Question: GameSparks Question - Does GameSparks SDK currently support ARM64 when build app to Android?

"Hi guys,Currently I am having an issue after create a APK build on Unity. I have followed the instructions here: https://docs.aws.amazon.com/gamesparks/latest/dg/get-started_client-unity.html to include the library to be used in code.However after install and run the game APK on my Samsung phone (Android API ver 33), and use logcat to debug, it printed out like so:2023/04/21 09:24:15.692 16843 17079 Error Unity DllNotFoundException: Unable to load DLL 'amazon-gamesparks-client-shared'. Tried the load the following dynamic libraries: Unable to load dynamic library 'amazon-gamesparks-client-shared' because of 'Failed to open the requested dynamic library (0x06000000) dlerror() = dlopen failed: library "amazon-gamesparks-client-shared" not found2023/04/21 09:24:15.692 16843 17079 Error Unity   at Amazon.GameSparks.Unity.DotNet.NativeApiWrapper.amzn_gs_create_client (System.IntPtr clientConfiguration) [0x00000] in <00000000000000000000000000000000>:0 2023/04/21 09:24:15.692 16843 17079 Error Unity   at Amazon.GameSparks.Unity.DotNet.NativeClientFactory.Create (System.Action`1[T] errorLogAction, System.Action`1[T] infoLogAction, System.Action`1[T] debugLogAction) [0x00000] in <00000000000000000000000000000000>:0 2023/04/21 09:24:15.692 16843 17079 Error Unity   at Amazon.GameSparks.Unity.EngineIntegration.Client..ctor (Amazon.GameSparks.Unity.DotNet.INativeClientFactory nativeClientFactory, System.TimeSpan updateInterval, System.Action`1[T] errorLogAction, System.Action`1[T] infoLogAction, System.Action`1[T] debugLogAction) [0x00000] in <00000000000000000000Using Dependencies Walker tool indicated that the output DLL does not contains the above amazon-gamesparks-client-shared.Also, when inspecting the APK file, amazon-gamesparks-client-shared does appear in the lib folder, but only under armv7, this make me deduce that probably the SDK does not support in ARM64 yet. Is there a workaround as I want to build and test in the ARM64 arch? Thanks in advance!FollowCommentHatem Amayreh a month agoWe are currently working on supporting android-arm64-v8a devices in GameSparks SDK, this should be released in the near future (no specific date yet). Will update you once we release the new version.Share"


Question: How to create a serverless endpoint configuration?

"based on the sample code provided here , https://docs.aws.amazon.com/sagemaker/latest/dg/serverless-endpoints-create.html#serverless-endpoints-create-configI created a model via lambda, now when i try to create a serverless endpoint config (sample code below) , i keep getting -> parameter validation failedunknown parameter in ProductVariants [ 0 ]: "ServerlessConfig", must be one of : VairantName, ModelName, InitialInstanceCount , Instancetype...response = client.create_endpoint_config(   EndpointConfigName="endpoint-new",   ProductionVariants=[        {            "ModelName": "MyModel",            "VariantName": "AllTraffic",            "ServerlessConfig": {                "MemorySizeInMB": 2048,                "MaxConcurrency": 10            }        }     ])FollowComment"

Answer: "1Accepted AnswerThe cause might be that your SageMaker Python SDK is not updated to the latest version. Please make sure you update it to the latest version as well as the AWS SDK for Python (boto3). You can use pip:pip install --upgrade boto3pip install --upgrade sagemakerFor a sample notebook you can have a look here. More information on the documentation page.CommentShareIoananswered a year ago1Hi,Can you confirm the version of boto3 that you are using? This error is likely to be caused because of an older version of boto3 that does not include capability for serverless inference.Serverless inference was introduced in version 1.20.18Hope this helps,GeorgiosCommentSharegeorgios_sanswered a year ago"


Question: Sagemaker Batch Transform - "upstream prematurely closed connection" - Unable to serve requests that take longer than 30 minutes

"This is a duplicate of a question I asked on stack overflowI am serving a sagemaker model through a custom docker container using the guide that AWS provides. This is a docker container that runs a simple nginx->gunicorn/wsgi->flask serverI am facing an issue where my transform requests time out around 30 minutes in all instances, despite should being able to continue to 60 minutes. I need requests to be able to go to sagemaker maximum of 60 minutes due to data intense nature of request.Through experience working with this setup for some months, I know that there are 3 factors that should affect the time my server has to respond to requests:Sagemaker itself will cap invocations requests according to theInvocationsTimeoutInSeconds paremeter set when creating the batchtransformjob.The nginx.conf file must be configured such that keepalive_timeout, proxy_read_timeout, proxy_send_timeout, and proxy_connect_timeout are all equal or greater than maximum timeoutgunicorn server must its timeout configured to be equal or greater than maximum timeoutI have verified that when I create my batch transform job InvocationsTimeoutInSeconds is set to 3600 (1 hour)My nginx.conf looks like this:worker_processes 1;daemon off; # Prevent forkingpid /tmp/nginx.pid;error_log /var/log/nginx/error.log;events {  # defaults}http {  include /etc/nginx/mime.types;  default_type application/octet-stream;  access_log /var/log/nginx/access.log combined;  sendfile        on;  client_max_body_size 30M;  keepalive_timeout  3920s;    upstream gunicorn {    server unix:/tmp/gunicorn.sock;  }  server {    listen 8080 deferred;    client_max_body_size 80m;    keepalive_timeout 3920s;    proxy_read_timeout 3920s;    proxy_send_timeout 3920s;    proxy_connect_timeout 3920s;    send_timeout 3920s;    location ~ ^/(ping|invocations) {      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;      proxy_set_header Host $http_host;      proxy_redirect off;      proxy_pass http://gunicorn;    }    location / {      return 404 "{}";    }  }}`I start the gunicorn server like this:def start_server():    print('Starting the inference server with {} workers.'.format(model_server_workers))    print('Model server timeout {}.'.format(model_server_timeout))    # link the log streams to stdout/err so they will be logged to the container logs    subprocess.check_call(['ln', '-sf', '/dev/stdout', '/var/log/nginx/access.log'])    subprocess.check_call(['ln', '-sf', '/dev/stderr', '/var/log/nginx/error.log'])    nginx = subprocess.Popen(['nginx', '-c', '/opt/program/nginx.conf'])    gunicorn = subprocess.Popen(['gunicorn',                                 '--timeout', str(3600),                                 '-k', 'sync',                                 '-b', 'unix:/tmp/gunicorn.sock',                                 '--log-level', 'debug',                                 '-w', str(1),                                 'wsgi:app'])    signal.signal(signal.SIGTERM, lambda a, b: sigterm_handler(nginx.pid, gunicorn.pid))    # If either subprocess exits, so do we.    pids = set([nginx.pid, gunicorn.pid])    while True:        pid, _ = os.wait()        if pid in pids:            break    sigterm_handler(nginx.pid, gunicorn.pid)    print('Inference server exiting')Despite all this, whenever a transform job takes longer than approx 30 minutes I will see this message in my logs and the transform job status becomes failed:2023/01/07 08:23:14 [error] 11#11: *4 upstream prematurely closed connection while reading response header from upstream, client: 169.254.255.130, server: , request: "POST /invocations HTTP/1.1", upstream: "http://unix:/tmp/gunicorn.sock:/invocations", host: "169.254.255.131:8080"I am close to thinking there is a bug in AWS batch transform, but perhaps I am missing some other variable (perhaps in the nginx.conf) that could lead to premature upstream termination of my request.FollowComment"

Answer: 0Accepted AnswerBy looking at hardware metrics was able to determine that the upstream termination only happens when the server was near its memory limit. So my guess is that the OS was killing the gunicorn worker and the 30 minute mark was just a coincidence that happened on my long running test cases.My solution was to increase the memory available on the serverCommentShareGrant-Crossfoldanswered 5 months ago


Question: "URGENT : HELP !!! : Name Mismatch, the exam time is today."

"HI ,I have scheduled my Exam today (2021/04/01). My Candidate name is not matching with ID proof.Candidate Name :KEN YANGID Proof Name : CHIEN KUO YANGCandidate ID : AWS01993028I have already raised the Customer Support request on:https://support.aws.amazon.com/#/contacts/aws-trainingCASE : 8172203211Is there any method to Contact Support Services ASAP?If AWS support not response or fix my name before 18:00, then I will not able to take the exam, and this schedule also not able to be re-scheduled....Great thanks if any AWS people can help!!FollowComment"

Answer: "0Problem fixed.Thanks for AWS support team’s prompt response and help.Edited by: YANGCHIENKUO on Apr 1, 2021 12:43 AMCommentShareYANGCHIENKUOanswered 2 years ago"


Question: Lambda Function Error

"I created Lambda function(Node.js) for image resizing.I got Runtime.HandlerNotFound error.Cloudwatch log as follows:2022-07-15T01:06:22.016ZundefinedERRORUncaught Exception {"errorType": "Runtime.HandlerNotFound","errorMessage": "index.handler is undefined or not exported","stack": ["Runtime.HandlerNotFound: index.handler is undefined or not exported","    at Object.module.exports.load (/var/runtime/UserFunction.js:283:11)","    at Object.<anonymous> (/var/runtime/index.js:43:34)","    at Module._compile (internal/modules/cjs/loader.js:1085:14)","    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)","    at Module.load (internal/modules/cjs/loader.js:950:32)","    at Function.Module._load (internal/modules/cjs/loader.js:790:12)","    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:75:12)","    at internal/main/run_main_module.js:17:47"]}Some of my Index.js is as follows:'use strict';const querystring = require('querystring'); // Don't install.const AWS = require('aws-sdk'); // Don't install.// http://sharp.pixelplumbing.com/en/stable/api-resize/const Sharp = require('sharp');const S3 = new AWS.S3({region: 'ap-northeast-2'  //});const BUCKET = 'BUCKET_NAME' // Input your bucket// Image types that can be handled by Sharpconst supportImageTypes = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'tiff', 'jfif'];exports.handler  = async(event, context, callback) => {const { request, response } = event.Records[0].cf;console.log("request: ", request)console.log("response: ", response)....FollowComment"

Answer: "2Your handler setup looks different to that described in https://docs.aws.amazon.com/lambda/latest/dg/nodejs-handler.html - are you sure it's equivalent?  I don't use node.js so can't tell for sure, but it looks a good place to start.CommentShareEXPERTskinsmananswered a year ago1Accepted Answercan you check if the path of the handler and location of the index file in the packaged code is same?You will get this error when the path of the handler and the location of index.js in the package is not the same.CommentSharerePost-User-6922853answered a year ago1I notice documentation always says "index.js" but you mentioned "Index.js".  I have no idea if it's relevant but just in case ...CommentShareEXPERTskinsmananswered a year agorePost-User-9649774 a year agoThanks. It's was typo.Share1I think you packaged a zip file which does not contains the index.js in root of zipThe zip commands can give you a zip file containing another folder inside which contains the index jsTry to verify the content of packageCommentShareOmid Eidivandianswered a year ago0I replaced Index.js as follows:exports.handler = function (event, context, callback)  {...but I got same error on cloudwatch.2022-07-15T02:04:22.891ZundefinedERRORUncaught Exception{"errorType": "Runtime.HandlerNotFound","errorMessage": "index.handler is undefined or not exported","stack": ["Runtime.HandlerNotFound: index.handler is undefined or not exported","    at Object.module.exports.load (/var/runtime/UserFunction.js:283:11)","    at Object.<anonymous> (/var/runtime/index.js:43:34)","    at Module._compile (internal/modules/cjs/loader.js:1085:14)","    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)","    at Module.load (internal/modules/cjs/loader.js:950:32)","    at Function.Module._load (internal/modules/cjs/loader.js:790:12)","    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:75:12)","    at internal/main/run_main_module.js:17:47"]}CommentSharerePost-User-9649774answered a year ago"


Question: Managed Grafana Signed plugin

How do I install a signed plugin?  I would like to use D3 Gauge and it shows up in the plugins search but instead of "install" it says "signed"FollowComment


Question: How to receive only one sns notification triggered via autoscaling event.

"I have registered SNS in AutoScalingGroup Activity notifications to receive notifications through messenger.If 4 instances are scaled-out, 4 alarms are generated through SNS.But I just want to know that it is scale-out. That is, I want to receive an alert only once.How can I change the configuration?FollowComment"

Answer: "0Accepted AnswerThis isn't possible currently, but I've passed on this feedback to the internal AutoScaling team.  The only workaround currently would be to aggregate the notifications via EventBridge, and then create your own mechanism to trigger an SNS notification once a threshold is breached.  Ex, :Have the Event notify Lambda which records the entries in a DBHave the Event logged in a CloudWatch log group; which has a metric filter to create a custom metric; link an alarm to that custom metrichttps://docs.aws.amazon.com/autoscaling/ec2/userguide/cloud-watch-events.htmlCommentShareShahad_Canswered a year ago"


Question: Can AWS Batch jobs use SageMaker FastFile mode?

Can a regular (non-machine learning) Python job submitted via AWS Batch make use of SageMaker FastFile mode to stream data from S3 to the container? Or is there any equivalent of SageMaker FastFile mode in other Python libraries? The key point is about whether it's possible to avoid the need to copy data from S3 to the EBS or instance store volume before processing.FollowComment

Answer: "1Don't think FastFile mode is available outside of SageMaker Training. Depending on your use-case/trade-offs, some of the options areUse SageMaker Training as your processing hostCould try FSx/EFSCommentShareAnonymousanswered a year ago"


Question: AWS associate ip with instance in other account

"I have a problem that I'm trying to fix for my school project.Let's say I have account A and my friend accounts B.each one of us as 1 instance ubuntu, and I want to transfer/allocate my elastic ip (if a program fails) to his instance through AWS CLI.both instances are in the same vpc, same subnet.so I have a script that disassociates the elastic ip and associates the new one to his instance like this.aws ec2 disassociate-address --public-ip 00.00.000.00(maybe on the script here I have to tranfer the elastic ip or make the awscli access his account?)aws ec2 associate-address --public-ip 00.00.000.00 --instance-id i-00000000of course, it won't work because the AWS CLI is connected to my account but I can't seem to find a way to make this work.Possible ways, transfer ip but don't know how to do it in an automated way, iam roles?I don't mind having both instances on one account but since we are 2 I would like to take advantage of the free tier since it's our first time using aws.Any idea how I can make this work?FollowComment"

Answer: "0Greetings,AWS account the necessary permissions to manage Elastic IPs in your account. You'll need to create a cross-account role in your account and have your friend assume that role in their account to execute the necessary AWS CLI commands.Here's a step-by-step guide to achieve this:In your AWS account, create an IAM role with the following trust policy. Replace 123456789012 with your friend's AWS account ID:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::123456789012:root"      },      "Action": "sts:AssumeRole"    }  ]}Attach a policy to the role you created in step 1 with the necessary permissions to manage Elastic IPs. You can create a custom policy like this:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:AssociateAddress",        "ec2:DisassociateAddress"      ],      "Resource": "*"    }  ]}Note the ARN of the role you created in step 1. It will look like this: arn:aws:iam::your_account_id:role/RoleNameIn your friend's AWS account, they should configure a CLI profile with their account credentials. They can do this by running aws configure --profile friend-profile, and then entering their access key, secret key, and default region.Your friend can then assume the role you created in your account by running the following command:aws sts assume-role --role-arn arn:aws:iam::your_account_id:role/RoleName --role-session-name FriendSession --profile friend-profileThis command will return temporary credentials (AccessKeyId, SecretAccessKey, and SessionToken) that they need to use when running AWS CLI commands with the assumed role.They can now use the temporary credentials to disassociate and associate the Elastic IP in your account using the AWS CLI. They should set the following environment variables:export AWS_ACCESS_KEY_ID=AssumedRoleAccessKeyIdexport AWS_SECRET_ACCESS_KEY=AssumedRoleSecretAccessKeyexport AWS_SESSION_TOKEN=AssumedRoleSessionTokenReplace AssumedRoleAccessKeyId, AssumedRoleSecretAccessKey, and AssumedRoleSessionToken with the actual values from step 5.Finally, your friend can run the disassociate and associate commands using the temporary credentials:aws ec2 disassociate-address --public-ip 00.00.000.00aws ec2 associate-address --public-ip 00.00.000.00 --instance-id i-00000000This way, you can keep the instances in separate accounts and still manage the Elastic IPs across both accounts.Links for reference:Creating an IAM role: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.htmlAttaching a policy to an IAM role: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.htmlAssuming a role with AWS CLI: https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/Configuring the AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.htmlAmazon EC2 Elastic IPs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlPlease let me know if I answered your questionCommentShareZJonanswered 3 months agorePost-User-1647857 2 months agoHi, I get this error An error occurred (InvalidInstanceID.NotFound) when calling the AssociateAddress operation: The instance ID i-123 does not exist, because it doesn't appear in my account (A) because i-123 belongs to the account (B)Share0To transfer an Elastic IP between accounts, please see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.htmlIm not sure entirely you have the instances in the same VPC/Subnet?? Are you sharing https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.htmlCommentShareGary Mcleananswered 2 months ago"


Question: Elastic Beanstalk Deployments Failing - Amazon Linux 2/3.1.5

"Hi all,We have been experiencing constant failing deployments on Elastic Beanstalk using CodePipeline.Elastic Beanstalk Environment:Platform PHP 7.4Amazon Linux 2/3.1.5We having a Symfony application running with a few cron jobs, during every deploy with CodePipeline the deployment fails with the following error message:2021/02/12 19:16:54.089661 Executing instruction: stop php-fpm2021/02/12 19:16:54.089672 Running command /bin/sh -c systemctl show -p PartOf php-fpm.service2021/02/12 19:16:54.094043 Running command /bin/sh -c systemctl stop php-fpm.service2021/02/12 19:16:54.204134 Executing instruction: FlipApplication2021/02/12 19:16:55.339260 An error occurred during execution of command [app-deploy] - [FlipApplication]. Stop running the command. Error: remove current dir failed: unlinkat /var/app/current: directory not empty2021/02/12 19:16:55.339271 Executing cleanup logic2021/02/12 19:16:55.339344 CommandService Response: {"status":"FAILURE","api_version":"1.0","results":[{"status":"FAILURE","msg":"Engine execution has encountered an error.","returncode":1,"events":[{"msg":"Instance deployment failed. For details, see 'eb-engine.log'.","timestamp":1613157415,"severity":"ERROR"}]}]}After the fail, retrying the deploy through CodePipeline works as expected.We have tried killing all cron jobs prior to deploying, different folder permission, etc but the issue still persists.Any guidance would be appreciated.Edited by: socialRanvir on Feb 16, 2021 2:33 AMFollowComment"

Answer: "0I ran the command eb deploy 1st time with the same error as you.However, I tried running eb deploy again for the second time and it didn't appear.If you know why, please share it with me.CommentShareitnavi-ducanswered 2 years ago0It happens to us each deploy, did it only affect you once?CommentSharesocialRanviranswered 2 years ago0It's happening to our application as well and as far as we can tell it happens every time we deploy using aws elasticbeanstalk instead of the eb deploy command.The way we have it set up is;commit code to GitlabGitlab runner starts up with aws-cli installedaws s3 uploads the build to S3aws elasticbeanstalk create-application-version creates a new application to deployaws elasticbeanstalk update-environment will deploy the application, which will fail with the error;[ERROR] An error occurred during execution of command [app-deploy] - [FlipApplication]. Stop running the command. Error: remove current dir failed: unlinkat /var/app/current: directory not emptyThis error does not occur when you use eb deploy \[application].Interested to know what's going on here.CommentShareartjuliananswered 2 years ago0Bump, anyone else?CommentSharesocialRanviranswered 2 years ago0Hi,Any movement on this? I am experiencing the same issue, we are using: PHP 7.4 running on 64bit Amazon Linux 2/3.1.6We are using the GitHub source integration in a CodePipeline so no manual commands being used to trigger the deploy, all whatever AWS does under the hood.CheersCommentSharemgilbertiesanswered 2 years ago0This issue for me was because I was mounting EFS to a directory in /var/app/current/.  Heres a related answer on stack overflow https://stackoverflow.com/a/67494984/15900388, might be helpful to some.Edited by: wesleyhendon on May 12, 2021 6:12 AMCommentSharewesleyhendonanswered 2 years ago0Same issue..CommentSharesimonmullaneyanswered 2 years ago0Same issue here. It has been happening for months but is becoming more frequent. Seems totally random, we can have multiple successes in a row with no problem and also have single/multiple failures despite no changes other than re-attempting the deployment.Amazin Linux 2/3.2.4Ruby 2.7 running on 64bitRails 6Using the eb deploy commandCommentShareJoeyParisanswered 2 years ago"


Question: SES mailfrom configuration

"HiI want Messages sent through Amazon SES will be marked as originating from my domain. Then I added two records (MX, TXT) into DNS and used mxtool.com to test. But the status of MAILFROM is still pending (I added at Friday 5/5)How to resolve this issue?ThanksFollowComment"


Question: Why is my S3 Lambda Trigger not executed for larger objects uploaded to S3 with KMS key

"When uploading a large file (I tried it with 60 MB) to S3 using e.g. browser upload with an AWS KMS managed customer master key (SSE-KMS)(!), no 'ObjectCreated'-Events will be triggered. As a consequence an attached lambda function won't trigger.The same setup works without any kind of issues when uploading smaller files (I tried it with 2MB)That is quite strange and I wonder, why it has not been fixed yet.Can you provide guidance here?Further evidence next to my own observation:https://stackoverflow.com/questions/67917878/aws-s3-lambda-function-doesnt-trigger-when-upload-large-file#comment125169885_67917878https://stackoverflow.com/questions/61125071/lambda-not-invoking-if-the-uploaded-files-are-large-in-size-in-s3-bucket#comment125169907_61125071https://forums.aws.amazon.com/thread.jspa?messageID=588242&#588242 (last post)Since no one was able to provide an answer that actually tackles the problem in those posts, it looks like this a bug to me. In that case I would suggest to fix it :)FollowCommentmike a year agoIs the event you're listening for "s3:ObjectCreated:*", specifically with the wildcard on the end?ShareAnd a year agoI just used the web-interface to set it up. There is no option to define any wildcards. https://paste.pics/FRKFUWhen looking at the trigger details (within the lambda function's trigger configuration) it just says: "Event type: ObjectCreated"ShareAnd a year agoFor the sake of completeness I added a second trigger for the Multipart Upload (see screenshot). As assumed there was no change in behavior: https://paste.pics/FRKRUAs stated I am using an AWS KMS managed customer master key (SSE-KMS) on the bucket and for the uploadShareAnd a year agoDoes the lambda function need the "AmazonS3ReadOnlyAccess" Policy to allow invocation via S3 multipart upload trigger?Share"

Answer: "0Expanding on the comment by @mike, your small files would be uploaded in one piece whereas large ones (over 5MB) would be multi-part uploads that are different API calls.  So depending how you defined your trigger conditions you could be picking up one but not the other.CommentShareEXPERTskinsmananswered a year agoAnd a year agoI just used the web-interface to set it up. There is no option to define any wildcards. https://paste.pics/FRKFUWhen looking at the trigger details (within the lambda function's trigger configuration) it just says: "Event type: ObjectCreated"Share"


Question: Docker-based backend distribution by branch

"Hello. Nice to meet you.I'd like to distribute the service using dockers on the backend.Once the pull request is complete on the backend, we are considering how to deploy and assign domains.dev branch → default domain: dev.example.comWhen a new pull request is submitted and distributed,New Domain: 123.dev.example.comIf new submitted again, 124.dev.example.comIn summary, I would like to have it distributed by branch and distributed when that branch is created.I want this kind of composition. What should I do?I need your help.Thank you.FollowComment"

Answer: "0This is a very abstract question. Even if you use Docker containers, there are various ways to solve the problem depending on the current architecture configuration.Let's take an example of solving a problem with a simple assumption.AssumptionUse Route53 Hosted ZoneUse AWS ECR1 ALB1 EC2 instance per service. (Not multi-tenant)No ECS, EKS, FargateProblem SolvingCreate A Alias record for the ALB with *.dev.example.comWhen the specific event(Pull request is submitted) occurs, just do followingbuild Image and push to ECR registry.Create EC2 instanceInstall Docker.Pull the corresponding container image from ECR registry, and run the container!Create a target group including the above EC2 instance.Add Listener Rule for the ALB with Host condition ${something}.dev.example.com to the target group.That's all.CommentShareEXPERTposquit0answered 6 months ago"


Question: DynamoDB TTL on item collections

"hello, I would like to know how TTL column works in case we are working with item collections. For example, if wanted to add a TTL column to this schema, I'm not sure about how to share the same value across all the records related to the same PK.Thanks.FollowComment"

Answer: "1A TTL is associated with a single item, never an item collection. You'll need to add a TTL attribute on each item.CommentSharejzhunteranswered 3 months ago"


Question: How to use EKS with AWS SSO

"Hi,We would like to give users permissions to use EKS using their AWS SSO usernames. I'm aware of the aws-iam-authenticator and eksctl, but not quite sure how to make them all work together with SSO rather than an IAM username.ThanksFollowComment"

Answer: "0Hi,Amazon EKS uses IAM to provide authentication to your Kubernetes cluster (through the aws eks get-token command, available in version 1.16.156 or later of the AWS CLI, or the AWS IAM Authenticator for Kubernetes), but it still relies on native Kubernetes Role Based Access Control (RBAC) for authorization. This means that IAM is only used for authentication of valid IAM entities. All permissions for interacting with your Amazon EKS cluster’s Kubernetes API is managed through the native Kubernetes RBAC system.https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.htmlRefer integration guide-  https://aws.amazon.com/blogs/opensource/integrating-ldap-ad-users-kubernetes-rbac-aws-iam-authenticator-project/Please mark Helpful or Correct Answer next to each message. Appreciate it.CommentSharelearn2skillsanswered 2 years ago0IMHO this topic deserves a specific documentation page. AWS SSO uses some weirdly formatted role arns, and I've never been able to set this stuff up so that SSO users can access EKS using kubectl.Pretty crazy that such an essential thing as kubectl access using SSO roles isn't properly documentedEdited by: trondhindenes-nomono-e2 on Sep 2, 2021 7:45 AMCommentSharetrondhindenes-nomono-e2answered 2 years ago0It looks like they documented it in a blog post: A quick path to Amazon EKS single sign-on using AWS SSOThe magical part is the rolearn specification in this fragment of the aws-auth ConfigMap:    - groups:      - system:masters      rolearn: arn:aws:iam::111222333444:role/AWSReservedSSO_EKSClusterAdminAccess_6a316cc66d154241      username: cluster-adminThe role specified is the assumed role (derived from the EKSClusterAdminAccess PermissionSet on the SSO account), without any suffixed username!(NB I haven't actually finished this yet, but the above article is the only one I found that pointed out this detail.)CommentShareAnthony Foianianswered 4 months ago"


Question: Auto-scaling is not working with Neptune cluster except when primary writer instance type db.r5d.xlarge.

"Issue: Scale-up actions work fine with any instance size, the scale-in action is triggered by the CloudWatch but is not able to remove the readers except r5d.xlarge.I am trying to Auto-scale the Amazon Neptune database to meet workload demands, But I'm getting issues while the Neptune writer is r5d.xlarge then it's working fine but when I changed the writer instance size then it's not working.I did not set neptune_autoscaling_config on the cluster parameter group.Applied the same configuration which is in the reference blog post,  but the one thing is different when I created the auto-scaling the first time was that time Writer instance was on r5d.xlarge. after that, I changed the writer instance size to t3.medium and then I deleted the old configuration of the auto-scaling app and scaling policy, deregistered the scale targets, and then created new everything about autoscaling, then after the scale-up action is working fine, but the scale-in action is not working except r5d.xlarge.I am not getting any error from the CloudWatch, CloudWatch action triggered successfully but it does not remove the Neptune reader which was created while the scale-up action, and also I'm not getting scaling activities which policy action is not able to delete the reader.This same thing is working fine on our Prod and Stage accounts but this issue has only occurred on the Dev account.Note: Scale-in(remove neptune reader) is working fine through a scheduled action https://docs.aws.amazon.com/autoscaling/application/userguide/examples-scheduled-actions.htmlCan anyone please help me with this?Thanks in advance!Below blog which I am using for referencehttps://aws.amazon.com/blogs/database/auto-scale-your-amazon-neptune-database-to-meet-workload-demands/FollowCommentTaylor-AWS a year agoWhen you say "scale-up", do you mean "scale-out"? Neptune auto-scaling only supports scaling-out and scaling-in read replicas.  The writer instance is not affected during these operations.  You also must have at least one read-replica already provisioned before enabling auto-scaling.  Auto-scaling can then scale-in the number of replicas to 0, but it needs this first replica online to start with.SharerePost-User-3079708 10 months agoHello Taylor-AWS,Thanks for your response.Yes, when I say scale-up means scale-out. Here I am talking about Neptune read replicas scale-out and scale-in process. I didn't set up anything to an auto-scaling application in which a fixed instance type reader will be added,  It's default setting will take instance size as the same writer instance size so, I mentioned about writer here. when my writer instance is r5d.xlarge then the auto-scale application trigger action for scale-out and scale-in it's working fine but when my writer instance is running on except r5d.xlarge then only scale-out is working fine but scale-in is not working.I already have one reader and writer instance with Neptune cluster at the time of configurations and I set min-capacity as 1 and max-capacity as 2. Also as I mentioned in my question it is working fine with our prod and stage accounts but the issue occurs in the Dev environment.Thanks!Share"


Question: Can we make use of AWS Credits to Purchase the reserved instances?

We have some credit amount left in our AWS Account. We wanted to purchase the AWS Reserved Instances using the AWS Credits that are remaining in our AWS Account. Can we make use of it?FollowComment

Answer: "3Accepted AnswerPromotional credits can't be applied to upfront costs for Partial Upfront RIs, All Upfront RIs, or Savings Plans.However, the hourly rates that you pay for running instances can be covered by your credits when you have Partial Upfront RIs, No Upfront RIs, or Savings Plans.CommentShareGovind Kumaranswered a month agoEXPERTalatechreviewed a month ago0In this case the solution could be to purchase RIs or Savings Plans with the No Upfront payment option. With this payment option, you get monthly charges for the RI/SP subscription, which are included in your regular monthly bill, which can be covered by Credits. However, I highly recommend to check which services are covered by your Credits. Because, for example, if you got Credits to cover certain AWS services, which don't have RI model, or if your Credits don't specify that they can cover Savings Plans, then even if you buy No Upfront RIs or SP, you may not get covered. If you're not sure - you can open a support case from your account, and our support team should be able to help you to find out which services can be covered by your credits.CommentShareEXPERTNataliya_Ganswered a month ago"


Question: AWS cognito using AWS amplify with Vue3 fails to show the component

"I am using vue3 and have set up an AWS user pool (amazoncognito.com) using the was web-console. The goal is to authenticate users with a username and password against Cognito and receive the OAuth2 token to authenticate API requests made against the AWS API gateway.Challenge: It seems that AWS amplify is not working with the latest vue3 release. It is not showing the ui-component.I have not configured amplify as I don't want it to mess with my backend, and just want to use the auth components. Therefore I configured the user-pool in the main.jsmain.jsimport { createApp } from 'vue'import App from './App.vue'import Amplify, { Auth } from 'aws-amplify';Amplify.configure({Auth: {identityPoolId: 'eu-central-1_REST-OF-THE-POOL-DATA',region: 'eu-central-1',userPoolWebClientId: '4t49u0pu0skXREST-OF-ID-DATA',mandatorySignIn: false,cookieStorage: {domain: 'PREFIX-IN-USE.auth.eu-central-1.amazoncognito.com',path: '/',expires: 365,sameSite: "strict",secure: true},authenticationFlowType: 'USER_PASSWORD_AUTH',oauth: {domain: 'PREFIX-DOMAIN-IN-USE.auth.eu-central-1.amazoncognito.com',scope: ['phone', 'email', 'profile', 'openid', 'aws.cognito.signin.user.admin'],redirectSignIn: 'http://localhost:3000/',redirectSignOut: 'http://localhost:3000/',responseType: 'code' // or 'token', note that REFRESH token will only be generated when the responseType is code}}});createApp(App).use(Amplify, Auth).mount("#app");And inside App.vue<template><HelloWorld msg="Welcome to Your Vue.js App"/><amplify-authenticator>
Inside Authenticator<amplify-sign-out></amplify-sign-out>
</amplify-authenticator></template>I hope someone sees the error, changing the stuff since a week...FollowComment"

Answer: 0Solution is easy. AWS just not supporting Amplify Auth with any modern and up-to-date Language.Vue3: https://github.com/aws-amplify/amplify-js/issues/6756Angular: Same stuff.Good Job!CommentShareGridKnightanswered 2 years ago


Question: CF stack stuck in cleanup

"ThanksBryanUS_East_1Edited by: bryanG on Sep 11, 2019 10:47 AMFollowComment"

Answer: "0Hello,Please provide the stack ARN/id so that I can take a look at it from my side.CommentShareVismay_Manswered 4 years ago"


Question: 使用finalshell 链接老是中断或无法链接

FollowComment


Question: How create VOD-Stream (FAST-Channel) with Ad-Markers via MediaTailor

"Hi,we are currently working on the creation of a FAST-Channel via MediaTailor (based on HLS-content created via MediaConvert).Samsung-TV expects that the stream includes Ad-Markers:Samsung requires frame-accurate ad markers (SCTE-35 supported)Variant manifest should have SCTE HLS tags indicating ad insertion pointsI then added an ESAM-XML (with three ad breaks starting 10s, 20s and 30s) when creating HLS-Outputs (HEVC-Codec) via MediaConvert  with the following settings:Video Output Settings -> SCTE-35 source: "passtrough"Apple HLS group settings -> Ad markers: "elemental (enabled)"The variant manifests provided by my Main-Manifest seem to properly include Ad-Markers:...#EXT-X-PLAYLIST-TYPE:VOD#EXTINF:6.000,hlsvideo_720_00001.ts#EXTINF:4.000,hlsvideo_720_00002.ts#EXT-X-CUE-OUT:0#EXT-X-CUE-IN#EXTINF:2.000,hlsvideo_720_00003.ts#EXTINF:6.000,hlsvideo_720_00004.ts#EXTINF:2.000,hlsvideo_720_00005.ts#EXT-X-CUE-OUT:0#EXT-X-CUE-IN...In the following I created a Channel via MediaTailor and added the previously described VOD-Source as a program and started the channel. When looking at fetched variant playlists, I can't find any EXT-X-CUEs (at the start of the Video with 5min duration):#EXTM3U#EXT-X-VERSION:6#EXT-X-TARGETDURATION:7#EXT-X-MEDIA-SEQUENCE:0#EXT-X-DISCONTINUITY-SEQUENCE:0#EXT-X-DISCONTINUITY#EXT-X-PROGRAM-DATE-TIME:2022-04-11T19:28:52.452Z#EXTINF:6.0,https://amogo-public.s3.sa-east-1.amazonaws.com/output/test/Por_um_Caixao_Cheio_de_Dolares_audioMatchVideoDuration_H265_ESAM_3xAdBreaks10s/snippet/hls/hlsvideo_720_00001.ts#EXT-X-PROGRAM-DATE-TIME:2022-04-11T19:28:58.452Z#EXTINF:4.0,https://amogo-public.s3.sa-east-1.amazonaws.com/output/test/Por_um_Caixao_Cheio_de_Dolares_audioMatchVideoDuration_H265_ESAM_3xAdBreaks10s/snippet/hls/hlsvideo_720_00002.ts#EXT-X-PROGRAM-DATE-TIME:2022-04-11T19:29:02.452Z#EXTINF:2.0,https://amogo-public.s3.sa-east-1.amazonaws.com/output/test/Por_um_Caixao_Cheio_de_Dolares_audioMatchVideoDuration_H265_ESAM_3xAdBreaks10s/snippet/hls/hlsvideo_720_00003.ts#EXT-X-PROGRAM-DATE-TIME:2022-04-11T19:29:04.452Z#EXTINF:6.0,https://amogo-public.s3.sa-east-1.amazonaws.com/output/test/Por_um_Caixao_Cheio_de_Dolares_audioMatchVideoDuration_H265_ESAM_3xAdBreaks10s/snippet/hls/hlsvideo_720_00004.ts...Is my approach here correct for adding the Ad-Markers to our Live-Stream?Kind regards,RivaFollowComment"

Answer: "0This is a bit difficult to understand what is being done as far as SCTE-35 insertions for Server Side Ad Insertion. It seems you are scheduling 3 ad insertions, one at 10s into the video, then at 20s and 30s. (How long are the ads? Less than 10s is not typical.)If you are looking to have an ad at the beginning of the video playout, you may need to schedule a Preroll ad. Please review this link.https://docs.aws.amazon.com/mediatailor/latest/ug/ad-behavior-preroll.htmlAlso if you are using MediaTailor Channel Assembly to create the playout channel, you may need to review the following link.https://docs.aws.amazon.com/mediatailor/latest/ug/channel-assembly-integrating-mediatailor-ssai.htmlCommentShareMike-MEanswered a year ago0These 3 ad insertions were just for testing the integration of the ad-markers (There are no ads provided).We aim to have ad-markers added for every 10 minutes of the content being played in the stream.According to the feedback from Samsung-Tv to our Test-Stream (provided via MediaTailor):the stream is missing ad markers and having them is a requirement for launchwe are supposed to provide ad-markers. From my understanding they will utilise these markers to set up ads themselves.CommentShareAWS-User-2672844answered a year ago"


Question: upgrade free tier

How can i upgrade my free tier plan i need more than 5 GB storageFollowComment

Answer: "1Even if you are using a free tier account, you can still set up more than 5GB of storage space.Please note that if you set a capacity of 5 GB or more, you will be charged for the amount you set.https://aws.amazon.com/s3/pricing/?nc1=h_lshttps://aws.amazon.com/free/?nc1=h_ls&all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*allCommentShareEXPERTRiku_Kobayashianswered 16 days ago"


Question: How to scale in ec2 fargate containers if job is done?

"We want to run containers on an ec2 fargate cluster that will run jobs of an arbitrary duration (30 minutes on average). We want to scale out based on active TCP connection metrics via the AWS loadbalancer (1 tcp connection contains stream that needs to be handled by 1 container). This seems possible with cloudwatch metrics. The question is how to scale in once the job is done. We do not want to stop a container when it's still processing an active connection. It could take hours for the job to finish (and that is OK).Is there a way we can remove a container once it is done processing (aka no active tcp connection anymore?)If the process inside the container stops, is it removed from the desired active container total?FollowComment"

Answer: "0If you need to trigger a Fargate task that executes a batch job and then exits wouldn't make more sense to use a pattern such as the one I am describing in this blog post? Note that in my example I submit an AWS Batch job but API GW also supports launching an ECS task (on Fargate).The idea is that the task would launch a program that does what you need it to do and then exits (you should not worry about scaling in at all with this pattern). Need another task? Hit the API GW API to submit/launch another job/task and that's it.CommentShareEXPERTmreferreanswered a year ago0Generally speaking, systems on AWS are conservative about scale ins, compared to scale out.You do not want your system to be scaled in immediately after it completes certain tasks.That being said, from a long term auto scaling policies such as target tracking do a fairly good job of matching capacity with demands. If there is no connection to a container, the auto scaling scale in event should be triggered.Also, to another point in the question, you might want to check the de-registration delay value for your ELB as well to avoid terminating active long-running connections.CommentShareJason_Sanswered a year ago"


Question: Update Geolocation DB

"Hi, I work in an ISPRecently we have rented an IP segment, we are doing the paperwork to formalize the transfer to my region, however, in the meanwhile we are using the IPs.We detected that AWS CloudFront is providing a Geo restriction to some websites, because Route 53 is using the previous IP's Geolocation DB.How could I proceed to indicates AWS the new IPs location?Thanks so much your help and supportFollowComment"

Answer: "0Hello ThereI understand you detected that AWS CloudFront is providing a Geo restriction to some websites, because Route 53 is using the previous IP's Geolocation DB, So you're seeing geolocation for some of your IP ranges is incorrect in AWS and you want to update it with a correct location.Please note: CloudFront uses Maxmind tool database to determine the location of the IP's [1],If you find any of your IP's location is shown incorrectly in Maxmind database[2] then you can log a request with Maxmind to correct the location of the IP’s [3].I suggest that you also view some documentation on CloudFront geographic restrictions feature that lets you control distribution of your content at the country level for all files that you’re distributing with a given web distribution.[4]I hope this information is helpful.Best regards,MfaneloReference:[1]https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GeoRestriction.html[2]https://www.maxmind.com/en/geoip-demo[3] https://www.maxmind.com/en/geoip-data-correction-request[4]https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html#georestrictions-geolocation-serviceCommentShareMfaneloanswered a year ago"


Question: IoT TwinMaker with Managed Grafana Annotation Problem - Unknown component type DataOverlay

"I am working with AWS IoT Twinmaker and AWS Managed Grafana. I am building out a WindFarm scene and I am attempting to update Tag icons based on rules. The documentation seems pretty light in this area and I am following instructions hereStep 5. states:In order to see tags change icons based on data: a. Add a "Get Property Value History by Component Type" query to the panel b. Select your component type and property, and optionally a filter on the property value. c. Select Order = DESC to pass data from most recent to oldest to the Scene Viewer. This panel will parse the data and pull off the first value to match with a tag's rule. This assumes you have composed your scene with rules to change tag icons based on data value thresholds.Note: The Scene Viewer only supports the "Get Property Value History by Component Type" queryI am seeing the error:ValidationException: No dataReaderByComponentType or dataReader connector defined for a query within workspaceI configured the rule on the tag as follows within the sceneThen I followed the instructions in "Step 5." as just the tag rule didn't seem to work. I then see the error:This is the tag location that should be updatedHas anyone encountered this issue? Is there a step that I have missed in the configuration?FollowComment"

Answer: "0Hello,In order to use the "Get Property Value History by Component Type" you will need to set up a data connector that supports this type of query. Read more about data connectors here.You will specifically need the "DataReadByComponentType" connector implemented.The Scene Viewer now also supports "Get Property Value History by Entity" query in Grafana where you can specify the same entityId, componentName, and propertyName that you set up for the tag's data binding. You will need to set up the "DataReaderByEntity" data connector for this.Make sure you have data returned in your query in Grafana. Select the correct time range where you ingested data, and use the Table panel visualization to see the raw data in a panel. Then when you use the same query for the Scene Viewer the latest value returned will be used to resolve the tag's rule.CommentShareHarry Wandersmananswered 16 days ago"


Question: transferred a domain from GoDaddy to Route 53 and now I can't use it

I'm getting a DNS_PROBE_FINISHED_NXDOMAIN error when I try to access my website socialdzine.comI purchased support yesterday and I'm still waiting on someone to be assigned to my issue:(I've read all I can read and not harm myself or others.I don't know what to ask or who to ask.Is anyone familiar with this issue or knows where I should look for clarity?LaurieFollowComment

Answer: "0Hi,Name servers appear in three places, and typically they should all be in synch:~ The name servers that Route 53 assigns to a hosted zone when you create it. These are the "master" name servers and cannot be changed. Name servers in the other locations usually match these.~ The name servers in the NS record in the hosted zone.~ The name servers that are associated with the domain registration. These are the name servers that control which DNS configuration is in use.For socialdzine.com, the "master" name servers match the name servers in the NS record, but the name servers in the domain registration are different.To fix that, do the following:Get the name servers that Route 53 assigned to the hosted zone when you created it. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the four name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlAfter you finish, it will take a couple of days for you to be able to see your website again because DNS resolvers typically cache the names of name servers for two days. (Folks who use different DNS resolvers will be able to see your website as soon as you make the change. You might also be able to see your website from your phone.) For an overview of how DNS works, including the part about resolver caching, see "How Amazon Route 53 routes traffic for your domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html#welcome-dns-service-how-route-53-routes-trafficScottCommentShareEXPERTAWS-User-6179575answered 3 years ago0Scott,Thank you so much. Truly!I have updated the name servers, and I'll wait now. :)Just having the information makes all the difference.Sincerely,LaurieCommentSharesocialdzineanswered 3 years ago"


Question: Handling S3 KMS CSE key rotation

We are creating S3 objects with KMS managed keys with CSE. I can upload and download the objects via java SDK by building the S3 client using the code below.`  AmazonS3EncryptionV2 s3Encryption = AmazonS3EncryptionClientV2Builder.standard().withKmsClient(kmsClient).withEncryptionMaterialsProvider(new KMSEncryptionMaterialsProvider(keyAlias)).withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.AuthenticatedEncryption)).build();`Key rotation is enable for the used keys. Will I be able to decrypt the old objects in S3 bucket if the key is rotated and key material is updated? How does KMS know which material to use to decrypt the data key when I have some objects created with before KMS key rotation and some after the rotation ? Is the version of key stored as part of the object metadata? I looked at the metadata of the generated objects and I don't see any metadata that references the version of the key material. Am I missing something about the key management and how they should be used with S3?FollowComment

Answer: "0Hi,From the question I understand that you would like to know if you will be able to decrypt data after the key that was used to encrypt it rotates.When key rotation occurs, new key material is created and the previous key material is saved so you can decrypt any data that was encrypted with that key. I am attaching the following documentation that goes over this here (1). Key information would be stored in the ciphertextblob which would be how KMS knows the key to use for decryption, I am attaching the following documentation that goes over this here (2). Therefore you would not need to make any changes when the key rotation occurs and all information will still be accessible due to the persistence of the saved key information.I hope you have a great rest of your day!References(1) https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html(2) https://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html#decryptionCommentShareSUPPORT ENGINEERPatrick_Vanswered a year agoAWS-User-3805604 a year agoHi,Thanks for the response.I assume that KMS service will not only know the key id but also the version of material that it needs to use to decrypt from the CipherTextBlob. Please confirm. We use KSM CSE and I assume it works the for CSE too.Also, does S3 encryption client store the key used to encrypt the object as metadata or I need to keep track of it my self? In some cases I see "kms_cmk_id":"alias/key-alias" on the object metadata and in some cases I don't see it. I think I see it only when the object created with 'legacy encryption modes'. How I know the key used to encrypt an object in S3?Thanks,Sreeni GundaShare"


Question: Unable to activate cloudfront for my domain

"Hi,I created cloudfront distribution for my domain and then changed the www entry into my DNS panel (DNS panel is not with route53) to CNAME provided by cloudfront distribution. I even uploaded my third party CA certificate which is a wildcard certificate which is lets say *.exmaple.com and www.example.com  CNAME d3oooep89xmnwn.cloudfront.netHowever when I try to access the url https://www.example.com not sure what's going wrong but getting below error.Am I missing anything?curl -v -I https://www.example.comTrying 108.159.61.86:443...Connected to www.example.com (108.159.61.86) port 443 (#0)schannel: disabled automatic use of client certificateALPN: offers http/1.1schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.Closing connection 0curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.And then checked the windows event logs and seeing below errorThe certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is www.example.com. The TLS connection request has failed. The attached data contains the server certificate.FollowComment"


Question: Archiving CloudWatch logs no with data loss

"I'm trying to archive logs to s3 before they expire. I have written lambdas to achieve that. But the issue now is that, some of the log data is lost because some of is written after the archiving is done. I need help with how to architect this without any data loss and if possible if I could know the  exact time the retention policies delete the triggers when the time is due.FollowComment"

Answer: "0One method you could use to approach this would be to utilize a scheduled EventBridge rule to trigger the Lambdas automatically every 24 hours and trigger an S3 Export Task for the most recent day's log data.However, another way to ensure that log data is continually archived from CloudWatch to S3 without losing data outside the window of running the Lambdas would be to utilize a subscription filter on the log groups you wish to archive, to be delivered to a Kinesis Firehose delivery stream with an S3 destination.[CW Log Group Subscription Filter] -> [Kinesis Firehose] -> [S3]By setting the Filter Pattern on the Subscription Filter to capture all logs, this will forward all log data ingested in to the log group to S3 via the Kinesis Firehose delivery stream without needing to run the lambda's to export data. Note that this will only send logs ingested after the creation of the subscription filter to S3. Any logs ingested prior to the subscription filter creation would still need to be exported.Resources for configuring this can be found here:Using CloudWatch Logs subscription filters - Example 3: Subscription filters with Amazon Kinesis Data FirehoseHow do I create, configure, and troubleshoot a subscription filter to Kinesis using the CloudWatch console?CommentShareSUPPORT ENGINEERJustin_Banswered a year ago"


Question: IAM policy for authenticated user for IoT

Following AWS doc link talks about IAM policy for  authenticated role for publisher.https://docs.aws.amazon.com/iot/latest/developerguide/cog-iot-policies.htmlBut what will the authenticated IAM policy for subscriber? This is not given in the docs.FollowCommentBard Lan 3 months agoTry the link here: https://docs.aws.amazon.com/iot/latest/developerguide/iam-users-groups-roles.htmlShare

Answer: "0Something like this would work to allow for the device to subscribe to a specific  topic{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "iot:Connect"            ],            "Resource": [                "arn:aws:iot:us-east-1:123456789012:client/clientId1",                "arn:aws:iot:us-east-1:123456789012:client/clientId2",                "arn:aws:iot:us-east-1:123456789012:client/clientId3"            ]        },        {            "Effect": "Allow",            "Action": [                "iot:Subscribe"            ],            "Resource": [                "arn:aws:iot:us-east-1:123456789012:topicfilter/some_specific_topic"            ]        },        {            "Effect": "Allow",            "Action": [                "iot:Receive"            ],            "Resource": [                "arn:aws:iot:us-east-1:123456789012:topic/some_specific_topic"            ]        }    ]}CommentShareIsaacanswered 3 months agoSaurabh 3 months agoThanks. Yes this is what I was thinking. So IoTcore's own policy and IoTcore policy for cognito both seems to be having similar info.ShareGavin_A 3 months agoFor Cognito principals, it's best practice to attach an AWS IoT Policy. When the principals connects using the IAM authenticated policy (which can have iot:connect), the attached IoT Policy is the one that is actually applied (connect, publish, subscribe, etc.).Share"


Question: Filtering CloudWatch Insights by timestamp with date range

"Is there a way to filter the date range? See below. It does not work.fields @timestamp as TimeStamp, @message| sort @timestamp desc| filter @timestamp >= '2020-06-01T00:00:00.000+00:00'and @timestamp <= '2020-06-30T23:59:59.000+00:00'Also, it will be nice if there is a way to get first date and last date of the current date. In that way, I can put on the filter. Is this possible?Edited by: destrada on Jun 24, 2020 5:01 PMFollowComment"

Answer: "1Hello,In the CloudWatch Logs Insights console, in the upper right of the query editor, there is a calendar icon. When you click on the calendar icon, you can select the Absolute tab and input your desired start and end date-times.If you want to specify a date-range via the API or AWS CLI, you can first save the query, then specify the range as arguments to the start-query method.Best,KevinCommentShareKevin-AWSanswered 3 years ago"


Question: Programmatically using CreateStreamingURL and persistent storage

"I'm investigating a similar approach to this question on using a custom IdP / authentication process. One thing that isn't clear from the docs is whether the CreateStreamingURL flag for the UserID also propagates through to the persistent storage via S3.The workflow that I would like is:User logs into my application, and permissions are checked. All authn/authz logic contained here.Application uses an AWS service account to call CreateStreamingURL, with e.g. UserID=user1@example.com and UserID=user2@example.com .Application gives user1 -> url1 and user2 -> url2, such that these sessions are isolated.Next day, user1 logs in again and gets url1_new, and should be able to see whatever settings / persistence as per the previous session.Is my understanding of the UserID parameter correct?FollowComment"

Answer: "0Accepted AnswerYes. If the username is the same, the user will get the same home folder and application settings persistence.CommentShareJeremy_Sanswered 7 months ago"


Question: DynamoDB throttling

"I am wondering if I set write capacity to dynamodb and some of the requests got "throttled" , are they eventually entering the database later?FollowComment"

Answer: "3For your application to run smoothly, you need to add logic to catch and respond to errors. Typical approaches include using try-catch blocks or if-then statements.The AWS SDKs perform their own retries and error checking. If you encounter an error while using one of the AWS SDKs, the error code and description can help you troubleshoot it.Each AWS SDK implements retry logic automatically. You can modify the retry parameters to your needs. For example, consider a Java application that requires can only tolerate 3 retries. With the AWS SDK for Java, you could use the ClientConfiguration class and provide a maxRetries value of 3 to allow only 3 retries. For more information, see the AWS SDK documentation for your programming language.In addition to simple retries, each AWS SDK implements an exponential backoff algorithm for better flow control. The concept behind exponential backoff is to use progressively longer waits between retries for consecutive error responses. For example, up to 50 milliseconds before the first retry, up to 100 milliseconds before the second, up to 200 milliseconds before third, and so on. However, after a minute, if the request has not succeeded, the problem might be the request size exceeding your provisioned throughput, and not the request rate. Set the maximum number of retries to stop around one minute. If the request is not successful, investigate your provisioned throughput options.In summary, your SDK will automatically retry to a fixed number of times before throwing an exception which you can catch in a try/catch block. If no exceptions were thrown it means that your items were successfully persisted with one of the retries. Retries are configurable, each of the SDK's have a different default value, e.g Java SDK V1 uses 10 as default, and Java SDK V2 uses 8.CommentShareEXPERTLeeroy Hannigananswered 5 months ago1, are they eventually entering the database later?No, the application must retry.Managing settings on DynamoDB provisioned capacity tables - Amazon DynamoDBIf your application performs reads or writes at a higher rate than your table can support, DynamoDB begins to throttle those requests. When DynamoDB throttles a read or write, it returns a ProvisionedThroughputExceededException to the caller. The application can then take appropriate action, such as waiting for a short interval before retrying the request.CommentSharejhashimotoanswered 5 months ago0Hi,The short answer is no. If you exceed your Provisioned Write Capacity, you will start to get theProvisionedThroughputExceededException error.Here is some more info on how to deal with throttling and how to deal with it.From the docs ... https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCapacityMode.html#HowItWorks.ProvisionedThroughput.ManualProvisioned throughput is the maximum amount of capacity that an application can consume from a table or index. If your application exceeds your provisioned throughput capacity on a table or index, it is subject to request throttling.Throttling prevents your application from consuming too many capacity units. When a request is throttled, it fails with an HTTP 400 code (Bad Request) and a ProvisionedThroughputExceededException. The AWS SDKs have built-in support for retrying throttled requests (see Error retries and exponential backoff), so you do not need to write this logic yourself.CommentSharemicahanswered 5 months ago0Something to remember is that SDKs will retry internally some number of times if they see a throttle exception, so it's entirely possible that in CloudWatch you'll see throttling happening while at the same time everything seems to have been written and your application won't seem to notice any issues.If the throttling is sustained long enough then the application will see the exception from the SDK call and at that point it needs to either do an explicit retry or else the write will not happen.CommentSharejzhunteranswered 5 months ago"


Question: How to have a websocket connection to lambda in a green grass core

"Hi,I have a green grass core device in which a long lived lambda will be executing, but I need this lambda to consume messages through websocket. Is that possible? Please guideFollowComment"

Answer: "0Hi,Yes you can use websocket inside a lambda. If your lambda is listening on a TCP port, the lambda has  access to the port. If your lambda needs to bind to a socket file on the host, you can run lambda in "nocontainer" mode to set up proper file access permission.Tutorial of "nocontainer" lambda config is here: https://docs.aws.amazon.com/greengrass/latest/developerguide/lambda-group-config.htmlThanks.CommentShareShirley-awsanswered 4 years ago0Thanks for the help.CommentSharemockingBirdanswered 4 years ago"


Question: SQL Server Agent on RDS / EC2

"Hello, Im new on EC2 and RDS, and having difficulties on finding SQL Server Agent on the SSMS i have installed on RDS. i have included the screenshot here. please kindly help to navigate where to look for the SQL Server Agent. thanks in advance.FollowComment"

Answer: "0Is it possible that you have an instance running SQL Server Express? SQL Server Agent is not supported on Express Edition.Also, if you're logging in with a different user than master, you would need to add the user to the SQLAgentUserRole. Here is the documentation  reference.CommentShareadrian-AWSanswered 19 days ago"


Question: Sagemaker Pipeline FailStep Error Message Not Shown

"I created a Sagemaker pipeline using Python SDK containing a fail step with a custom error message, which is part of a condition step, as seen at the bottom of this post.Whenever  the execution of the pipeline fails due to the fact that the trained model's accuracy is lower than the threshold, the FailStep custom error message is not displayed anywhere: not in the stdout console where Im running the pipeline script, not in the CloudWatch logs and nowhere in the AWS Sagemaker Console. The pipeline execution simply fails with some general WaiterError message:botocore.exceptions.WaiterError: Waiter PipelineExecutionComplete failed: Waiter encountered a terminal failure state: For expression "PipelineExecutionStatus" we matched expected path: "Failed"Therefore, I have no way to know why did the pipeline failed.... What am I missing here? Where can I find the FailStep message at runtime?step_fail = FailStep(        name="AccuracyFailStep",        error_message=Join(on=" ", values=["Execution failed due to binary accuracy < ", accuracy_threshold]),)step_cond = ConditionStep(        name="CheckAccuracyEvaluationStep",        conditions=[cond_lte],        if_steps=[step_create_model, step_register_model, step_deploy_model],        else_steps=[step_fail])FollowComment"

Answer: "0Once the FailStep is reached, the execution fails and the error message is set as the failure reason. To be more specific, this step will first fail the pipeline exection, which results in the waiter timeout. Then it will record your provided message as failure reason in meta data of this execution.This failure reason field will be available when you call describe pipelien execution api. In the response, as described in https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribePipelineExecution.html#API_DescribePipelineExecution_ResponseSyntaxCommentShareAWS-User-5210721answered 5 months agoSagebreaker 5 months agoThe describe method does not retrieve any specific reason about why the pipeline execution failed. The field FailureReason only has this value: "'Step failure: One or multiple steps failed.'" No information about which step failed or why whatsoever... Where is then this metadata containing the error messages thrown by the pipeline's execution at runtime that you mentioned?ShareAWS-User-5210721 5 months agoSeems the step failure reason is not marked as the pipeline failure reason. Could you please try https://docs.aws.amazon.com/cli/latest/reference/sagemaker/list-pipeline-execution-steps.html this API to see if the failure step will show the provided error message ?ShareSagebreaker 5 months agoHi, yes, I can confirm that and I was actually about to post an answer to my own question after finding out that indeed the list_steps function contains the pipeline's execution metadata of all steps, such as, the status and the error message in case of failure. Thank youShare"


Question: Changing Outside IP Address for VPN Tunnels

Can I change this ip address from my Elastic ip?FollowComment

Answer: "1VPN endpoint's Outside IP addresses on the AWS side can not be changed, also you can not associate Elastic IP as the Outside IP address for the AWS VPN endpoint.  What is the reason you are looking to change the outside IPs?CommentShareEXPERTTushar_Janswered a month ago0@Tushar_J I am configuring with WatchGuard and there is 1 ip in the white list, the external ip is random so I am worried about connection problemsCommentShareHugo Voanswered a month agoTushar_J EXPERTa month agoWhen you modify the VPN connection options, the VPN endpoint IP addresses on the AWS side do not change, and the tunnel options do not change. Your VPN connection will be temporarily unavailable for a brief period while the VPN connection is updated. Reference: https://docs.aws.amazon.com/vpn/latest/s2svpn/modify-vpn-connection-options.html.Share"


Question: How to trigger CodePipeline from GitHub

"Hi,I am trying to get my CDK Stacks deployed automatically via CodePipeline. The pipeline works but it won't get triggered from any commits on my GitHub Repository.I've created an issue for that:https://github.com/aws/aws-cdk/issues/18656Basically the code looks like that    const githubConnection = pipelines.CodePipelineSource.connection(      "org/repo",      "main",      {        connectionArn: ARN        triggerOnPush: true,      }    );    const pipeline = new pipelines.CodePipeline(this, "CdkPipeline", {      synth: new pipelines.ShellStep("Synth", {        input: githubConnection,        installCommands: ["yarn install --frozen-lockfile"],        commands: ["npx cdk synth"],      }),    });FollowCommentMichael_K a year agoTry revoking the AWS Connector for Github and resetting up the connection. But it sounds like you can manually start the pipeline.I just went through this creating a workshop for this setup a couple weeks ago... I can try it again. You are using v2.8.0. Which region are your in? Anything special with your github account?Share"

Answer: "2We have seen issues in the past where the casing of the repository as configured in CodePipeline does not match the casing of the repository in GitHub or Bitbucket, and as a result, pipelines were not being properly triggered - even though using "Release Changes" would work.One suggestion would be to edit the Source action in the AWS Console and use the name of the repository as it appears in the dropdown that appears when configuring the source action - for other customers this has resolved the issue.CommentShareaws-mackenzieanswered a year ago"


Question: DMS(CDC) to Kafka Payload format

"Hi,Currently am using DMS to capture db changes and sending them to Kafka.Am only interested in data (json values without "data" keyword included) and not metadata. I am following the user guide and specifically the below configuration but not working. Could you please assist.So am only interested in flat json payload with only the data values inserted to table.Example:  {  "prop1":"value1","prop2":"value2"}{"rules": [{"rule-type": "selection","rule-id": "1","rule-name": "1","rule-action": "include","object-locator": {"schema-name": "BW3","table-name": "INT_TRANSACTIONS"}},{"rule-type": "object-mapping","rule-id": "2","rule-name": "DefaultMapToKafka","rule-action": "map-record-to-record","object-locator": {"schema-name": "BW3","table-name": "INT_TRANSACTIONS"}}]}FollowComment"

Answer: "1Accepted AnswerHi,If I understand correctly, you want only flat json file without the:data keywordmetadata sectionCurrently, there is no available way for DMS to migrate with above requirement however, I was able to find internal feature request raised for option removing metadata. There will be no ETA for when this can be available.Best option for right now is to clean the database as needed before ingest into the consumer.CommentShareSUPPORT ENGINEERKevin_Zanswered a year agorePost-User-6360525 a year agoThanks,By cleaning db as needed however, still the above keywords will be included in payload , which is something we dont need.ShareKevin_Z SUPPORT ENGINEER10 months agoHi, sorry for the typo, I mean to say clean the data from Kafka before ingesting into a consumer.Share"


Question: AppStream 2.0 after initial invite email is sent - not sending email notification

"Hi fellow AWS techs have a strange issue with AppStream 2.0 aftre setting up and then assigning a stack to a user. the workflow sennds out Welcome Email - no  issues, then send another which requests user login from link and aos forces a password chaneg. This all works dandy, however, when I try and resend - email not sent when fleet re-assigned to user -FollowComment"

Answer: "1If the user is still assigned to the stack, assigning the user to the same stack again won't trigger the notification email.If you'd like to notify the user again via email,  you can unassign the user from the stack and re-assign the stack to the user.CommentShareQing_Lanswered a year ago"


Question: Boto3 Bug in response when creating a hosted zone in route53 with Python

"I had boto3 1.16.7 libraries and went to 1.23.24, to see if this could still be replicated.When I run the following code to create a hosted zone, I get a response that contains a call to the the datetime library as a value for the SubmittedAt key in the json/dictionary:  'SubmittedAt': datetime.datetime(2021, 12, 17, 16, 40, 21, 154000, tzinfo=tzutc()). This had caused some problems when I was trying to extract data, but I have worked around that.When I run this with the aws cli (aws route53 create-hosted-zone --name contoso.com --caller-reference 20211217), I get an expected value: "SubmittedAt": "2021-12-18T01:40:44.781000+00:00"Am I doing something wrong or is this a bug?Code:import boto3import datetime awsProfile = 'default'awsRegion = 'us-east-1'hostedZoneName = 'dev.contoso.com'timeStamp = datetime.datetime.now().strftime("%Y%m%d%H%M%S") boto3.setup_default_session(profile_name=awsProfile, region_name=awsRegion) client = boto3.client('route53') hostedZoneParams = {    'Name': hostedZoneName,    'CallerReference': timeStamp,} response = client.create_hosted_zone(**hostedZoneParams)print(response)Output:{'ResponseMetadata': {'RequestId': 'redacted', 'HTTPStatusCode': 201, 'HTTPHeaders': {'x-amzn-requestid': 'redacted', 'location': 'https://route53.amazonaws.com/2013-04-01/hostedzone/redacted', 'content-type': 'text/xml', 'content-length': '762', 'date': 'Fri, 17 Dec 2021 16:40:20 GMT'}, 'RetryAttempts': 0}, 'Location': 'https://route53.amazonaws.com/2013-04-01/hostedzone/redacted', 'HostedZone': {'Id': '/hostedzone/redacted', 'Name': 'dev.contoso.com.', 'CallerReference': '20211217114020', 'Config': {'PrivateZone': False}, 'ResourceRecordSetCount': 2}, 'ChangeInfo': {'Id': '/change/redacted', 'Status': 'PENDING', 'SubmittedAt': datetime.datetime(2021, 12, 17, 16, 40, 21, 154000, tzinfo=tzutc())}, 'DelegationSet': {'NameServers': ['ns-144.awsdns-18.com', 'ns-1956.awsdns-52.co.uk', 'ns-550.awsdns-04.net', 'ns-1307.awsdns-35.org']}}FollowComment"

Answer: "0This is the expected behavior as per the document, SubmittedAt will be datetime object.  Route53 - Boto3SubmittedAt (datetime) --The date and time that the change request was submitted in ISO 8601 format and Coordinated Universal Time (UTC). For example, the value 2017-03-27T17:48:16.751Z represents March 27, 2017 at 17:48:16.751 UTC.If you can share what problems you ran into because of that I might be able to figure out a solution for that.CommentSharehameedullahanswered a year agodevsecops a year agoThanks, I guess my question was not clear, I understand that that format is correct, but if you look at the second code block, you can see I am not getting a UTC time value. I am getting python code in the response from AWS:  'SubmittedAt': datetime.datetime(2021, 12, 17, 16, 40, 21, 154000, tzinfo=tzutc())} Unless you are telling me that datetime.datetime and tzinfo=tzutc() is part of ISO 8601 format.Share"


Question: AWS took money off my card ***2035 visa debit card and I want a refund immediately

"AWS took money off my card ***2035 visa debit card and I want a refund immediately£14.50 which was supposed to be covered by  US$100 AWS credit with my university in the UK, Anglia Ruskin University Cambridge.FollowComment"

Answer: 2You must create a support case ticket in the AWS Account that the transaction ocurred.Here is the link to the documentation on how to create a Support Case Ticket:https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentSharevtjeananswered 10 days agoEXPERTalatechreviewed 10 days ago


Question: Workmail misses to redirect to main receiver

"A mail coming from external big party/company to my company 3 receivers , A as main and B and C as CC. A, B and C är "groups" and mail is redirecting to an account in Workmail managing the final redirect to other external accounts for A, B and C according to set rules.A does not receive anything but B and C do.Another mail later sends redirection to A.In other cases the redirection for A, B and C works as for a number of other "groups" in our solution.What is this? A glitch? A missconfiguration? Does A have some special status?FollowComment"


Question: Can't modify RDS instance class

"HelloUsing AWS RDS Aurora (mysql 5.7 2.10.2), in ca-central-1. Currently a r5.4xlarge. Status is green/available.Trying to change the instance class as I'm usually doing on weekends, but I can't. Under DB Instance class, it says "This fields is required".. but textbox is completely empty, I don't see anything, no choice at all, even if I thick "Include previous generation classes".Is somebody anywhere of any issues in ca-central-1 ?ThanksFollowComment"

Answer: "1Accepted AnswerI've seen where the console would not populate the dropdown. Can you switch to another browser and see if the behavior is the same? Also try to change with the CLI, see: modify-db-instanceCommentShareEXPERTkentradanswered a year ago0Usually, vertical scaling should be straightforward, however, if you are selecting some of the new RDS instance types. You might have to check the upgrade path, it is usually the combination of engine version support to instance class type. That is just one aspect there could be more on how to troubleshoot to solve the above problem. Can you update your question with from which Instance class type to which Instance class type you are trying to upgrade along with current engine versionCommentSharevaibhavsrivastavaanswered a year ago0Finally, it was a GUI/browser thing. Today everything looks fine. Kinda weird.I was actually going from r5.4xlarge to a T3.medium.. to save money :)Thanks for your help !CommentShareAWS-User-8553943answered a year ago"


Question: Publish to IoT Thing from Lambda Javascript Example

Hi folks.  We have developed an IoT application and all is going great with the receiving of messages from our IoT Device to trigger Lambda's.  The next step is to Publish messages from a Lambda to the device using JavaScript.  I can successfully Publish back to the device using the Test option from the web console.  I can't seem to find JavaScript sample Lambda code that shows how to connect to a specific Thing and then Publish to it.  Would also need to understand the security required for the Lambda connection to the Thing (ie. does the Lambda have to load the same certificates used by the IoT Device).I appreciate any help.Thanks. Grant.FollowComment

Answer: 1You will need to use the NodeJs  SDK and import the  module IotData.Look at below and use the publish method to send data to the associated topic and payload:https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IotData.htmlhttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IotData.html#publish-propertyCommentShareEXPERTalatechanswered 4 months ago


Question: Codebuild build status to Lambda function

"Hey, I have a codebuild project what i want is when codebuild buid complete we can get the completion notification on lambda so through lambda i can start and stop the ECS fargate task.So is there any way to we can get codebuild build status ?Thanks in advance....FollowComment"

Answer: "1You can integrate AWS CodeBuild with many AWS services.This blog post shows you an example how to set up automated testing of pull requests using AWS CodeCommit, AWS CodeBuild, and AWS Lambda. In addition, it shows you how to set up a pipeline to automatically build your tested, approved, and merged code changes using AWS CodePipeline.Also refer to this GitHub repository mentioned in the blog post. There, you can find an example how to connect a CodeBuild project to a Lambda function to process the CodeBuild build state changes.CommentShareDmitry Balabanovanswered 4 months agorePost-User-5126011 4 months agoHi,I am using CloudWatch event to get the codebuild events to Lambda function. I am successfully getting the code build events in Lambda function. But now I want to start/stop ECS Fargate service task from lambda function only. For this I am using python boto3 library and able to get ECS services and task. So now I have ECS services & task and code build project name.So on what basis I start/stop particular ECS Fargate task of a particular codebuild project.Can I get ECS Fargate service from codebuild itself ? If this is possible then it's so easy to implement.Thanks in advanceShare1Yes you can create notifications to SNS (see https://docs.aws.amazon.com/codebuild/latest/userguide/notification-rule-create.html) then subscribe a Lambda function to process them.Note there's some common notifications management across all of the developer tools (CodeCommit, CodeBuild etc) in the Developer Tools Console.  It has some "Code*" / "CodeStar" branding in the underlying APIs.CommentShareEXPERTskinsmananswered 4 months ago0Is there any blog or post on that . So it will help me in doing the processCommentSharerePost-User-5126011answered 4 months agoDmitry Balabanov 4 months agoPlease note that you should post clarifying questions as comments, not as answers.Share"


Question: Aws private Link interface endpoint outbound rules

"Hi, To configure aws private link interface based endpoint to example use aws storage gateway endpoint services do I need to configure interface endpoint security group outbound rules to reach AWS?. Normally corporate security will not allow to open ephemeral ports outbound to reach AWS..2024-65535..Also there is no static public IP..so need to open for range of aws ip.Its a risky process..Any suggestions.?FollowComment"

Answer: "0Hi,With Privatelink interface endpoints, this will create an ENI (Elastic Network Interface) is the associated subnet that is chosen when you create the VPC endpoint.  These also have security groups attached to the VPC endpoint.  Security groups are stateful, so you can account for whatever access is needed and not be concerned with any return traffic (like NACLs for AWS VPCs).Some additional information around this topic is in they documentation located hereCommentShareAWS-User-0357409answered 2 months ago0Hi , I appreciate your response .So the interface endpoint act as entry point to reach aws endpoint service (producer ) . The actual storage gateway instance running on private subnet will receive the response from AWS endpoint services through the interface endpoint.With this scenario there is requirement to open 1026-1031 port in inbound in interface SG , its done .The private network is completely controlled by NACL . My storage gateway instance and interface endpoint in the same subnet , now security group side all clear . Related with NACL is I need to open  1026-1031  inbound or outbound level. Because there is return traffic coming from AWS into private subnet or it will work without opening any port in NACL . (Its custom NACL associated)also is ephemeral port needs to be allowed 1024-65535 in NACL?https://docs.aws.amazon.com/filegateway/latest/files3/gateway-private-link.htmlCommentSharerePost-User-7598473answered 2 months ago"


Question: Prevent Rewrite of Queries in Redshift

Is there any way to prevent Redshift from rewriting queries? It seems to be done random on data from S3 (external tables) without the query is changed in any way . Our reporting tool seems to have problems with these rewritten queries.FollowComment

Answer: 0The query optimizer rewrites queries to provide the best execution possible. If you believe that some incorrect and random query rewrite is causing negative impact then kindly open up a Support Ticket for further investigation.CommentShareMilindOkeanswered 9 months ago


Question: AWS S3 replication rules: Number of distinct destination bucket ARNs cannot exceed 22

"I trying to replicate/sync from a single bucket with many directories utilizing replication rules and filters, to many distinct bucket on another account.I got an error that said:"Number of distinct destination bucket ARNs cannot exceed 22"Why 22?There is a quota service for AWS S3 replication rule, that i could increase?FollowComment"

Answer: "0Accepted AnswerThere are 22 standard regions, excluding (China and GovCloud) that is the basis of the limit.What is the use case for replicating to so many buckets?CommentShareMichael_Kanswered a year agoIsaac Mecchi a year agoI'm creating a data pipeline and storing it in different buckets to organize the data logically in a single tenant way.ShareMichael_K a year agoYou would be able to achieve such with AWS Datapipeline. Have you looked into it yet?https://aws.amazon.com/premiumsupport/knowledge-center/s3-data-pipeline-transfer/Share0Is there a priority and filter for each rule?CommentSharerePostfanclubanswered a year agoIsaac Mecchi a year agoYes. For each one. I could not find s3 replication rule limit on documentation.Share"


Question: ec2 disconnects from the internet every month

"I have an ec2 instance of type t2.micro and I have a web service that communicates with services outside the server so it needs internet and I have noticed that internet connectivity is lost at least 1 time a month and I have to restart so that back to normal and I would like to solve that problem. It is worth mentioning that I have a load balancer for that server and a security certificate for my domain.FollowCommentMarc Schuricht a year agoWhen your instance disconnects from the internet, what errors are you seeing? How are you calling the external web service (port/protocol/address)?Share"

Answer: "0I understand lost internet connection as 2 possibilities:your EC2 can not reach out to internet : suggest check VPC flow logs to see if traffic is sent out, to confirm if it is EC2 issue(most likely ), if you can not find logs in VPC flow logs, most probably EC2 is not sending out packets, you can try tcpdump on EC2 to see what is happening.Your EC2 can not receive traffic from internet, in your case, it is your load balancer receives traffic from internet and forward to your EC2, you can check the healthcheck result from your load balancer to see if your EC2 port is functioning. you can also try to ping private IP's gateway address from EC2 to see if  IP path is OK or not.For both case I suspect EC2 issue, suggest next time you can take a look at EC2 logs , check memory usage, disk usage, any suspicious logs, etc...CommentShareAWS-User-5482937answered a year ago"


Question: Connect to RDS from basic SageMaker Studio domain?

"If you have a default SageMaker Studio domain, which has public internet access, I'm guessing you can't connect to an RDS instance that's in a private subnet? You'd have to create a new domain with the "Standard setup" instead of the "Quick Setup", right?Or can you actually connect from a SageMaker Studio notebook that doesn't have the "Standard Setup"? If so, how do you see its security group, so I can allow list that security group in the RDS instance's  inbound security group rules.FollowComment"

Answer: "0Hi,You can connect to an RDS instance in a private subnet from a SageMaker Studio Notebook, check this Document. There is also a blog. In both links, the SageMaker domain has an ENI inside the VPC, so it can communicate with other resources in the VPC. To configure the VPC and Networking settings, you have to follow the Standard Setup route.Assuming your database is in a private subnet and your SageMaker Studio Domain is too, the things to check are the following:Can your SageMaker Studio ENI reach your RDS Database endpoint? - If they are in the same VPC they will see each other, however there is a possibility of them being in different VPCs. In this case, you will need to have both VPCs connected, via VPC Peering, AWS Transit Gateway or PrivateLink plus NLB as described in this blog. Another option worth looking at would be to use RDSProxy for cross-account access as show in this other blog.Do your security groups allow the traffic? - The RDS instance must allow traffic from the Security Group of the SageMaker Studio ENI or its CIDR. In case you are peering VPCs, you can reference security groups of peered VPCs as explained in the AWS Documentation.Hope this helps!CommentSharejnavrroanswered 14 days agoyann_stoneman 14 days agoIt sounds like you're providing evidence to support the following answer to my question, "If you want to connect to an RDS instance located in a private subnet from a SageMaker Studio Notebook, the SageMaker Domain must be created with the Standard Setup. You cannot use the default domain, i.e., the Quick Setup." Is that correct?Sharejnavrro 13 days agoThat's correct. To have access to a private RDS instance, you need to have control over the VPC settings of the SageMaker Domain, and the only way is through the Standard Setup. Quick Setup does not allow you to control the VPC settings.Share0You are correct: As shown in the architecture diagrams on the blog post @jnavrro linked in his answer, The default (direct-to-Internet) Studio setup has notebooks accessing the Internet directly through SageMaker's own service accounts. This means your RDS instances would only be accessible from the notebook if they're accessible from the Internet.(It's worth mentioning that even in this mode there is still some VPC involvement: Because Studio uses Amazon EFS for user file storage and this must be provisioned inside a VPC in your account. However, this connection is used for the filesystem only: It doesn't give you a route for user code in the notebooks to access your VPC).So if you want to access private-subnet RDS databases (or EMR clusters, data warehouses, or other similar things!) from Studio, I'd suggest to provision a VPC-based SageMaker Domain through the standard setup instead.CommentShareEXPERTAlex_Tanswered 14 days ago"


Question: Transfer Family to FSx?

"Transfer Family supports S3 and EFS storage targets, but a project's requirement specifies up/downloaded files be available to Windows EC2 instances via SMB (specifically a FSx share). I would let the EC2 instances mount the EFS volume used by Transfer Family, but Microsoft says Windows NFS clients can only use NFSv2 or NFSv3.Since Transfer Family doesn't natively support FSx, is DataSync “between AWS storage services” the best way to support this workflow?As an added twist, we'll probably need to support both uploads (items that arrived via SFTP, consumed by the EC2 instances) and downloads (EC2 instance outputs a file, which will then be fetched by a remote user via SFTP) so we'll need to have bidirectional DataSync between the EFS and FSx volumes.FollowComment"

Answer: "0Hi ThereSince Transfer Family for FSx direct access over SMB is currently not supported, A workaround could be to run Managed Workflows on file upload over SFTP and use the workflow's custom step feature to invoke a DataSync API call to copy from EFS to FSxWin.Also take a look at this blog post for Enabling SMB access for serverless workloads with Amazon FSx which might give you some ideas for building some type of file watcher using Lambda to move the files from FSx to EFS for upload.CommentShareEXPERTMatt-Banswered 8 months ago"


Question: Custom IAM policy with custom IAM Actions

"I want to create a Custom I AM policy with custom IAM Actions.something like below:{     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Action": [                 "myCustomService:MyCustomAction",                 "myCustomService1:MyCustomAction1",             ],             "Resource": "*"         }     ] }I need this to control clients/ users/ clientApplication access to my application running in EKS cluster.thanks in advance.FollowComment"

Answer: "0i have added the following example please modify accordingly{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "eks:DescribeCluster",                "eks:ListFargateProfiles",                "eks:ListUpdates",                "eks:UpdateClusterVersion"            ],            "Resource": "arn:aws:eks:us-west-2:123456789012:cluster/my-cluster",            "Condition": {                "StringEquals": {                    "aws:userid": [                        "user1",                        "user2"                    ],                    "sourceArn": [                        "arn:aws:execute-api:us-west-2:123456789012:abcdefghij/*/GET/resource1",                        "arn:aws:execute-api:us-west-2:123456789012:abcdefghij/*/GET/resource2"                    ]                }            }        },        {            "Effect": "Allow",            "Action": [                "ecr:BatchGetImage",                "ecr:DescribeRepositories",                "ecr:ListImages",                "ecr:ListTagsForResource",                "ecr:PutImage"            ],            "Resource": "arn:aws:ecr:us-west-2:123456789012:repository/my-repo",            "Condition": {                "StringEquals": {                    "aws:userid": [                        "user1",                        "user2"                    ],                    "sourceArn": [                        "arn:aws:execute-api:us-west-2:123456789012:abcdefghij/*/POST/resource3",                        "arn:aws:execute-api:us-west-2:123456789012:abcdefghij/*/POST/resource4"                    ]                }            }        }    ]}CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: OpsWorks Stacks: We encountered an error while loading your data.

"Starting to learn OpsWorks Stacks but when I reach Step 2, this is what I see, I was already granted full access to an ec2 instance.FollowCommentzmedgyesi 13 days agoGo to the Users menu, select yourself with the pencil/edit command, and... in my case simply clicking to Save was enough.Share"


Question: Set consumer.isolation.level in MSK Connect (sink connector)

"I want to set up a MSK connect to listen to a topic where messages are transactionally published. To make the connector transaction-aware, I need to set up consumer.isolation.level for the workers (or enable client overrides in the worker configuration and then use consumer.override.isolation.level in the connector config). However, connector.client.config.override.policy and consumer.isolation.level are not allowed in MSK worker configuration: https://docs.aws.amazon.com/msk/latest/developerguide/msk-connect-workers.html.How do I make the MSK sink connector transaction-aware?FollowComment"


Question: OpenSSL v3 vulnerability: Are all ECS-optimized AMIs affected or just the Amazon Linux 2022 based ones?

"https://aws.amazon.com/security/security-bulletins/AWS-2022-008/saysCustomers utilizing Amazon Linux 2022, Bottlerocket OS or ECS-optimized Amazon Machine Images (AMIs) on Amazon ECS should read the instructions below.Which sounds like all ECS-optimized AMIs are affected. However, the recommendation is:we recommend that ECS customers update the version of OpenSSL 3.0 via DNF configuration.To my understanding, DNF is only available on Amazon Linux 2022.Checking the version of openssl in one of our instances that run an Amazon Linux 2 based ECS-optimized AMI, I get:sh-4.2$ openssl versionOpenSSL 1.0.2k-fips  26 Jan 2017Can I consider Amazon Linux 2 based ECS-optimized AMIs to be unaffected by CVE-2022-3602 and CVE-2022-3786?FollowComment"

Answer: "0Accepted AnswerThank you for the detailed description.Yes, ECS-optimized Amazon Linux 2 AMI is not affected as OpenSSL 3.0 is not shipped in this version, as also per your openssl version command output and this quote Amazon Linux 2 do not ship with OpenSSL 3.0 and are not affected by these issues from https://aws.amazon.com/security/security-bulletins/AWS-2022-008/.CommentShareweidianswered 7 months ago"


Question: "Can I send a logfile, generated by an local application (outside AWS) to cloudwatch?"

Its a PowerShell script that continuously generates performance monitoring data. It runs on a client to monitor the performance on an end-user device.Any chance I can add the results to cloudwatch?FollowComment

Answer: "0You can do try the following steps:Install Cloudwatch Agent on the Windows Server. Create the CloudWatch Agent Configuration File with the Wizard Edit the CloudWatch agent configuration file: Logs section - log_collected field, to send the result file to CloudWatchCommentShareronald_lanswered 5 months agorePost-User-9645409 5 months agoHi Ronald, thanks. I have read these resources, but can't seem to find the answer I am looking for.Allow me to explain a bit further:I have a script that is testing performance of my app (which is hosted on AWS) on my client. Every few minutes, a few tests run, and then a log file – entry is generated, which contains a timestamp and 3 numerical values.I would like to display how these values vary over time, as a chart in CloudWatch.If that is possible with the agent:how can I configure the agent, that it reads the log file every n minutes and sends the timestamp and the values to CloudWatch?What format and structure does the log file need to have? (I can customize the log file and the data-structure in it, in any way the agent needs, I just need to know how it's expecting the data.)How do I configure cloud watch to display these values in a chart?Thanks!Share0Hello,AWS has a Powershell module for invoking API calls. The Cmdlet used for publishing logs to CloudWatch is Write-CWLLogEvent. More information about what the API call does can be found on the CLI documentation.To create visualization of the log data you can use metric filters.. This will create a metric every time a new log entry meets the pattern you create.CommentSharevbrownellanswered 5 months ago"