Question: Postgres RDS Multi AZ DB Cluster - Multiple Databases.

"Can we create multiple databases in one instance of Postgres RDS Multi AZ DB Cluster. AWS Console does not allow specifying the initial DB name for this option.  If yes, possible, Please share the reference document or CL detailsFollowComment"

Answer: "0Yes, sure.  https://aws.amazon.com/rds/faqs/  You can create as much as your workload could suffer.CommentShareLihu Wuanswered 3 months agorePost-User-9685715 3 months agoThanks. Can you please point me to any document covering this? AWS Console does not provide the option to specify the Initial DB name for Multi AZ DB Cluster. Also I could not find any CLI supporting this.ShareLihu Wu 3 months agoYou have to use client or sdk connect to the instance and create it by using DDL.Share0Hello, Yes you can create multiple databasesCommentSharegokul_Ganswered 3 months ago"


Question: SageMaker notebook instance in VPC failed to connect to local database

"hi there,I am setting up a jupyter notebook in SageMaker within the VPC and using the jdbc jars to connect to the local database. But it shows the following error messages.": com.microsoft.sqlserver.jdbc.SQLServerException: The TCP/IP connection to the host xxx.xxx.xxx.xxx, port 21000 has failed. Error: "connect timed out. Verify the connection properties. Make sure that an instance of SQL Server is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by a firewall."."I used the exactly the same VPC, subnet, security group as what i used in a glue job to extract the data from the local db. While the glue job works but the SageMaker notebook failed. I am sure the firewalls are opened.Could anyone tell me how to solve it?I also came across the following articles, but i am not sure if it is the root cause.https://aws.amazon.com/blogs/machine-learning/understanding-amazon-sagemaker-notebook-instance-networking-configurations-and-advanced-routing-options/FollowComment"

Answer: "0Accepted AnswerHi,The principle here is that there much be network connectivity between the Notebook Instance and the DB Instance, and the security groups on the DB Instance should allow in-bound traffic from the Notebook InstanceOne example of such as setup isRDS DB Instance is VPC vpc-a and Subnet subnet-b.SageMaker Notebook is launched in VPC vpc-a, Subnet subnet-b, with Security Group sg-c with DirectIntenetAccess "Disabled"In the RDS DB Instance's Security Group rules, you can add an Inbound Rule to allow inbound traffic from the SageMaker Notebook security group "sg-c"-- Type - Protocol - Port Range - Source-- MYSQL/Aurora - TCP - 3306 - sg-cSample Code:! pip install mysql-connectorimport mysql.connectormydb = mysql.connector.connect(host="$RDS_ENDPOINT",user="$RDS_USERNAME",passwd="$RDS_PASSWORD")cursor = mydb.cursor()cursor.execute("SHOW DATABASES") Thanks for using Amazon SageMaker and let us know if there's anything else we can help with!Edited by: JaipreetS-AWS on May 6, 2019 3:04 PMCommentShareAWS-User-2256160answered 4 years ago"


Question: Build numbers in application title

"So to have build numbers in the application, I used to change the LUMBERYARD_VERSION inside dev/waf_brach_spec.py, however this triggers a full rebuild for the whole solution.Does anyone of you have a better idea on how to have an iterating build number to identify which version you are on currently?Follow"

Answer: "0Accepted AnswerHey @REDACTEDUSERBecause the build number is tied to the .exe, you will have to rebuild in order to see the number change in the title bar. You can continue to update the build in the waf_branch_spec.py file, or some other options might be to set it in the WAF/user_settings.options file, or via command line when you are building.Sorry this slows down your iteration times, it's something I can put in as a request for a better solution though.SharerePost-User-7951591answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago0Best explained with an image (dont mind my photoshop skills):REMOVEDUPLOADSo I would like to have a trailing build number in the title bar of the launched game.I was able to achieve this with editing the Version in the waf_brach_spec.py file.However, this made a full rebuild of the game necessary which is not great for CI (because even with IncrediBuild, full rebuilds are quite time consuming).Is there a better way to get a trailing build number in the title bar, so I can track which build I get from the CI system?SharerePost-User-5460328answered 6 years ago0Hey @REDACTEDUSERJust wanted to get more clarification on what you were trying to accomplish.Are you trying to adjust the build number that displays on the splash/loading image for Lumberyard when you first launch the Editor? Just the title bar specifically? Or all locations where the build number would be displayed in the Editor?SharerePost-User-7951591answered 6 years ago0Hey @REDACTEDUSERDon't worry, we won't judge your programmer art, but thank you for the example and clarification. Let me find out if there is a different way to achieve this aside from the waf_branch_spec.py file.SharerePost-User-7951591answered 6 years ago0I thought about putting it int he usersettings file, but it would just simply put the latest change list number into that file (or the build number of the build system), but that does not mean that there was a new build.We revert unchanged files in perforce, before we submit it, to make sure it is actually a new Editor.exe and a new GameLauncher.exe. And only then we submit. However we would always commit something then (the change of the build number) but the executables didnt change and were reverted.Tl;dr: Build numbers in a text file dont work for us :(Thanks for clarification, we have to see how we adapt to that!SharerePost-User-5460328answered 6 years ago"


Question: Manual changes alerts

"Using IaC in our accounts, we want to set up alerts for manual resource changes. We tried the EventBridge option. It does not suit us because the "anything-but" option only supports one prefix (in our case there are three of them such as "terraform", "aws-sdk-nodejs", "packer") and does not support regex.The CloudWatch option is not suitable because we want to receive detailed information in an alert (resource ID, address in case of changes in security groups).Any other solutions?FollowComment"

Answer: "0For CloudFormation based stacks, you could run a drift-detection and emit a custom metric and alert should drift be found. To automate the process, you could set up a custom AWS Config rule to run the drift detection.CommentShareAaron Doddanswered 8 months ago0I meant not tracking drift statusterraform was introduced relatively recently in our infrastructure, before that it was deployed through a self-written platform on nodejsRight now we want to monitor security group and vpc for manual changes (someone went into the console and changed it manually)in the eventbridge solution, we tracked userAgent through exclusions (we excluded terraform, our deployment platform)as I wrote above, the solutions of eventbridge and cloudwatch alarm are not suitable for usCommentSharerePost-User-8709928answered 8 months ago"


Question: IAM Policy Condition with Role Session Name

"Is there a way we can restrict the access to AWS resources for certain user ids through an assumed role session name ? Something like below ?{  "Sid": "VisualEditor1",  "Effect": "Allow",  "Action": [      "ec2:*"  ],  "Resource": "arn:aws:ec2:*:1234567890:*",  "Condition": {      "StringEquals": {          "aws:PrincipalArn": "arn:aws:sts::1234567890:assumed-role/accounting-role-name/kalmesh@xyz.com"      }  }}I tried multiple combinations for StringEquals and aws:PrincipalArn fields but didn't get it working.FollowCommentalatech EXPERT4 months agoWould below condition work?     "Condition": {        "StringEquals": {          "aws:username": [            "username1",            "username2"          ]        }      }Share"

Answer: "0According to the reference guide StringEquals will limit the value to be a string with exact matching, case sensitive. (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) Instead you can try to use Amazon Resource Name (ARN) condition operators such as:"ArnNotLike": {"aws:PrincipalARN": ["arn:aws:iam::*:role/AWSControlTowerExecution"]}CommentSharebullittbirantanswered 4 months agokalmesh 4 months agoBoth the options suggested above doesn't work for assumed role. It still gives me the same error message"User: arn:aws:sts:: 1234567890:assumed-role/accounting-role-name/kalmesh@xyz.com is not authorized to perform.....because no identity-based policy allows...."Sharebullittbirant 4 months agoAre you trying to attach the policy that you mention above to your accounting-role-name role? What kind of action(s) are you taking to test it? Are you working in a single account or multiple accounts? Are there any other policies that may be blocking your action(s) such as Service Control Policies?Share"


Question: Do Windows WorkSpaces and AppStream qualify for FSLogix by default?

"According to the Microsoft site: https://docs.microsoft.com/en-us/fslogix/overview#requirementsYou are eligible to access FSLogix Profile Container, Office 365 Container, Application Masking, and Java Redirection tools if you have one of the following licenses:Microsoft 365 E3/E5Microsoft 365 A3/A5/ Student Use BenefitsMicrosoft 365 F1Microsoft 365 BusinessWindows 10 Enterprise E3/E5*Windows 10 Education A3/A5Windows 10 VDA per userRemote Desktop Services (RDS) Client Access License (CAL)Remote Desktop Services (RDS) Subscriber Access License (SAL)FSLogix solutions may be used in any public or private data center, as long as a user is properly licensed.FSLogix tools operate on all operating systems newer than, and including:Desktop - Windows 7Server - 2008 R2Since the RDS CAL is included, and the OS is Server 2008 or later, then FSLogix is licensed on all Amazon WorkSpaces and Amazon AppStream 2.0 implementations.Is that correct or am I missing something?FollowComment"

Answer: "0Accepted AnswerYes, I believe you are correct. As you mentioned, for AppStream 2.0 or Workspaces, the customer is receiving an RDS Cal license when they are using license included options and the Microsoft docs state that you are eligible to use FSLogix with an RDS CAL license.  I have customers who have been actively using FSLogix in AppStream 2.0 for awhile with this understanding.For BYOL options, I think it's the same situation. AppSteam 2.0 customers can bring their own RDS CAL license (still eligible to use FSLogix). WorkSpaces users can bring a Windows 10 VDA per user or Enterprise license.By the way, I published a blog about setting up FSLogix in AppStream 2.0 if you have a customer planning on doing that.CommentShareEXPERTSpencerAtAWSanswered 3 years ago"


Question: How to read the Client Context sent with a POST request to the Lambda API Invoke?

"Hi community!I want to send a POST request using the Lambda API's Action "Invoke" (Here's the docs on how to configure this API call: https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_RequestSyntax).The problem is that I also want to send some base64-encoded client context ( e.g {"message": "Hello World"}), but I don't know how to read this data from my lambda function code. I thought it was supposed to be found in the "context" object of my lambda handler, but seems it's not.FollowComment"

Answer: "0Lambda functions receive two parameters: Event object and Context object. The event object contains all the information about why it was triggered. The context object contains different run-time information, e.g., request ID. Most customers don't use the context object.When you invoke the function using the Invoke API, the event object will contain the payload that you send in the API call. Usually clients will not invoke the function directly. They will use other services to invoke the function, e.g., API Gateway to expose a REST API that invokes the function for every API call. In this case, when API GW invokes the function, the payload will include the entire REST request, including all the headers, body, etc.CommentShareEXPERTUrianswered 5 months ago"


Question: Permissions Issue - Can I use Instance Profile?

"POSTED IN ERROR, Please see other issue same title.Edited by: justgetmeon on Jun 3, 2019 10:20 AMFollowComment"

Answer: 0DUPLICATE POSTCommentShareAWS-User-9045506answered 4 years ago


Question: How to install amazon code deploy agent in AMAZON LINUX 2023 AMI

I'm trying to install code deploy agent. As prerequisite code deploy requires ruby. When i tried to install ruby using this command yum install ruby  it has 3.2 version. but code deploy agent do not support 3.2. Is there any other way to install code deploy agent.FollowComment

Answer: 0CodeDeploy Agent v1.6.0 with support for Ruby 3.2 and AL2023 is in the process of release at this moment.  We estimate the release process will be completed for all commercial regions by April 7th 2023.Please use this new version with AL2023.Here is how to update your CodeDeploy Agent: https://docs.aws.amazon.com/codedeploy/latest/userguide/codedeploy-agent-operations-update.htmlCommentShareMichael Choianswered 2 months ago


Question: S3 Object Lock and incomplete uploads.

Say you want to upload a bunch of really large files. However somewhere in between the upload something goes wrong. The files don't complete.The whole thing is a mess so you just want to start over. If you set up the bucket with Object Lock in Compliance mode. You're pretty much just going to have to eat the costs for the durations of the retention period? Am I understanding this correctly?Do you guys have any advice for dealing with these situations? This is for backups I am currently using Amazon S3 (not Glacier). Perhaps I should be using Amazon S3 Glacier with Vault lock instead. But I'm not as familiar with it as I've never used it before.Is there a better way to handle this situation? Ultimately I want the files to be immutable after I upload them. But I wouldn't mind if it waited until the upload finished.(SEPARATE QUESTION) Another problem I run into is my S3 Browser uploads everything as "Standard". When I change everything to Glacier Deep Storage it redownloads the data again. While also creating a separate version still in Standard. Am I going to be charged for both? And if so is there any way to avoid this besides  using the funky browser upload? (That is how I got the messed up original upload)So in summation:How does Object Lock handle incomplete uploads. Is there anyway to delete them after you uploaded them.Is there a better way to apply a different storage tier to an Object Locked S3 Bucket. Besides uploading it twice or using the browser.Thank you!FollowComment

Answer: "0This doesn't answer your question, but it might save you some money.  If you're doing multipart uploads to S3, you need to know to create a lifecycle rule that deletes failed multipart uploads from each bucket that you upload to.  Here's a document on how to do that.  I don't think you need to wait 7 days for it to take effect though.  You might want to choose a shorter time frame.  https://aws.amazon.com/blogs/aws-cloud-financial-management/discovering-and-deleting-incomplete-multipart-uploads-to-lower-amazon-s3-costs/CommentSharejschwar313answered 8 months agojschwar313 8 months agoIf you do find you're being charged for multipart failed uploads, you can request a refund from AWS.  Just open a case and tell them which buckets you were uploading to and how far back this uploading was being done and they will take care of it.Share"


Question: LightGBM on SageMaker

"I have a customer who wants to install LightGBM on SageMaker notebooks, as they are currently using it outside of SageMaker.Right now, they are interested in the ability to SSH into the instance, but it would be great if we could provide them a way to install LightGBM right now.CheersFollowComment"

Answer: "0Accepted AnswerIt's possible to do, I have used it myself for gradient boosting, from within Jupyter you can simply run:!conda install -y -c conda-forge lightgbmWithin a selected conda environment. No terminal access is needed, however it must be done, On the top right of the Jupyter notebook you can choose a terminal environment which will give you a shell to the backend instance and you can install there.However if you want the notebook to be immutable/transferable you can do the install within the notebook .ThanksCommentShareEXPERTAmr_Ranswered 5 years ago"


Question: Greengrass v2 - deployment status check with EventBridge

"Hi there,How can i set up the EventBridge so that it can catch the ggv2 deployment status events and trigger a lambda.FollowComment"

Answer: "1Accepted AnswerHi. GGv2 doesn't support deployment notifications to EventBridge at this time.If you are deploying to a Thing group, you can enable Jobs events and setup an IoT Rule for topic $aws/events/jobExecution/# to action the deployment outcome of each core device.CommentShareEXPERTGreg_Banswered a year ago"


Question: Use Customerdisplay name in amazon connect contact flow

"I am trying to built some logic using "customerDisplayName" which is used to pass customer name  from the chat widget to my amazon connect contact flow. However, I am unable to find the attribute /variable in contact flow so that I can build some logic around it. How do I access this customer attribute in contact flow ?Any help is much appreciated.FollowComment"

Answer: "0customerDisplayName is not available as a contact attribute, but you can pass the same value to a user-defined contact flow attribute.  See the following link in the admin guide for instructions on passing contact attributes: https://docs.aws.amazon.com/connect/latest/adminguide/pass-contact-attributes-chat.htmlCommentSharegthomasanswered a year ago"


Question: amazon account hacked and generating money charges

"Hello, on saturday 06/04 my account was hacked by an error when I published a password in a public repository, when I received the change email, I deleted all keys and roles, as well as aws users, I changed the password of the account, and changed my email password, actrive MFA with the phone, I stopped all services that were started (apparently for mining with EC2) and checked everything, However, the account is still violated, currently with a charge of 40 usd of something I never use and I fear it will continue to rise, I already sent a case in review, attached images, but no one solves the problem, I want to delete the account, I want to unlink my data, every hour that passes I feel that more charges will be generated, more services initiated, EVERYTHING.besides if i close the account, the charge will remain open and will arrive to my address, a charge that i never used, i only had the account for educational purposes. this is totally frustrating, i talked to support but they take 2 days to answer every message, and every second that passes a new active service is generated....I do not know what to do, I have seen cases where they reach 10k of debt, and I do not want to reach that, I am a student, I can not pay, and above all, I can not pay something that does not correspond to me, my account was HACKED, it is as simple to verify my innocence as to see from where the requests are made, instance creations, accesses. and see that does not correspond with my country and address registered in the AWS account...PLEASE I NEED HELP.FollowComment"

Answer: "0Alright.If you made sure you are currently the only one that can access the account you can control the cost generated from this point onwards.remove all usersremove all access keysThere might be scripts in place that automatically instantiate costly services:delete any EventBridge rule (all regions)delete any Lambda (all regions)Monitor Cost Explorer daily to minimize additional costs.try seeing what generates the cost and shut it down.Don't worry too much. If you file a support case AWS Support often will waive any costs. (If it is the first time this happens, and cost are relatively low).You also have to understand that AWS can't tell the difference between your account being hack or that you willingly handed them a password.CommentShareJaccoPKanswered a year ago"


Question: Not recognizing Queries service of Textract

"I have an issue with not recognizing the Query service of Textract on AWS. The image is built and deployed with the SAM framework, it's interesting that without using SAM the Query service works in the pure local docker container. The Forms service of Textract works in both scenarios.These are the versions of libraries that I used:Base image public.ecr.aws/lambda/python:3.9 with the following version of SDK:boto3:          1.24.35botocore:     1.27.35This is the error:"Unknown parameter in input: "QueriesConfig", must be one of: Document, FeatureTypes, HumanLoopConfig"Also, there are 2 similar questions here on the forum from 2 months ago that point to a similar issue that is still not resolved.Can you help us with this issue?Thank you!FollowCommentAlex_T EXPERT10 months agoJust to clarify, did you already check at the point of use (e.g. print(botocore.__version__))? According to the boto3 and botocore changelogs, this feature should be supported... So my guess is your upgraded boto3 installation is being shadowed by the runtime default boto3==1.20.32. In SAM, are you upgrading your function's boto3 via requirements.txt? are you building with --use-container?ShareMLExpert 10 months ago@Alex_T, It seems that you are right about the default runtime, the print function shows:Botocore: 1.23.32 and Boto3: 1.20.32.Do you know how I can change priority or default runtime for AWS SDK ? Thanks.Btw, I'm using Poetry for dependency management and sam build --use-container as building command.Share"

Answer: "0Hi, could you verify your boto installation version within your installed Python? It is probably related to an old version of boto hence does not support Query. If there are mulitple versions of boto installation, you can also check and update your PYTHONPATH to point to the right version. Thanks.CommentShareAWS-User-0574899answered 10 months agoMLExpert 10 months agoThe print function shows Botocore: 1.23.32 and Boto3: 1.20.32.How should I find the right python path for the appropriate botocore ? Interactive container? Thanks.Share"


Question: rsyslog configuration: sending but not receiving

I would like to get my on-demand ami instances using rsyslog to ship application log messages to my middleware (also  an AWS ami).  The messages are generated by our analysis application which is using logback.I have the necessary re-configurations in my UserData init scriptsystemctl stop rsyslogprintf "%s\n" '""" _ rsyslogForward(ACCSERVER) _ """' | sed 's/__/"/'g >> /etc/rsyslog.d/loghost.conf;printf "& stop\n" >> /etc/rsyslog.d/loghost.confsystemctl start rsyslogand I'm hopeful that will work.  Meanwhile I'm testing from a static linux instance which can see ACCSERVER (At least it can hit the port of the custom service running there on 15002) with the following in /etc/rsyslog.d/loghost.conf usinglocal3.info action(type="omfwd" target="10.0.2.28" port="514" protocol="tcp"** action.resumeRetryCount="100" queue.type="linkedList" queue.size="10000")**& stopThe log server (10.0.2.28) has this directive in it's /etc/rsyslog.d/50-sgs.conflocal3.info /var/log/sgs.log& stopand tcp enabled in rsyslog.conf# Provides TCP syslog reception$ModLoad imtcp$InputTCPServerRun 514Include all config files in /etc/rsyslog.d/$IncludeConfig /etc/rsyslog.d/*.confOn the static instance (source of messages) I can turn the "stop" directive off an on and respectively I get/don't get my tests in /var/log/messages.  From this I take it that I'm sending log messages /somewhere else/ when I have the stop enabled.  But the tests never make it the servers log files: not in /var/log/messages nor the custom /var/log/sgs.log.  I've restarted rsyslog on both machines (over and over).  /var/log/sgs.log exists and accepts test messages from localhost[root@ip-10-0-2-28 ]# logger -p local3.info test SGS3TEST message[root@ip-10-0-2-28 ]# grep SGS3TE /var/log/sgs.logDec  6 23:49:47 ip-10-0-2-28 ec2-user: test SGS3TEST messageAny help appreciatedFollowComment

Answer: "0I was missing the fact that the port had to be opened for the security group, not just the bare metal. There's a web page for it.CommentSharesegmentedanswered 3 years ago"


Question: Date Back EC2 Instance

"Hi, I'm hosting my WordPress website using the EC2 Instance right now. Something went wrong on my website yesterday and I'm not able to fix it. Unfortunately, I haven't made any backups as well. So, I just wanted to ask if there's a way to date the instance back to a past date like maybe March 7th or 6th? Any help would be appreciated. Thank you!FollowComment"

Answer: "1Unfortunately not, if you haven't been utilizing backups or snapshots, you cannot restore state to a previous timeline.I would suggest for future avoidance of such issues you take a look at the AWS Data Lifecycle Manager or AWS Backuphttps://docs.aws.amazon.com/dlm/index.htmlhttps://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.htmlWhat kind of issue are you having Wordpress though?CommentShareEXPERTRob_Hanswered a year agoJimmy a year agoLooks like I'm screwed :(Share"


Question: Dynamo DB stream event type mismatch with Dynamo DB unmarshall function in Typescript

"I'm trying to handle Dynamo DB stream events in a Lamdba function written in TypeScript. My code is something like this:import { DynamoDBStreamEvent } from 'aws-lambda'import { unmarshall } from '@aws-sdk/util-dynamodb'const handler = async (event: DynamoDBStreamEvent): Promise<void> => {  for (const record of event.Records) {    if (record.dynamodb?.NewImage) {      const newImage = unmarshall(record.dynamodb.NewImage)      // not relevant from this point on...    }  }}The problem is, I get a type mismatch on the line, where unmarshall is called:Argument of type '{ [key: string]: AttributeValue; }' is not assignable to parameter of type 'Record<string, AttributeValue>'.  'string' index signatures are incompatible.    Type 'AWSLambda.AttributeValue' is not assignable to type 'import("/path/to/project/node_modules/@aws-sdk/client-dynamodb/dist-types/models/models_0").AttributeValue'.      Property '$unknown' is missing in type 'AttributeValue' but required in type '$UnknownMember'.ts(2345)models_0.d.ts(5057, 9): '$unknown' is declared here.(property) StreamRecord.NewImage?: {    [key: string]: AttributeValue;}That is, the NewImage in the DynamoDBStreamEvent is declared in package @types/aws-lambda and uses an AttributeValue type defined there, while the unmarshall expects the data using type AttributeValue defined in package @aws-sdk/client-dynamodb, and those types are not compatible.In practice, both of these different AttributeValue types define the Dynamo DB JSON format, but they are incompatible according to TypeScript typing.I can workaround this by changing the unmarshall call to:      const newImage = unmarshall(record.dynamodb?.NewImage as any)and it works - it unmarshalls the DynamoDB JSON format to my native JSON format correctly - but that defeats the purpose of typing. Is there any more correct way of handling this situation, or is this a bug?FollowComment"


Question: SES Massmailing log not working

"Hello AWS Support Team,We have recently noted down the sudden spike in our outgoing email traffic today. We have enabled the logging on our AWS SES using the SNS but surprisingly, we are not be able to received any events on the same. We are able to receive the emais for all other standard email operations on configured email address.  We would like to know the reason behind the same. Also, can you please let me know, from which particular IP this event is happening and can you please share your suggestions about blocking those ip permanentntly for the SES communication channel.We are not getting logs when mass mailing happens in our account.Thank you,FollowComment"

Answer: "0Hello Team,Can anyone help me in this caseThank youCommentSharerePost-User-1085830answered 4 months ago"


Question: Cloudformation Designer Bugs?

"The following document says that when a Subnet is placed in a VPC area, a reference to the VPC is automatically inserted into the Subnet's Properties, but even after this operation, the Subnet does not reference the VPC.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/working-with-templates-cfn-designer-walkthrough-createbasicwebserver.html#working-with-templates-cfn-designer-walkthrough-createbasicwebserver-resourceproperties:~:text=AWS%20CloudFormation%20Designer%20automatically%20added%20the%20VPC%20ID%20property%20when%20you%20dragged%20the%20subnet%20inside%20the%20VPC.FollowComment"

Answer: "0HiThanks for pointing out that the bug related to property not getting updated.  However, I would like to point out that there are two small circles which denotes the dependency. The blue circle denotes subnet network acl association and the orange circle denotes that subnet depends on vpc. Please populate the VpcId property in subnet to continue with successful creationCommentShareEXPERTAWS-User-7407181answered 7 months ago"


Question: Cannot create S3 Backup using AWS Backup

"I am trying to make an S3 Backup using AWS Backup.The error message I'm getting is (I have deliberately changed the bucket name and account number)Unable to perform s3:PutBucketNotification on my-bucket-name-123 The backup job failed to create a recovery point for your resource arn:aws:s3:::my-bucket-name-123 due to missing permissions on role arn:aws:iam::123456789000:role/service-role/AWSBackupDefaultServiceRole.I have attached the inline policies described in the documentation to AWSBackupDefaultServiceRole(note: the role also contains the AWS managed policy AWSBackupServiceRolePolicyForBackup as well as the following){  "Version":"2012-10-17",  "Statement":[    {      "Sid":"S3BucketBackupPermissions",      "Action":[        "s3:GetInventoryConfiguration",        "s3:PutInventoryConfiguration",        "s3:ListBucketVersions",        "s3:ListBucket",        "s3:GetBucketVersioning",        "s3:GetBucketNotification",        "s3:PutBucketNotification",        "s3:GetBucketLocation",        "s3:GetBucketTagging"      ],      "Effect":"Allow",      "Resource":[        "arn:aws:s3:::*"      ]    },    {      "Sid":"S3ObjectBackupPermissions",      "Action":[        "s3:GetObjectAcl",        "s3:GetObject",        "s3:GetObjectVersionTagging",        "s3:GetObjectVersionAcl",        "s3:GetObjectTagging",        "s3:GetObjectVersion"      ],      "Effect":"Allow",      "Resource":[        "arn:aws:s3:::*/*"      ]    },    {      "Sid":"S3GlobalPermissions",      "Action":[        "s3:ListAllMyBuckets"      ],      "Effect":"Allow",      "Resource":[        "*"      ]    },    {      "Sid":"KMSBackupPermissions",      "Action":[        "kms:Decrypt",        "kms:DescribeKey"      ],      "Effect":"Allow",      "Resource":"*",      "Condition":{        "StringLike":{          "kms:ViaService":"s3.*.amazonaws.com"        }      }    },    {      "Sid":"EventsPermissions",      "Action":[        "events:DescribeRule",        "events:EnableRule",        "events:PutRule",        "events:DeleteRule",        "events:PutTargets",        "events:RemoveTargets",        "events:ListTargetsByRule",        "events:DisableRule"      ],      "Effect":"Allow",      "Resource":"arn:aws:events:*:*:rule/AwsBackupManagedRule*"    },    {      "Sid":"EventsMetricsGlobalPermissions",      "Action":[        "cloudwatch:GetMetricData",        "events:ListRules"      ],      "Effect":"Allow",      "Resource":"*"    }  ]}This to me, looks correct and it not should be giving that error.Is there a bug? Or is there a step which is not described in the documentation? I would really appreciate some help.Many thanksFollowComment"

Answer: "0Hi there, I understand you want to create an S3 backup using AWS backup but you are unable to.Please correct me if I misunderstood.The error mentioned on the notes occurs if the S3 bucket you are trying to backup has a faulty S3 event notification.You can use the Amazon S3 Event Notifications feature to receive notifications when certain events happen in your S3 bucket.S3 offers link [1] and [2] APIs that allows you to interact with the s3 event notification feature.I recommend you check :-Ensure that all the current S3 event notification destination still exists.-Check that all the current S3 event notification destination have a valid resource based policy.-Ensure that the KMS Key policy is valid for KMS encrypted topics and queues.For the policies follow for necessary permissions please use this link [3]-Add s3:PutBucketNotification to the policy arn:aws:iam::123456789000:role/service-role/AWSBackupDefaultServiceRole-Lastly ensure that the Bucket Resource Policy is not restrictiveI hope this was helpful.Reference[1]https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotificationConfiguration.html[2]https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotificationConfiguration.html[3]https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html#key-policy-sns-sqs[4]https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html#sns-topic-policy[5]https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html#sqs-queue-policyCommentShareKaraboanswered a year ago"


Question: What is the SPEKE v2 response "cpix:HLSSignalingData" tags looks like?

"I'm developing a DRM key server for SPEKE v2.I'm not sure what values should the "cpix:HLSSignalingData" tags be set  for CMAF AppleHLS.I tried to encrypt the contents with two keys. One for video track another for audio track. But MediaPackage sent me an error message as bellow.It looks like the attributes for EXT-X-SESSION-KEY are incorrect...."MediaPackage Key Provider Notification",..."detail":{"event":"KeyProviderError","message":"[SPEKE v2]:KeyProviderEKE::RequestKeys: failed:-Invalid #EXT-X-SESSION-KEY value found in HlsSignalingData [#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="skd://3f94e259-8e64-4c74-b4c0-d5409e58272a",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSION="1", IV=0x61314bbd61221436ad397c99a1f3e50a] Response code [200]Response ...The whole "cpix:DRMSystemList" tag I replied to MediaPackage is as bellow.<cpix:DRMSystemList><cpix:DRMSystem kid="3f94e259-8e64-4c74-b4c0-d5409e58272a" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2"><cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU1NJT04tS0VZOk1FVEhPRD1TQU1QTEUtQUVTLFVSST0ic2tkOi8vM2Y5NGUyNTktOGU2NC00Yzc0LWI0YzAtZDU0MDllNTgyNzJhIixLRVlGT1JNQVQ9ImNvbS5hcHBsZS5zdHJlYW1pbmdrZXlkZWxpdmVyeSIsS0VZRk9STUFUVkVSU0lPTj0iMSIsSVY9MHg2MTMxNGJiZDYxMjIxNDM2YWQzOTdjOTlhMWYzZTUwYQ==</cpix:HLSSignalingData><cpix:HLSSignalingData playlist="media">I0VYVC1YLUtFWTpNRVRIT0Q9U0FNUExFLUFFUyxVUkk9InNrZDovLzNmOTRlMjU5LThlNjQtNGM3NC1iNGMwLWQ1NDA5ZTU4MjcyYSIsS0VZRk9STUFUPSJjb20uYXBwbGUuc3RyZWFtaW5na2V5ZGVsaXZlcnkiLEtFWUZPUk1BVFZFUlNJT049IjEiLElWPTB4NjEzMTRiYmQ2MTIyMTQzNmFkMzk3Yzk5YTFmM2U1MGE=</cpix:HLSSignalingData></cpix:DRMSystem><cpix:DRMSystem kid="56a52cd0-10b3-4830-a9f4-6ae3a8e26ccb" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2"><cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU1NJT04tS0VZOk1FVEhPRD1TQU1QTEUtQUVTLFVSST0ic2tkOi8vNTZhNTJjZDAtMTBiMy00ODMwLWE5ZjQtNmFlM2E4ZTI2Y2NiIixLRVlGT1JNQVQ9ImNvbS5hcHBsZS5zdHJlYW1pbmdrZXlkZWxpdmVyeSIsS0VZRk9STUFUVkVSU0lPTj0iMSIsSVY9MHg2MTMxNGJiZDYxMjIxNDM2YWQzOTdjOTlhMWYzZTUwYQ==</cpix:HLSSignalingData><cpix:HLSSignalingData playlist="media">I0VYVC1YLUtFWTpNRVRIT0Q9U0FNUExFLUFFUyxVUkk9InNrZDovLzU2YTUyY2QwLTEwYjMtNDgzMC1hOWY0LTZhZTNhOGUyNmNjYiIsS0VZRk9STUFUPSJjb20uYXBwbGUuc3RyZWFtaW5na2V5ZGVsaXZlcnkiLEtFWUZPUk1BVFZFUlNJT049IjEiLElWPTB4NjEzMTRiYmQ2MTIyMTQzNmFkMzk3Yzk5YTFmM2U1MGE=</cpix:HLSSignalingData></cpix:DRMSystem></cpix:DRMSystemList>As you can see I set the "master" playlist HLSSignalingData value as the same with  "media" playlist HLSSignalingData except the "#EXT-X-SESSION-KEY" tag name.Could you give me an sample of SPEKEV2 response with correct 'HLSSignalingData" setting for this use case?FollowComment"


Question: deleting hosted zone

"Hi,when trying to delte my hosted zones, i get this error "Error occurredBad request.(InvalidKeySigningKeyStatus 400: Key Signing Key with name datalabsai cannot be deleted because current status is not INACTIVE. You can use DeactivateKeySigningKey to deactivate the Key Signing Key before you delete it.)"I followed each step in the documentation but I am still not able to delete the hosted zone.Any solution???FollowComment"

Answer: "0Thank you for the detailed description. To successfully delete the hosted zone, we will have to:Delete the key-signing keys. Please follow this link to edit the key-signing key status to INACTIVE, and delete the key-signing keys.Disable DNSSEC signing for the hosted zone. Please follow this link to disable DNSSEC signing.Complete the above steps and try again deleting the hosted zone.CommentShareweidianswered 5 months ago"


Question: Model Monitor Capture data - EndpointOutput Encoding is BASE64

"https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-capture-endpoint.htmlI have followed the steps mentioned in this and it appears I cannot change the encoding for EndpointOutput in datacapture file. It's coming BASE64 for xgboost model. I am using latest version 1.2.3.For monitor scheduler it required both EndpointOutput and EndpointInput to have the same encoding. My EndpointInput  is CSV but EndpointOutput is coming to be BASE64 and nothing can change it.This is causing issue while run of analyzer. After baseline is generated and data is captured, when monitoring schedule runs the analyzer it throws error of Encoding mismatch. For it to run EndpointOutput and EndpointInput should have same encoding.I saw we cannot do anything to change the encoding of output. I used LightGBM, CatBoost algorithms also and found for these EndpointOuput encoding is JSON, which is readable but still not solving the purpose.Is there a way we can change EndpointOutput Encoding for DataCapture.FollowCommentMr Karki 5 months agoThis is causing issue while run of analyzer. After baseline is generated and data is captured, when monitoring schedule runs the analyzer it throws error of Encoding mismatch. For it to run EndpointOutput and EndpointInput should have same encoding.I saw we cannot do anything to change the encoding of output. I used LightGBM, CatBoost algorithms also and found for these EndpointOuput encoding is JSON, which is readable but still not solving the purpose.Is there a way we can change EndpointOutput Encoding for DataCapture.Share"

Answer: "0Accepted AnswerOutput encoding can be configured by using the CaptureContentTypeHeaderin EndpointConfig.DataCaptureConfig. I believe since this is not being set, default encoding i.e. base64 is being used.Please try once with this attribute set as below:"CaptureContentTypeHeader": {          "CsvContentTypes": [ "text/csv" ]      }Assuming that content_type/accept is "text_csv" for the concerned model.CommentSharerePost-User-3048018answered 4 months agoMr Karki 4 months agoThanks this helpedShare"


Question: Action Required: Irregular activity in your AWS account

"Hi,We are busy assisting a client with a business critical task. We started a 92 vCPU instances last night, and it appears that our account was suspended shortly after this. Now none of our other AWS services are running.Please can you assist ASAP to get this suspension lifted, and also share why the account was suspended? To me it looks like a mistake from one of your automatic security checks. If am not wrong, and this is a mistake, can you kindly advise how we prevent this from happening again?Case ID: 9189474941CharlFollowComment"

Answer: "0Zero response more than 10 hours after the account was suspended and an "Urgent business impacting question" level case opened. I can understand that normal cases take time to get to the front of the queue, but if one of your bots/security rules suspends an entire account, surely there must be a more efficient way to reactivate it, especially if it is business critical?CommentShareCJCPTanswered 2 years ago"


Question: How to load ASW Textract results in vector database?

"Hi,Are there any tutorials or other resources available which demonstrate how to structure and load AWS Textract results in a vector database?FollowComment"

Answer: 0Here is one blog post explaining an approach: https://aws.amazon.com/blogs/machine-learning/dialogue-guided-intelligent-document-processing-with-foundation-models-on-amazon-sagemaker-jumpstart/We are working on a sample in the IDP CDK samples similar to the OpenSearch one https://github.com/aws-samples/amazon-textract-idp-cdk-stack-samples#opensearchworkflow.CommentShareMartin Schade _AWS_answered 2 days ago


Question: SSL Cert not renewing

"I have an SSL Cert that expired today and it is pending validation. I have DNS validation for the cert and some of the DNS entries were missing. I went ahead and added in the missing DNS entries as the site has been down all day.Cert ARN is: arn:aws:acm:us-east-1:161976503557:certificate/9949ca08-f3a1-40f8-832a-ddee7efc10eeCan someone please trigger a renewal? I had to do this on another account that wouldn't renew before and I need to get this back up ASAP.Thank you for your time.Rant: I really wish support would be revamped for organizations... I already pay on 3 accounts (more than $15k/month) and yet other accounts that have a hiccup once a year isn't worth the hefty price tag.Edited by: parables-jeremy on Feb 21, 2021 6:13 PMFollowComment"

Answer: 0Argh! Seems immediately after I posted this it renewed!CommentShareparables-jeremyanswered 2 years ago


Question: Does AWS WAF detects and Logs HTTP Flood logs?

Does AWS WAF Detects and log HTTP Flood logs? I know that it detects the HTTP Flood and we can apply rate based rule which is a blanket rule of less than 100 attacks per 5 minutes.If this rule is breached then what will happen? Will it log somewhere?Is there any link to find an example log for HTTP Flood logs and the rule is breached? I tried to find it but was not able to find any log.Thanks in Advance :)FollowComment

Answer: "1Accepted AnswerQ. Does AWS WAF Detects and log HTTP Flood logs?If detailed WAF logging is enabled, WAF will log the HTTP flood requests just like any other incoming requests in the destination that you choose.Q. If this rule is breached then what will happen? Will it log somewhere?If the rule is breached:You will be able to find a datapoint in the CW metrics for WAF for the rate based rule.You will be able to list the IPs blocked by this rule by running the CLI command described hereQ. Is there any link to find an example log for HTTP Flood logs and the rule is breached?You can run this CW insights query to filter by requests blocked by a rate-based rule:fields @timestamp, httpRequest.clientIp, terminatingRuleId, httpRequest.country,@message| filter terminatingRuleType ="RATE_BASED" ## and webaclId = "arn:aws:wafv2:us-east-1:xxxxxxxx:regional/webacl/waf-test/abcdefghijkl" ## uncomment to filter for specific WebACL| sort requestCount descYou can find the other sample queries hereCommentShareAWS-User-3413787answered 25 days ago1Hello,You gonna find an excellent content for your question in the blog post The three most important AWS WAF rate-based rules with the most important AWS WAF rate-based rules are for proactively protecting your web applications against common HTTP flood events, and how to implement these rules.The AWS's Shield Response Team (SRT) has learned from helping customers respond to HTTP floods and this blog post show how all AWS WAF customers can benefit from these learnings.Hope it helps,CommentShareIbrahim Cesaranswered a month ago"


Question: Is there any way a worker can work on the HIT even when it has expired?

"Facing an anomaly with my HIT.User was able to work on HIT after HIT expiry(LifetimeInSeconds)Sorry if the question seems a bit naive. I am facing an issue with my HIT.I have tested on the sandbox, and it's not possible for workers to accept the HIT after expiration. When a worker previews an assignment just before the expiry time, they can preview it even after the expiry time but they cannot accept it then.But I have got an anomaly. There is one user whose start time for data logged is after 22nd minute of HIT creation where as HIT expires in 5 minutes. I have employed various method to ensure that reload doesn't restarts the survey and survey autosubmits at various stages within first 8 minutes. in short, it's not possible to start the survey after 22nd minute of HIT creation.Thus it only points out that the worker was able to accept the assignment even after expiry. Given that it's not possible on sandbox, I don't think it could be possible on mechanical turk main. But I don't have a production account for mturk worker and thus I can't verify if a worker can somehow accept the task even after the expiry time or not.Does anyone know any case where worker can start work even after expiry?FollowComment"


Question: Pluralsight- adding cidr range to vpc

"Im getting an error when trying to input this command.  I'm following along on Pluralsight and it looks like its supposed to be straight forward but...well....take a look:PS C:\Users\kooko\Downloads\advanced-networking-on-aws-master\advanced-networking-on-aws-master\m3> vpc_id=$(aws ec2 describe-vpcs --filters Name="tag:Name",Values="globo-primary" >>--query 'Vpcs[0].VpcId' --output text)vpc_id=$(aws ec2 describe-vpcs --filters Name="tag:Name",Values="globo-primary" --query 'Vpcs[0].VpcId' --output text) : The term 'vpc_id=$(aws ec2 describe-vpcs --filters Name="tag:Name",Values="globo-primary" --query 'Vpcs[0].VpcId' --output text)' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path wasincluded, verify that the path is correct and try again.At line:1 char:1vpc_id=$(aws ec2 describe-vpcs --filters Name="tag:Name",Values="glob ...  + CategoryInfo          : ObjectNotFound: (vpc_id=$(aws ec... --output text):String) [], CommandNotFoundException  + FullyQualifiedErrorId : CommandNotFoundExceptionFollowComment"

Answer: "0The error CommandNotFoundException is telling you that that it can't find the command vpc_id.Thats because it looks like you are trying to run a script as a normal command.This looks like Powershell, firstly make sure you have the AWS Tools for Powershell installed (https://docs.aws.amazon.com/powershell/index.html)Then try running the script in the PowerShell ISE (https://learn.microsoft.com/en-us/powershell/scripting/windows-powershell/ise/introducing-the-windows-powershell-ise?view=powershell-7.2)CommentSharerianbkanswered 8 months ago0dddasdfsdfdsfCommentSharestealthyh11answered 7 months ago"


Question: aws.greengrass.labs.jupyterlab is not listed in AWS IOT Deploy console - Why?

When I go to deploy jupyterlab to a gg device it is not listed. Is it not supported anymore?FollowComment

Answer: "1The components you see listed in the AWS IoT Console (under the Public Components tab) are components that the team at AWS developed and actively maintains. All the components on the software catalog https://github.com/aws-greengrass/aws-greengrass-software-catalog are, as you mentioned, third party components or components that serve as starting points for the community to develop their own custom components which can then be uploaded to your own AWS account and will display in the console under the "My Components" tab.CommentShareochoanelanswered 8 months ago0Well, If I could delete I would. I see it is a third party component.CommentShareflycastanswered 8 months agoochoanel 8 months agoHey flycast,The components you see listed in the AWS IoT Console (under the Public Components tab) are components that the team at AWS developed and actively maintains. All the components on the software catalog https://github.com/aws-greengrass/aws-greengrass-software-catalog are, as you mentioned, third party components or components that serve as starting points for the community to develop their own custom components which can then be uploaded to your own AWS account and will display in the console under the "My Components" tab.Share"


Question: poll status after creating data repository association

"Does the aws cli provide a way of polling the "Lifecycle" value of a data repository association$ aws fsx describe-data-repository-associations{    "Associations": [        {            "AssociationId": "dra-XXX",            "ResourceARN": "arn:aws:fsx:YYY",            "FileSystemId": "fs-ZZZ",            "Lifecycle": "CREATING",            "DataRepositoryPath": "s3://RRR",            "BatchImportMetaDataOnCreate": true,            "ImportedFileChunkSize": 1024,            "S3": {                "AutoImportPolicy": {                    "Events": [                        "NEW",                        "CHANGED",                        "DELETED"                    ]                },                "AutoExportPolicy": {                    "Events": [                        "NEW",                        "CHANGED",                        "DELETED"                    ]                }            },            "Tags": [],            "CreationTime": 1678000000.999        }    ]}to become AVAILABLE after runningaws fsx create-data-repository-association ..,similar to the commandaws cloudformation wait stack-create-complete ..?FollowComment"

Answer: 1Accepted AnswerThere is none currently.You could leverage Client-side filtering https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.html to extract the Lifecycle field and loop on it programmatically until it becomes  AVAILABLE perhaps ?ex.:$ aws fsx describe-data-repository-associations --query 'Associations[*].Lifecycle'CommentShareJS-AWSanswered 3 months ago


Question: IoT Events: Publish IoT Topic action with dynamic topic name

"I'd like to be able to publish a message to a topic, which name is build up dynamically based on one of the input values.I can access to the input already when setting up Transition Events, but can't find a way to interpolate the input value into the topic name.Suppose I have an input such as: $input.foo = barWould like to use it in the topic name as: "my/topic/$input.foo", resulting into "my/topic/bar"Have tried all type of proposed substitution templates w/o success (https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-expressions.html)FollowComment"

Answer: "0Answering to my own question, after some further testing. I did not manage to interpolate the topic dynamically on-the-fly as I wanted. Instead, I found a workaround by declaring a variable that contains the resolved interpolation in a previous state. For instance, the variable leds_topic is initialized with 'gate/' + $input.gate_sensors.gateid + '/leds'Aterwards, I can publish to that topic using as Topic name ($variable.leds_topic)CommentShareJordi Portaanswered a year ago"


Question: RDS Snapshot stuck in Creating 0% state in Singapore Region

"Hi,I'm trying to restore a MySQL database from RDS Snapshots in the Singapore region and all the instances which I have created for restore are stuck in creating snapshots stage.can anyone from AWS look into this issue?FollowComment"

Answer: "0The snapshot you are restoring has a corrupted innodb log file.I was able to allow the most recent restore request to complete by disabling the innodb_log_checksums.I'd suggest you dump a backup of your data and import it back into a fresh database. It is not clear what the source of the corruption may have been.-PhilCommentShareMODERATORphilawsanswered 4 years ago0Hi Phil,I was getting same issue again can you someone from AWS can help to restore the the snapshot which I have trying to restore.this time I will take backup and create a new instance as suggestedCommentShareknchaitanyaanswered 4 years ago"


Question: Is Windows 7 supported as BYOL in Amazon Workpaces

"Understand that Windows 10 is supported in BYOL scenario when using Amazon Workspaces, I would like to check if Windows 7 still supported officially when customer wants to bring their own image with Windows7. Thanks!FollowComment"

Answer: "0Accepted AnswerPer the documentation it is not supported.  Here are two links:https://docs.aws.amazon.com/workspaces/latest/adminguide/create-custom-bundle.htmlhttps://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.htmlAfter January 14, 2020, images cannot be created from public Windows 7bundles. You might want to consider migrating your Windows 7WorkSpaces to Windows 10. For more information, see Migrate aWorkSpace.andWindows Versions That Are Supported for BYOL Your VM must run one ofthe following Windows versions:Windows 10 Version 1803 (April 2018 Update)Windows 10 Version 1809 (October 2018 Update)Windows 10 Version 1903 (May 2019 Update)Windows 10 Version 1909 (November 2019 Update)All supported OS versions support all of the compute types availablein the AWS Region where you're using WorkSpaces. Versions of Windowsthat are no longer supported by Microsoft are not guaranteed to workand are not supported by AWS Support.CommentShareAWS-User-8075018answered 3 years ago"


Question: CloudWatch metric filters dimensions cannot include whitespace?

"When creating dimensions from CloudWatch logs using metric filter with JSON fields, any value with a space, like "First phase" is registered as a blank dimension value. If the value has no space, like "First_phase", it is properly registered.Dimension name, however, can be created with a space. The problem is just with dimension values.The description in the filter creation dialog states: "Dimension names and values can be up to 255 characters, cannot contain blank spaces or non-ASCII characters". It also directs to https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_Dimension.html, which states: "The value of the dimension. Dimension values must contain only ASCII characters and must include at least one non-whitespace character."One the one hand, the wording of the metric creation dialog warns "cannot contain blank spaces".However, the formal docs say "must include at least one non-whitespace character".The dimension name follows the formal docs, the value seems to follow the dialog's wording.Is it a bug?FollowComment"


Question: SES SPF Configuration

"Is there any way to update the SES SPF entries ?  I am receiving the following error when sending emails to our clients through SES:Received: from smtp-mx-server-8.servers.netregistry.net (unknown [202.124.241.71])by inpre01.tmes.trendmicro.eu (Trend Micro Email Security) with ESMTPS id 7BC531000030Afor xxxx@xxxx.com; Tue,  7 Mar 2023 16:15:42 +0000 (UTC)Received: from b232-174.smtp-out.ap-southeast-2.amazonses.com ([69.169.232.174])by smtp-mx-server-8.servers.netregistry.net protocol: esmtps (Exim 4.84_2 #1 (Debian))id 1pZa1N-0002ZX-Lhfor xxxx@xxxx.com.au; Wed, 08 Mar 2023 03:18:41 +1100DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;s=hpebk22bkizsh6atur5nbat4au2alh6m; d=icn.org.au; t=1678205730;h=Message-ID:List-Unsubscribe:From:Reply-To:To:Subject:Date:MIME-Version:Content-Type;bh=FpZUfDYmSu471kLXy5HAcZskghFdjaMmiX8lxUZT+is=;b=OioV28EAkEa1ZUznc4ZyTE/y7TPxSmQS8uUbp55iLRV6lZqDBt48g62ownzctA0K1mp5ZxxWfYKK6OqRxJH33sXdiNDo+bF/odVauFL9kbh0bigd97YE0Fv+0+3vAjezd/hSGcjQjMOk8xem11l3ueiHN/b3n7Lakqzpp7LgNrI=DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;s=o6ptibvfbllhpdhtxr7klizy2riobquz; d=amazonses.com; t=1678205730;h=Message-ID:List-Unsubscribe:From:Reply-To:To:Subject:Date:MIME-Version:Content-Type:Feedback-ID;bh=FpZUfDYmSu471kLXy5HAcZskghFdjaMmiX8lxUZT+is=;b=nFSeUjAi8iXm6w7hVVqQfTQCGHfMNkOCg/TI/Zuk/csdbznhxLF7wywSM0WVwZjOmpfq/R6nXE4OjlR4VGrYI1vaAmhOlEzEgHnD4R+zhhzi17ZiSonVHN1X7K7zqmY3yhBycGO8xTmDOQXrtjnxtXjYGGC/mdQW/9DqsrAfqLQ=Message-ID: 01080186bcdb404f-50dd182b-5c62-4882-8f4b-047c45c5fdd8-000000@ap-southeast-2.amazonses.comList-Unsubscribe: =?utf-8?q?=3Cmailto=3Axxxx=40icn=2Eorg=2Eau=3E=2C=3Chttps=3A=2F=2Fgateway=2Eicn=2Eorg=2Eau=2Fcomp?==?utf-8?q?any=2Fmember=3Fnotifications=3D1=3E?=From: ICN Helpdesk xxxx@icn.org.auReply-To: ICN Gateway xxxx@icn.org.auTo: xxxx@xxxx.com.auSubject: New Work Package AdviceDate: Tue, 7 Mar 2023 16:15:30 +0000MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=-oL69DlJhcmknVEbcDS+8aA=="Feedback-ID: 1.ap-southeast-2.m85nUVHKLSXfur1SoHQOQxJGTXLGoBlMupefzGlVEqQ=:AmazonSESX-SES-Outgoing: 2023.03.07-69.169.232.174X-TM-Received-SPF: Fail (domain of  01080186bcdb404f-50dd182b-5c62-4882-8f4b-047c45c5fdd8-000000@ap-southeast-2.amazonses.com does not designates 202.124.241.71 as permitted sender) client-ip=202.124.241.71; envelope-from=01080186bcdb404f-50dd182b-5c62-4882-8f4b-047c45c5fdd8-000000@ap-southeast-2.amazonses.com; helo=smtp-mx-server-8.servers.netregistry.netIs this a configuration issue at our end or is this a config issue in the AWS SES ?FollowComment"

Answer: "0It looks like you want to use a custom MAIL FROM domain (icn.org.au). Since it is a custom domain, you need to have the appropriate SPF record configured in your DNS. If you use the Amazon SES FROM domain, then AWS takes care of the SPF setup for you.CommentSharerowanuanswered 3 months ago0This issue is due to a SMTP redirect/forwarding scenario. The headers indicate that the message was sent by SES and delivered to smtp-mx-server-8.servers.netregistry.net. During this hop the message passes SPF.During the next hop smtp-mx-server-8.servers.netregistry.net delivers the message to inpre01.tmes.trendmicro.eu. It fails SPF because smtp-mx-server-8.servers.netregistry.net is not in the SPF policy for ap-southeast-2.amazonses.comAn intermediary SMTP server should rewrite the MAIL FROM address to something within a domain it controls.If you trust smtp-mx-server-8.servers.netregistry.net then you can configure a custom MAIL FROM domain and add the necessary IP addresses to that domain's SPF record, as @rowanu instructed.On the other hand, if you have no idea what that server is (who controls it, etc), then you should not authorize it via SPF. The recipient you are sending to is using a incompatible email forwarding service/strategy. This is likely resulting in most of their incoming email being rejected, and their downstream mailbox is likely not getting very much email from you or anyone else.CommentShareJesse_Tanswered 2 months ago"


Question: Lambda@Edge custom 'Server-Timing' missing

"I have a Lambda@Edge on origin-request and it returns a Server-Timing header, however the value is ignored or missing.According to the Cloudfront documentation on Server-Timing header metrics:"The response that CloudFront sends to the viewer contains a single Server-Timing header that includes the value that came from the origin and the metrics that CloudFront added." (emphasis mine)I also don't see any documentation saying Lambda@Edge it's not allowed to return a Server-Timing header.Here are the steps I tried:Setting the response header policy with a "Custom headers" set to Server-Timing and override false, the value is always missing.Setting the response header with "Server-Timing header" enabled returns only Cloudfront metrics and ignores my custom Lambda@Edge response.Looks like a bug or missing documentation, thank you in advance!FollowComment"

Answer: "0Is your Lambda function generating and returning the whole response? If it is passing the request through to an origin, I think you'd need to add server-timing on the Origin Response trigger, rather than Origin Request. Either way, the server-timing header generated by your Lambda@Edge function or the Origin will only be sent to the user in the event of a cache miss. If your requests are being served from cache, the value generated by the origin or Lambda@Edge for server-timing will not be present.CommentSharePaul_Lanswered 9 months ago"


Question: Can't connect to Aurora cluster from AWS Bastion Host

"I've successfully created an Aurora cluster, and it's running.  I've successfully created a Bastion Host, using the template.  It seems to be connected to the right VPC (same one as the Aurora cluster).  I can't connect to the Aurora cluster.  What I want to do is to use MySQL Workbench.  It can connect to the Bastion Host, but it gets an error connecting to the database. I can SSH to the Bastion Host, but can't see the endpoint.  Ping, SSH, nothing.  I can resolve the endpoint to an IP address, but can't get that address to respond.This is probably something fundamental and simple, like maybe I have to create some rule in the security group or something.  I "think" the Bastion Host is on the VPC, so it shouldn't need a rule, and if it does., I don't know what it would be.FollowComment"

Answer: "0Hi,For the Aurora database1. click on Services->RDS2. Click on Databases3. Click on the DB identifier for the Aurora instance4. Write down the following information:    Endpoint :    Port:    VPC:    VPC security groups:    Public accessibility    subnet group:    Subnets:5. Click on the link for the VPC security groups 6. click on the Inbound tab and write down what protocols/Port Range/Sources are allowed. Note: 3306 should be one of the allowed ports. If NO, then Click the Edit button, Click Add Rule, 3306 for the Port range and for the source enter 0.0.0.0/0 (for now... later, you can lock down the IP to the Bastion server's private IP address, but let's see if you can first connect).7. See if you can now connect.FYI: I verified that I was able to connect from my desktop through a Bastion server.I will try to help you debug more, if after you follow the above steps, you are still having problems connecting.{code}-randyCommentShareRandyTakeshitaanswered 4 years ago0endpoint: stripcallcluster-1.cluster-cc53mewxcxrb.us-east-1.rds.amazonaws.comport: 3306vpc: vpc-2f3ca355vpc security group: AuroraForStripcallSG (sg-05c0596e84b978312)( active )default (sg-e5a25ebd)There is no setting for "public availability"Subnet group stripcallgroupSubnetssubnet-e70210adsubnet-495dcb77subnet-36206251subnet-3f470e11subnet-d97f7bd6subnet-5a5b1406The default VPC security grouo inbound rules are:All traffic All All sg-e5a25ebd (default)MYSQL/Aurora TCP 3306 65.74.232.84/32MYSQL/Aurora TCP 3306 24.154.122.0/24I added an inbound rule for 0.0.0.0/0That helped.  "Test Connection" in Workbench worked.However: Your connection attempt failed for user 'admin' to the MySQL server at stripcallcluster-1.cluster-cc53mewxcxrb.us-east-1.rds.amazonaws.com:3306:Lost connection to MySQL server during queryI waited an hour and tried again, and this time it succeeded, so I actually have Workbench connected and running to the database.So at least part of the problem is that I need an inbound rule for the Bastion Host.  How do I construct that correctly?CommentSharebrtech99answered 4 years ago0Hi,Double check your Aurora database instance for "public availability". It should be in the right hand column side of the properties. It should hopefully be "no".As you mentioned, you will need to add your Bastion server's private IP address to the Security Group. So you will first1. Services->EC22. Click on Instances3. Click on your Bastion Server instance4. In the Description tab, on the right hand side column, there will be an Private IP address in the row, Private IPs. Copy this IP address.Then follow the directions in my earlier message, and instead of 0.0.0.0/0, put the <IP address>/32.  For example, if your IP address was 172.31.46.221, then enter 172.31.46.221/32-randyCommentShareRandyTakeshitaanswered 4 years ago0Okay, so that worked, and Workbench has access with the /32.  Thank you very much.I still don't see the public availabilty setting.I go to RDS Services->Databases.  Select my database.  I have a summary, with no Public AvailabilityI have tabs for Connectivity & securityMonitoringLogs & eventsConfigurationMaintenance & backupsTagsI look in Connectivity and security and see a security heading on the right, but all it has is the security groups.I look at Configuration and it has an Availability column, but the only things in that column are IAM db authentication, user name and password.Dunno where else to look.CommentSharebrtech99answered 4 years ago0I'm closing this.  I did get it to work, but there are so many issues in setting up Aurora Serverless to work with Lambda, I've given up entirely and started all over with DynamoDB.  This application is a much better fit with a small relational DB, but the complications in using Aurora Serverless with Lambda is way, way too daunting.  Thanks again for your help.CommentSharebrtech99answered 4 years ago"


Question: I am unable to install AWS Greengrass on my Ubuntu Touch OS phone.

"I want to install AWS Greengrass on my Ubuntu Touch OS phone. It is a Google Pixel 3a phone that has ubuntu touch OS as the operating system. We are able to access the terminal from the phone. I am getting the error, "Unable to set up Nucleus as a system service". I also tried to install greengrass as a docker container. Even that is not happening. Please provide me any suggestions on how to continue further.FollowComment"

Answer: "0Hi,Touch OS phone uses upstart and not systemd. Like systemd, you can use upstart to start Greengrass, and respawn it in case of failure.I would advice to first test to start Greengrass manually. Assuming the installation went Ok up to the point where you got the Unable to set up Nucleus as a system service error, you can try starting Greengrass via the following command:MIN_HEAP_SIZE="100m"MAX_HEAP_SIZE="100m"LOG_STORE="FILE"NUCLEUS_PATH="/greengrass/v2/alts/current/distro/lib"java -Xms$MIN_HEAP_SIZE -Xmx$MAX_HEAP_SIZE -Droot=$GGC_ROOT_PATH -Dlog.store=$LOG_STORE -jar $NUCLEUS_PATH/Greengrass.jarNote: HEAP_SIZE values are only suggestions - you might need to change them based on your systemCommentShareEXPERTMassimilianoAWSanswered 5 months ago"


Question: Batch job tags don't show up everywhere

"When creating new AWS Batch jobs via the SubmitJob API (done in Python, boto3), I see the submitted tags show up in the AWS Batch console. Where I don't see them though, isThe DescribeJob API (done via AWS CLI, aws batch describe-jobs ...Job State change events sent to EventBridgeIs this a bug or intended behavior?If it's intended, what is the appropriate way to tag my jobs so that Batch events have arbitrary key/value pairs that I can match EventBridge rules against?FollowComment"

Answer: "0Accepted AnswerI found a way to do solve my (EventBridge) problem using AWS Batch's parameters option for jobs.This is a way to write an EventBridge rule that matches a specific parameter set for filtering purposes{  "source": ["aws.batch"],  "detail-type": ["Batch Job State Change"],  "detail": {    "parameters": {      "match_me_exactly": ["only-this-should-match"]    }  }}This will filter down to job state events that come from a job submitted like sobatch_client.submit_job(  # other stuff here ...  parameters={"match_me_exactly": "only-this-should-match"})Other types of content matching can be figured out from EventBridge's docs https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns-content-based-filtering.html#eb-filtering-complex-exampleCommentShareaturek-avantusanswered 8 months ago"


Question: Origin Request Lambda Returns 400

"Hi,I have an issue with an Origin Request Lambda@Edge lambda. After it returns the modified request object the request throws an error and returns a 400. (I checked the requests never reached the Origin) and also the x-cache header of the response is "Error from CloudFront".Now I have a suspicion that the reason for that behavior is that the uri field is the following - "uri": "/cohesionapi/entity-preview/[media-reference:media:e44cf764-a581-4e26-903d-fc0ef5369738]" - do you think that the [ would break CloudFront, or is it a valid response/request to make?ThanksSandorFollowComment"

Answer: "0I am not sure about the URI format, but a few things to try to get started:Can you look at the 400 response body? Sometimes the response error body has useful information that can point in the right direction. Try pulling the URL up in a browser.The Error from CloudFront means the request is probably malformed, which might align with your theory on the uri format. If it was an issue with the Lambda logic you would likely get a 502 and the x-cache header would be LambdaValidationError or LambdaExecutionError.Is there anything meaningful in the CloudWatch logs that might point you in the right direction?Consider logging the event object at the end of your L@E function. I am not sure which language you are using, but for node I usually do something like the following. You should see the output in the CloudWatch logs which might point to the issue. Start by checking the event.request.origin object to see if everything looks correct there.console.log(JSON.stringify(event));CommentShareJeremyAWSanswered a year ago"


Question: I want to create a folder in the shared top directory of FSx using SSM's PowerShell command.

"I would like to run powershell commands on a specified EC2 instance using AWS-RunPowerShellScript in Systems Manager's Run Command.I want to create a folder in the shared top directory of FSx, so I carried out the following command.$path = FSx network drive pathNew-Item -Path "$path\D$\folder-name" -ItemType directoryHowever, access is denied.I get an error message "Unable to connect to remote server" even after executing the following commands.$name = FSx nameInvoke-Command -Credential $domainCredential -ComputerName $name -ScriptBlock { New-Item -Path "\D$\folder-name" -ItemType directory }I would like to know what I should do.FollowComment"

Answer: "0Hello! FSx provides you with a Powershell management endpoint to perform commands. Please take a look at the following documentation which explains how to connect to the FSx Powershell management endpoint which you can use to run commands. Please make sure you are using the FSx powershell endpoint name instead of the regular FSx name. If you are already using the FSx powershell endpoint name as shown in the documentation screenshots, please let us know.https://docs.aws.amazon.com/fsx/latest/WindowsGuide/remote-pwrshell.html#using-rpsCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago0Hello!From the context of an SSM run command, New-Item without credentials will be unauthenticated.That being said, New-Item does support -Credential as a parameter, please try your command again with credentials.$path = FSx network drive pathNew-Item -Path "$path\D$\folder-name" -ItemType directory -Credential $domainCredentialAt this time, the FSx PowerShell management endpoint does not support New-Item as a powershell command. For a list of supported commands, please consider invoking a remote session and using Get-Command.References:Powershell 5.1 New-Item: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-item?view=powershell-5.1CommentShareSUPPORT ENGINEERRJ-Danswered a year ago"


Question: Scaling a cluster

"Is it possible to scale a cluster down ? We are currently set up with 6 brokers (2 per AZ), and I would like to scale that down to 3 brokers. Is this possible without having to stand up a new cluster and switch DNS names to point to the new Zookeepers and Brokers ?Thanks,JasonFollowComment"

Answer: 0You currently cant change the number of brokers within a cluster.  We are working on adding that functionality.  The current solution involves standing up a new cluster and replicating the data with a tool like Mirrormaker or equivalent.ThanksChaseCommentShareAWS-User-6643836answered 4 years ago


Question: Can we export the mongodb using the data pipeline?

"Howdy..Customer wants to use the data pipeline to schedule a job, exporting data from mongodb in json format, and then import it to the dynamodb. I checked the developer guide, but it says that the supported data nodes are dynamodb/mysql/redshift/s3.My guess is that the customer should perform the export in mongodb native way to s3, and then, we can use the data pipeline to import the data to dynamodb.Just give me a light on it. Thanks, in advance.FollowComment"

Answer: "0You don't need a specific data node to do this. You could schedule an EC2 instance with a shell command activity (http://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-object-shellcommandactivity.html), which would contact the API endpoint of the mongo-cluster to call the export method, download the JSON, and upload it to DynamoDB.CommentShareEXPERTAWS-User-9033290answered 7 years ago"


Question: aws_requests_auth problem

"I'm trying to create an apigateway  in order to create an api that integrates the lex bot.I did that using sam with lambda function;the probelm when I run locally my script using sam local start-api I got this :Invalid lambda response received: Invalid API Gateway Response Keys: {'requestId', 'errorMessage', 'errorType', 'stackTrace'} in {'errorMessage': "Unable to import module 'app': No module named 'aws_requests_auth'", 'errorType': 'Runtime.ImportModuleError', 'requestId': 'XXXXXX', 'stackTrace': []}although I already installed  aws_requests_auth lib and the api is working fine on postman.I check the installation using pip list command and I got this :aws-requests-auth  0.4.3this is the script :import jsonimport boto3import osimport uuidimport requestsfrom aws_requests_auth.aws_auth import AWSRequestsAuthdef run(event,context):URL = apiURL"payload="{\r\n\r\n   \"text\": \"2012\"\r\n}"#### put the  api-key found in the lapose.fr api documentation https://developer.laposte.fr/ headers = {'Content-Type': 'application/json','X-Amz-Content-Sha256': 'XXXXXXXXX','X-Amz-Date': 'XXXXXXXXXXXX'}auth = AWSRequestsAuth(aws_access_key='XXXXXXXXXXX',aws_secret_access_key='XXXXXXXXXX',aws_host='runtime-v2-lex.us-east-1.amazonaws.com',aws_region='us-east-1',aws_service='lex')response = requests.post(URL, headers=headers, data=payload ,auth=auth)print(response.json())return{  'statusCode':200,  'headers': {    'Content-Type': 'application/json',    },    'body': json.dumps(response.json())    }FollowComment"


Question: can not update beanstalk as it keeps looking for a deleted database

"We have EC2 instance, Beanstalk setup, RDS databases.We recently added a database on the RDS. In that process, I also added a database to the EC2 instance (or at least a database in the Beanstalk itself). I then deleted this database, but for some reason it keeps trying to use it and complains about it, meaning that we can not update any details in our configuration.When I turn off the feature "do health check or roll back" it still rolls back because it thinks the instance does not start nicely.I think the issue is that I deleted the created RDS database, but in beanstalk there is no option to delete the database properly.FollowComment"

Answer: "0Hi There,I understand that you recently added a database on RDS. In that process, you also added a database to the EC2 instance (or at least a database in the Beanstalk itself). you then deleted this database, but for some reason it keeps trying to use it and complains about it, meaning that you can not update any details in your configuration.Please note that Deletion protection is enabled for you when you use the AWS Management Console to create a production DB instance. However, Amazon RDS enforces deletion protection when you use the console, the CLI, or the API to delete a DB instance.In order to successfully and correctly delete an RDS instance from beanstalk you need to first decouple this RDS DB instance from beanstalk.You can decouple your database from an Elastic Beanstalk environment without affecting the health of the environment, please follow the document here. [1]You can choose to create a snapshot of the database and then terminate it, retain the database operational as a standalone database external to Elastic Beanstalk, or permanently delete the database. The Database deletion policy setting determines this result.I suggest that in your case, you decouple all databases attached to beanstalk using The Database deletion policy setting.Choose delete for the rds you plan to delete and choose retain for the one you need to keep.Then clean up your beanstalk so you can create a new one that you can then attach the necessary resources to.[2]I hope this information is helpful to you.=================References===================[1] Decoupling an RDS DB instance using the console:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.db.html#using-features.decoupling.db[2] Clean up:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/GettingStarted.Cleanup.htmlPlease note that I personally value your feedback, please accept and thumbs up this answer if you find it helpful.CommentShareMfaneloanswered a year ago"


Question: How to make the log of  "DeleteUser" "responseElements" to have the value of "UserId"

The "DeleteUser" log has a "null" value on "responseElements" filed.Is there any flag I can raise so that the delete_user action will return the "userId" in the response?The scenario is:create then delete in loop users with the same name.I should determine the correlation between creating and deleting logs in real time.I can determine what "create" action is related to what "delete" action since they all have the same name.FollowComment

Answer: "0Hi, there's quite a few AWS APIs that have a DeleteUser action - which one are you asking about?CommentShareEXPERTskinsmananswered a year agorePost-User-4528537 a year agoboto3 IAM delete_userShare0As documented in https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.delete_user, delete_user() doesn't have a "responseElements" field. It's documented as "Returns: None" which means the response is a dictionary containing a ResponseMetadata dictionary and possibly an Error dictionary.  The response won't contain a userId field.CommentShareEXPERTskinsmananswered a year ago"


Question: I'm having trouble writing the correct GraphQL query in Node.JS for an AWS DataExchange Provider's API specification

"I'm trying to write a GraphQL query to fetch data from an AWS DataExchange provider based on their company's API specification.However, every query I've written so far is returning 'data: null'.I've verified that all my AWS credentials and IAM keys are correct.Could someone please help me write the correct query based on the API specification given by the data provider.Thanks!My current request 'body' looks like below:Body: JSON.stringify({  content: {      "application/graphql": {        "schema": {          "$ref": "#/components/schemas/CatalogSearchRequest"        },        query: `query availablemetadatarecord(limit: 10 content: { catalogProperties: { vendor: { eq: "EYE" } } }) {                 assignedId        }      }`      }  }}),The DataExchange provider's actual API specification looks like below.{  "openapi": "3.0.1",  "info": {    "title": "image-services",    "description": "API Gateway for integration of Platform Services into AWS Data Exchange",    "version": "2022-03-03T20:04:18Z"  },  "servers": [    {      "url": ""    }  ],  "paths": {    "/psdm/graphql": {      "post": {        "requestBody": {          "description": "GraphQL query for the Catalog in the form of:\n\n  `{\n    availablemetadatarecord(\n      QUERYPARAMS\n    ) { \n      FIELDLIST\n    } \n  }`\n",          "content": {            "application/graphql": {              "schema": {                "$ref": "#/components/schemas/CatalogSearchRequest"              },              "examples": {                "Limit returned data": {                  "description": "Limit the number of records in a response.\n\nIn your query, simply specify `limit: <int>` \n",                  "value": "{\n  availablemetadatarecord(\n    limit: 10\n    content: { catalogProperties: { vendor: { eq: \"EYE\" } } }\n  ) {\n    assignedId\n  }\n}\n"                }              }            }          },          "required": true        },        "responses": {          "200": {            "description": "200 response",            "content": {              "application/json": {                "schema": {                  "$ref": "#/components/schemas/CatalogSearchResponse"                }              }            }          }        },        "security": [          {            "sigv4": []          }        ]      }    }  },  "components": {    "schemas": {      "CatalogSearchRequest": {        "title": "CatalogSearchRequest",        "type": "object"      },      "CatalogSearchResponse": {        "title": "Catalog Search Response",        "required": [          "data",          "paginationInfo"        ],        "type": "object",        "properties": {          "paginationInfo": {            "type": "object",            "properties": {              "recordsInPage": {                "type": "integer"              },              "nextOffset": {                "type": "integer"              }            }          },          "data": {            "type": "object",            "properties": {              "availablemetadatarecord": {                "type": "array",                "description": "Records returned by query",                "items": {                  "type": "object"                }              }            }          }        }      }    },    "securitySchemes": {      "sigv4": {        "type": "apiKey",        "name": "Authorization",        "in": "header",        "x-amazon-apigateway-authtype": "awsSigv4"      }    }  }}The response I get from my GraphQL query looks like below:httpRequest: HttpRequest {    method: 'POST',    path: '/',    headers: { 'User-Agent': 'aws-sdk-nodejs/2.1241.0 win32/v16.9.1' },    body: '',    endpoint: {      protocol: 'https:',      host: 'dataexchange.us-east-1.amazonaws.com',      port: 443,      hostname: 'dataexchange.us-east-1.amazonaws.com',      pathname: '/',      path: '/',      href: 'https://dataexchange.us-east-1.amazonaws.com/',      constructor: [Function]    },    region: 'us-east-1',    _userAgent: 'aws-sdk-nodejs/2.1241.0 win32/v16.9.1'  },  startTime: 2022-11-04T18:25:22.763Z,  response: Response {    request: [Circular *1],    data: null,    error: null,    retryCount: 0,    redirectCount: 0,    httpResponse: HttpResponse {      statusCode: undefined,      headers: {},      body: undefined,      streaming: false,      stream: null    },    maxRetries: 3,    maxRedirects: 10  },FollowCommentjchan 6 months agoIt's hard to know what's going on without a subscription to whichever provider's API you're using, but I'll point out that the query you have in your body has an unbalanced number of curly braces; there is one more closing brace than opening one. Looking at the example in the schema, there is an opening brace before availablemetadatarecord.Share"

Answer: 0I ran into this with a simple dynamo table.  The solution was to edit the schema in the AppSync console and add resolvers.  The template code was enough in my case to get the data flowing.CommentSharerePost-EricPanswered 4 months ago


Question: How to detect passwords using Amazon Macie?

It looks like passwords are not one of the managed identifiers. Is there a recommendation for how to create a custom identifier that has a good balance of false positives and false negatives?I see an SO answer with many RegEx examples for passwords: https://stackoverflow.com/a/21456918 I guess this could be combined with Macie's custom identifiers capability of only showing results that have a certain word within a certain proximity.Just trying to see what has given other people success?FollowComment

Answer: "0A custom data identifier is a set of criteria that you define to detect sensitive data in Amazon Simple Storage Service (Amazon S3) objects. The criteria consist of a regular expression (regex) that defines a text pattern to match and, optionally, character sequences and a proximity rule that refine the results.With custom data identifiers, you can define detection criteria that reflects your organization's particular scenarios. If you configure sensitive data discovery jobs or automated sensitive data discovery to use these identifiers, you can analyze S3 objects in a way that supplements the managed data identifiers that Amazon Macie provides.Reference : https://docs.aws.amazon.com/macie/latest/user/custom-data-identifiers.htmlCommentShareEXPERTAWS-User-Nitinanswered 5 months ago"


Question: Nodejs lambda function unable to parse event.body getting errors

I followed the below post and created a lambda function with lambda proxy api gateway but i'm getting server error when ever i post data for event.bodyjson.parse(event.body); is throwing errorsCan anyone tell how to parse event.body in node js environmenthttps://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-cross-account-lambda-integrations.htmlFollowComment

Answer: "0Hi,Are you still having problems? I followed the directions in the tutorial and was able to successfully invoke the API. I invoked from Postman with:https://xxxxxxxxg.execute-api.us-east-1.amazonaws.com/prod?name=randy&city=Santa Anaand in the Headers, I placed Key=day and Value=Monday.The message response from the lambda function was the expected:    "message": "Good day, randy of Santa Ana. Happy Monday!",The only extra step I performed outside of the tutorial was to Deploy the API.I used the lambda function, as stated in the tutorial using Node.js.8.10 and the parsing worked fine.'use strict';console.log('Loading hello world function'); exports.handler = async (event) => {    let name = "you";    let city = 'World';    let time = 'day';    let day = '';    let responseCode = 200;    console.log("request: " + JSON.stringify(event));        if (event.queryStringParameters && event.queryStringParameters.name) {        console.log("Received name: " + event.queryStringParameters.name);        name = event.queryStringParameters.name;    }        if (event.queryStringParameters && event.queryStringParameters.city) {        console.log("Received city: " + event.queryStringParameters.city);        city = event.queryStringParameters.city;    }        if (event.headers && event.headers['day']) {        console.log("Received day: " + event.headers.day);        day = event.headers.day;    }        if (event.body) {        let body = JSON.parse(event.body)        if (body.time)             time = body.time;    }     let greeting = `Good ${time}, ${name} of ${city}.`;    if (day) greeting += ` Happy ${day}!`;    let responseBody = {        message: greeting,        input: event    };        // The output from a Lambda proxy integration must be     // in the following JSON object. The 'headers' property     // is for custom response headers in addition to standard     // ones. The 'body' property  must be a JSON string. For     // base64-encoded payload, you must also set the 'isBase64Encoded'    // property to 'true'.    let response = {        statusCode: responseCode,        headers: {            "x-custom-header" : "my custom header value"        },        body: JSON.stringify(responseBody)    };    console.log("response: " + JSON.stringify(response))    return response;};In the Lambda function "Designer" screen, if you click on the "Key" icon, the Function Policy shows that the API Gateway from the other account is able to invoke the function in this account:{  "Version": "2012-10-17",  "Id": "default",  "Statement": [    {      "Sid": "93xxxe-xxxxx-4680-95xx8-aacxxxxxc8b",      "Effect": "Allow",      "Principal": {        "Service": "apigateway.amazonaws.com"      },      "Action": "lambda:InvokeFunction",      "Resource": "arn:aws:lambda:us-east-1:xxxxxxxxxxxxxxx:function:randyFunction",      "Condition": {        "ArnLike": {          "AWS:SourceArn": "arn:aws:execute-api:us-east-1:xxxxxxxxxxxxxxxxxg/*/GET/"        }      }    }  ]}Hopefully, something from above might help you figure out what steps you may have missed.-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: Process ftp files with sensor readings

"For an IoT project I need to ingest data (files with sensor data) coming from an (on-prem) FTP server. I have a Lambda function with a Cloudwatch cronjob that on an interval basis get the content of these files. I would like (a cold path) storing the raw data to DynamoDB and/or an S3 bucket and (a warm path) by using AWS IoT Analytics.My question:   Is it best to process the contents of the files and interface directly with DynamoDB and/or S3 and IoT Analytics (BatchPutMessage) or     Process the incoming files sensor readings publish them first to AWS IoT, and from there use rules for the cold and warm path?  Thanks.GuyFollowComment"

Answer: "0Of the two options you listed, I recommend the first one. You should just interface directly with S3 (or DynamoDB) and IoT Analytics if your data is not already being sent to the AWS IoT Core Message Broker.You could alternatively use IoT Analytics for both the cold path and the warm path. You can use an IoT Analytics Datastore for cold storage in your S3 Bucket. [0] [1] You could then enrich the data in your IoT Analytics Dataset's query. This option is preferable if a SQL query is sufficient for your data enrichment needs.Note that in both options I listed, you would ingest data into IoT Analytics through the BatchPutMessage API. What sets the second option apart is that you would not need to upload the data to S3 yourself; IoT Analytics would handle uploading the data to your bucket.[0] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotanalytics-datastore-customermanageds3.html[1] https://docs.aws.amazon.com/iotanalytics/latest/userguide/getting-started.html#aws-iot-analytics-step-create-datastoreEdited by: DavidWataws on Feb 27, 2020 7:52 PMEdited by: DavidWataws on Feb 27, 2020 7:53 PMCommentShareAWS-User-4919307answered 3 years ago0Many thanks.CommentShareGuyDanswered 3 years ago"


Question: ORA-20000: Your request contains duplicate headers.

"Hi,my app was working for years but 2 months ago I am not bale to upload xml files to aws.Do you what it could be?SQL> beginsys.dbms_scheduler.run_job('"TSMON"."MONITORING_SNAPSHOT"',TRUE);end;/   2    3    4begin*ERROR at line 1:ORA-20000: Your request contains duplicate headers.ORA-06512: at "TSMON.AMAZON_AWS_S3_PKG", line 44ORA-06512: at "TSMON.AMAZON_AWS_S3_PKG", line 72ORA-06512: at "TSMON.AMAZON_AWS_S3_PKG", line 829ORA-06512: at "TSMON.XML_AMAZON", line 92ORA-06512: at line 3ORA-06512: at "SYS.DBMS_ISCHED", line 242ORA-06512: at "SYS.DBMS_SCHEDULER", line 566ORA-06512: at line 2thank you.Regards,TomFollowComment"

Answer: "0Hello,Hope the below summary helps you.ORA-20000Programs that rely on PL/SQL can often be hit with run-time errors that occur due to faults in design, problems with coding, and a number of other issues. However, one of the great aspects of working with PL/SQL in Oracle is that the user can plan for the errors that frequently arise by creating warnings, or exceptions, to signal them.The user can have exceptions for items in a database such as “insufficient_budget” that signal when more funding is allocated to a particular budget category than what is owned. When the error occurs, an exception is raised and users can write routines called ‘exception handlers’ that essentially skip over the procedure to allow continuous running. The ORA-20000 concerns these types of user-defined errors as well as other errors that are artificially tacked onto a program to facilitate a database manager’s needs.The ProblemThe ORA-20000 is a generic error that almost always accompanies another error or a stack of errors. It is part of the reserved section of PL/SQL user-defined errors. The error is caused when a stored procedure (‘raise_application_error’) is called upon. Oracle raises exceptions from the innermost to the outermost error, so when the ORA-20000 is seen in front of a stack of errors, the user knows that the innermost error, or bottom, is the block that can serve as the catalyst.The amount of information available on the ORA-20000 is minimal due primarily to its open-ended ness. Essentially, when a user sees an ORA-20000, their goal is not necessarily to correct the ORA-20000. Instead, they need to resolve the error accompanying an ORA-20000, regardless of whether it is a user-created error or a reserved error. Because the error accompanies several other error messages, let us look at some of the more common combinations for the ORA-20000.THE SOLUTIONOne example of the ORA-20000 conjoined with another set of errors is shown below. Suppose the following stack of exceptions is thrown together: ORA-20000: ORA-20000: ORA-0000: normal, successful completion Update failed for the ch_clnt_mast Line: 632 Execution of ap_old_ib_terms_xfer_dr failed Line: 1045 ORA-06512: at “AEPRDFCRH.ORA_RAISERROR”, line 16 ORA-06512: at “AEPRDFCRH.AP_OL_IB_TERMS_XFER_DR”, line 935To review, the ORA-06512 is an error caused when the stack is unwound by unhandled exceptions in the code. As previously mentioned, the ORA-06512 error and ORA-20000 error are often triggered together. To fix these errors, the user would need to correct the condition causing the errors or write an exception handler.To begin correcting the stack of errors, check the code in the lines indicated in the error message. In this particular case, the user-defined error likely occurred due to being place in a WHEN OTHERS exception. Check over the code in line 632 (update failed for the ch_clnt_mast) as well as line 1045 (ap_old_ib_terms_xfer_dr failed). The user will have to remove or work with the exception handlers that are masking the real error message so they can rerun the code to discover what is occurring in the system.Another common error combination is the ORA-20000: ORU-10027: buffer overflow. DBMS_OUTPUT has various default buffer sizes that all depend on the user’s version of Oracle. In the system, the buffer size limit is 2000 bytes. The user can extend the buffer all the way to 1,000,000 bytes by issuing the statement below: DBMS_OUTPUT.ENABLE(1000000);The comparable SQL*Plus statement looks like this:set serveroutput on size 1000000If the user is working with Oracle’s 10g release or something more recent, unlimited buffer settings can be set with the following: DBMS_OUTPUT.ENABLE (buffer_size => NULL);And the SQL*Plus version:set serveroutput on size unlimitedThis should offset the ORA-20000: ORU-10027, but, if the user conducts this approach and is still triggering the error, it is recommended to look back through the code in full to see if any items are overriding the buffer settings.CommentShareVetrivelanswered 2 months ago"


Question: How to declare multi region access point in cloudformation template

"I want to add a multi region access point policy to my cloudformation template and I am getting a syntax error as undefined resource when running the cloudformation templateTemplate error: instance of Fn::GetAtt references undefined resource m67ckh1qr8zan.mrapCan someone help me with the correct format of declaring and using a multi region access point by a cloudformation template. Thanks.FollowCommentDmitry Balabanov a year agoCould you please edit your question and add a code snippet showing a part of your CloudFormation template where you define the resource and reference it? Without looking at the template, it is hard to tell what exactly might cause the error. Thank you!Share"

Answer: "0Hi,Hope this template helps. Pre-requisite is to have at least two buckets in different regions created already so as to reference those bucket names in the CF template{    "AWSTemplateFormatVersion": "2010-09-09",    "Resources": {        "MyMRAP": {          "Type" : "AWS::S3::MultiRegionAccessPoint",          "Properties" : {            "PublicAccessBlockConfiguration" : {              "BlockPublicAcls" : "True",              "BlockPublicPolicy" : "True",              "IgnorePublicAcls" : "True",              "RestrictPublicBuckets" : "True"            },            "Regions" : [ {"Bucket":"bucket1"}, {"Bucket": "bucket2"} ]        }      }    }}Replace the bucket1/bucket2 in above code with the actual bucket names. I was able to successfully create Multi region Access point with the above code--SydCommentShareSydanswered a year ago"


Question: Import DMP file in to Oracle RDS from EC2 instance

"So, have some DMP files that was exported from a oracle on premise, using expdp.And now from the linux EC2 instance i need import those dumps that is already there if is possible using the impdp but since there is no access to directory in the RDS instance how to do that?On linux i hace oracle installed and i can connect by sqlplus in the target db.FollowComment"

Answer: "0Hi DearThe problem that impdb require directory config that in normal oracle db must be in the same oracle installation server but since i need to import in oracle rds is not possible that is my current issueCommentSharerlacerdaanswered 3 months agophilaws MODERATOR3 months agoThe file does not have to be physically on the RDS instanceimpdp username@${ORACLE_SID} dumpfile=file.dmpShare0The impdp command just take a username@SID in the same way as any database client such as plsql. If you can reach your instance with plsql you should be able to reach it with impdp. There is no requirement that the DMP files reside on the RDS instance.CommentShareMODERATORphilawsanswered 3 months ago0Hello,Dump file has to be on the directory which is accessible to RDS instance, in this case its ebs volume attached to RDS.You would need to enable S3 integration with RDS for Oracle.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.htmlFirst copy data file to S3, which is accessible by RDS instance.Copy file using rdsadmin.rdsadmin_s3_tasks.download_from_s3.Once dump file is copied to RDS volume than you may use EC2 to connect to RDS instance  to import using command line utility.or else through pl/sql  (sqlplus).Hope this will helpThanksCommentShareJitenderanswered 3 months ago"