.function triggerDoor:OnActivate()self.triggerHandler = TriggerAreaEntityNotificationBus.Connect(self, self.entityId)Debug.Log("OnActivate ")endfunction triggerDoor:OnTriggerAreaEntered(entityId)Debug.Log("------- TRIGGERED.")endfunction triggerDoor:OnEntityExitedTriggerArea(entityId)Debug.Log("------- TRIGGERED.")end
REMOVEDUPLOADSharerePost-User-5849136answered 6 years ago0I read this in the documentation, but I could not find the checkbox."NoteYou must use a physics component and select the Proximity Triggerable check box in order for an entity to interact with the trigger areas."AlsoAt the class TriggerAreaComponent.cpp we have these two lines:EBUS_EVENT_ID(GetEntityId(), TriggerAreaNotificationBus, OnTriggerAreaEntered, entityId);EBUS_EVENT_ID(entityId, TriggerAreaEntityNotificationBus, OnEntityEnteredTriggerArea, GetEntityId());
SharerePost-User-5849136answered 6 years ago0@REDACTEDUSERTo help others:function puzzeCamera:OnActivate()self.triggerHandler = TriggerAreaNotificationBus.Connect(self, self.entityId)endfunction puzzeCamera:OnDeactivate()self.triggerHandler:Disconnect()endfunction puzzeCamera:OnTriggerAreaEntered(entityId)Debug.Log("------- TRIGGERED.")endfunction puzzeCamera:OnTriggerAreaExited(entityId)Debug.Log("------- saiu TRIGGERED.")endSharerePost-User-5849136answered 6 years ago0Awesome—thanks for solving and sharing!SharerePost-User-5738838answered 6 years ago0Hey @arineto, thanks for testing that out — I did notice one more thing. Let's give it a try! Please replace TriggerAreaEntityNotificationBus.Connect(self, self.entityId) with TriggerAreaNotificationBus.Connect(self, self.entityId). You may need to re-browse the Lua file in the Lua Script Component for the script to work :)SharerePost-User-5738838answered 6 years ago"


Question: ai personal assistant

Hi there. i want to create ai personal assistant application that understands human language and speak with people on lithuanian languageFollowComment

Answer: "0I believe it can be developed using AWS services.The following AWS services are used for speech recognition and natural language understanding.Amazon LexAmazon Lex is a natural language understanding service.Amazon Lex can be used to create voice chatbots, etc.https://docs.aws.amazon.com/lexv2/latest/dg/what-is.htmlAmazon TranslateAmazon Translate is a text translation service.Amazon Translate can help you translate from Lithuanian to other languages and vice versa.https://docs.aws.amazon.com/translate/latest/dg/what-is.htmlOther AWS services that may be useful include "Amazon Transcribe," which converts voice data to text, and "Amazon Polly," a text-to-speech service.CommentShareEXPERTRiku_Kobayashianswered 2 months ago0Hi, I just almost did exactly what you are looking for, but with ChatGpt and aws integration and amplify.You can tweak the example of course to do translations via the amplify Predictions package.This is the article: https://levelup.gitconnected.com/build-your-personal-speaker-assistant-with-amplify-and-chatgpt-8b6433fea042Hope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Why are my AWS Glue Studio notebook interactive sessions termination times are inconsistent?

"My AWS console user sessions auto logout setting is 45 minutes. I see my interactive AWS Glue Studio notebook sessions either gets terminated at 45 minutes, or at 12 hours for few sessions or at 48 hours for few sessions. How can I get a consistent session termination experience and avoid unexpected costs?FollowComment"

Answer: "0Accepted AnswerIf the user launches a notebook and no cells have been executed, AWS Glue Studio notebook times out after 12 hours.Once the user executes a cell, this will start an interactive session with default timeout value as 48 hours.Within this 48 hour window, if the user logs out, or closes browser tab, glue studio stops the open session immediately.In case of a edge scenario like “terminate” an app - i.e. force close the browser, the session will be terminated at the default timeout (48 hours) value.Users have the control on changing this default timeout value to a much lower value by defining a custom idle-timeout using Magics before executing the cell, so the session don’t wait for the 48 hour mark and gets terminated at user defined value.CommentShareArun Kumaranswered 10 days ago"


Question: Glue job keep running indefinitely on S3 registered with Lake Formation

"2021-06-23 13:26:36,962 INFO \[Thread-4] util.FileSchemeWrapper (FileSchemeWrapper.scala:executeWithQualifiedScheme(76)): Should Bypass LF Cred Fetching: false  Job keeps running and has this log flushed the log stream. And I already made sure that the rule which run this job is registered in Data Permission of Lake Formation. Not sure what I'm missing here.Thanks!FollowComment"

Answer: "0Turns out that my s3 is private and it needs glue connectionEdited by: Tunway on Jun 24, 2021 12:29 AMCommentShareTunwayanswered 2 years ago"


Question: Send attachments via .Net API SES

I have sent emails successfully using SES API for .NET but cannot find information on how to send attachments.Can you help me please?thanksPQFollowComment

Answer: 0Use "SendRawEmail" to send an email with an attachment.Please check the following document for details.https://docs.aws.amazon.com/ses/latest/APIReference/API_SendRawEmail.htmlhttps://docs.aws.amazon.com/ja_jp/ses/latest/dg/send-email-raw.html#send-email-raw-apiThe following documents are API references for .NET.https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/SimpleEmail/MSimpleEmailServiceSendRawEmailSendRawEmailRequest.htmlCommentShareEXPERTRiku_Kobayashianswered 20 days ago


Question: http/3 not working any longer for Cloudfront

In August 2022 it was announced support for HTTP/3 for Cloudfront. I spent some time enabling it and testing it yesterday for our website and it does not serve HTTP/3. I could only get HTTP/2 both on Chrome and on the http/3 test website from geekflare. Anybody else experiencing the same errors.FollowComment

Answer: "0HTTP/3 support for Amazon CloudFront was announced in August 2022, so it's relatively new. It is possible that there could still be some compatibility issues or bugs that need to be fixed. If you are unable to get HTTP/3 to work, I would suggest reaching out to Amazon's support team for further assistance.CommentShareDivyam Chauhananswered 4 months ago0Can you verify whether you're getting alt-svc header when getting the output from Http/3 enabled Cloudfront domain?something likealt-svc: h3=":443"; ma=86400Also maybe it is worth checking on chome://flags page wether QUIC is enabled (rather than "default" )CommentShareAlex_Tanswered 4 months ago"