Question: Unable to Connect Greengrass Core IPC When Component Setup for Web Deployment

"IntroductionI used gdk component build to generate a component's artifacts and recipes in the generatedgreengrass-build folder.See below for screen shot of the folder structure.Here's the generated recipe.yml. The gdk is configured to build artifcats as zip.ComponentConfiguration:  DefaultConfiguration:    accessControl:      aws.greengrass.ipc.mqttproxy:        com.twisthink.SystemController:mqttproxy:1:          operations:          - aws.greengrass#SubscribeToIoTCore          policyDescription: Allows access to subscribe to IoT Core topic          resources:          - $aws/things/{iot:thingName}/jobs/get/accepted          - $aws/things/{iot:thingName}/jobs/get/rejected        com.twisthink.SystemController:mqttproxy:2:          operations:          - aws.greengrass#PublishToIoTCore          policyDescription: Allows access to publish to IoT Core topic          resources:          - $aws/things/{iot:thingName}/jobs/getComponentDescription: This is simple Hello World component written in Python.ComponentName: myExampleComponentPublisher: mynameComponentVersion: 1.0.1Manifests:- Artifacts:  - URI: s3://BUCKET_NAME/COMPONENT_NAME/COMPONENT_VERSION/example.zip    Unarchive: ZIP  Lifecycle:    Run:      RequiresPrivilege: true      Script: sudo python3 {artifacts:decompressedPath}/example/main.py  Platform:    os: linuxRecipeFormatVersion: '2020-01-25'I then ran the following commands to locally deploy my component:cd greengrass-buildsudo greengrass-cli deployment create --recipeDir recipes --artifactDir artifacts --merge "myExample=1.0.1"ProblemHere's what I see in the ....greengrass/v2/logs/myExample.log:2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. File "/home/me/greengrass/v2/packages/artifacts-unarchived/myExample/1.0.1/example/main.py", line 41, in __init__. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. self.ipc_client_v2 = GreengrassCoreIPCClientV2(). {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. File "/usr/local/lib/python3.8/dist-packages/awsiot/greengrasscoreipc/clientv2.py", line 31, in __init__. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. client = awsiot.greengrasscoreipc.connect(). {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. File "/usr/local/lib/python3.8/dist-packages/awsiot/greengrasscoreipc/__init__.py", line 45, in connect. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. ipc_socket = os.environ["AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT"]. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. File "/usr/lib/python3.8/os.py", line 675, in __getitem__. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. raise KeyError(key) from None. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.518Z [WARN] (Copier) myExample: stderr. KeyError: 'AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT'. {scriptName=services.myExample.lifecycle.Run.Script, serviceName=myExample, currentState=RUNNING}2023-02-10T21:10:17.540Z [INFO] (Copier) myExample: Run script exited. {exitCode=1, serviceName=myExample, currentState=RUNNING}QuestionWhy is AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT missing from the environment variable? And how can I fix that?P.S. I do not get this error when I run my component with non-zipped artifacts.FollowComment"

Answer: "1Accepted AnswerYour recipe has sudo, do not use sudo, this is what RequiresPrivilege is for.sudo will drop all environment variables.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 4 months agoictwist 4 months agoYou're right.I changed the Lifecycle part of my recipe to  Lifecycle:    Run:      RequiresPrivilege: true      Script: python3 {artifacts:decompressedPath}/example/main.pyAnd this worked. Thanks Michael!Share"


Question: Bulkemail limit

Hi. Does anyone have document limitations or condition about sendBulkemail?I going to send about 25k emails so I want to make sure it work or I have to split a request.FollowComment

Answer: 0Accepted AnswerFounded! https://docs.aws.amazon.com/ses/latest/dg/quotas.htmlCommentShareTeerapong-janswered a year agoSUPPORT ENGINEERMonica_Lluisreviewed a year ago


Question: ""E: Unable to locate package python-pip", Python 3.6.10, pip 9.0.3"

"So I started the tutorial for Mythical Mysfits and when I try to implement the docker build: docker build . -t REPLACE_ME_AWS_ACCOUNT_ID.dkr.ecr.REPLACE_ME_REGION.amazonaws.com/mythicalmysfits/service:latest(yes with my credentials and in the /app folder)then I get the error message "E: Unable to locate package python-pip".When I check for Python version its Python 3.6.10and pip is pip 9.0.3.All searches lead me to ubuntu installs, what am I supposed to do?FollowComment"

Answer: 0Answer can be found here: https://github.com/aws-samples/aws-modern-application-workshop/issues/192CommentShareHarryPachtyanswered 3 years ago


Question: IoT Analytics dataset schedule job can't stop

"Yesterday I used IoT Analytics and I set the dataset schedule job as frequency was 1 min and duration period was 10 min. However the job continued to run after 10 min. Although I delete the dataset and create another dataset, same problem occurred. How to fix the problem?FollowComment"

Answer: "0I solved it. It was lack of my understanding of Data set scheduling parameters. There are no space to set "duration period" and it was just able to set "minute of hour" of one minute frequency setting. I used Japanese language mode and it may cause my misunderstanding... ("minute of hour" -> "分"(minute))Edited by: Basicnn on Sep 1, 2019 7:45 PMCommentShareBasicnnanswered 4 years ago"


Question: What steps do I take to create a space environment? (Space Skysphere with stars on it just to begin with)

"At this point I want to keep my goal for the week simple. Create a level environment that looks like outer space. To complete this, a simple sky sphere with a material applied to it that has tiny stars on it will do. I have the texture/jpeg I want but how do I create an environment with just stars all around the player?Later on, I'll worry about creating a Sun, some planets, and zero-g physics for player movement, but for now I want to keep each goal simple. Can you answer my question?Best regards,SabreFoxxFollow"

Answer: "0Accepted AnswerHey @SabreFoxxLumberyarduses its own sky sphere by default that can be manipulated by Time Of Day, but it is not suitable for space environment because it has no texture at bottom side.In this case, you must use your own sky-sphere. Follow the steps:1- add the following to game.cfg file inside your project directory:e_Skybox = 0e_Sun = 0e_Fog = 02- create a level without terrain.3- create a entity and add a mesh component with sphere as its asset.4- set X/Y/Z Scale to 10000.0 and set X/Y/Z Translate to 0.5- and finally, you need a material with Equirectangular texture as its diffuse-texture. (this tool can help you and this)SharerePost-User-3337236answered 4 years ago0@REDACTEDUSERSharerePost-User-0211831answered 4 years ago0This is because you chose the wrong mesh asset that is affected by the culling system.You should chose this mesh as asset:Gems\PrimitiveAssets\Assets\Objects\_Primitives\_Sphere_1x1And before that, make sure the relevant Gem is active (Primitive Assets).SharerePost-User-3337236answered 4 years ago0Thanks so much!SharerePost-User-0211831answered 4 years ago0Awesome to see Spacescape is still getting some use! Another option I've been toying with is removing the fog from the time of day system so there are just stars and then using pictures of nebula on distance clouds objects. Works OK, though you don't have a lot of control on how much the stars shine through in the nebulas.Here's a zip that has a "space" time of day file and a level.cfg that turns off terrain visibility (e_terrain 0) and turns on some chromatic abberation and vignetting8425-spacelevelsettings.zip|attachment (2.06 KB)spacelevelsettings.zipSharerePost-User-5841084answered 4 years ago0Spacescape is very interesting and cool tool. Thank you for making it available to the public for free.I tested the contents of the zip file, and that chromatic effect of the stars was interesting. The default sky in lumberyard (Dynamic Sky) looks good and I know that it is even more optimal and flexible than any custom sky. But in the static state (Static Skyboxes) there is a weakness and it is the lack of texture at bottom side of the sky-sphere. The last time I built a custom material for the static sky, the bottom side was not textureable!SharerePost-User-3337236answered 4 years ago0Thanks @REDACTEDUSERSharerePost-User-5841084answered 4 years ago0@REDACTEDUSERSharerePost-User-5841084answered 4 years ago0@REDACTEDUSERSharerePost-User-4357073answered 4 years ago"


Question: Error while uploading to s3 from elastic beanstalk console

I am getting error as 'Error while uploading to s3' from elastic beanstalk console while trying to upload a jar file to an existing environment.FollowComment

Answer: 0Can you check if it is the same issue reported here - https://repost.aws/questions/QUDpuRoadAQHK9g9kpnzcuGg/cant-upload-to-elastic-beanstalkCommentShareEXPERTIndranil Banerjee AWSanswered 7 months ago0you can add EXTRA_ARGS: '--exclude=* --include=*.jar' to upload only .jar file into s3.you can check this blog section ( Use of Exclude and Include Filters )https://docs.aws.amazon.com/cli/latest/reference/s3/index.html#use-of-exclude-and-include-filtersCommentShareutkarsh-awsanswered 7 months ago


Question: Guardrail recommendations

How do I determine which control tower guardrails to implement?  Is there a place to see recommendations for certain industries?FollowComment

Answer: 0The Control Tower Controls Library screen has these detalis in place. See the below screenshot for your reference.CommentSharePraveen Muppalaanswered 2 months ago


Question: AWS F1 Custom pBlock

"Hi,I am using the AWS F1 instance to create my own accelerator in CL portion. There are multiple blocks in my hierarchy and what I want to be able to do is assign a hierarchical block to my own pblock. You can generally  create a pblock via the vivado gui. I opened the synthesized DCP and tried creating a pblock. When I try to save the constraints, it does not get saved anywhere. Is there a way I can do this or do I need to do this via XDC file only?Thanks.FollowComment"

Answer: "0Hello,Thank you for reaching out to us on this topic. The CL build flow allows users to define user specific pblocks and assign modules to it.Following example shows an xdc that creates pblock for the CL_DRAM_DMA design. The XDC is read before link_design stage:https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/build/constraints/cl_pnr_user.xdchttps://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/build/scripts/create_dcp_from_cl.tcl#L247We have few follow up questions:Do you see any errors when creating pblocks using GUI?Could you try creating pblocks in GUI using post_link.dcp?Were you able to create pblocks using xdc?Thanks!ChakraCommentShareawschakraanswered 6 months ago0Hi Chakra. I ended up creating pblocks from xdc. This seems to work well. I did try the gui but it wasnt taking it well for some reason. When I was trying to save the constraints using the gui, it saves it in some temp folder under ".Xil". But then when I go there, its not there.Sai.CommentShareskilambianswered 6 months ago0Hello Sai,The ".Xil" is a temporary folder created by Vivado tool to save all the intermediate files used by the tool. So I would like to suggest few options here:If you are creating pblocks in the GUI, please make sure to save the DCP after creating pblock constraints and use this DCP during builds.Alternately, you should be able to view the TCL constraints used by the tool in "tcl console" window when you create pblocks in the GUI. You may copy these commands into a seperate xdc file and use it for the builds.Also, please try running write_xdc <filename>.xdc in the tcl console to dump all the constraints into an xdc file.Hope this helps. Please reach out to us if you have any questions or need any details.Thanks,ChakraCommentShareawschakraanswered 6 months ago"


Question: Best Method for large data sets in r

"Apologies if this is a naive question or not the correct place to asked, new to AWS and not finding answers online.I am working with sequencing data in r. Based on some research, using AWS EC2 rstudio seemed like a good approach for me since I do not have access to servers at my institution. I uploaded my data files from an external drive to S3. My challenge is how to work with the multiple files in r. From what I understand, you cannot use S3 as a working directory, just as a location to store the files. I also believe r has a memory limitation of 1 GB. I have multiple files that total approximately 14 GB. So reading the files into r is not a solution. Any suggestions around this, other solutions, or tutorials available?FollowComment"


Question: How add partitions on Glue Job without update table schema?

"I created a Glue Table and added description and comments in the columns. I know the schema and it will not change.I have a Glue Job ETL that adds partitions to this table. I'm trying to do this in two ways, according to the documentation (https://docs.aws.amazon.com/glue/latest/dg/update-from-job.html):**write_dynamic_frame_from_catalog**additionalOptions = {"enableUpdateCatalog": True}additionalOptions["partitionKeys"] = ["region", "year", "month", "day"]sink = glueContext.write_dynamic_frame_from_catalog(frame=last_transform, database=<target_db_name>, table_name=<target_table_name>, transformation_ctx="write_sink", additional_options=additionalOptions)**getSink**sink = glueContext.getSink(    connection_type="s3",     path="<S3_output_path>",    enableUpdateCatalog=True,    partitionKeys=["region", "year", "month", "day"])sink.setFormat("json")sink.setCatalogInfo(catalogDatabase=<target_db_name>, catalogTableName=<target_table_name>)sink.writeFrame(last_transform)The problem is: the table is updated with the new partitions, but the column comments have been deleted, including the table description.How to keep the original description and column comments?FollowComment"

Answer: "0Hi ,please note that , as by the documentation page you linked, what you are experiencing is the default behaviuor:You can also set the updateBehavior value to LOG if you want to prevent your table schema from being overwritten, but still want to add the new partitions. The default value of updateBehavior is UPDATE_IN_DATABASE, so if you don’t explicitly define it, then the table schema will be overwritten.The code should look like:additionalOptions = {    "enableUpdateCatalog": True,     "updateBehavior": "LOG"}additionalOptions["partitionKeys"] = ["partition_key0", "partition_key1"]sink = glueContext.write_dynamic_frame_from_catalog(frame=last_transform, database=<dst_db_name>,    table_name=<dst_tbl_name>, transformation_ctx="write_sink",    additional_options=additionalOptions)job.commit()CommentShareEXPERTFabrizio@AWSanswered a year agoAWS-User-3494384 a year agoHi,Thanks for your answer, but I tried with "updateBehavior": "LOG", and the table description and column comments were updated.ShareFabrizio@AWS EXPERTa year agothank you for the feed back I will research it a bit moreShare"


Question: account verification

how do I get my account verified so that I can create a cloudfront distribution FollowComment

Answer: 0The URL you need is in your screenshot. You will need to put in a support request to AWS Support saying you'd like to create a CloudFront distribution but your account requires verification.CommentShareJason Butzanswered a month ago


Question: Use AWS CLI to connect to AWS SSO that can only be accessed through Incognito Browser

"Hi, I'm trying to use the AWS CLI to login to my organization's AWS SSO that's can only be accessed from an Incognito browser not the main browser. Whenever I put in the SSO start URL in the CLI it takes me to the main browser SSO where it can't be accessed. Is it possible to access the SSO that's in the Incognito browser?Thanks,harFollowCommentharjones23 10 months agoThank you for your response. I'm running this on command prompt, would you happen to know the windows alternative of the command. Looked for it but didn't find anything. I also tried the -incognito at the end of the SSO url but it didn't work.Shareajmarcin 10 months agoI'm not sure, but it may be found in the command prompt properties menu (right click the bar at the top). More information may be found in the shell documents: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commandsShare"

Answer: "0Hello,I believe there are a couple options here. The CLI uses the default browser settings, so one option is to set your default browser to private. This isn't desirable, so you'd have to change the command line or terminal default browser settings.For command prompt, it may be possible through the properties menu (found by right clicking the bar at the top). More information can be found in the shell documents.For a linux terminal, it's done through the command: sudo update-alternatives --config x-www-browser. Adding the -incognito tag may also work.Hope this helps.CommentShareajmarcinanswered 10 months ago"


Question: "All data in RDS on my account has been deleted, how can I recover it?"

"All data in RDS on my account has been deleted, how can I recover it?FollowComment"

Answer: "0If you have snapshots, try restoring from snapshots. [1] [2][1] I accidentally deleted my Amazon RDS for MySQL instancehttps://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-accidental-delete/?nc1=h_ls[2] Restoring from a DB snapshot - Amazon Relational Database Servicehttps://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.htmlCommentSharemn87answered 8 months ago0Hello,Only way to recover is by restoring the snapshot or if you have its native engine dumps stored anywhere.CommentShareVetrivelanswered 8 months ago"


Question: Amazon SNS: Unable to find ARN for topic subscription

"I'm trying to subscribe to a topic via SNS according to this documentation, but the only topics I can find in the SNS Create Subscription panel are my own.When I enter arn:aws:sns:us-east-1:137112412989:amazon-linux-2022-ami-updates in the Topic ARN search field, it can't be found, and if I just copy/paste the ARN in the Topic ARN field and submit, I receive the following error message: Couldn't create subscription. Error code: InvalidParameter - Error message: Invalid parameter: TopicArnFollowComment"

Answer: "0Accepted AnswerHello,You do not have select one of your created topics from the input dropdown when creating a subscription, you can copy/paste a topic ARN into the box.  The selector just makes it easier to populate a topic based on the topics you have created so you do not have to remember them or copy/paste them.Please retry copy/pasting that ARN and creating the subscription.CommentShareEXPERTChris_Ganswered 8 months agoamazon-linux-2022 8 months agoI've copy/pasted the ARN, but I receive the following error: "Couldn't create subscription. Error code: InvalidParameter - Error message: Invalid parameter: TopicArn." I'll update my question to reflect this.ShareChris_G EXPERT8 months agoCan you confirm you're currently using us-east-1? You'll get that error if you're trying to use any other region.Shareamazon-linux-2022 7 months agoThanks, this was the issue - I didn't realize subscriptions were limited by region!Share"


Question: Data loss or duplication on Cloudtrail LookupEvents API StartTime parameter

"I need to use LookupEvents API provied by Cloudtrial to periodically fetch events. Initially I set a **StartTime **parameter to something initially, and fetched all events. The after some time when I fetch, I specify the **StartTime **as recent event's **EventTime **from previous fetch + 1 second.Can I use this? Or will I miss any events? If so, can I get any suggestions while also avoiding duplicate events.FollowComment"

Answer: "3Accepted AnswerYour approach of using the most recent event's EventTime + 1 second as the StartTime for the next lookup can generally work, but there is a small chance of missing events or having duplicate events if events have the same timestamp or if there is a delay in the processing and delivery of events.To minimize the risk of missing or duplicating events, you can slightly modify your approach:Use the EndTime parameter along with StartTime. Set the EndTime to the current time when you make the API call. This ensures you're only fetching events within a specific time window.When setting the StartTime for the next API call, subtract a small buffer (e.g., 5 seconds) from the most recent event's EventTime. This will help account for events with the same timestamp and potential delays.By implementing these changes, you will reduce the chance of missing or duplicating events. However, you may still need to handle duplicates on your side by storing and comparing event IDs or implementing deduplication logic.CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Deploy microservice

I have a microservice. What would be the most appropriate and economical infrastructure. The idea is to always keep the same public ip to associate it to the DNS. And that it does not change when we make new deployments.Use Fargate with Balancer.Use Api Gateway.Use Beanstalk with Elastic Ip in an EC2 and without Balancer.FollowComment

Answer: "0Hi there,To always keep the same public ip associated to the DNS of your microservice, you can use AWS Global Accelerator. Using an accelerator provides static IP addresses and improves the availability and performance of your applications.Your microservice architecture would look like this:Accelerator → ALB → ECS FargateYou can add the accelerator when you create a load balancer.  https://docs.aws.amazon.com/global-accelerator/latest/dg/about-accelerators.alb-accelerator.htmlOptionally, you can also access an AWS API Gateway via static IP addresses provided by AWS Global Accelerator. See blog post for more.You can always use the AWS Calculator to estimate what your expense would look like and determine if it is economical for you.CommentShareOlawale-AWSanswered 9 months ago"


Question: Using Appsync with Redshift?

"We use Redshift extensively and want to implement a GraphQL API in front of reporting tables. I can't see an obvious way of using Appsync for this, without creating a middleware layer in e.g. lambda.I'm hoping I'm missing something, because being able to do this by config in Appsync would be brilliant!FollowComment"

Answer: "0Hi,I regret to inform that it is not currently possible to integrate Appsync directly with Redshift. We can find the list of supported Datasources and operations here in our Appsync DocumentationAs you have already mentioned, you would need to use a Lambda function in the middle to use Appsync with Redshift. I hope this helps. Please let us know if you may have any other questions for us.CommentShareSUPPORT ENGINEERRyan_Aanswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-User-2532670 a year agoThanks Ryan, much appreciated and very clear.Have you got any links to design patterns/ tutorials to get us on the right path?ShareRyan_A SUPPORT ENGINEERa year agoHi,Thanks for your reply. I have checked out our documentation and blogs but unfortunately it does not look like we have a tutorial that covers an Appsync -> Lambda -> Redshift integration. I would recommend starting with these 2 separate links to get you startedAppsync -> Lambda tutorial https://docs.aws.amazon.com/appsync/latest/devguide/tutorial-lambda-resolvers.htmlLambda -> Redshift blog post https://aws.amazon.com/blogs/big-data/building-an-event-driven-application-with-aws-lambda-and-the-amazon-redshift-data-api/In the blog, you can replace the Amazon Eventbridge with Appsync as the trigger to the Lambda function. I do hope this helps you get started.Share"


Question: Does Reserve instances free reservation during replacement

"Hi,Let's say I bought 1 Zonal Reserved Instances, so InsufficientInstanceCapacity error won't happen during my deployment. I'm using Terraform for my deployment so during deploy this one instance is terminated and after than new one is created.My question is how Reserved Instances will work in that case. Will terminating instance free reservation instantly or does it work like "terminate" state - instance does not exist anymore, but it still takes reservation for a little while.FollowComment"

Answer: "0Reserved instance(RI) only apply to running instances. Once an instances is terminated the RI covering the instance will be released and applied to another instance that the RI covers or simply go unused if no instances matching the RI exist.CommentShareAWS-User-6621777answered 6 days ago0To ease any concerns regarding how zonal RIs apply to your instances when you terminate them or launch new ones, we highly recommend using On-Demand Capacity Reservations (ODCR) instead - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-capacity-reservations.html - Zonal EC2 RIs were the very first type of RIs offered to customers, and they are very restrictive. To make sure you make best use of the capacity reservation, use ODCRs instead. And if you still want to benefit from the discount, purchase EC2 Instance Savings Plans instead of those zonal RIs (if your RIs are currently active, you can wait until they retire, and simply replace them with savings plans instead).From capacity perspective - ODCR is flexible in a way that if you terminate an instance, the capacity will no longer be used, and you can launch a new instance into that reservation space. You can also set it up the way you need - either specify which ODCR you want your instance to use at launch, or leave the reservation open, so any instance with matching attributes could launch into that ODCR. You cannot do this with RIs (e.g. you can't specify to which EC2 instance you want your RI to apply, it just applies automatically depending on the attributes / parameters).From the discount perspective - Savings Plans can apply both to your running EC2 instances, or to your unused capacity reservations (unused ODCRs). For example, if you are runing an instance inside the ODCR, in that case that instance will be benefiting from the SP discount; let's say you terminate your instance, now your ODCR is idle - so during that time your SP will be covering that idle reservation; and then, if you decide to launch a new instance inside your ODCR, that instance will start getting the discount from your SP again in place of the original instance that you already terminated. When instances are running inside the ODCR - you are also not paying for that capacity reservation.I hope this helps!CommentShareEXPERTNataliya_Ganswered 3 hours ago"


Question: Changing IAM Role on EC2 instance: Internal Error

"Hello,I am trying to change the IAM role assigned to an ec2 instance.In the AWS console, it results in:Error updating IAM RoleAn internal error has occurredI have tried it with multiple ec2 instances.  I've tried it with new roles and roles that have worked before.What other information can I look at to diagnose and/or fix this?Thanks!JerryCFollowComment"

Answer: 0I needed the instance to be running...CommentShareJerryCanswered 3 years ago


Question: Email Attachment in SES

"Hi.,Is there a way that I can only save the attachments in S3 when an email comes to SES domain.I don't want to save the entire email content just the attachment.FollowComment"

Answer: "0Hi,It looks like this stackoverflow thread might meet your requirements to extract the attachment from your email and save to s3 using a lambda function.https://stackoverflow.com/questions/44389550/extract-and-save-attachment-from-email-via-ses-into-aws-s3Hope this helps,-randyCommentShareRandyTakeshitaanswered 4 years ago0Thank you very much.!!CommentShareSiddiqanswered 3 years ago"


Question: Is it possible to run a JDK11 application on EMR serverless?

"Is it possible to run a JDK11 application on EMR serverless? I tried and got an error:Job execution failed, please check complete logs in configured logging destination. ExitCode: 1. Last few exceptions: Exception in thread "main" java.lang.UnsupportedClassVersionError: [......] has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0...Thanks!FollowComment"

Answer: "1Accepted AnswerShort answerNot at this time.Long answerAs outlined in the Hadoop Java Versions documentation[1], Apache Hadoop 3.3 and upper supports Java 8 and Java 11 (runtime only) and compiling Hadoop with Java 11 is not supported.Currently, EMR Serverless supports only EMR release 6.6.0 with Hadoop 3.2.1, which unfortunately supports Java 8 only. Therefore, updating the java version on EMR might lead to unintended behaviour.There is a feature request to add Java 11 support in EMR.   EMR updates are listed in link[2].For verification purposes, I run the following simple Spark job in EMR Serverless to check the available Java versions:import osif __name__ == "__main__":    print(os.listdir("/usr/lib/jvm"))The job returned the following: ['jre', 'java-1.8.0-amazon-corretto.x86_64', 'java']. This means that the only version available in EMR Serverless for now is Java 8.Documentation links:[1] https://cwiki.apache.org/confluence/display/HADOOP/Hadoop+Java+Versions[2] https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-whatsnew.htmlCommentSharefilipganswered 10 months ago0Updated: now it possible, you can use emr-serverless 6.9.0 and custom image with java 11Documentation links:[1] https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/application-custom-image.html[2] https://aws.amazon.com/ru/blogs/big-data/add-your-own-libraries-and-application-dependencies-to-spark-and-hive-on-amazon-emr-serverless-with-custom-images/CommentSharedmitrymakarevichanswered 3 months ago0I followed the steps provided in documentation to create custom image of JDK 11, however, I am still unable to run my job.I had set:--conf spark.executorEnv.JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.16.0.8-1.amzn2.0.1.x86_64 --conf spark.driverEnv.JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.16.0.8-1.amzn2.0.1.x86_64I have posted my detailed query here: https://repost.aws/en/questions/QU-LEd1uM2Rr2p82ZNOvv9xg/emr-serverless-custom-image-not-runningHas anyone of you tried the scenario with latest emr serverless release?RegardsTapanCommentShareTapan Sharmaanswered 21 days ago0I am able to run that. I had not added emr-serverless in the driver env variable. It should have been spark.emr-serverless.driverEnv.JAVA_HOME.Thanks guys.CommentShareTapan Sharmaanswered 21 days ago"


Question: Environment forever stuck in abort

"Hi There,We accidentally deleted a Custom AMI prior to a transitioning the environment to a new Custom AMI, and now the environment is forever stuck in an abort.  Is there anyone who can assist?  In trying to update the AMI via the CLI, we receive this error:command: aws elasticbeanstalk update-environment --environment-name {env-name} --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=ImageId,Value={new-ami-id} --region {region}An error occurred (InvalidParameterValue) when calling the UpdateEnvironment operation: Environment named {env-name} is in an invalid state for this operation. Must be Ready.Thanks!Edited by: bwn on Jan 11, 2019 1:59 PMFollowComment"

Answer: 0We ended up deleting the entire application and starting over.  Too bad that AWS doesn't appear to really assist much in these forums anymore.Best of luck to anyone with the same issue!CommentSharebwnanswered 4 years ago


Question: How To Inject A Nonce Into CoudFront Distribution For My Content Security Policy

"Hello All,I am building a new website from scratch.  I want to comply with the latest CSP recommendations.Using Nginx on an EC2 instance that serves as my origin. I have configured Nginx to inject a nonce into me Headers and the various scripts and styles. I have moved al in-line stuff to style sheets and js files. I used this tutorial: --https://krvtz.net/posts/easy-nonce-based-content-security-policy-with-nginx.htmlAll works great when I access the server directly via cdn.mywebsite.com. I also use the same subdomain, cdn.mywebsite.com as the source for my CloudFront Distribution.  I then invalidate the whole,  /*, distribution.  When I access the site via mywebsite.com, which is set up via Rout 53 to fetch from CloudFront, everything breaks.I view the source code and see that the nonce has been rewritten to "" instead of the nice and secure string that I get when directly accessing via the origin.I can figure things out but am lost. Do I need a Lambada function or something else?Hugs and kisses for any help provided,JCUFollowComment"

Answer: "0Hi,Thanks for your question and it seems we missed on our backlog. I am really sorry for that.Can you please confirm if you still have issues?I believe that this issues it is related to CORS - cross-origin resource sharingHow do I resolve the "No 'Access-Control-Allow-Origin' header is present on the requested resource" error from CloudFront? -> https://aws.amazon.com/premiumsupport/knowledge-center/no-access-control-allow-origin-error/Looking forward for hearing back from you.CommentShareAWS-User-5519546answered 10 months ago"


Question: Resolving the error "Ensure IAM policies are attached only to groups or roles"

"In essence I am working to clean up a bunch of concerning items in AWS.  One of which is the error in the title.From my own research, it seems pretty straight forward, in essence goto the IAM console, open the user out of policy, copy down what their permissions are, goto Policies, create a new policy for those permissions, goto Roles or groups as needed create a role/group and attach the policy to it, Go back to the initial user section, and remove existing permissions and add a policy attached from a group, and put in the role/group with the newly made policy.So that is my understanding of the process.Is it wrong?  if so please elaborate.Also since it looks like roles a groups can both be assigned policies, what is the best use case for both?Thanks all in advanced for the assistance.FollowComment"

Answer: "1@rowanuThanks for the reply, it is helpful.I do see a lot of these have their permissions defined by JSON.  Now several are identical except for the ARN for the specific S3 bucket that they are attached to.We have data being pulled and dropped into a specific buckets (dozens of them) and individual users made to interact with each of these buckets, I believe this is all being accessed\used through custom code through Azure Devops.How do I create a single policy and/or single group to cover these without giving extra permissions to users that shouldn't have them.  Currently IAM user 1 has a policy json to give it permissions to s3 bucket 1, and IAM user 2 has a policy json to give it permissions to s3 bucket 2 but with identical permissions to their respective buckets.  Can this be done, creating a single policy (covering the specific S3 permissions defined in the JSON) that I can apply to a group, OR individual users that will grant IAM User 1 to S3 bucket 1 but not Bucket 2, 3, 4 etc; that can then be put onto ALL the users that share these S3 access permissions?I am trying to avoid making dozens of nearly identical policies to accommodate each of these user\bucket combos; that would also require making new policies each time a new user\bucket combo was made.  Instead make it once and either apply it to a new user, or add the next new user to a group with this policy assigned, either way is fine.Thanks again!CommentShareBigD63answered a year agorowanu a year agoIt sounds like you want to leverage attribute-based access control (ABAC), which can do what you want, but gets complicated.Check out the official docs https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html or the official blogs https://aws.amazon.com/blogs/security/tag/abac/ to learn more about ABAC.You will have to attach a tag to the user, and then reference that tag in the policy that's attached to the group to determine the bucket that they can access.Share1I think your understanding is correct. This error is flagging that you have IAM policies attached directly to users. This makes it harder to keep track of who has what permissions, and keep them updated over time. If you want to keep using IAM users, then you should be using groups to assign them permissions.Roles and groups both leverage identity policies, but perform very different purposes.Groups help you manage users, roles allow you to give short-term access to AWS (such as users, AWS services, etc).CommentSharerowanuanswered a year ago"


Question: Unable to set ResponseHeadersPolicyId via CloudFormation

"I found this post: https://forums.aws.amazon.com/thread.jspa?threadID=347842,now i found myself in the same spot but cannot make it work. I get this message:UPDATE_FAILED: CloudFrontDistribution (AWS::CloudFront::Distribution)Property validation failure: [Encountered unsupported properties in {/DistributionConfig/DefaultCacheBehavior}: [ResponseHeadersPolicyId]]I'm in the eu-south-1 regiono, if that can help.Thanksedit: i add part of my configuration as example:    CloudFrontDistribution:      Type: AWS::CloudFront::Distribution      DependsOn: [ CloudFrontCustomNoCachePolicy ]      Properties:        DistributionConfig:          HttpVersion: http2          Enabled: true          DefaultCacheBehavior:            ViewerProtocolPolicy: redirect-to-https            AllowedMethods:              - GET              - HEAD              - OPTIONS              - PUT              - PATCH              - POST              - DELETE            CachedMethods:              - GET              - HEAD              - OPTIONS            CachePolicyId: { Ref: CloudFrontCustomNoCachePolicy }            Compress: true            OriginRequestPolicyId: 59781a5b-3903-41f3-afcb-af62929ccde1 # ID of managed Managed-CORS-CustomOrigin            # dosnt work... why? it is needed tho            ResponseHeadersPolicyId: 5cc3b908-e619-4b99-88e5-2cf7f45965bd # ID of managed Managed-CORS-With-Preflight            TargetOriginId: XXXif i comment out ResponseHeadersPolicyId it worksFollowComment"

Answer: "0Maybe you did some typo or is putting this property in the wrong place?Here you can find my code with this field which works :)CommentShareMGanswered a year agoNemolo a year agoThanks for the answer, i updated the question with part of my configurationShare"


Question: deny access to a specific idp provider while creating an iam role

"Hello All,Using Landing Zone. Each sub account has its own admin users. I would like to implement this as a service control policy from the main account.We have a job workflow in github actions which requests an access token from the AWS IdP provider that we created at our end. This short lived access token is then passed on to an IAM role which has been mentioned in the github workflow. As part of creating the trust relationship of this IAM role, our ORG repo needs to be mentioned. However, this trust relationship can either be edited or a 2nd role with web identity federation can be created to bypass this trust relationship. This way the role can actually be used on via a public repo as well.I would like to deny access to a specific IdP provider while creating an IAM role.sample code{    "Version": "2008-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"            },            "Action": "sts:AssumeRoleWithWebIdentity",            "Condition": {                "StringLike": {                    "token.actions.githubusercontent.com:sub": "repo:ORG/*"                }            }        }    ]}Using the UpdateAssumeRolePolicy IAM action I can deny any the ability to edit the trust relationship, however, as a work around, admin users can still create a role with a custom string.Let me know if you need any further informationThanksdsidsFollowComment"

Answer: "0Hello,Thank you for contacting us! I understand that you would like to deny access to a specific IdP provider while creating an IAM role.I would like to share with you that unfortunately, it is not possible to restrict the control on specific Identity Provider when creating a role.When you start creating a role (via Console), it starts with making a selection on the trusted entityand provides you with the following 5 Trusted entity types:AWS serviceAWS accountWeb identitySAML 2.0 federationCustom trust policyDue to process-flow requirements (of "iam:CreateRole"), it is not possible to restrict the selection of a particular available resources in the drop-down for any of these above 5 Trusted entity types. Hence, your use-case cannot be met. I highly regret for the inconvenience this may have caused to you.Next, you may please refer the document [1] which defines all the supported Condition Keys on the reource/s for the respective API ("iam:CreateRole" here). If you note, "iam:CreateRole" doesn't have any condition key which can enforce restrictions on the Identity Provider.Reference:[1] Actions, resources, and condition keys for Identity And Access Management: https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.htmlIf the suggestions above was not adequate to address your concern, I request you to please create a support case instead, with us, so that we can discuss it further.Please do not post any sensitive information over re:Post since this is a public platform. Please don't hesitate to reach back with any further questions or concerns and we will be glad to assist you accordingly.Thank you.CommentShareAWS-User-0773029answered a year ago"


Question: AWS Connect call agents without being logged in

"Hi,Please help. For my use case I need AWS Connect agents to answer customer calls using their mobile. I managed to configure pick-up from mobile phone for each agent but it will forward calls only if the user in logged in into the Agent console. How can I make the mobile phone forward to function only for the call center opening schedule?Thank youFollowComment"

Answer: 1If you want to transfer to phone numbers without needing to have someone be logged in you could check for opening hours and if it is during opening hours use a Lambda function to retrieve the phone number you want to dial from a DynamoDB table and then make an outbound phone call using the "Transfer to phone number" block.CommentShareThomas_Ranswered a year ago


Question: Running spark job from AWS Lambda

I would like to get data from IceBerg table using AWS Lambda. I was able to create all the code and containers only to discover that AWS Lambda doesn't allow process substitution that spark uses here: https://github.com/apache/spark/blob/121f9338cefbb1c800fabfea5152899a58176b00/bin/spark-class#L92The error is:/usr/local/lib/python3.10/dist-packages/pyspark/bin/spark-class: line 92: /dev/fd/63: No such file or directoryDo you maybe have some idea how this can be solved?FollowComment

Answer: "0Hi,You can run it for sure. The thing is that you can´t initialise the env that way.See this post for inspiration.https://plainenglish.io/blog/spark-on-aws-lambda-c65877c0ac96If not, my suggestion here is to change to a Java based Lambda ( Spark and Iceberg are based on Java Virtual Machine).Bests.CommentShareacmanjonanswered 5 months ago0Hi,not sure I understand your use case, if you just need to read the Iceberg table from the Lambda Function, a better option might be to invoke a query in Athena using pyAthena or the aws-sdk-pandas, which is provided as a Lambda Layer as well.if you are trying to run  some specific spark jobs and you would like the semplicity of a serverless function you might want to have a look at AWS Glue.hope this helpsCommentShareEXPERTFabrizio@AWSanswered 5 months ago"


Question: Amazon instance can't connect after 23days

"hello allI created one instance with instance type t2.small on 10/8.I tried to connect to that instance today(12/14), but I'm stuck.I can't connect to SSH or EC2 Instance Connect.I checked the instance status on the EC2 consoleThe instance status is running, and the status check is 2/2 checked passed.There was no error log in "Get system log" in "monitor and troubleshoot".How should I confirm that I cannot connect from what day?regardsstuartFollowComment"

Answer: "1Accepted AnswerThe best place to raise this question is with our support team because they can troubleshoot with you.However, some other steps:Have you tried restarting the instance from the console?Has anything else changed (Security Groups, NACLs).Can you reach other instances using SSH?Given that EC2 Instance Connect isn't working my guess is that something is "wrong" in the operating system and a reboot might resolve it.CommentShareEXPERTBrettski-AWSanswered a year agostuart90 a year agothanks for reply.1.restarting instance haven't try yet. i will try that.2.Security group, NACL haven't changed since created.3.other instances can connect without problem.Sharestuart90 a year ago@Brettski@AWSAs you suggested, instance reboot return to get normal state.Thanks again.Share1More of a suggestion for future usage, take a look at the Systems Manager session manager, in case you're not able to SSH it will help with access easier than EC2 instance connect in my experience: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.htmlWhat @Brettski@AWS mentioned is also what I'd recommend for troubleshooting it could be that the system is just in a hung state and a reboot from the console will resolve the connection issues.  You can take a look at the CloudWatch metrics as well to see if perhaps you hit high CPU and that's why the machines has issues.CommentShareEXPERTRob_Hanswered a year agostuart90 a year ago@Rob_HThanks for reply.As @Brettski@AWS mentioned, restart instance will recover to normal state.I think system is freeze and can't restore to normal state.As you suggested, i will try Systems Manager session manager later.Share0I have the same problem but no joy with reboot :'(I think it's an authorization problem because I faced the awful "sudo must be owned by uid 0" error message after trying to update my servers SSL's and then reinstated mistakenly typing "chown root:root /etc" (instead of /etc/sslSubfolder...)... So now I can't access this instance (and this instance only) neither over SSH nor over the web based EC2IC. Serial connection is not possible due to incompatible instance type. The consequence is that I can't fix the authorization cmd mistake I made since every troubleshouting doc I see involves connecting over SSH... I can't even restart the SSH service on this instance. Restarting the instance didn't change anything. Even hard restart which may also have caused more issues although using elastic ip's so records are intact but apache config seems altered too.CommentSharerePost-User-7744359answered 7 months ago"


Question: "Bug Report: InvalidParameterCombination: DBInstanceClass=db.t3.micro, Engine=mariadb, EngineVersion=10.6.10, LicenseModel=general-public-license"

"I think I discovered a bug. I tried running my Terraform code for my resources in Region Asia Pacific (Jakarta) ap-southeast-3.Previously it's something like thisresource "aws_db_instance" "test_database" {  allocated_storage               = 30  max_allocated_storage           = 100  engine                          = "mariadb"  engine_version                  = "10.6.8"Then the console outputInvalidParameterCombination: Cannot upgrade mariadb from 10.6.10 to 10.6.8I tried changing to 10.6resource "aws_db_instance" "test_database" {  allocated_storage               = 30  max_allocated_storage           = 100  engine                          = "mariadb"  engine_version                  = "10.6"It showsInvalidParameterCombination: RDS does not support creating a DB instance with the following combination: DBInstanceClass=db.t3.micro, Engine=mariadb, EngineVersion=10.6.10, LicenseModel=general-public-license. For supported combinations of instance class and database engine version, see the documentation.I checked in the RDS console for my instance. It's somewhat already in version 10.6.10.But when I tried modify the instance, the options shows nothingThen I tried creating a new RDS, there is no options 10.6.10.FollowComment"


Question: How to define the rightsize RDS postgresql instance

looking for a way to know the rightsize RDS postgres instance.FollowComment

Answer: "2Accepted AnswerThe rightsize of your RDS instance depends on your workload, is it predictable? you can check this document  https://d1.awsstatic.com/whitepapers/cost-optimization-right-sizing.pdfI think enabling and monitoring Performance insights is also something that you can look into. Based on the database load, you can decide if you need to scale your instances or storage as well.CommentShareOthnajidanswered a month agoEXPERTAWS-User-Nitinreviewed a month agoJacob alonso a month agoThank you.Share"


Question: Help with Inference Script for Amazon Sagemaker Neo Compiled Models

"Hello everyone, I was trying to execute the example mentioned in the docs - https://sagemaker-examples.readthedocs.io/en/latest/sagemaker_neo_compilation_jobs/pytorch_torchvision/pytorch_torchvision_neo.html.I was able to successfully run this example but as soon as I changed the target_device  to jetson_tx2, after which I ran the entire script again, keeping the rest of the code as it is, the model stopped working. I was not getting any inferences from the deployed model and it always errors out with the message:An error occurred (ModelError) when calling the InvokeEndpoint operation: Received server error (0) from <users-sagemaker-endpoint> with message "Your invocation timed out while waiting for a response from container model. Review the latency metrics for each container in Amazon CloudWatch, resolve the issue, and try again."                According to the troubleshoot docs https://docs.aws.amazon.com/sagemaker/latest/dg/neo-troubleshooting-inference.html, this seems to be an issue of model_fn() function.The inference script used by this example is mentioned here https://github.com/aws/amazon-sagemaker-examples/blob/main/sagemaker_neo_compilation_jobs/pytorch_torchvision/code/resnet18.py , which itself doesn't contain any model_fn() definition but it still worked for target device ml_c5.So could anyone please help me with the following questions:What changes does SageMaker Neo do to the model depending on target_device type? Since it seems the same model is loaded in a different way for different target device.Is there any way to determine how the model is expected to load for a certain target_device type so that I could define the model_fn() function myself in the same inference script mentioned above?At-last, can anyone please help with the inference script for this very same model as mentioned in docs above which works for jetson_tx2 device as well.Any suggestions or links on how to resolve this issue would be really helpful.FollowComment"

Answer: "1Accepted AnswerAs you mentioned, you changed the Neo compiling target from ml_c5 to jetson_tx2, the compiled model will require runtime from jetson_tx2. If you kept other code unchanged, the model will be deployed to a ml.c5.9xlarge EC2 instance, which doesn't provide Nvida Jeston.The model can't be loaded and will error out since Jestion is a device Nvidia GPU structure while c5 is only equipped with CPU. No CUDA environment.If you compile the model with jeston_tx2 as target, you should download the model and run the compiled model in a real Nvidia Jeston device.CommentShareAWS-User-5210721answered 6 months agoRupesh 6 months agoIt looks like I overlooked where the model was actually being deployed. Thanks a lot for pointing it out.Share"


Question: Matchmaking Configurations Metrics Missing Matches Created

Hi there. As of about 11am PST this morning the matchmaking configurations dashboard has stopped showing metrics for matches created and tickets succeed. It looks like this is probably just a reporting issue as I am still seeing game sessions running on my fleets. Still a bit disconcerting. Any insight would be appreciated. Thanks!FollowComment

Answer: "0Sorry about that.Are you still seeing it? In any particular regions or all regions? Can you provide a matchmaker configuration id that is impacted?I've pinged the GameLift service team about this to see if they are aware.  I don't see any status reports on https://status.aws.amazon.com/ so it may be just localized to you sadly.In the future, if this is impacting your game, you may want to open an issue through AWS Support as they can talk directly to GameLift.CommentSharerePost-User-5332620answered 3 years ago0Sure. We run our match making out of us-west-2. The configuration is BattleArena-Default-Latest. Happy to open an issue if that's the preferred route. Thanks for the quick response.CommentSharerePost-User-4559156answered 3 years ago0Any updates the this issue? I'm still not seeing the missing metrics in our matchmaking dashboard. Should I open a support issue? Thanks.CommentSharerePost-User-4559156answered 3 years ago0Apologies, I missed your responses. I have pinged the GameLift Service team for help in understanding whats going on.Do you have any sample ticket ids? Or the Matchmaking config id? Or fleet/queue id this is tied to? Would help identify your resource as "BattleArena-Default-Latest" may not be unique enough to identify your  account and config.CommentSharerePost-User-5332620answered 3 years ago0Sure! The matchmaking configuration in question uses queue:arn:******I'm not actually sure where in the dashboard I can see individual ticket ids...?CommentSharerePost-User-4559156answered 3 years ago0Checking in again. The issue still persists and I'd be curious to know if the GameLift team has had an opportunity to look into it. Thanks for any updates!Also, I did look into creating a case in the AWS support center but apparently I have to upgrade to a higher paid tier to do so. Think I'm not clear of the preferred  method to open an issue. Surely I don't have to pay for an upgraded support plan just to file a bug...?CommentSharerePost-User-4559156answered 3 years ago0I can confirm that I am facing a similar issue with the matchmaking configuration dashboard in the us-east-1 region.CommentSharerePost-User-5100160answered 3 years ago0Looks like the situation may have been resolved as of around 1:30PM PST. My thanks to anyone involved in resolving the issue (and to chrisgong for the bump).CommentSharerePost-User-4559156answered 3 years ago"


Question: Access restriction in CloudFront

"Hi, everyone.I would like to restrict access to my files in Amazon S3 bucket.In my case, I developed a game that has to download 500MB to 1GB assets when it starts in the first time.Players can access my files via a CloudFront link, download it, and I have no idea who he is.So I'm worried about malicious downloads, how can I prevent this from happening?Does AWS have done anything for preventing this kind of problem(ex: Malicious downloads which cause massive Bandwidth cost)?Maybe to have a expiration token to restrict access?FollowComment"

Answer: "0Accepted AnswerHello JinAn,You can configure CloudFront to require that users access your files using either signed URLs or signed cookies.  You then develop your application either to create and distribute signed URLs to authenticated users or to send Set-Cookie headers that set signed cookies on the viewers for authenticated users. (To give a few users long-term access to a limited number of files, you can also create signed URLs manually.)~ Serving Private Content with Signed URLs and Signed Cookies - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.htmlAll the best,EtienneCommentShareEtienneAtAWSanswered 4 years ago0You want to limit the bandwidth or number of downloads per IP per day?Use Lambda to catch the Viewer Request events, and record the visitor's IP and number of requests on db from your Lambda function.If the same IP requested too many downloads today, ban the IP.Lambda+Cloudfront How To: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.htmlHow to use a DB from Lambda: https://docs.aws.amazon.com/lambda/latest/dg/vpc-rds.htmlCommentSharelbphpanswered 4 years ago0Thanks!CommentShareJinAnanswered 4 years ago0Awesome! Thanks a lot! :)CommentShareJinAnanswered 4 years ago"


Question: Best way to track s3 bucket size growth over a user defined time period using athena queries or other tools

"I see from this blog post that we can get S3 bucket size in athena using storage_mb like this:https://aws.amazon.com/blogs/storage/query-amazon-s3-analytics-data-with-amazon-athena/However, how might one track the bucket size growth over time, ideally over an interval defined by the customer?FollowComment"

Answer: "0Accepted AnswerIf you prefer the Athena route then you can use something like this (you can easily subdivide the results however you want, in the following example I subdivide by the storage tier):SELECT format_datetime(line_item_usage_start_date,         'M/d/y') AS "Day", line_item_resource_id AS "Bucket",    CASE    WHEN line_item_usage_type LIKE '%TimedStorage-Byte%' THEN    'Standard'    WHEN line_item_usage_type LIKE '%TimedStorage-SIA%' THEN    'Infrequent Access'    WHEN line_item_usage_type LIKE '%TimedStorage-Glacier%' THEN    'Glacier'    WHEN line_item_usage_type LIKE '%TimedStorage-RRS%' THEN    'Reduced Redundancy'    ELSE 'Other'    END AS "Tier", sum(line_item_usage_amount) *30 AS "Storage IN GB", sum(line_item_unblended_cost) AS "Unblended Cost"FROM customer_cur_data.customer_allWHERE line_item_product_code = 'AmazonS3'        AND line_item_usage_type LIKE '%TimedStorage%'        AND line_item_usage_start_date = timestamp '2020-08-31'GROUP BY  1, 2, 3ORDER BY  2, 1, 3In the Where section you would need to modify line_item_usage_start_date = timestamp '2020-08-31' to be whatever range or value you want. Also in the Select modify the sum(line_item_usage_amount) *30 to multiply by the actual number of days in the month (Feb would multiply by 28). The sum of unblended cost is just that day's cost. Multiply by the same number of days in the month to project the monthly cost given that amount of storage.CommentShareAWS-User-3911429answered 3 years ago"


Question: AWS Glue Monitoring error

"I am getting ‘Error loading data’  error thrown on the AWS console screen when I try to access AWS Glue Monitoring service. I gave List*, Get*, BatchGet*  for the Glue policy. Am I missing any requires actions or policies. (I can not give AWSGlueConsoleFullAccess as this is for test-users). Appreciate any help! ThanksFollowComment"

Answer: "0Sorry for the late reply, I hope your problem was already resolved.  But I'm going to put a response here because I noticed the same behavior, and had difficulty finding the solution.Allowing permissions on QueryJobRuns, QueryJobs, and QueryJobRunsAggregated allow access to Glue Jobs Monitoring without the error "Resource{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["glue:QueryJobRuns","glue:QueryJobs","glue:QueryJobRunsAggregated"],"Resource": "*"}]}This allows Glue Job Monitoring access without giving AWSGlueConsoleFullAccessCommentSharewameyeranswered 9 months ago"


Question: AWS SageMaker Studio pricing. How does the billing work?

"Hello,I am currently considering using SageMaker Studio (moved from plain SageMaker Notebook Instances to try the functionality of the Studio) and am currently trying to figure out how the billing part works.Basically my questions are:Do we start to pay after Notebook is initialized (in Studio) or when we initialize Notebook and Kernel (e.g. Python3) is performing tasks?Or is the billing based upon "Running Apps" (if that's the case, could you please describe nuances; in particular I am interested in "default" App and whether we pay for it or not)If not like in questions 1. and 2., then how?I would appreciate any help in this matter :)FollowComment"

Answer: "0Thank you for your interest in SageMaker Studio notebook.To answer your questions:Do we start to pay after Notebook is initialized (in Studio) or when we initialize Notebook and Kernel (e.g. Python3) is performing tasks?When you initialize a notebook & kernel, a compute resource is launched to run the notebook, so you will start getting billed. You don't get charged per notebook. You can create and run multiple notebooks on the same compute instance. You pay only for the compute that you use, not for individual items.Or is the billing based upon "Running Apps" (if that's the case, could you please describe nuances; in particular I am interested in "default" App and whether we pay for it or not)You are billed by compute instance, not running apps. You can have up to 4 apps running on the same compute instance.If not like in questions 1. and 2., then how?You pay for both compute and storage when you use SageMaker Studio notebooks. See Amazon SageMaker Pricing (https://aws.amazon.com/sagemaker/pricing/) for charges by compute instance type. Your notebooks and associated artifacts such as data files and scripts are persisted on Amazon EFS. See Amazon EFS Pricing (https://aws.amazon.com/efs/pricing/) for storage charges. You can find more FAQs on SageMaker Studio notebook pricing here: https://aws.amazon.com/sagemaker/faqs/#Build_ModelsEdited by: HuongNguyen on Sep 15, 2020 10:05 PMCommentShareHuongNguyenanswered 3 years agoDurga_S a year agoTo add to the answer, on #2, you don't pay for the default app. You pay only for the instances used by the notebooks/other apps. You can shut down instances when they're not in use to avoid incurring extra costs. The notebook outputs, metadata etc. will still be stored in your EFS storage.  To automatically shut down instances after an idle timeout, you can set a lifecycle configuration script as well.Share0Thank you for your interest in SageMaker Studio notebook.To answer your questions:Do we start to pay after Notebook is initialized (in Studio) or when we initialize Notebook and Kernel (e.g. Python3) is performing tasks?When you initialize a notebook & kernel, a compute resource is launched to run the notebook, so you will start getting billed. You don't get charged per notebook. You can create and run multiple notebooks on the same compute instance. You pay only for the compute that you use, not for individual items.Or is the billing based upon "Running Apps" (if that's the case, could you please describe nuances; in particular I am interested in "default" App and whether we pay for it or not)You are billed by compute instance, not running apps. You can have up to 4 apps running on the same compute instance.If not like in questions 1. and 2., then how?You pay for both compute and storage when you use SageMaker Studio notebooks. See Amazon SageMaker Pricing (https://aws.amazon.com/sagemaker/pricing/) for charges by compute instance type. Your notebooks and associated artifacts such as data files and scripts are persisted on Amazon EFS. See Amazon EFS Pricing (https://aws.amazon.com/efs/pricing/) for storage charges. You can find more FAQs on SageMaker Studio notebook pricing here: https://aws.amazon.com/sagemaker/faqs/#Build_ModelsEdited by: HuongNguyen on Sep 15, 2020 10:05 PMCommentShareHuongNguyenanswered 3 years ago"


Question: Restrict read access to CodeCommit Repository

"Hello,I have 2 repositories[repo-1, repo-2] in my CodeCommit. And have 2 IAM groups[org-1, org-2],  I want to create 2 IAM policies that will restrict read and write access for org-2 users in repo-1 and org-1 users in repo-2. I have successfully blocked the write access, now trying to block the read access, basically trying to implement two policies, where org-1 users won't be able to see repo-2 and vice versa. Can anyone please help me with this? Thanks in advance.FollowComment"

Answer: 1Some good example CodeCommit IAM policies  can be found here.https://docs.amazonaws.cn/en_us/codecommit/latest/userguide/customer-managed-policies.html#identity-based-policies-example-2You can build off the examples to get the behavior you are looking for.Here is a link for more detail on how IAM policies work.https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.htmlCommentSharetedtrentanswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months ago


Question: WAF showing wrong country name but rule still working

Weird issues with a waf. Right now i have it blocking anything outside of the US and it has been working fine.Today i notice an allowed request from Belgium but when i went to look it was just a US ip for a Palo alto scanner.Any idea why it is showing the wrong info or what to do to get it corrected?FollowComment

Answer: "1I suspect the IP database that AWS use may be out of date..Personally blocking like this will never be 100% due to how and who manages the information from IANA etc.CommentShareGary Mcleananswered a month agoEXPERTkentradreviewed a month agoRodney Lester a month agoAWS Database is updated "frequently," but your statement is correct. They are never 100% accurate.Share"


Question: EKS VPC-CNI Plugin Node Group Setup Questions

"I am creating an EKS managed node group in terraform using the eks module version 17.1.0 and up until now specifying the bootstrap_extra_args like so has been working    node_groups = [{                        name = "${var.environment}-nodes"            desired_capacity = var.eks_cluster.desired_capacity            max_capacity     = var.eks_cluster.max_capacity            min_capacity     = var.eks_cluster.min_capacity                    additional_security_group_ids = aws_security_group.nodes.id            instance_types                = [var.eks_cluster.node_instance_type]            key_name = "$$$$$$"            bootstrap_extra_args = "/etc/eks/bootstrap.sh '${local.cluster_name}' --use-max-pods false --kubelet-extra-args '--max-pods=110'"    }]I have created two clusters like this and the nodes have been created with the max pods set to 110. both of these clusters are in us-east-2I am now trying to create a cluster in China region cn-northwest-1 and the same configuration only sets the max pods to 35 and I cannot seem to get it to go any higher.Node types: t3a.large instancesNote: I have also attempted to launch the nodes in China with a launch_template containing the following userdata script and the script is read, there are no errors that I can find and I end up with the same result.MIME-Version: 1.0Content-Type: multipart/mixed; boundary="//"--//Content-Type: text/x-shellscript; charset="us-ascii"#!/bin/bash -xe/etc/eks/bootstrap.sh '${cluster_name}' --use-max-pods false --kubelet-extra-args '--max-pods=110'--//--This begs the question, are eks managed node groups setup a bit differently in china? Is what I'm trying to do even possible without some crazy workaround I cannot seem to find?FollowComment"

Answer: "0Hello,Depending on which instance family and size you run, you have a constraint of number of IPs per ENI and a max number of ENI applies too.As described here : https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENIFor example, a t3a.large instance is constrained to 3 ENI and 12 IPs per ENI at max.Do you use the same instance family/size for your clusters in us-east-2 ?For ref, a great blog post that explains the mechanisms of CNI IP allocation and how to manage the limits with prefixes.https://aws.amazon.com/blogs/containers/amazon-vpc-cni-increases-pods-per-node-limits/ThanksCommentShareJulienanswered a year agoAWS-User-8233690 a year agoyup I used the same family/size (t3a.large) in us-east-2. Hence my confusion that its behaving differently, but we have also noticed that the console in us-east-2 mentions prefixes for each network interface whereas the console in cn-northwest-1 does not.  This makes me think that the prefix assignment feature is not available in the cn-northwest-1 region which could be the issue here possibly?ShareJulien a year agoHi, i don't see any region specific limitation for prefix assignment on my end.If you already use this capability without any issue, then i would take a look at VPC CNI logs just to make sure the plugin can operate as expected for allocation.ie: troubleshooting scenarios described here : https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.htmlShare"


Question: Difference between free tier GP2 storage and gp2 storage running PostgreSQL?

"I´m a begginer in AWS and I'm using the free tier to learn AWS, and I´ve tried with one instance database. A few days ago, there are some little costs with GB/month gp2 storage running PostgreSQL.What's the difference between free tier GP2 storage and gp2 storage running PostgreSQL?FollowComment"

Answer: "0Accepted AnswerHello, I hope you are doing well! From your question, its unclear the region in which your resources are operating and if you are running PostgreSQL within Amazon EC2 or if you are leveraging Amazon RDS to run your database. For each service, there is separate free tier which stipulates what you will not be charged for as long as you are operating within the free tier limits.For example, Amazon EBS when used with Amazon EC2 allows for the following utilization within the free tier (link to source):30 GB of Amazon EBS: any combination of General Purpose (SSD) or Magnetic2,000,000 I/Os (with EBS Magnetic)1 GB of snapshot storageWith Amazon RDS, the free tier includes the following usage (link to source):750 Hours per month of db.t2.micro database usage (applicable DB engines)20 GB of General Purpose (SSD) database storage20 GB of storage for database backups and DB Snapshots**Note that the RDS free tier is inclusive of its storage utilization whereas EC2 and EBS have separate free tiers. **Moving forward, I suggest you leverage AWS Cost Explorer to further dive into your AWS utilization and costs. If you are using RDS, I suggest specifying the following within Cost Explorer:Group By - Usage TypeFilter - Service - Relational Database ServiceFilter - Usage Type Group - RDS: StorageIf you are using EC2, I suggest specifying the following within Cost Explorer:Group By - Usage TypeFilter - Service - EC2-OtherFilter - Usage Type Group - EC2: EBS - SSD(gp2)For either of the above views in Cost Explorer, you'll be able to see the volume usage in GB-Month as well as any associated costs for that utilization. I hope that this answers your question and provides additional visibility into why you were seeing costs for gp2.CommentShareDanBoothanswered a year ago"


Question: Sagemaker - S3 bucket access when logged into us-east-1

"My IAM works, but when I login, it logs me into us-east-1.  My project is on the S3 instance (sagemaker tool).  How can I access buckets in S3 if I am logged into us-east-1 by default.FollowComment"

Answer: 0You can change the region when you are inside a SageMaker notebook or python script.Here you can find many examples of how to access S3 buckets from SageMaker.Please elaborate more on the issue you are facing so we can help you.CommentShareIoananswered a year ago


Question: Load balancer Target group always shows unhealthy for https 443 port

"Hi,I have created a new environment (tomcat) with Elastic Beanstalk and uploaded my war application.Application works fine with http (80)inbound port https 443 entry created into respective security group.New Load Balancer created.Listener 1 http redirect to https 443Listener 2 https forward to a target group (ssl selected)Target group created with port 443 directed towards the respective instance.After some time, Target group always shows health status as unhealthy.Kindly suggest.FollowComment"

Answer: -1Please look at the link https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/CommentShareGKanswered 3 months ago


Question: AWS Lambda Layers with Python Package

"Hi,I have a python script which is running on my local machine and I want to move it to AWS Lambda for periodic execution. I have 3 import statements in the script for which I am adding layers but facing some issues.from googleapiclient.discovery import buildimport pandas as pdfrom datetime import dateFor googleapiclient api, I downloaded it in a folder and uploaded to AWS layer and lambda is able to find this module. I wanted to use this along with AWS Data wrangler package but running into layer size restriction issues. So I downloaded pandas to the same folder as google api and then uploaded the zip file to layer. But now I am get a numpy dependency error though numpy was downloaded as part of pandas install. Two folders as part of my libraries folder are numpy, numpy-1.22.0.dist-info which is correct version as per error message below. I also tried downloading numpy separately in same package but that also not working.Please let me know if I am missing something and if this is the correct approach for installing python packages for AWS Lambda.Response{"errorMessage": "Unable to import module 'lambda_function': Unable to import required dependencies:\nnumpy: \n\nIMPORTANT: PLEASE READ THIS FOR ADVICE ON HOW TO SOLVE THIS ISSUE!\n\nImporting the numpy C-extensions failed. This error can happen for\nmany reasons, often due to issues with your setup or how NumPy was\ninstalled.\n\nWe have compiled some common reasons and troubleshooting tips at:\n\n    https://numpy.org/devdocs/user/troubleshooting-importerror.html\n\nPlease note and check the following:\n\n  * The Python version is: Python3.7 from "/var/lang/bin/python3.7"\n  * The NumPy version is: "1.22.0"\n\nand make sure that they are the versions you expect.\nPlease carefully study the documentation linked above for further help.\n\nOriginal error was: No module named 'numpy.core._multiarray_umath'\n","errorType": "Runtime.ImportModuleError","stackTrace": []}Function LogsSTART RequestId: de7259a6-cd11-4ecc-9f93-1a624f1c0c6d Version: $LATEST[ERROR] Runtime.ImportModuleError: Unable to import module 'lambda_function': Unable to import required dependencies:numpy:IMPORTANT: PLEASE READ THIS FOR ADVICE ON HOW TO SOLVE THIS ISSUE!Importing the numpy C-extensions failed. This error can happen formany reasons, often due to issues with your setup or how NumPy wasinstalled.We have compiled some common reasons and troubleshooting tips at:https://numpy.org/devdocs/user/troubleshooting-importerror.htmlPlease note and check the following:The Python version is: Python3.7 from "/var/lang/bin/python3.7"The NumPy version is: "1.22.0"and make sure that they are the versions you expect.Please carefully study the documentation linked above for further help.Original error was: No module named 'numpy.core._multiarray_umath'Traceback (most recent call last):END RequestId: de7259a6-cd11-4ecc-9f93-1a624f1c0c6dREPORT RequestId: de7259a6-cd11-4ecc-9f93-1a624f1c0c6dDuration: 1.68 msBilled Duration: 2 msMemory Size: 128 MBMax Memory Used: 55 MBInit Duration: 570.09 msRequest IDde7259a6-cd11-4ecc-9f93-1a624f1c0c6dRegards,DbeingsFollowComment"

Answer: "3As the error states the issue with how you NumPy was installed. Most probably you compiled it on your dev machines which might be windows, mac or some flavor of linux. While lambda runs on Amazon Linux. Since NumPy is a C extension it is better that you build the Python package for your panda and NumPy using Amazon Linux.You can easily use a docker image on your dev machine to build the packages or you can deploy an EC2 instance to build the package as well and then terminate the ec2 instance. If you use CodeBuild to build your packages then CodeBuild also runs on Amazon Linux.CommentSharehameedullahanswered a year agodbeing a year agoThanks a ton! This was indeed the issue. I now used EC2 instance to install pandas files in a folder ( pip install pandas -t .) and then copied the files to my machine and then put the zip folder on my AWS layer. This worked.Share"


Question: EKS Control Plane Security

"Hi,A customer in the enterprise sector who is currently evaluating EKS. They have an internal security document and they need help answering the following questions:Can you customize the AMI for the control pane nodes?I know it is possible to build custom AMI for the worker nodes but what about the control pane? My guess is that it isn't possible as part of the managed service offering but I want to double check.Can you activate AppArmor or SELinux on control pane nodes?Are the K8S components (api, scheduler, etc.) containerised on the control pane and can we limit the number of processes?For the latter part I assume the answer is no, but I'm just curious about the first part.FollowComment"

Answer: "1Accepted AnswerAFAIK.Q: Can you customise the AMI for the control pane nodes?Ans: No. We can't since it's managed by AWS. You are right.Q: Can you activate AppArmor or SELinux on control pane nodes?Ans: No for control plane and Yes for worker nodes i.e. pods/container -- refer slide#31 https://d1.awsstatic.com/events/reinvent/2019/REPEAT_1_Running_high-security_workloads_on_Amazon_EKS_CON334-R1.pdfQ: Are the K8S components (api, scheduler, etc.) containerized on the control pane and can we limit the number of processes?Ans: Yes the component are containerized but again we don't have access to view inside the control plane.https://www.eksworkshop.com/010_introduction/architecture/architecture_control/https://kubernetes.io/docs/concepts/overview/components/#master-componentsCommentShareAWS-User-9985273answered 3 years ago"


Question: Set group.id for Kafka event source for lambda?

"We have a self managed Kafka cluster and I would like to configure a topic to be an event source for lambda. The documentation says this is possible, but I don’t see anywhere you can set the group.Id. https://kafka.apache.org/documentation/#consumerconfigs_group.idIs it possible to configure this value?FollowComment"

Answer: "0Can you shed some light on what is it you are trying to achieve by using the group.id in the lambda context?Using group.id makes perfect sense if consumers were running on containers or EC2 because you may want traditional queue functionality within the group, where one particular message is delivered to only one member of the group.In the case of lambda, lambda can be spinning up a large number of instances to consume messages from Kafka and a particular lambda function is acting like the group in the containers/EC2 world. One message will be delivered to a particular instance of a lambda. So technically it functions just like a group of consumers.If you define another lambda function as a consumer to the same Kafka topic, that lambda function will act like its own group.CommentShareEXPERTIndranil Banerjee AWSanswered a year agoVampireHackerD a year agoThank you for your response.There are actually two cases I'm curious about. And I think you may have answered most of how this first case works already. The docs suggest when scaling that  1 consumer is created intially that processes all partitions, and that one consumer will result in multiple lambdas as needed.  But if it gets overloaded, additional *consumers * will be spun up that each target a specific partition. And additional lambdas will be spun up by that consumer as needed.  Am I understanding that correctly?What would I expect to see as active clients / groups on the kafka cluster when this happens? (that might explain what is happening without a group.id)Now if the group.id isn't really needed - I might just need another plan for multi-region redundancy. Thinking I could simply set the group.id on the event source and that would allow me to deploy the exact same code to multiple regions and consume the topic actively in all. The group would allow each region to consume, but they wouldn't consume messages processed elsewhere. I expect that a multi-region deployment of the same code would really look like multiple separate consumers and each region would consume every message, is that correct?ShareVampireHackerD a year agoThis blog from confluent might explain it. Says Consumers to lambdas are one to one. The event source mechanism must be responsible for divvying up the partitions when needed, and do so without a group.Id. https://www.confluent.io/blog/serverless-event-stream-processing/#scaling-and-performanceShare0https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.htmlRead on this block: Customizable consumer group IDCommentSharerePost-User-9046369answered 3 months ago"


Question: Is IoT Python SDK broken with Raspberry Pi?

"I'm following the below tutorial step by step in order to setup a Raspberry Pi for a IoT project at home.https://docs.aws.amazon.com/iot/latest/developerguide/connecting-to-existing-device.htmlI've  gone over the tutorial multiple times and am quite sure I have setup the certs / policy correctly for the Thing on the AWS IoT website.However, when I attempt to run the pubsub.py demo I get the error:Traceback (most recent call last):File "/home/pi/aws-iot-device-sdk-python-v2/samples/pubsub.py", line 113, in <module>mqtt_connection = mqtt_connection_builder.mtls_from_path(File "/home/pi/.local/lib/python3.9/site-packages/awsiot/mqtt_connection_builder.py", line 231, in mtls_from_pathreturn _builder(tls_ctx_options, **kwargs)File "/home/pi/.local/lib/python3.9/site-packages/awsiot/mqtt_connection_builder.py", line 189, in _buildertls_ctx = awscrt.io.ClientTlsContext(tls_ctx_options)File "/home/pi/.local/lib/python3.9/site-packages/awscrt/io.py", line 424, in initself._binding = _awscrt.client_tls_ctx_new(RuntimeError: 1033 (AWS_IO_TLS_CTX_ERROR): Failed to create tls contextSimilarly, when I attempt to run the shadow.py demo I get the same error.All I am trying to do in this project is tell Alexa to turn on a device and have it toggle a GPIO pin on and off. Super simple, but it seems like the Python SDK is broken at the moment. At least, maybe the latest version and for the Raspberry Pi.FollowComment"

Answer: "1Accepted AnswerI've tried to reproduce the issue on my Raspberry Pi 4. The tutorial works as expected on my environment with Python 3.7.3, awscrt 0.12.1 and awsiotsdk 1.7.1.pi@raspberrypi:~/aws-iot-device-sdk-python-v2 $ pip3 show awscrtName: awscrtVersion: 0.12.1...pi@raspberrypi:~/aws-iot-device-sdk-python-v2 $ pip3 show awsiotsdkName: awsiotsdkVersion: 1.7.1...Also, as I see from the error message you shared, you're testing on Python3.9, so I downloaded and installed the Python3.9 to simulate your environment. Again, the tutorial works as expected. I'm sharing my test outputs to help your troubleshooting.PS: I've masked some identifiers with ** characters.pi@raspberrypi:~/aws-iot-device-sdk-python-v2/samples $ python3.9 --versionPython 3.9.9pi@raspberrypi:~/aws-iot-device-sdk-python-v2/samples $ pip3.9 freezeawscrt==0.12.1awsiotsdk==1.7.1pi@raspberrypi:~/aws-iot-device-sdk-python-v2/samples $ python3.9 pubsub.py --topic topic_1 --root-ca ~/certs/AmazonRootCA1.pem --cert ~/certs/**-certificate.pem.crt --key ~/certs/**-private.pem.key --endpoint **-ats.iot.eu-west-1.amazonaws.comConnecting to **-ats.iot.eu-west-1.amazonaws.com with client ID 'test-**'...Connected!Subscribing to topic 'topic_1'...Subscribed with QoS.AT_LEAST_ONCESending 10 message(s)Publishing message to topic 'topic_1': Hello World! [1]Received message from topic 'topic_1': b'"Hello World! [1]"'Publishing message to topic 'topic_1': Hello World! [2]Received message from topic 'topic_1': b'"Hello World! [2]"'So, here are some action points that can help troubleshooting the issue:Can you check if you have, at least, those versions of packages by running pip3 show <package-name> commands?Can you check if you're providing correct certificates to the python3 pubsub.py command? Please notice the match between certificate file extensions and the parameters.FileFile pathRoot CA certificate~/certs/Amazon-root-CA-1.pemDevice certificate~/certs/device.pem.crtPrivate key~/certs/private.pem.keyCommentShareEmir_Aanswered a year ago"


Question: GameLift in 2020 - Major update now available in preview

"Calling all game developers! Today, we’re excited to release an update that enhances the flexibility in how you can adopt and use GameLift. Available now in preview, the updated GameLift FleetIQ feature allows you to on-board game server workloads to the AWS cloud while using your own game server management layer. You can now use GameLift FleetIQ to launch new games and scale or migrate live games onto low-cost AWS game servers. Just like with GameLift, you can save up to 70% compared to existing on-premises deployments.Here’s how it works. With three APIs, you can setup an Auto Scaling group in your own AWS account where GameLift FleetIQ automatically manages Spot instances to avoid game session interruption, providing you low-cost game servers that you can add alongside your existing on-premises capacity to host your live games. You can also use containers or integrate instances with other AWS services such as AWS Shield and Amazon Elastic Container Service because with the updated GameLift FleetIQ, instances can run in your AWS account.We can’t wait to see what you build with the updated GameLift FleetIQ! To learn more, check out our blog and developer guide.FollowComment"


Question: CodeDeploy Environment Variables On Windows

I am using CodeDeploy to deploy a .Net app to a Windows Server 2022 machine.I am using an AppSpec.yml file to manage the deployment steps. I have read that you can read in the CodeDeploy environment variables such as $DEPLOYMENT_GROUP_NAME in your hook scripts e.g. https://aws.amazon.com/blogs/devops/using-codedeploy-environment-variables/. The example are always in linux scripts though e.g.    if [ "$DEPLOYMENT_GROUP_NAME" == "Staging" ]thenI am wanting to do this in a cmd file as when deploying to Windows you can't use .sh files. I have tried as a test echoing the results of a variable from a cmd file but it always comes out as not being set to my Deployment Group Name.  Are CodeDeploy variables not available in windows deployments or am I using them wrong.What I am trying to achieve ultimately is to know which Deployment Group (Test or Prod) is being deployed to so that I can update some configuration accordingly.FollowComment

Answer: 1Actually figured it out. For Windows when using cmd or bat files you need to use a slightly different variable syntax. It is%DEPLOYMENT_GROUP_NAME%instead of$DEPLOYMENT_GROUP_NAMEThe %DEPLOYMENT_GROUP_NAME% gets replaced with the correct value. In my case "Staging".CommentShareBen Ifflandanswered a year ago


Question: Neptune FTS BadRequestException Error

"Hi All,While trying to use federated query for FTS, i am getting{  "code": "BadRequestException",  "detailedMessage": "An IOException happened while fetching data from ES",  "requestId": "xxx-xxxx-xxxx-xxxx"}The Query looks very simple-PREFIX neptune-fts: <http://aws.amazon.com/neptune/vocab/v01/services/fts#>SELECT * WHERE {  SERVICE neptune-fts:search {    neptune-fts:config neptune-fts:endpoint 'Elasticsearch Endpint' .    neptune-fts:config neptune-fts:queryType 'match' .    neptune-fts:config neptune-fts:field '*' .    neptune-fts:config neptune-fts:query 'naruto' .    neptune-fts:config neptune-fts:return ?res.    }  }FollowComment"

Answer: "0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following linkCommentShareSUPPORT ENGINEERChaitanya_Tanswered a year ago"


Question: Domain registration ko

"I transferred my domain to aws since the beginning of February everything was ok until this morning.everything was working perfectly and this morning no more site no more email...when I do a#dig mydomain NSWhere#dig mydomain MX...I have nothingas if my domain does not know that the DNS are those of AWS but I can not do anything at this level, or I missed something.My DNS zone is still present and has not changedThanks for your helpFollowComment"


Question: Amazon Redshift cluster snapshot stuck in Creating state

"Hi team,Our Amazon Redshift cluster "astro-providers-cluster" in the Ohio region is stuck in the "Modifying" state and I see its snapshot "astro-providers-cluster-snapshot" is stuck in the "Creating" state.I am not allowed to delete the snapshot or the cluster as it's not in one of the terminal states. Attaching the snapshots. Can you please check what's happening here? Will this affect our billing as the cluster will stay on and we don't have permission to delete it? Appreciate quick support on this, pleaseFollowCommentfred a month agoSame problem here, but with Redshift Serverless, its snapshot is stuck in "Creating State". In this stuck state, it is impossible to delete the snapshot, cluster and namespace.Share"

Answer: "0Hi - Thanks for reaching out. I would recommend to open a support ticket for this if possible so that they can check logs etc.CommentShareEXPERTAWS-User-Nitinanswered a month agoPankaj Koti a month agoYes, I tried creating one, but it says we do not have technical support on our account and it asked to reach out here. What is the best way for seeking help?Share0This issue is very specific to your account and cluster, so Support is your best plan of action.AWS offers multiple support plans, the lowest being Developer, which is recommended if you are experimenting or testing in AWS, gives you unlimited cases with 1 primary contact, and case severity of System impaired with < 12 hours SLA. Although minimum recommended tier is Business, if you have production workloads in AWS.CommentShareMilindOkeanswered a month ago0We are having the same issue since april, 20th. Cluster gets stuck for hours and hours until it becames availableCommentSharerePost-User-1298044answered 18 days ago"


Question: how to configure max concurrent transforms and instance count  parameter  in batch transform ?

"configuring a batch job for inference in sagemaker ( sample code below) . for my use case,  there are multiple input files and i'm trying to configure such that it can process files one by one or if the instance type allows process them in parallel. if value of max concurrrent transforms is greater than 1, does it processes file in parallel. as things are predefined for the job , before it starts , for exampel the instance_count is already set to 1. how does it do horizontal scaling? can it add add more instances. does the value of instance type or instance count dictate what value we can configure for max concurrent transforms parameter?from sagemaker.transformer import Transformertransformer = Transformer(model_name='my-previously-trained-model',                          max_concurrent_transforms=0                          instance_count=1,                          instance_type='ml.m4.xlarge')FollowComment"

Answer: "1To add to it, you can set the BatchStrategy to MultiLine in order to speed up the processing.General guideline is - number of workers/instances is a multiple of number of files in S3 to process.If MaxConcurrentTransforms is set to 0 or left unset, Amazon SageMaker checks the optional execution-parameters to determine the settings for your chosen algorithmCommentShareAWS-Raghuanswered a year agoclouduser a year ago@AWS-Anonymous - thanks. I am inquiring if there is a way we can figure out a value for  MaxConcurrentTransforms when we bring our own model/algorithm/container. can the value equal be to # of cpu available in whatever instance type we configure?Share0It partitions the Amazon S3 objects in the input by key. Please checkout https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.htmlCommentShareAnonymousanswered a year ago"


Question: ApiGateway has 500 error when Lambda is updating

"I am seeing a rare race condition. Sometimes, if I update my image-based Lambda to have a new image, the ApiGateway api that is triggering the Lambda returns the following error:(f654758f-d377-4222-a4c3-766325f0de32) Lambda invocation failed with status: 409. Lambda request id: 1e69c921-26ce-4c4d-81ad-183264a08c59(f654758f-d377-4222-a4c3-766325f0de32) Execution failed due to configuration error: The operation cannot be performed at this time. The function is currently in the following state: Pending(f654758f-d377-4222-a4c3-766325f0de32) Method completed with status: 500Here is how I'm updating the Lambda which causes the race condition to occur:# publish the new docker image to the functionaws lambda update-function-code --publish --function-name "$name" --image-uri "$image"# update my alias to the new published versionaws lambda update-alias --name "$stage" --function-name "$name" --function-version "$version"I must be doing something wrong, because if a Lambda image or alias can't be updated atomically, that is a deal-breaker for reliable deployments.FollowComment"

Answer: "2Accepted AnswerLambda functions can be in one of several states. This happens during function creation and update.I assume your API is configured to invoke a specific lambda alias. It seems you are moving your alias before the new lambda version is in the Active state. You should be update the alias only after the function gets into the Active state.CommentShareEXPERTUrianswered a year agoamoffat a year agoYes, that would make sense. I have added the following commands before I update the alias pointer, and it seems to clear up the issue:aws lambda wait function-updated --function-name "$name"aws lambda wait function-active --function-name "$name"Share"


Question: AWS Organizations - Control Access To All Accounts By ISO3166 Region

"Hello Team - is there a way to limit logging into any AWS account in Control Tower/Organizations by regions based on ISO 3166? As an example, i dont want anyone from an European IP address to log into any AWS Account in Organizations? I know with SCPs, you can use policies based on IP address, but is there a more wholistic way?FollowComment"

Answer: 0From the case question I understand that you would like to know if there is a way to limit access to the AWS console by geographic region such as using ISO 3166 codes.Currently the best way to achieve that would be to restrict access to specific IP addresses with a Service Control Policy. I am attaching the following documentation that goes over this here [1]. There currently isn't another condition like "NotIpAddress" which can be used in order to limit access to the AWS console to specific countries or geographic regions.I hope you have a great rest of your day!References[1] https://aws.amazon.com/premiumsupport/knowledge-center/iam-restrict-calls-ip-addresses/CommentShareSUPPORT ENGINEERPatrick_Vanswered a year ago


Question: Contact Lens for Connect: Where is the sentiment score stored?

"My company wants to enable Contact Lens but, rather than use the UI for our Connect instance, export the transcription and data from the analysis. I'm looking to see if that's feasible. I found in the documentation that the transcripts are stored in the S3 bucket with the call recordings. Where is the sentiment score, etc. stored?Edited by: jsutton on Jul 2, 2020 1:55 PMFollowComment"

Answer: 1The contact lens data is all stored in a seperate JSON file on S3. The sentiment score ranges from -5.0 to 5.0Have a look at the video on the bottom of this page: https://landing.voicefoundry.com/amazon-connect-spotlight-webinars-archive-contact-lensfast forward to 30:20CommentShareDanBloyanswered 3 years ago


Question: Bare Metal Instances Slow to Reboot.

"This problem only occurs with Bare Metal instances.I created a new metal instance c5d.metal on N. Virginia with Amazon Linux 2 AMI (HVM) - Kernel 5.10.After the instance was ready, I logged into it using SSH and restarted it by typing ‘sudo reboot’ without doing anything else.The instance failed to come back from the restart.The error was :System status checks : System reachability check failedInstance status checks : Instance reachability check failedThe error disappeared after 10 - 15 minutes after which I was able to access the instance.However, whenever I reboot the instance, the same error occurs again and I have to wait 10 - 15 minutes to access it.I tried to terminate the instance and create a new one – same problem.If I launch equivalent but non metal instances, everything works fine.The problem only occurs with Bare Metal instances, even if the instances are 'out of the box', i.e. the only thing I do after creating the instance is restarting it.Any idea what's wrong ? Thanks in advance.FollowComment"

Answer: "2Doesn't sound to me like anything is wrong per se -- bare metal instances take a long time to (re)boot because the Nitro system has to do a lot of verification before it hands control over to the instance.  (More than is necessary on regular instances, because being "bare metal" gives the customer code far more low-level control over the system than it gets on regular instances.)CommentSharecpercivaanswered a year ago0As per Colin's - yes, we are aware Bare Metal instances are slower to boot (or reboot).A quick note on what you identify as an "error" - it's perfectly normal for system status checks to fail during a reboot, many customers rely on them to track an instance's real status (but deep health checks ie from an ALB/NLB are generally better).Is this just an annoiance or causing some problems? Does your use case rely on frequently rebooting instances? And do you have an hard dependency on Bare Metal (ie nested virt) or can do the same with virtual instances?CommentShareGiorgio@AWSanswered a year ago0Thanks for your response.Yes my use case relies on being able to restart the server quickly, within 2-3 minutes is bearable, but over 10 minutes makes bare metal instances not useful for my case.I don’t need to restart the server very often, but when I do, I can’t wait over 10 minutes.If there is any way to shorten the restart time please let me know. Otherwise, I will probably revert to the non-metal equivalent.As to your question, I don’t know, this is the first time I am trying a bare metal instance. I wanted to check if my application gains any performance advantage by using c5d.metal instead of c5d.24xlarge.CommentShareAWS-User-2953085answered a year ago"