Question: Cognito User Pools: Receiving Expired Session During CUSTOM_AUTH flow

"I have setup my lambda triggers for define auth challenge, create auth challenge, and verify auth challenge. I am able to successfully get through the PASSWORD_VERIFIER challenge and issue my custom challenge. However, as soon as I try to respond to newly issued custom challenge with AdminRespondToAuth, I get the following error:NotAuthorizedException: An error occurred (NotAuthorizedException) when calling the AdminRespondToAuthChallenge operation: Invalid session for the user.I am sending back the session token from the response I received after calling AdminRespondToAuthChallenge during the PASSWORD_VERIFIER challenge. I've checked the logs for my lambdas, but it looks like it's not even hitting any of themFollowComment"

Answer: "0Hello,Firstly, in regards to the Session String, it is an encrypted session received by the client in the previous step that the client must pass back as-is. The session contains state information about the current authentication. It cannot be replayed and it expires after 3 minutes.https://aws.amazon.com/jp/blogs/mobile/customizing-your-user-pool-authentication-flow/Secondly, in regards to the error faced, one way this error can happen is if two consecutive API calls were being made with the same session in your application code. Please do remember that the session key can be used only once. If RespondToAuthChallenge call is performed using the same session key again, you will get the above error. Hence, I would recommend checking the flow of your API calls in your application code. Also, checking Cloudtrail logs in your AWS account can also help in confirming if there are any multiple RespondToAuthChallenge API executions taking place.Additionally, the general flow of API and Lambda invocation in terms of custom challenges should look like below -InitiateAuth Api call with CUSTOM_AUTH authflow will invoke the DefineAuth trigger.DefineAuth trigger will then invoke CreateAuth trigger.CreateAuth trigger sends the response to DefineAuth trigger, which then invokes verifyAuth trigger.VerifyAuth trigger confirms the challenges and send the response to DefineAuth trigger, this trigger then generates token or prints error based on the response received.Thirdly, if above suggestion doesn't help, we will need to investigate your Lambda (considering you mentioned that it's not even hitting them - this would require checking the configurations of Lambda itself first to make sure that enough permissions [1] are provided for Cognito to be able to invoke them), the flow of your API calls, and test CLI vs application behavior to isolate if the issue exists in just the application end, or if it is consistent everywhere else. Also, if required capture the service request IDs (can be procured using HAR logs [2] for your app or CLI --debug [3] capabilities) for those failing Cognito API calls (RespondToAuthChallenge) to check for the issue.However, please do not post any any of the above sensitive information about your accounts or it's resources over this re:Post channel since this is a public platform. Therefore, I would like to request you to log a support case directly with our Premium Support team if you require any further assistance.As always, feel free to reach back out with any further questions or concerns in the meantime!References:[1] https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html[2] https://aws.amazon.com/premiumsupport/knowledge-center/support-case-browser-har-file/[3] https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.htmlCommentShareSUPPORT ENGINEERYash_Canswered 4 months ago"


Question: Serverless lambda rest api not updating database properly

"I am invoking my lambda REST api to update tables in dynamo db but it only updates the database after the second time its invoked. e.g - 1st call I post "some data" to lambda api it doesn't do anything but 2nd call I post "other data" it will process the first call I made("some data"). If I call lambda the third time then it will process "other data". If I wait between 1st and 2nd call the "some data" is lost and never processed.Everything works fine when I run the server locally. I am using api-gateway, lambda and express serverless-http packages. I have tried logging before and after the db calls are made looks like the code is executing but the database is not updating. What am I doing wrong?FollowComment"

Answer: "3Accepted AnswerAs you are using node.js I think the issue is that the function returns before the function finished updating the database. Once the function returns, the Lambda execution environment is frozen and it will be unfrozen when the next request is received.You should either update the DB using a synchronous mode, i.e., use await when updating the DB, or make sure that the context.callbackWaitsForEmptyEventLoop is set to true. See more information here.CommentShareEXPERTUrianswered a year ago"


Question: How can I configure a custom CloudWatch alert for my Ec2 instance ?

"How can I configure a custom CloudWatch alert i.e. (Disk, Memory) for my Ec2 instance (Linux / Windows) without agent installation & any scripts over the system?FollowComment"

Answer: "1Without an agent/application or scheduled script there is no way for the operating system metrics to be sent to cloudwatch  and therefore no way to set an alert.Most commonly customers install the cloudwatch agent to send OS metrics + custom metrics to cloudwatch. If using an AMI with SSM already installed the agent can be deployed via SSMCommentShareEXPERTPeter_Ganswered 14 days agoEXPERTkentradreviewed 14 days ago1To create custom metrics without using CloudWatch Agent, you must use AWS CLI or AWS SDK to create a script to fetch the necessary values.If the only metrics you want to get are disk and memory, it would be easier to include CloudWatch Agent than to create a script.CommentShareEXPERTRiku_Kobayashianswered 14 days agoEXPERTkentradreviewed 14 days ago"


Question: Export dynamodb data as Excel files

"Hey,We just changed to AWS Dynamodb and i was wondering what is the best way for exporting the data to an Excel file. This should be automated later on . Is it with AWS S3 or with some python programming? Can't find a clear solution online so thats why i'm asking.Any suggestions?Thanks!FollowComment"

Answer: "1Depending on what is your goal, I would look into 3 options:If you want to just dump, a quick script in language you prefer would do the jobIf you want to dump periodically, I would suggest to make Lambda out of it - here is a result of quick googling with working example: https://medium.com/@jrodl3r/exporting-dynamodb-data-to-excel-using-lambda-with-s3-on-aws-e6f873681c77If you need to work dynamically with the given data, let`s say to slice & dice, filter, etc analyse it by users - consider using AWS Quicksight with DynamoDB as data source.CommentSharewieshkaanswered 7 months ago1DynamoDB does not provide the ability to export the entire table to CSV, only a small sub-set.The best way I have found is using Athena's capability to export to CSV, this is done using theAthena DynamoDB ConncectorThe next suggestion approach is to come up with your own logic/script to export the table to CSV using Lambda and Event Bridge to periodically kick off the job. There are many tools available to assist you with converting JSON to CSV and even tools to do the entire process for you such as:NPM dynamodb-to-csvAnd finally, if your table is really large you can use AWS Glue to run a periodic ETL job which will read from DynamoDB and export to CSV in an S3 Bucket:AWS GlueOverall it depends on your specific use-case needs on which option to use.CommentShareEXPERTLeeroy Hannigananswered 7 months ago0I think the second option is the one we go with. Just dumping periodically. But this is more for sending it through email? is their a way to store it in ... a bucket?CommentSharerePost-User-1452554answered 7 months agowieshka 7 months agoThat`s depending on what you implement in the given Lambda code - from there you can both send to e-mail (via AWS SES), and as well park in the S3 bucket. Or, send an e-mail of the new dump being created on S3 with a pre-signed download URL for convenience.Since you mentioned Python - boto3 is your friend.Share0I was planning to create a lambda with an Event bridge. And storing the file on aws S3. Should that be the best way? So we can download Excel files from the bucket or can we acces Excel in aws it self?CommentSharerePost-User-1452554answered 7 months agoLeeroy Hannigan EXPERT7 months agoYou can use comments to post comments under posts to avoid creating multiple answers.Yes, that would be the best way in my opinion, there is multiple libraries that allow you to convert JSON to CSV and then store in S3. You can then share pre-signed URL's with others who can then download your files.Share"


Question: "Can't connect with Elastic Beanstalk CLI: "C:\Users\Danny B>eb init 'eb' is not recognized as an internal or external command, operable program or batch file.""

"I have succesfully installed Elastic Beanstalk CLI on my local Windows machine following instrucions here:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/eb-cli3-install-advanced.htmlI have also added these paths in my local windows environment variables:%USERPROFILE%\AppData\Roaming\Python\Scripts%USERPROFILE%\AppData\Local\Programs\Python\Python311\Scripts%USERPROFILE%\AppData\Roaming\Python\Python311\ScriptsEhe error I'm getting in my command line when I typeC:\Users\Danny B>eb initis this:'eb' is not recognized as an internal or external command,operable program or batch file.Can anybody help?Thanks!FollowComment"

Answer: "0HiIt seems that even though you have configured the Paths they have not loaded into your terminal environment.If you are using Powershell you can use the following command to reload$env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User") Another way to reload is to simply restart the machine.Hope this helpsCommentShareBisinaanswered 9 days agorePost-User-1408394 9 days agoI restarted the machine, but it didn't help. I don't understand how to translate what you wrote for my situation.Share"


Question: IP access restriction on S3

Does AWS S3 allow you to configure a list of allowed IPs that can be uploaded to buckets?FollowComment

Answer: "0Hi,Answering to your question, yes you can restrict access to S3 bucket to specific IP address or range using a bucket policy.The following example bucket policy allows traffic to the bucket when the request is from specified IP address or range ( aws:SourceIp):{"Id": "SourceIP","Version": "2012-10-17","Statement": [{"Sid": "AllowSourceIP","Principal": "","Action": "s3:","Effect": "Allow","Resource": ["arn:aws:s3:::BUCKET-NAME","arn:aws:s3:::BUCKET-NAME/*"],"Condition": {"IpAddress": {"aws:SourceIp": ["11.11.11.11/32","22.22.22.22/24"]}}}]}Note: Above policy allows s3 full access to all users from the specified IP address or range, but it doesn't deny all access from outside the IP address or range. If a IAM user/role from the same account is authenticated and has s3 access via IAM policy, this policy still allows the IAM to access the bucket from outside the specified IP address or range.For example policy that denies permissions to any user to perform any S3 operations on objects in the specified S3 bucket unless the request originates from the IP address or range specified in the condition, please refer following documents.[+] https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-3[+] https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/Regards,PavithraCommentSharePavithra-AWSanswered 2 years ago"


Question: "Any option for large, chunked responses from Lambda"

"I'm building a data access application that sometimes needs to return large responses. I would like the code to run in a scale to zero server less system like Lambda but both API Gateway and Application Load Balancer Lambda integrations do not seem to support chunked responses and if I build my own proxy in front I will still have the 6MB limit to contend with.Other Lambda limits (running time and memory) have been increased over the years, why are we stuck with the 6MB limit?FollowComment"

Answer: "4I can't talk to why the limit hasn't been increased. But the most common solution is to place large objects into S3 and then return a presigned URL to the caller to access that object. You could also take advantage of CloudFront and the global AWS backbone network just by using those services.You need to make sure that the credentials used to generate the presigned URL are long-lived enough for the client to retrieve the object - if it is a one-time retrieval then the credentials from the Lambda function are usually fine; but many implementations use a separate set of credentials so that if the Lambda function credentials expire before the client has retrieved the object then it still works.You'd also presumably need to clean up the objects in S3 afterwards - this can easily accomplished with bucket lifecycle policies.You could implement a chunked transfer mechanisms using API Gateway and Lambda; it would require you to store the object somewhere permanent anyway (because there's no guarantee that separate calls to retrieve chunks would hit the same Lambda invocation) - so there's a bunch of work to be done if you went down that path. I wouldn't recommend it but it can be done.CommentShareEXPERTBrettski-AWSanswered a year agoEXPERTUrireviewed a year agoarnab a year agoThis solution sounds like the right approach.A note on the credentials used to generate the S3 pre-signed URLs: As @Brettski mentions, if the credentials expire before the client has retrieved the object, this mechanism will result in your client failing to retrieve the result. Since you as a customer can't control the lifecycle of Lambda functions, you don't have control over how long these credentials will last. It could expire a second after the S3 presigned URL is generated, if the Lambda container is recycled.Because of this, a separate set of credentials must be used in this case.ShareLaurence Rowe a year agoThe chunked transfer mechanism I'm looking for is an equivalent to Transfer-Encoding: chunked, a basic HTTP feature with no need for separate calls.It can be awkward to determine whether a response will exceed the 6MB limit and then require a full roundtrip redirect to the client (because API Gateway does not to my knowledge support an equivalent to Nginx's X-Accel-Redirect.)I guess I just want to be able to run an HTTP server in a scale to zero container as I can on Cloud Run. It's frustrating there's not yet an equivalent in AWS.Share"


Question: Unable to connect to instance from a newly created ami: Failed to start Service for snap ap…amazon-ssm-agent.amazon-ssm-agent

"Hello,I created an ami on from an ubuntu 18.04 instance. AMI was generated without any errors. However, when I launch a new instance from the ami, instance reachability check fails and I unable to ssh into the instance. After looking at the logs, I got the following error message:...[FAILED] Failed to start Service for snap ap…amazon-ssm-agent.amazon-ssm-agent.See 'systemctl status snap.amazon-ssm-a….amazon-ssm-agent.service' for details.Failed to start Service for snap ap…amazon-ssm-agent.amazon-ssm-agent.I cannot the command as the instance is not accessible by ssh. Can anyone please help? Thank you.FollowCommentAWS-User-2166362 a year agoDid you ever find out the solution to this? I am receiving the same error.Share"

Answer: 0Can you use the AWS Serial Console to access the instances? Then you'll be able to look at the log file or run the command above to determine where the issue is.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: AWS IoT Core and Fleet Indexing connected:false response

"Hi,while I try Fleet Indexing, I found I always get a response of connected:false while the device is connected to the Iot core and publish message to iot core, anyone has faced this, thank you.us-west-2aws iot describe-index --index-name "AWS_Things"{"indexName": "AWS_Things","indexStatus": "ACTIVE","schema": "REGISTRY_AND_SHADOW_AND_CONNECTIVITY_STATUS"}aws iot search-index --index-name "AWS_Things" --query-string "pm"{"things": [{"thingName": "pm","thingId": "{thingId}","thingTypeName": "demo-iot","thingGroupNames": ["test_group"],"shadow": "{"metadata":{},"version":1}","connectivity": {"connected": false}}]}FollowComment"

Answer: "1Accepted AnswerIf your client is using a different client ID from Thing Name when connecting to AWS IoT, the connectivity status of your "thing" will not be indexed by Fleet Indexing.CommentShareEXPERTMassimilianoAWSanswered 4 years agoAWS-User-3949958 a year agogenius thanksShare"


Question: Apollo subscription with AWS Lambda and Mongodb

"Hi team,I'm implementing apollo subscription with aws lambda and mongodb. I found one documentation for the same but with dynamodb. https://github.com/aws-samples/apollo-server-on-aws-lambdaCan anyone help me to guide me to how to implement with mongodb. Actually I'm confused on cdk. The github link uses cdk. So cdk is required to create subscription env with aws lambda? I found @aws-cdk/aws-dynamodb library but not found same library for mongodb. Can anyone help me with this? ThanksFollowComment"


Question: Will We Ever Get a Forum?

"So will we ever get a developers forum like the other game engines ?You know I really like just easiness of normal forums, such as Subscribe to topic buttons normal font sizes etc... :)So is there a plan for such a thing in the future ?ThanksFollow"

Answer: "0Accepted AnswerHeya @REDACTEDUSERThis is certainly a good topic among many. Removing friction and improving the customer experience is top priority for 2018. We'd love to hear more about what specifically you are looking for -- /Community, please feel free to join in on this! The more we know, the more we can improve on this quality bar.SharerePost-User-5738838answered 5 years ago0Great to hear. Fingers crossed for this year then. :)SharerePost-User-4807048answered 5 years ago0@REDACTEDUSERWe also need a nice overhead menu bar with a "Marketplace" and "Learn" and "Community" links across the top/header. We also need a Marketplace, where users can post their assets for the community to use/share.Lumberyard needs a REAL Forum, and also needs a "standardized" menu bar (similar to this one here) that shows "Explore" (with sub-menu navigation pages/links for "Features", "Showcase", "Roadmap", "News" and "Indie Development Fund"), and then "Marketplace" (with a link to the "Marketplace" storefront where users can post their community created content (for users to download for free, or for sale, etc.), a place were users/developers can search for free community-created Assets, plugins/gems, scripts, sound effects, Full Projects, etc. A "Learn" (with sub-menu navigation links/pages for "Tutorials" and "Documentation"). A "Community" (with sub-menu navigation links/pages for "Gallery", "Forums", "Answers" and "GitHub").Create the forums/community/Lumberyard site with a black background (instead of white), for uniformity, and so if you are surfing/viewing the forums (on your mobile device) you can save/conserve energy. Using a white background on the site really eats up the battery life on mobile devices. Or at least have it so you can "toggle" between white and black backgrounds (with black being the default). That way if users like white, they can "toggle" back to white, very easily. Just have a "Lights On" and "Lights Off" toggle (for black and white backgrounds), with black being the default.Also make sure that it supports HTML and/or BBCode, and also a nice WYSIWYG Editor (similar to WordPress). With the ability to use HTML, BBCode, Smilies/Emoticons, etc. Also have the ability to create "User Groups" (users that divide the community into manageable sections/communities/groups with "like minded" interests), especially for projects/features (i.e. Flight Simulator, Train Simulator, Truck Simulator, Cars/Racing Simulator, etc.). Where users can work together, share code, have discussions, and Community Volunteers can "volunteer" to help/moderate various community "User Groups" (sub-groups) [with "public", or "private" or "hidden"/closed memberships]But we REALLY REALLY REALLY need Forums with Community Volunteers/Group Leaders, where we can create our own private (or even "hidden"/closed User Groups) with mailing lists, group discussions, and users can request to "join" a public or private group (hidden groups are "invite" only). Where community group members can discuss Game Design, plugins, tools, models, art, UI, audio, animation, materials, visual scripting, UI, etc.We also need the ability to send PM's (Private Messages), as well as have mailing lists. So developers can discuss topics/discussions (with a group/team) via Mailing List.Give "Teams" the ability to create their own "User Group" and their own various "Mailing Lists" (Dev Mailing List, Support Mailing List, User Mailing List, etc.)Also add the ability for "Friends" or "Foes" list (where we can add people/users to our "Friends" list, or block users in our "Foes" list). Also have the ability to see users (who's currently online) and see their online status, and send them private messages (messenger/PM's).Also have "template" support, so that teams can create their own "templates" and customize the look/feel of the various sub-groups.If you need help with this, let me know... but this would be a good "example" of a nice Community Forum (easy to use, well thought out, and has all the easy to use navigation and forum features that we need).Use either vBulletin or phpBB (Crytek uses phpBB). I think phpBB would be the best for a Community Forum.SharerePost-User-9149768answered 5 years ago"


Question: AWS Lambda Application Runtime Limitations

"A customer wants to use AWS Lambda Applications (not only functions) with Python runtime, but as they mentioned and I could double check internally, it seems only NodeJS support is offered (at least through the AWS Console).However, I can’t find any documentation explicitly talking about that limitation. Do you know if that is a known limitation and where I can find more about it?If you try to go now to Lambda > Applications > Create Application > Create/Author from scratch(or use this link) -> you get only NodeJS RuntimeFollowComment"

Answer: "0Accepted AnswerThere are only examples that use node.js currently with Lambda Applications. If you use Cloudformation to deploy Lambda, then they appear as applications, so can make your own. Optionally use the Serverless Application Repository to do this. Currently the "Authohr from Scratch" option only includes Node.js. This can be done via SAM, Cloudformation, serverless, CDK, etc.CommentSharesang_kanswered 3 years ago"


Question: How to set/reset password for user in Identity store using the Java SDK?

"Hello,I was able to create a user in the IAM Identity Center using the Java SDK with the IdentitystoreClient and CreateUserRequest. The user gets created in the Identity Center directory.I need to set (in future reset) the password for this user using the API. I am unable to find any examples or API to accomplish the same. Can this be done via API call? If yes, then please provide some example code/reference to the API class.Is there an API to assign the user to a group?Thanks,Binfer.FollowComment"

Answer: "0Hi Binfer,To set password via sdk look at this reference: https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.htmlto add user to a group: https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.htmlCommentShareEXPERTalatechanswered 4 months agoBinfer 4 months agoThanks, but that works only for IAM and not IAM Identity center. They both appear to have different API's. The identity server client had no UpdateLoginProfile mechanism and the IAM UpdateLoginProfile does not work with users created with the identity center API as identityStoreId is needed for API calls. Ref: https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/identitystore/IdentitystoreClient.htmlSharealatech EXPERT4 months agoI see. for adding user to a group you could try this? https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/identitystore/IdentitystoreClient.html#createGroupMembership(software.amazon.awssdk.services.identitystore.model.CreateGroupMembershipRequest)To rest password I am not able to find a proper methodShare"


Question: 404 Nginx Error with AWS Meta Capi

"Hi,I set up the Facebook/ Meta Conversion API with deploying it to AWS. I followed all the steps of deploying it and  the stack was sucessfully created. The deployment urlAlso the dns was setup sucessfully. If I want to enter the Capi Dashboard, it can't reach the server and if I use the the ConversionsApiGatewayInstanceURL in the CloudFormation Output it gives me a 404 Not found Nginx Error.I also can't connect to the ec2 Instance because it tells me that I use the wrong credentials (I use the user that I found in the Userdata). Session Manager ist not setup, ssh client connection timed out, EC2 Instance Connect gives me a "failed to connect to your instance" and Ec2 serial console doesn't work with my credentials.What is the problem and / or how can I have access to my EC2 Instance so I can debug the Nginx Error? Sadly I am not so familiar with AWS products.Kind regards and thank you!FollowComment"

Answer: 0Having the same issue and I also followed the same tutorialCommentSharerePost-User-5713609answered 8 months ago


Question: Glue job fail many workers

"Hi team,I have a glue job that reads CSV files S3 to MySQL RDS. I set up** 2 workers** on my glue job,the job fails for one big file with the  flowing error :An error occurred while calling o122.pyWriteDynamicFrame. Duplicate entry '123456' for key 'mySqlTable.PRIMARY'I checked on the CSV file in question I have only one single line with the value '123456'  so no duplication on the file.is that error because 2 workers try to insert the same data at the same time? so that It generates the duplicate key error?I tried with 4 workers => same errorI wanted to try with 1 worker but seems the minimum number of workers should be 2 or greater.I truncate my SQL table every time and make sure that's empty before each run.thank you.FollowComment"

Answer: "0Is the data already present in the MySQL table?AWS Glue is based on Spark, as you know, 1 node is the Spark driver and the other nodes are hosting the executors (doing the real works), in you case with just 2 workers you have only 1 executor in your cluster.Even with multiple executor, spark partitions the data without replicating it this means that even parallel writes will never try to enter the same data twice, unless as already mentioned your code has introduced the duplicates.Glue works in Append mode only. no updates, have you checked if that key is, by any chance, already present in the target database?hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agoJess a year agoI truncate my SQL table every time and make sure that's empty before each run. I tried with 2 workers and 4 workers always the same error.the previous file passes successfully this file cause always this error from glueShareFabrizio@AWS EXPERTa year ago@Jess could you please pose an anonymized snippet of the code generated?I have not experienced that and not sure how to reproduce it.ShareFabrizio@AWS EXPERTa year ago@Jess could you please pose an anonymized snippet of the code generated?I have not experienced that and not sure how to reproduce it.Share0Are you doing some transformation, join, which can produce duplicate data? Is it happening to all the keys or single key only. I would suggest to remove PK or unique constraint and let the job complete once. Then you can evaluate in RDS is it true duplicate or some transformation is generating duplicateCommentShareZahidanswered a year agoJess a year agono, it's direct mapping no transformation nor join it happened on a single key each runShare"


Question: There’s piracy of NBA AND NFL games being live streamed on the Amazon cloud front

Cloud front with more than 20 million views per month alongside child exploitations and it’s all being completely ignored since November 2021 and AWS has control over everything on the cloud front so why wouldn’t they remove that??? AWS even deleted one of my cases regarding this 9494299111FollowComment

Answer: "0Accepted AnswerIt's important that we (AWS) ensure that resources are used in legal ways. However, this forum isn't the right place to report that. Please use our AWS abuse form for this. You can read details about what is illegal/abusive content here: https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/CommentShareEXPERTBrettski-AWSanswered a year agoMelaniee a year agoI have done that and made a compliance report and brought it to their attention since November and it’s completely ignored. AWS deleted my case regarding it (9494299111)Share0Also amazon Trust and safety team lied about having ever received any reports of that nature when they have multiple times prior when I emailed them asking why they lied ignore me so yes they are fully awareCommentShareMelanieeanswered 10 months ago"


Question: CEDR Project-id

Where do i find the project-id of the CEDR project which is required to run the upgrade assessment tool while migrating AWS EDR?FollowCommentAWS-User-2560483 2 months agoDid you upgrade CEDR to DRS successfully?Please share the steps performed as for me below mentioned document not fetching successful results:https://docs.cloudendure.com/#Configuring_and_Running_Disaster_Recovery/Upgrade_CEDR_to_DRS/Upgrade_CEDR_to_DRS.htm#Upgrading_from_CEDR_to_AWS%C2%A0DRS%3FTocPath%3DNavigation%7CConfiguring%2520and%2520Running%2520Disaster%2520Recovery%7CUpgrading%2520from%2520CEDR%2520to%2520AWS%25C2%25A0DRS%7C_____0Thank you.Share

Answer: "0you can find the --project-id  from the CEDR URL once you are in that project.For example:https://console.cloudendure.com/#/project/XXXXXX-7184-4736-XXXX-84b8XXXXX84aa/machines.This is the Project Id here is XXXXXX-7184-4736-XXXX-84b8XXXXX84aa.Which can be used to run the upgrade assessment tool as provided below,python3 cloudendure_to_drs_upgrade_assessment_tool.py --api-token XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX --project-id XXXXXX-7184-4736-XXXX-84b8XXXXX84aaCommentShareAWS-User-4748647answered 2 months ago"


Question: FSx for Windows appears to be blocking WinRM

"I have stood up FSx for windows and I can connect to the shares and manage them fine. I have include the necessary ports in the SG to manage the service from the documentation. However, when I tried to connect via WinRM on port 5985 to the FSx instance, it fails to connect.  I can connect via SMB 445 when running a test and we confirmed that by connecting to the service and creating shares. SMB and WinRM are opened in the same SG for FSx, so it makes no sense. All ports are allowed outbound and the NACL is still set to default all open in both directions. What is even more strange is that a connectivity analysis test says the port is open between the same instance and ENI for FSx (445 and 5985), but from inside the instance it is not open when doing a test. Local firewall is disabled and all ports open on instance SG and NACL for the same local private subnet (FSx and instance). This is very bizarre. Anyone else run into this?https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.htmlFollowComment"

Answer:
"1Hi, thanks for sharing the output of the Test-NetConnection command.This tells us that the port is open and the security group attached to FSx is correct.Please could you share the command that you are using to connect to the FSx remote powershell endpoint?Alternatively, please try this example command:$FSxWindowsRemotePowerShellEndpoint  = "ReplacewithyourRemotePowerShellEndpointDNSname"Invoke-Command -ComputerName $FSxWindowsRemotePowerShellEndpoint -ConfigurationName FSxRemoteAdmin -ScriptBlock { Get-FSxSmbOpenFile}One of the key differences between regular PS remoting and FSx, is that you need to specify the -ConfigurationName FSxRemoteAdmin parameter.Let me know how it goes :)CommentSharePeter-John Manswered 8 months agoAWS-User-2639757 8 months agoI was able to get it working. I believe I wasn't using that Windows Remote PowerShell Endpoint to connect to the instance via PowerShell and that was my issue.SharePeter-John M 8 months agoAwesome, thanks for the update, glad its working!Share0Hello there!I notice that you are having trouble connecting to your FSx instance via WinRM on port 5985.From the notes you have mentioned that you have configured the instance for testing via SMB port 445 and opened the SG for SMB and WinRM. You also mention that all ports are allowed outbound and NACL set for both directions.However I would like you to please note a couple of factors in regards to your case:For starters you have to ensure that you can connect to the Windows Remote PowerShell Endpoint.
The main point that I noticed is that there was no mention of the file system’s inbound rule that will grant access for remote PowerShell connections. It is mandatory that the SG group in the inbound direction to allow traffic on port 5985 so a remote Powershell session is established. This will allow traffic from your FSx file system, which is what is currently blocking the connection[1]. Please also check that you are not using the addresses 198.18.0.0/15 space in your VPC, which is referenced in the documentation[2]. For more information about inbound rules and associating a security group[3] have a look at the references below.References:[1] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/remote-pwr-shell.html[2] https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_prereqs.html[3] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/limit-access-security-groups.html#fsx-vpc-security-groupsCommentShareAntonioanswered a year ago0Hello Antonio, when testing the endpoint and port using the command below, it comes back with True (I have removed the network-specific info). I'll need to go back and test it again. I have been just using the File Server role to manage the shares, etc. for now:PS C:\Users\username> test-netconnection {endpoint.domain.com} -port 5985ComputerName     : {endpoint.domain.com}RemoteAddress    : XXX.XX.XXX.XXXRemotePort       : 5985InterfaceAlias   : EthernetSourceAddress    : XXX.XX.XXX.XXXTcpTestSucceeded : TrueCommentShareAWS-User-2639757answered a year ago"


Question: Unable to deploy model

"Hi,I am in the early stages of building a CV demo using Qualcomm chipset and Greengrass V2.My app contains the following components components.My system is unable to do any inference though it is able to send empty MQTT packages to the cloud.I am seeing the following error when I am deploying a model using the variant.DLR'''2022-10-10T20:21:22.232Z [WARN] (Copier) variant.DLR: stderr. ++ PATH=/greengrass/v2/work/variant.DLR/greengrass_ml/greengrass_ml_dlr_venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.232Z [WARN] (Copier) variant.DLR: stderr. ++ export PATH. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.232Z [WARN] (Copier) variant.DLR: stderr. ++ '[' -n '' ']'. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.233Z [WARN] (Copier) variant.DLR: stderr. ++ '[' -z '' ']'. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.233Z [WARN] (Copier) variant.DLR: stderr. ++ _OLD_VIRTUAL_PS1=. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.233Z [WARN] (Copier) variant.DLR: stderr. ++ '[' 'x(greengrass_ml_dlr_venv) ' '!=' x ']'. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.234Z [WARN] (Copier) variant.DLR: stderr. ++ PS1='(greengrass_ml_dlr_venv) '. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.234Z [WARN] (Copier) variant.DLR: stderr. ++ export PS1. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.234Z [WARN] (Copier) variant.DLR: stderr. ++ '[' -n /bin/bash -o -n '' ']'. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.235Z [WARN] (Copier) variant.DLR: stderr. ++ hash -r. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.235Z [WARN] (Copier) variant.DLR: stderr. ++ python3 -c 'try:. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.236Z [WARN] (Copier) variant.DLR: stderr. import dlr. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.236Z [WARN] (Copier) variant.DLR: stderr. print(dlr.version). {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.236Z [WARN] (Copier) variant.DLR: stderr. except Exception as e:. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.237Z [WARN] (Copier) variant.DLR: stderr. print(e)'. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.647Z [WARN] (Copier) variant.DLR: stderr. + get_dlr_version=1.6.0. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.647Z [INFO] (Copier) variant.DLR: stdout. Skipping DLR installation as it already exists.. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.648Z [WARN] (Copier) variant.DLR: stderr. + [[ 1.6.0 == \1.\6.\0 ]]. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}2022-10-10T20:21:22.649Z [WARN] (Copier) variant.DLR: stderr. + return 0. {scriptName=services.variant.DLR.lifecycle.install.script, serviceName=variant.DLR, currentState=NEW}'''Any help would be appreciated.Thanks,FollowComment"


Question: MWAA: how to install python requirements behind proxy

"Hello everyone,we've launched a private MWAA environment. We are able to access the UI, but we're having some trouble installing our python requirements. MWAA picks up the requirements file from S3, but runs into a timeout when trying to install the python packages.This is expected, because we're behind a proxy, so here goes my question: how do we tell MWAA to use our proxy while installing our python dependencies?This is what our CloudWatch log stream (requirements_install_ip*) tells us:"WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None))after connection broken by 'ConnectTimeoutError(<pip._vendor.urllib3.connection.HTTPSConnectionobject at 0x7fda26b394d0>, 'Connection to pypi.org timed out. (connect timeout=15)')' "FollowComment"

Answer: "0Hi,Please see https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-dependencies.htmlThanks!CommentShareJohn_Janswered 2 years agoAWSuser a year agoHi, we are trying to setup MWAA in private mode. We have included the requirements.txt as per option 1 in above link but we are still getting error. The pypi.org is accessible from other EC2 on the same subnet so there should not be any network/FW issues. Does anyone has any idea what might be wrong or what other configuration may be needed to make this work? Happy to provide additional details if required.Share"


Question: Organisation ConformancePacks: s3 bucket policy for delegated administrator?

"I am following the documented procedure to use a delegated administrator to deploy organisation-wide conformance packs:https://aws.amazon.com/blogs/mt/deploy-aws-config-rules-and-conformance-packs-using-a-delegated-admin/When using the delegated account to put the packs I get an error:An error occurred (InsufficientPermissionsException) when calling the PutOrganizationConformancePack operation: Insufficient permission to get S3 bucket ACL for awsconfigconforms-company-orgThe only way to make it work so far is to add this policy statement to allow the delegated account access to the ACL on the bucket:            "Sid": "DelegatedAdministratorAllowGetBucketAcl",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::123456789:root"            },            "Action": "s3:GetBucketAcl",            "Resource": "arn:aws:s3:::awsconfigconforms-company-org",            "Condition": {                "StringEquals": {                    "aws:PrincipalOrgID": "o-123456"                }            }        }Is this how I can resolve the permission issue? Or is there a better way to give cross account access to the bucket in the master account?Also: is it expected that the conformancePacks are created in the delegated account and not in the master account? aws configservice describe-organization-conformance-packs lists them for the delegated one, I guess that's expected as I'm delegating?FollowComment"

Answer: 1Delegated Administrator with AWS Organizations supports a list of compatible AWS services.Take a look at How can I provide cross-account access to objects that are in Amazon S3 buckets on granting permissions cross-account.CommentShareNick_Canswered a year agogduemlein a year agoAWS Config is listed as a compatible service.AWSServiceRoleForConfigMultiAccountSetup is a service-linked role - so I cannot change it's permissions/policies.I guess I can modify the permissions/policies of the user executing PutOrganizationConformancePack - however that's a running through SSO in our case. So I believe my user is assuming a role that's then assuming the service linked role.I'll need to do more reading on that topic.Share


Question: Filters for CloudWatch Dashboard widgets

Is there a way where I can add a filter for a log table in cloud-watch dashboard to select the service and get the detailsFollowComment

Answer: 0Have a look at Custom Widgets for CloudWatch Dashboards. You can achieve what you want with one. There is a sample widget called Logs Insights query editor that can be deployed directly from within a CloudWatch Dashboard that should give you a good starting point.CommentShareAmazon-CloudWatch-01answered 9 months ago


Question: Origin SSL check fails with the NEW Letsencrypt Issuer

"Certificates on the origin from Letsencrypt worked fine for years now.Yesterday one of the ssl certificate of a websites got renewed successfully.But now cloudfront makes a 503 error only for this website (one of many)other website with an older certifacte from letsencrypt still working fine.The only difference is that LetsEncrypt now signes with a new issuerOld issuers was: "Let's Encrypt Authority X3"New issuer is: "R3"Issuer Certifacteshttps://letsencrypt.org/certificates/There are two Intermediate certifiactes,this one make the issue:https://crt.sh/?id=3479778542Issuer Statement:https://letsencrypt.org/documents/isrg-cps-v3.0/It seams that cloudfront dont trust the certifactes from the new letsencrypt issuer "R3"Edited by: Zetanova on Dec 5, 2020 9:00 AMFollowComment"

Answer: 0My hosting system virtualmin only renewed the certificate but not the Intermediate certificate.After updating the Intermediate certificate manually it is working againCommentShareZetanovaanswered 2 years ago


Question: Use Connect Contact Lens to analyze pre recorded phone conversations

"I have a number of recordings of phone conversations that were made using Amazon Connect a couple of years ago, that I want to analyze using Contact Lens.  I have reviewed the APIs for both Connect and Contact Lens and can not find any methods that would let me do this.  I am looking at the .net sdk documentation.A thorough google search has not returned anything.Asking open ai's chat gpt - returned a function that didn't align with the current .net sdks, having a mismatch of methods and models taken from the Connect and Contact Lens classes.FollowComment"

Answer: 0Contact Lens for Connect will only kick in for new incoming calls.  It cannot go back and analyze.Alternative is to use AWS Transcribe/Comprehend manually on the call recording to get the analytics that you need for them.   But these are outside of Connect/Contact Lens processing now.CommentShareClarenceChoianswered 3 months ago


Question: Domain Point to one static ip in aws

"Hai,I have purchased the domain from GoDaddy, I have deployed an application with that domain.I just want to point that domain into static IP and that static IP i want to configure into juniper firewall.When the juniper got down application should not impact.Please suggest.I tried route 53 to create a hosted zone.FollowComment"

Answer: "1You can create an Elastic IP address and then create an 'A' record for that IP with your domain in Route53. You can find how to set this up here - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-ec2-instance.html.The Juniper firewall will be your EC2 instance.CommentShareAjitanswered 2 months agoMahendra Kumar V 2 months agoHai,My application deployed on premisses with the mentioned domain.That domain point to AWS.Share1See the instructions here: Making Route 53 the DNS service for a domain that's in use. Step #7 is where you point to the NS servers in Route 53 at GoDaddy.CommentShareEXPERTkentradanswered 2 months ago"


Question: MediaLive S3 Put / Set different filename for HLS manifest and HLS Segments

"Hello All,We are trying to migrate our existing transcode workflow over to AWS Media Live via storing the HLS segments into S3 directly for our platform to pickup. Everything is stored in the same directory in S3. When I am setting this up as expected in Media Live I don't see a configuration that would result in the main manifest having a distinct name from the child manifest and ts segments.Current ResultMain Manifest/desktop-playlist.m3u8Child Manifest/desktop-playlist-1228k.m3u8/desktop-playlist-2128k.m3u8TS Segment/desktop-playlist-1228k-00000.ts/desktop-playlist-2128k-00000.tsDesired resultMain Manifest/desktop-playlist.m3u8Child Manifest/file-1228k.m3u8/file-2128k.m3u8TS Segment/file-1228k-00000.ts/file-2128k-00000.tsPlease let me know if this is possible or if anyone has any suggestions to try.Thanks,JayFollowComment"

Answer: "0Accepted AnswerTo answer my own question, I have found a work around. I set the HLS output group to only output the child manifest and ts segments. Since our desktop-playlist content is persistent we are going to create it externally and place it into the directory as it is created.Alternatively, we may just have medialive create the Main mainfest and rename the file at time of creation to our existing naming structure.JayCommentShareKaFronanswered 3 months ago0MediaLive does offer the ability to create sub directories for each rendition in the Adaptive Bit Rate stack. This will write the top level manifest into the top directory, then create sub directories for 'Stream', where the child playlist and segments for that rendition are stored.As an example for an HLS Output Group, select the top level Output Group, then expand the Location drop down and under Directory Structure choose SUB_DIRECTORY_PER_STREAM. The Stream sub directories will take their name from the  Name Modifier defined in the individual outputs (ex. _2128k)It is not advised to attempt to create sub directory names that end in .m3u8 or .ts. Those are extensions reserved for actual components of the Streams. This may cause confusion.CommentShareMike-MEanswered 3 months ago0Thanks for the quick response!My goal is to have everything in the same directory, but have the Main manifest have a different name than the child manifest and TS segments.Currently you define the HLS Rendition Group you give it the path and the name pre-fix for that manifest. This is also where it derives the filename prefix for the child manifests and ts segments.So currently I have the below configuredHLS group destination As3:/directory/desktop-playlistHLS outputOutput 1 - Name Modifier (-5928k)Output 2 - Name Modifier (-3128k)etcThis results in this/desktop-playlist.m3u8/desktop-playlist-5928k.m3u8/desktop-playlist-3128k.m3u8/desktop-playlist-5928k-00000.ts/desktop-playlist-3128k-00000.tsI would like to make a configuration change that would result in the below/desktop-playlist.m3u8/file-5928k.m3u8/file-3128k.m3u8/file-5928k-00000.ts/file-3128k-00000.tsLet me know if that makes is clear what I'm trying to adjust.Thanks,JayCommentShareKaFronanswered 3 months ago"


Question: Feature request: Support for DynamoDB Transactions in AppSync

"Could a future build of AppSync support Dynamodb transactions directly in VTL. Possibly for batch/pipeline resolvers.Rolling back partially completed requests is a huge pain. Given that DynamoDB now supports transactions, when do you think we will see AppSync making use of this functionality?FollowComment"

Answer: "0Accepted AnswerHi,Thanks for the feature request. Could you +1 it at https://github.com/aws/aws-appsync-community/issues/14 please?Regards,RohanCommentShareAWS-User-6514131answered 4 years ago"


Question: Quota increase for Rekognition Stored Video concurrent jobs

"Hello,In the quotas and guidelines for Rekognition, it is mentioned that "Amazon Rekognition Video supports a maximum of 20 concurrent jobs per account". This number is too less for my use case. Is there any way it can be increased by raising a request?In case there cannot be more than 20 concurrent jobs, are the other jobs stored in some sort of internal queue or are they lost?FollowComment"

Answer: "0Hi,Quota increase can be requested in AWS console "Service Quotas > AWS services > Amazon Rekognition".https://console.aws.amazon.com/servicequotas/home/services/rekognition/quotas.Find "Concurrent Amazon Rekognition Video stored video jobs per account".Currently, queuing is not supported, and has to be implemented on user side. If exceeding the concurrent jobs limit, further job submission is blocked from API (eg. StartFaceDetection).Thanks,CommentShareAWS-User-5016049answered a year agoAWS-User-3217907 a year agoOhk, thanks! Could you let me know the max limit of the quota please? Can it be increased to indefinite?Share"


Question: cloud front (ssl) connection issue with ec2.

"I am implementing public ssl via clod front and connecting cloud front to ec2 machine.SSL  implemented successfully but  (Mixed Content) issue showing that the content must be served over HTTPS.in setting of clod front domain section i enabled protocol https but issue is still same on live site (talends.com )issue is :Mixed Content: The page at 'https://talends.com/' was loaded over HTTPS, but requested an insecure stylesheet This request has been blocked; the content must be served over HTTPS.please guide how can we resolve this issue.FollowComment"

Answer: "0Hi, @talends.Check the HTML source you get when you access https://talends.com.Perhaps the warned animate.css, style.css, etc. are not output with absolute paths (starting with http)?This error occurs because the browser accesses HTTP EC2 directly, ignoring HTTPS CloudFront only for stylesheets.If you modify the stylesheet path so that it is output as a relative path, the stylesheet will also be retrieved via CloudFront's HTTPS, so the problem should be resolved.CommentShareEXPERTiwasaanswered 10 months agotalends 10 months agohiall assets path come from cloud front domain name (ec2 public dns).and i select  Protocol  (https)  but on website assets loading  only with http.i can not update path for assets from code becuase path come from cloud front domain name.site open on https but not assets.may be  some setting miss on cloud front for content to load with https.please guide and check screenshots.https://prnt.sc/bOWZWhpV-GGbhttps://prnt.sc/nkEnFEXcrXIkShareiwasa EXPERT10 months ago@talends.The screenshot you posted is of the CloudFront settings screen, but we don't need to look there yet. (You may see it later, but order matters in problem solving.)The first thing to check is the content of the response you get in your browser.Open the target page in a browser to view the source and publish the capture.Sharetalends 10 months agookaythis is issue on browswer console.Mixed Content: The page at 'https://talends.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://ec2-3-235-241-28.compute-1.amazonaws.com/talends/assets/css/animate.css'. This request has been blocked; the content must be served over HTTPS.https://prnt.sc/ta782DT63KOJhttps://prnt.sc/W6eyTFghUBRnShareiwasa EXPERT10 months agoIs it possible to share the contents of the page displayed by accessing the following with Google Chrome?We need to see the HTTP response content, not the developer tools or the CloudFront console.view-source:https://talends.com/Sharetalends 10 months agoplease checkhttps://prnt.sc/jAOXEfxr7cwshttps://prnt.sc/3ftc6d4iVt2tShareShow 3 more comments0CloudFront doesn't modify the content of the message, unless you use Lambda@Edge. So the references to the EC2 instances domain name is coming from somewhere in your code.So depending on how you generate the HTML pages (if it's CSM or your generate them as part of your Node build) you will need to make sure the base URL is set to your domain. In many cases if you don't customize this the CSM or your Node build will assume to use the name of the machine.So please check with your chosen framework, technology or service how do you customize the base URL so that links to resources and other pages are generated correctly.As related note, I would recommend you protect your custom origin, so that only Cloudfront can connect to it. Use the Security Group to only allow access from CloudFront IP addresses. Please see: https://aws.amazon.com/blogs/networking-and-content-delivery/limit-access-to-your-origins-using-the-aws-managed-prefix-list-for-amazon-cloudfront/CommentShareEXPERTToni_Sanswered 10 months ago"


Question: Reliably archiving many s3 files

"I would like to be able to add many (hundreds of thousands) of small s3 files to a single archive elsewhere on s3.  It doesn't necessarily need to be fast, but it does need to be reliable.  I can stream data through an archiver and back to s3 in a single lambda on a small scale, but since I need to get every single object, at full scale it's a lot to ask from a single lambda.Could I, for instance, use step function to run archiving lambdas against a subset of the files and perform multipart uploads into a single combined archive?Are there any better ways to achieve this sort of thing?FollowComment"

Answer: 0If you can leverage something like Firehose in your application you can stream files to a data lake in S3 and then archive to glacier with lifecycle policies.CommentShareEXPERTRob_Hanswered a year ago


Question: S3 > SQS Event Notification Failure

I've been trying to setup through AWS Management Console an S3 event to send notification to SQS for newly-created objects but I'm always getting an error.Unknown ErrorAn unexpected error occurred.Unable to validate the following destination configurationsNOTE: Both S3 and SQS are in the same region.FollowComment

Answer: "1Hi.You need to attach an IAM policy to the SQS queue to allow notifications from S3.https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html#grant-sns-sqs-permission-for-s3If you have already set this, there are cases where the S3 notification and destination queue settings are incorrect as shown below.https://zenn.dev/fffukken/articles/5c165e8cde8e2bCommentShareEXPERTiwasaanswered a year ago"


Question: "CloudFront set to "HTTPS only", but http will still be served"

"I have a CloudFront (with a registered domain) "connected" to an S3 bucket. The Viewer protocol policy is set to HTTPS only. However, requesting http://mydomain.com will reply with an HTTP answer.Tested on:  securityheaders.comFollowComment"

Answer: "2Hi,try to select Redirect HTTP to HTTPS.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.htmlCommentShareEXPERTalatechanswered 4 months agoPeter 4 months agoWorks as a workaround.Sharealatech EXPERT4 months agoThanks, if above helped you, I d appreciate an upvote/accepted answer so that also community benefits for clarity ;)Share"


Question: How to import/load pretrained DeepAR model into an estimator for continuous training?

"Hi, I have a trained DeepAR model saved as model.tar.gz in some S3 location. I hope to further optimize it by training for some extra epochs with extra data having same features, like transfer learning. I have read some DeepAR documentation but cannot find a way to import the trained model.I tried using Sagemaker's Estimator's model_uri config, but it reports error for deepar, saying no 'model' channel is acceptable.I am wondering does DeepAR have such functionality or it is still not developed?FollowComment"

Answer: "0Hello,Thank you for using AWS SageMaker. I understand that you are looking for Incremental training using SageMaker DeepAR algorithm where you can add trained DeepAR model saved in S3 location which further optimize your model.Unfortunately at this time, only three built-in algorithms currently support incremental training: Object Detection - MXNet, Image Classification - MXNet, and Semantic Segmentation Algorithm.If you need any further assistance or need detailed investigation please open a support case with AWSCommentShareSUPPORT ENGINEERKartik_Ranswered 4 months ago"


Question: API Gateway Upgraded and API Lost

Did AWS upgrade the API Gateway code last night as I get a new interface and all my API are now gone?FollowComment

Answer: "0Hello:No update occurred at this time that should have resulted in your APIs disappearing. I would encourage you to review your CloudTrail logs to see if/why your APIs were removed.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago0Thanks Bob .CommentShareRajanGanswered 3 years ago"


Question: Want to remove sign-up option from AWS Cognito default interface

"Hello,I was trying the default Amazon Cognito hosted login page to integrate with my application for authentication purpose and wanted a way to remove the signup option from the default hosted page of Amazon Cognito. I want to add the users from the backend and don't want to allow the users to sign up.Is there any way to do so?FollowComment"

Answer: "0Accepted AnswerGo to your user pool in Amazon Cognito.Under General Settings, go to Policies.Select the option Only allow administrators to create users as shown in the screenshot below and Save Changes.CommentShareRajjat Kumaranswered 4 months agounknown 4 months agoThanks, this helped! :)Share"


Question: How to set termination protection on an Amplify app stack in CloudFormation?

"As a production best practice, I want to deploy my Amplify app with termination protection enabled on its stacks in CloudFormation. How do I do that programmatically?FollowComment"


Question: AWS DMS connected successfully to Redshift created table but not loading data. Connected to S3 but failing at Uploading files to redshift.

"Any help please? Logs is as below:: Failed to upload file '/rdsdbdata/data/tasks/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/cloud/1/LOAD00000001.gzip' to bucket 'dms-in2tox7r7fgrwfjrshecwnp6s4y2uvsre63afzy' as 'redshift-FGKQA6KH2TIZ5J6G4T3NMVU7REZGRBNUYSGQI3Y/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/1/LOAD00000001.csv', status = 4 (FAILED) [1001705] (transfer_client.cpp:514)2022-11-17T14:59:38.000+00:00 2022-11-17T14:59:38 [FILE_FACTORY ]E: Failed to upload </rdsdbdata/data/tasks/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/cloud/1/LOAD00000001.gzip> to <dms-in2tox7r7fgrwfjrshecwnp6s4y2uvsre63afzy/redshift-FGKQA6KH2TIZ5J6G4T3NMVU7REZGRBNUYSGQI3Y/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/1/LOAD00000001.csv> [1000722] (at_s3_ff.c:429)2022-11-17T14:59:38.000+00:00 2022-11-17T14:59:38 [FILE_FACTORY ]E: Failed to write entire file (second trial) [1000722] (at_universal_fs_object.c:631)2022-11-17T14:59:38.000+00:00 2022-11-17T14:59:38 [FILE_FACTORY ]E: Write entire file failed: source = '/rdsdbdata/data/tasks/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/cloud/1/LOAD00000001.gzip' target = 'dms-in2tox7r7fgrwfjrshecwnp6s4y2uvsre63afzy/redshift-FGKQA6KH2TIZ5J6G4T3NMVU7REZGRBNUYSGQI3Y/KXHGVEZM7WRYI636BOJOQYTCOIGFGS6AOGE3MNY/1/LOAD00000001.csv' open type = 3 [1000731] (at_universal_fs_object.c:316FollowComment"

Answer: "0Hi,Have you checked that the used IAM Role has the S3 Get Object permission?The last section found in this link could be helpful https://aws.amazon.com/premiumsupport/knowledge-center/dms-task-successful-no-data-s3/Thanks,CommentShareZiadanswered 6 months ago"


Question: AWS PrivateLink use case validation

"Hello,I would like to ask about my use case if it needs a private link https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html, or not.We have a VPC with 2 public subnets, 2 private subnets, one of the EC2 is in private subnet and needs to connect to ALB (Application Loud Balancer) with Internal Scheme and also exist on same private subnet on same VPCConsidering AWS Well-Architect, do we need to add any private link (endpoint) from this EC2 to the related ALB ? Is this a valid scenario?Many thanks.FollowComment"

Answer: "1Accepted AnswerWith both the instance and ALB in the same subnet and VPC privatelink is not required. Within the same subnet you can use the security group of the ALB to control who is allowed to connect (ie use the security group of the EC2 instance within the ALB inbound rule)PrivateLink can be used to expose your NLB (not ALB) to other AWS accounts or unlinked VPCsCommentShareEXPERTPeter_Ganswered 10 months agoEXPERTBrettski-AWSreviewed 10 months ago0I don't understand your question but a privatelink is to access to a service outside your VPC...If the target ALB is in the same VPC, you "just" need good configurations on NACL, Security Groups and routes.CommentSharebacattaanswered 10 months ago"


Question: Cannot load anything other than root request -- ECS + ECR + ALB 503s

"Greetings,I have a simple static site behind NGINX in a container. I have pushed the image to ECR, and can pull and run the container without any issues.However, when I put an Application Load Balancer in front of the ECS Service with Fargate, I am unable to load any assets. For that matter, anything beyond the root does not load: i.e. subdomain.example.com loads, and subdomain.example.com/* throws a 503.As mentioned, I can run the container locally without issue by pulling the :latest tag, so I am confident it's not an issue with the container, and the issue lies somewhere in the configuration of the ALB and ECS Service.Any guidance would be greatly appreciated.FollowComment"

Answer: "0This turned out to be a misconfigured Listener that was pointed at an incorrect target group. I don't see any way to delete my question, so I figured I'd share the "solution."CommentShareJakeAHarrisanswered 3 years ago"


Question: "Hot to call functions like toString() , DumpEntities() from a LUA?"

"Hi,When I try to use toString() or DumpEntities() functions from a simple LUA i get:[Error] scripts/main_menu/main_menu_boot.lua:15: attempt to call global 'toString' (a nil value)---------- START STACK TRACE ---------- =C: toStringscripts/main_menu/main_menu_boot.lua(15): ? ---------- END STACK TRACE ----------toString is supposed to be some kind of global ?DumpEntities if from entityutils.luaDo I need to load those files at boot ?How to achieve this ?Thanks in advance.NicolasFollow"

Answer: "0Accepted AnswerHey @REDACTEDUSERAs for DumpEntities(), let me dig into that and get back to you —SharerePost-User-5738838answered 6 years ago0Thanks very much for the fast answer.yes toststring(...) works instead of toString()for info: several docs refer to toString() like this one:http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-ces.html(looks been updated in the meantime ?)as for DumpEntities() it is documented there:http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-ref-entityutils.htmlI cannot figure if need to include some additional .lua files ?Thanks again.SharerePost-User-2516973answered 6 years ago0DumpEntities is maybe a Legacy thing that is not available anymore ?anyway, I was looking for the set of functions to find/findByName entities kind. Any idea where I can find that kind of utills ?Thanks.NickSharerePost-User-2516973answered 6 years ago0Hi @REDACTEDUSERFor the utils you're looking for, http://docs.aws.amazon.com/lumberyard/latest/developerguide/scriptbind_system.html has what you need (specifically GetEntityByName and GetEntityIdByName). Let us know how those work for you!SharerePost-User-6135477answered 6 years ago0Thanks. I will check that.NickSharerePost-User-2516973answered 6 years ago"


Question: Match randomly generated clientId to thing-name

"Hi -I want to monitor the connections/disconnections of my IoT devices and execute some lambda functions after a connection event happens.Monitoring the connection state via the lifecycle topics '$aws/events/presence/(dis)connected/#' works perfectly fine but I have a problem identifying the client who sent the disconnect message.Since the IoT devices use the RESTful API for updating the things shadow, the clientId is randomly generated and not associated to the specific thing.I looked through the documentations to find a way to match this clientId or any other parameter out of the lifecycle messages to the thing which triggered the message, but I didn't find a way to achieve that.Is there any way to do that and I'm just missing something or is that just not possible with the current implementation?MathisEdited by: mathiswi on Jul 2, 2020 6:14 AMFollowComment"

Answer: "0Hi:AWS IoT Core's life-cycle events (https://docs.aws.amazon.com/iot/latest/developerguide/life-cycle-events.html) are designed to be used for persistent connections using MQTT in order to determine whether a device's connection was established or disconnected. HTTP Rest APIs are using by design short-lived connections and the connection can be multiplexed when using AWS IAM credentials and thereby doesn't provide an indication whether a specific device is "connected".If you need to tell whether a specific device is connected/online you'll need to use MQTT connections instead. Client IDs are independent of Things and unless the relationship is maintained by the device using a clientID via MQTT that matches its registered Thing name there is no relationship between the two.CommentShareAWS-User-4634767answered 3 years ago0As Christoph mentioned, the devices are identified as things if they use thing name as the clientId while connecting to IoT Core. Is there a reason for not able to use thing name as clientId?We could add thing name in life cycle message but we don't do it today because customers can get thing name from the clientId. Refer https://docs.aws.amazon.com/iot/latest/developerguide/iot-thing-management.htmlCommentShareAWS-User-3247576answered 3 years ago0Hey,using the thing name as the clientId would definitely be the preferred way but the developer who works on the firmware of the devices was set on using the REST API to push updates to the shadow for some reasons regarding the device architecture.Apparently it's not possible to manually set the clientId when using the REST API (according to this post  https://forums.aws.amazon.com/message.jspa?messageID=751184#751184 ) at this moment which lead to my problem.I've now brought the reasoning regarding the connectivity using the REST API towards the dev and was able to convince him to change his implementation of the IoT messages to using MQTT so I guess the issue is resolved for now. Thanks for your answers!MathisCommentSharemathiswianswered 3 years ago"


Question: Amplify auto-generated lambda functions using Node 12

"I created an Amplify app with back-end a couple of weeks ago. This caused a few Lambda functions to be generated, such as "amplify-login-verify-auth-challenge-SHORTCODE" as described here. The functions use Node 12 as the runtime environment. Yesterday I received an email from AWS saying Node 12 will no longer be supported by AWS. Will Amplify be updated - or is there something I can do to make sure the Amplify-generated functions use a newer version of Node going forward?For reference, here is the content of the email:Amazon Web Services, Inc. <no-reply-aws@amazon.com>Sun, Aug 14, 9:55 AM (1 day ago)to XXXHello,We are contacting you as we have identified that your AWS Account currently has one or more Lambda functions using Node.js 12 runtime.We are ending support for Node.js 12 in AWS Lambda. This follows Node.js 12 End-Of-Life (EOL) reached on April 30, 2022 [1].As described in the Lambda runtime support policy [2], end of support for language runtimes in Lambda happens in two stages. Starting November 14, 2022, Lambda will no longer apply security patches and other updates to the Node.js 12 runtime used by Lambda functions, and functions using Node.js 12 will no longer be eligible for technical support. In addition, you will no longer be able to create new Lambda functions using the Node.js 12 runtime. Starting December 14, 2022, you will no longer be able to update existing functions using the Node.js 12 runtime.We recommend that you upgrade your existing Node.js 12 functions to Node.js 16 before November 14, 2022.End of support does not impact function execution. Your functions will continue to run. However, they will be running on an unsupported runtime which is no longer maintained or patched by the AWS Lambda team.The following command shows how to use the AWS CLI [3] to list all functions in a specific region using Node.js 12. To find all such functions in your account, repeat this command for each region:aws lambda list-functions --function-version ALL --region us-east-1 --output text --query "Functions[?Runtime=='nodejs12.x'].FunctionArn"If you have any concerns or require further assistance, please contact AWS Support [4].[1] https://nodejs.org/en/blog/release/v12.22.12/[2] https://docs.aws.amazon.com/lambda/latest/dg/runtime-support-policy.html[3] https://aws.amazon.com/cli/[4] https://aws.amazon.com/supportSincerely,Amazon Web ServicesAmazon Web Services, Inc. is a subsidiary of Amazon.com, Inc. Amazon.com is a registered trademark of Amazon.com, Inc. This message was produced and distributed by Amazon Web Services Inc., 410 Terry Ave. North, Seattle, WA 98109-5210FollowComment"

Answer: 0An Issue and Pull Request had already been created on GitHub.  I think Amplify CLI will likely be updated soon.https://github.com/aws-amplify/amplify-cli/issues/10887CommentSharehayao-kanswered 10 months ago


Question: Forecasting in AWS Autopilot

"Hey all,I am used to using an AutoML solution where you can do forecasting algorithms, by uploading a time-series dataset and choose a time-period for which you want to predict (e.g. 6 months). The time-series dataset can be both multivariate, multiple time-series, include categorical/numericla values and include parameters known in advance (e.g. time since product launch, country, product etc.). In AWS AutoPilot I can only choose regression/multiclass classification - but not really a prediction model for a set number of months. When I do a google search, I cant find any guides to how to do forecasting in AutoPilot - even if it claims that e.g., stock predictions are possible. Any comments, thought and ideas to this? Or any link to a guide that can help we set up AutoPilot for forecasting?FollowComment"

Answer: "0For a low/no-code option for forecasting, connected with the SageMaker ecosystem - I'd suggest using SageMaker Canvas. Canvas explicitly supports forecasting, using internal approaches for "quick model", the or Amazon Forecast back-end when users build a full model. If you're not so concerned about close integration with SageMaker, you could also try using the Amazon Forecast service itself.Time-series forecasting brings special considerations around train/validation data splitting (e.g. for a fair assessment of performance, you need to take the end of your dataset as the validation period, not just randomly select time points throughout). More timeseries-tailored algorithms may also perform better than plain regression approaches (e.g. auto-regressive algos like DeepAR and CNN-QR).Because it doesn't cater for these points at the moment, Autopilot today doesn't formally support forecasting as a problem type. You technically could try tackling forecasting as a regression problem in Autopilot, for example by engineering lots of features for day-of-week, month-of-year, etc in your data table... But correctly interpreting model metrics would likely be a challenge, and accuracy may not be as good (depending on the nature of your data of course).CommentShareEXPERTAlex_Tanswered 6 months ago0Although Amazon SageMaker Autopilot supports time series data type in input dataset, but the problem type options are only Regression, Binary classification, and Multiclass classification 1.In other word, you can use Amazon SageMaker Autopilot to build machine learning models only for regression and classification problems for time series or any sequence data.Amazon SageMaker Autopilot is an automated machine learning (AutoML) solution to obtain prediction, not forecasting.Amazon SageMaker Canvas and Amazon Forecast service provide better capabilities to address time-series forecast challenges.Amazon SageMaker Canvas gives you the ability to use machine-learning time series forecasts 2, and Forecast service is a fully managed service that uses statistical and machine-learning algorithms to deliver highly accurate time-series forecasts 3 4 5.Please make an informed decision by considering the costs associated with Canvas 6 and Forecast 7. Canvas can be pricey compared with Forecast.CommentSharerePost-User-5648202answered 6 months ago"


Question: Help in verification of amazoncognito.com domain for Google OAuth verification

"Hi, we are using AWS Cognito as identity provider, with social IdP options available. In order to verify the Google OAuth screen we are requested to verify the custom domain and amazoncognito.com. We have verified custom domain and have trouble going past amazoncognito.com. Can anyone suggest how we can get around this? Will dropping the domain from OAuth consent screen break any functionality? And we use hosted UI. Thanks in advance.FollowComment"

Answer: "1Accepted AnswerHello,I understand that you are using signin with Google IdP for Cognito Userpool and Google is requesting you to verify your domain in order, and you currently want to verify the Cognito provided domains *.auth.<region>.amazoncognito.com.Firstly, the apex domain and subdomains of *.auth.<region>.amazoncognito.com is owned by AWS, and are used as a generic default domain for customers Cognito userpool; unfortunately it is not possible to verify domain ownership for specific customer, as the domain is not really owned by specific customer in the public domain registrar.Secondly, from  checking Google documentation for domain verification (either host-specific or generic method), it requires adding a TXT record with value generate by Google to your domain DNS records. If this is not the method of Google domain verification for your application, please kindly share the specific documentation if possible.This means instead of using Cognito provided domain *.auth.eu-central-1.amazoncognito.com, you can use your own custom domain name if you have control to your domain. The details steps for using you own custom domain in Cognito userpool can be found here [1].For example, something like test-example-auth-dev.myowndomain.com in the Cognito userpool, so that your application will use your own domain name. However, I can see from your rePost message itself that you have already verified custom domain.To summarize - When the custom domain is successfully activated in your Cognito userpool, both your custom domain and the previous Cognito managed amazoncognito.com  domain can be used for user login. However, because amazoncognito.com  cannot be used for Google domain verification, you will need to change in your Google app to use your customer domain instead of amazoncognito.com .I hope the above shared information is insightful to your query. Please feel free to reach out if you have any questions!References:[1] https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.htmlCommentShareSUPPORT ENGINEERYash_Canswered 8 months agoorumukham 8 months agoThanks for the reply. Assuming your suggestion is to provide google with custom domain only, is exactly what we are trying now. However, the question was asked because according to AWS Docs, we are instructed to provide both both custom domain and cognito domain, hence not registering cognito domain with google might raise issues with functionality. However, though too early to decide, we have not had any issues by not providing cognito domain to google. Will get back here to share our experience if anything goes wrong.Share"


Question: AWS CloudWatch Custom Widget With lambda

"I have created a custom widget for log insight query when is refresh and try to reload I am getting the below error sometimes. Do I need to change any configuration settings in lambda function.{"message": "Rate exceeded","code": "ThrottlingException","time": "2022-09-15T04:52:02.796Z","requestId": "312412399-758e-4729-9c41-dbaacac1a82e5b","statusCode": 400,"retryable": true}FollowComment"


Question: Can you still use static routing for site-to-site VPN?

Can you still use static routing for site-to-site VPN? I don't see the option on the Create customer gateway page.FollowComment

Answer: "0Accepted AnswerYou can use Static routing, the option is not under create CGW, its at the below location:VPC --> Virtual Private Network (VPN) --> Site-to-Site connections --> Create VPN ConnectionCommentShareEXPERTTushar_Janswered 3 months ago"


Question: "My AWS hosted www.denisejames.dev does not resolve, www.goop.dev does"

After years my hosted website www.denisejames.dev does not resolve. www.goop.dev does resolve. Route53 shows them both being hosted.FollowComment

Answer: "0Well the domain is certainly registered, https://domains.google.com/registrar/search/whois/denisejames.dev?hl=en&searchTerm=www.denisejames.devI selected the four below as more than likely but please review the source documentation for other details.There is more than likely some reasoning behind why you are having this problem.You transferred domain registration and specified the wrong name servers in the domain settingsYou transferred DNS service first, but you didn't wait long enough before transferring domain registrationYou deleted the hosted zone that Route 53 is using to route internet traffic for the domainYour domain has been suspendedLet me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)CommentShareD Ganswered 17 days ago0Looks like denisejames.dev DNS is hosted at Google:#> dig NS denisejames.dev; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.amzn2.13 <<>> NS denisejames.dev;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47542;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;denisejames.dev.       IN  NS;; ANSWER SECTION:denisejames.dev.    21600   IN  NS  ns-cloud-d2.googledomains.com.denisejames.dev.    21600   IN  NS  ns-cloud-d4.googledomains.com.denisejames.dev.    21600   IN  NS  ns-cloud-d1.googledomains.com.denisejames.dev.    21600   IN  NS  ns-cloud-d3.googledomains.com.;; Query time: 64 msec;; SERVER: 10.10.0.2#53(10.10.0.2);; WHEN: Tue May 16 01:13:57 UTC 2023;; MSG SIZE  rcvd: 165And goop.dev DNS is hosted in Route 53:dig NS goop.dev; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.amzn2.13 <<>> NS goop.dev;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14359;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;goop.dev.          IN  NS;; ANSWER SECTION:goop.dev.       86219   IN  NS  ns-1238.awsdns-26.org.goop.dev.       86219   IN  NS  ns-1557.awsdns-02.co.uk.goop.dev.       86219   IN  NS  ns-503.awsdns-62.com.goop.dev.       86219   IN  NS  ns-879.awsdns-45.net.;; Query time: 1 msec;; SERVER: 10.10.0.2#53(10.10.0.2);; WHEN: Tue May 16 01:15:31 UTC 2023;; MSG SIZE  rcvd: 177If you want to use Route 53 to host the DNS, change the Name Servers at your registrar (Google) to point to the NS servers you see listed in Route 53 for denisejames.dev.CommentShareEXPERTkentradanswered 17 days ago"


Question: Should I create IAM role to allow AWS service send events to my default bus

"I have setup an example with eventbridge: ec2 -> eventbridge -> sqs.This example works well, but I didn't create IAM role for ec2, I wonder that does the EC2 need an IAM role to access my default bus or not?FollowComment"

Answer: "0For AWS Services, such as EC2, to publish events to your default event-bus, they do not need an IAM role. You get these AWS service events by default on your "default" event-bus - You do not need to do anything to receive them.Please keep in mind, only AWS Services can do this on your default-event-bus. Other identities (users/roles), or other event-bus destinations require authentication to call the "PutEvents" EventBridge API.Hope this helps!CommentShareAWS-User-9275897answered 3 years ago0Got it, thanksCommentShareyukonanswered 3 years ago"


Question: Why can't I open ports?

"As shown in the picture, I set the port in the firewall, but when I look at the port, it shows that only port 22 is open.FollowComment"

Answer: "0The 2 screenshot that you are shared are not relevant to each other.  Security group configuration will pass the Client traffic to your EC2 server . Netstat command will return if specific service is running on your operating system.Port 22 is used to establish an SSH connection, this port is automatically configured during the installation of your operating system, and status will be always Listening.Looks like you are planning to run some services/applications on ports 80, 8080, 443 etc. You need to first install and then start those services on your operating system on EC2 so that your services start listening on those specified port. (Allowing traffic in Security group is nothing to do with it).example : I am running Nginx on port 80, then netstat output look like below :$ netstat -an | grep LISTENtcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN     tcp6       0      0 :::111                  :::*                    LISTEN     tcp6       0      0 :::80                   :::*                    LISTEN     tcp6       0      0 :::22                   :::*                    LISTEN   If I stop Nginx on port 80, then you can see that I am not listening on port 80 anymore.$ netstat -an | grep LISTENtcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN     tcp6       0      0 :::111                  :::*                    LISTEN     tcp6       0      0 :::22                   :::*                    LISTEN  CommentSharenavazanswered 3 months ago"


Question: pg_cron 1.5 isn't available on RDS

"Hello,We need this commit from pg_cron and it only got released in version 1.5. It turns out RDS only supports 1.4.1 for now.Is there any way I can work around this? How long do these extension upgrades tend to take?Thank you!FollowComment"

Answer: "0Hi,I understand that you would like to know about the availability of pg_cron extension version 1.5 for RDS Postgres for fix of bug #200 of pg_cron or if there is any workaround in RDS for same issue.As it is a version that was only released a few weeks ago, it is currently difficult to provide an ETA for its availability on RDS Postgres. Also, I regret to inform you that there is no workaround for the same at this time.Our service team already have this upgrade planned on roadmap. As you might understand, any new feature has to go through a development cycle and rigorous testing before it can be rolled out to the public. Any new feature or products are announced whenever made available on following public forums, hence I would recommend you to follow the same to know about pg_cron version 1.5 availability and supported RDS versions annoucements:[+] AWS blog: https://aws.amazon.com/blogs/aws/[+] What's new from AWS page: https://aws.amazon.com/new/#database-servicesCommentShareSUPPORT ENGINEERYASHanswered 2 months ago"


Question: Restrictions on login using IP address when using AWS SSO cloud application.

"Hi there,Is it possible to restrict login by source IP address when using AWS SSO cloud application?I want to use AWS SSO as IdP for logging in to MuleSoft AnyPoint.I know that I can restrict access to the AWS Management Console by source IP address by using Permission sets, but I'm not sure if it is possible to restrict login by source IP address when using AWS SSO cloud application.If it is possible to restrict login by IP address when using AWS SSO cloud application, please let me know how to configure it.Thanks.FollowComment"

Answer: "1Accepted AnswerThank you for providing your valuable feedback on the service. It is currently not a feature to restrict access to cloud applications by SSO logins using IP address ranges. I have raised a feature request with the service team on your behalf. While I am unable to comment on if/when this feature may get released, you can keep an eye on our What's New and Blog pages for any new feature announcements.aws.amazon.com/new/aws.amazon.com/blogs/awsCommentShareKyle_Wanswered 10 months agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: AMI not copying sshd file

"I have user and password auth configured for my instances but every one I launch i have to add this to the bootstrapsudo sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_configsudo service sshd restartIs there a reason creating an image from an existing instance isn't copying that file?Edited by: witchkinkofangmar on Oct 11, 2019 10:49 AMFollowComment"

Answer: 0https://stackoverflow.com/questions/18344390/how-do-i-get-aws-ec2-to-not-reset-my-sshd-config-fileCommentSharewitchkinkofangmaranswered 4 years ago0Configuration is in the /etc/cloud/cloud.cfgfileCommentSharewitchkinkofangmaranswered 4 years ago


Question: stop CloudHSM billing costs

"How to disable CloudHSM and its billing?I deleted the cluster HSM , is it sufficient to stop billing costs?FollowComment"

Answer: "0To delete a HSM perform the following steps:Use the consolea) Choose the cluster that contains the HSM that you are removing.b) On the HSMs tab, choose the HSM that you are removing. Then choose Delete HSM.c) Confirm that you want to delete the HSM. Then choose Delete.From this moment on you will no longer be charged for any HSM fees. Please check cost explorer after 48h to confirm.CommentSharerePost-User-5310971answered a month ago"


Question: How can I add an instance manually to Elastic Beanstalk environment that uses the same application stack?

"Hi,I need to add a separate load balancer and instance to an existing elastic beanstalk environment. I can add these manually no problem, but how do I make sure the manually added instance is configured / installed the same application stack that is in the EB environment (e.g. nodeJS + the application zip file)?Where is the EB configuration that ensures this?ThanksFollowComment"

Answer: "1If you only think to add an similar instance of your existing instance on beanstalk environment, you may create a snapshot of the existing instance of your environment. Select the existing EC2 and create a snapshot of the EC2. Select the snapshot, and create an image from the snapshot, under the Actons menu.Click AMI under the Image on Dashboard and you will see your newly created image on top of the page. Select the image and click Launch instance from AMI, now you will go to "Launch an instance" configure as per your requirements, such as VPC, OS, instance type, subnet and availability zone.Second option: You can create an instance and replace its root volume with the snapshot.I do not know how you will configure target group, auto scaling - it is up to you. To test the newly EC2 created from the image, you can stop the old instance (be careful with your auto scaling, which may create a new one, I hope you know, how the target group, and auto scaling group works). If you configure DNS and hosted zone with the new EC2, you will find the website is working. The other checking you can use the command (Linux commnad) of your newly created EC2, such what kind of file/folder you have on your EC2.You can also visit: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/GettingStarted.EditConfig.htmlPlease advise me whther this information came any help to you. Thnaks.CommentSharerePost-User-7136343answered 3 months agosaasbuilder 3 months agoThanks, interesting way to replicate the original instance, however the issue is any time an update is rolled out, I would have to manually re-image the original instance. I think what I need is to find the cloud formation stack for the elastic beanstalk environment and introduce these new load balancer, target group and instances. That way when a new update is pushed the new instance(s) are also updated.I wish EB had an open source infrastructure as code recipe that can be easily extended.Share0Excellent! Thank you to come back with your solutions.CommentSharerePost-User-7136343answered 3 months ago"


Question: How to get DataFrame index without RDD conversion?

"Hi,I'm trying to iterate through the results returned from SelectFields action using the following commandSelectFields_node1656679636429.toDF().indexbut i get the following errorAttributeError: 'DataFrame' object has no attribute 'index'it appears that even I convert the DynamicFrame to DataFrame, many attributes are missing.I found a workaround using RDD, and re-inialising a new DataFrame, like belowrdd = SelectFields_node1656679636429.toDF().rdddf = pd.DataFrame(rdd.collect())df.indexbut this approach seems an overhead.Are there any better, native ways of getting the properly initialized DataFrame from DynamicFrame?FollowComment"


Question: Instance i-0b03428e27c0fbc41 stuck in shutting-down state

I've tried stopping it and force stopping it but it does not stop. I've also tried shutting it down and executing a "halt" from inside the instance. Nothing works.FollowComment

Answer: 0After approximately 30 minutes it has stopped.CommentShare1010010answered 4 years ago


Question: [System Manager/Billing] Session Manager Cost

"Systems Manager advanced instances are priced on a pay-as-you-go basis. You are charged based on the number of advanced instances activated as Systems Manager managed instances and the hours those instances are running. [System Manager Pricing]So does this only include nodes registered on Fleet Manager? If, for example, the outgoing System Manager traffic was blocked from an instance would it cease to be charged as an advanced tier instance?FollowComment"


Question: "Tags of ECR images concatenate, if images are the same."

"So, i found out, if i push the same image, but with the different tag names, to the same repository in the AWS ECR, tags concatenate. I dont think thats how it should work? is it a bug, or im not understanding something?ThanksFollowComment"

Answer: "3Accepted AnswerThis is actually the expected behavior in AWS ECR. When you push an image to a repository with a different tag name, the image will be stored as a new tag for the same image, rather than creating a new copy of the image. This means that the tags will essentially be pointing to the same image, and any changes made to one tag will be reflected in all the other tags as well.This behavior can be useful in cases where you have multiple versions of the same image and you want to keep them organized under the same repository. However, if you want to create completely separate copies of the image with different tags, you'll need to use different repository names or use a separate registry altogether.CommentShareAWS_Guyanswered 3 months agoEXPERTskinsmanreviewed 3 months ago1Expanding on the answer by @AWS_Guy, it's up to you whether you have images for one package (multiple versions of it) per repository or have images for lots of packages (and their versions) in a repository. You just manage it appropriately with a tagging strategy, e.g tagging each image ServiceName_VersionNumber.When you upload an image by default it's tagged "latest" (and the previous "latest" becomes untagged) but you can instead decide what tag(s) to apply - typically include a version number.  Note that making use of the default "latest" behaviour therefore only makes sense with images for a single package (with multiple versions) in a repo.It's common to want to do both:tag your images with a version number, andbe able to always refer to "latest" rather than a specific version number from ECS etc.A common solution is to push the built image twice - first with no tag (ends up tagged "latest") and then with the version tag. ECR is smart enough to recognise that the image digest did not change and it will not try to actually upload the image twice. On the second push only the tag will be send to ECR.  This is the behaviour you've seen.CommentShareEXPERTskinsmananswered 3 months ago"


Question: AWSIotDeviceProperty annotation does not accept updates from the shadow.

"Java SDK version: 1.3.0 (https://github.com/aws/aws-iot-device-sdk-java)The @AWSIotDeviceProperty does not work properly.I have the following example:public class MyDevice extends AWSIotDevice {public MyDevice(String thingName) {super(thingName);}@AWSIotDevicePropertyprivate float data;public float getData(){return data;}public void setData(float data){this.data = data;}}Lets assume that data value > 0 in the Shadow (simply from previous updates).Once the created device attached to the client, data value changed to be 0.0 (or null for non primitive types)After debugging, here some conclusions:1 - Fields never synchronized by Shadow values, so they still have 0.0/null values, althoughallowUpdate has true value by default. (Setter function never called to sync attributes values).2 - Shadow calls Getter function (getData) every 3 seconds to keep the shadow updates, but as described in the previous clause, fields still have 0.0/null values, so Shadow will be synced with 0.0/null values.3 - Getter function called every 3 seconds and Setter functions never called.Is there a way to let @AWSIotDeviceProperty works in a bidirectional way so MyDevice attributes synced with Shadow values immediately after the attach and before Getter function called with 0.0/null ?ThanksFollowComment"

Answer: "0Problem solved.Since desire Json section missed, the device shadow service failed calculating the delta by iterating through each field in the desired state and comparing it to the reported state.So it also failed published delta message to update/delta and setter method never called.Edited by: Fadikh on May 5, 2019 12:41 AMCommentShareFadikhanswered 4 years ago"


Question: Unable to create instance from newly created AMI

"I created an AMI from an existing running instance and created a new instance (i-0165a9a3074670a46) from that AMI.  But that new instance never comes up.  I've actually tried from two different source images, and they only get to 1/2 checks passed.[DEPEND] Dependency failed for /vol.[DEPEND] Dependency failed for Local File Systems.[DEPEND] Dependency failed for Migrate local... structure to the new structure.[DEPEND] Dependency failed for Relabel all filesystems, if necessary.Looking for errors, this is all I was able to find... /vol is a 400 GB standard volume and the root volume is a 100 GB gp2.FollowComment"

Answer: 0Apparently my issue was related to the source of the instance (Marketplace - CentOS) and possibly changing the instance size (from M5 to T2).  Once I created the instance with the same instance type as the source the new instance booted up without a problem.CommentSharerichard-rganswered 4 years ago