Question: aws cloudtrail not showing detailed error message for 'access denied' error

"hi AWS:I am troubleshooting an 'access denied' event in cloud trail. According to my research online, the cloudtrail error message is supposed to give details on what specific permission is lacking, such as this "User: arn:aws:iam::account:user/username is not authorized to perform: cloudtrail:LookupEvents with an explicit deny in an identity-based policy".However, when I look at my event in cloudtrail lake, the only message in the error message column is 'Access Denied'. Is there any additional config I need to change to see details of the error?here is my query:selecterrorMessagefrom mydatastoreIDwhere errorCode ='AccessDenied'and requestID= myrequestIDFollowComment"

Answer: 0I would do "select *" and have a look at the other fields.CommentShareEXPERTskinsmananswered 4 months ago


Question: CodePipeline activity notification JSON ends up malformed at Microsoft Teams

"Has anybody else tried to send CodePipeline events over to a Microsoft Teams channel using the following exampleshttps://aws.amazon.com/premiumsupport/knowledge-center/sns-lambda-webhooks-chime-slack-teams/and end up with the displayed JSON having no value for the additionalAttributes property? It is supposed to be an empty {} object.{"account": "ACCOUNTNUMBER","detailType": "CodePipeline Pipeline Execution State Change","region": "REGION","source": "aws.codepipeline","time": "2022-01-17T08:59:36Z","notificationRuleArn": "RULEARN","detail": {"pipeline": "PIPELINE","execution-id": "GUID","execution-trigger": {"trigger-type": "Webhook","trigger-detail": "CODESTARARN"},"state": "STARTED","version": 1.0},"resources": ["PIPELINEARN"],"additionalAttributes": }I logged down the Python formatting statements and the resultant encoded string does include the {} so I guess somehow the Teams side does not like empty objects and drops it off?FollowComment"

Answer: "0Accepted AnswerWe are sending to Microsoft Teams that payload format.{ "text": "STRINGYFIED_JSON" }Where STRINGYFIED_JSON = the serialised SNS message object.I tested further by adding a placeholder property to the blank object for additionalAttributes and Teams did accept that and rendered proper JSON in the post.# Add placeholder property to potentially empty object {} in additionalAttributes# Microsoft Teams may not like it and not render in rendered post text.snsMessage['additionalAttributes']['placeholder'] = "Prevent empty object."CommentShareicelavaanswered a year ago0As described in the Knowledge Center Article, the minimum payload for TEAMS has to be:{"text": "Some Text"}Just {} won't work.The article simply uses the JSON payload of the SNS message and forwards it to the TEAMS Webhook, however they support Adaptive Cards and their legacy format Actionable Message which allows you to format your information quite nicely. Our team uses the Python module pyadaptivecards to make the layout of our cards easier.CommentSharewolfadranswered a year ago"


Question: Connection between AWS AppFlow and SAP OData fails with error 401

"Hi all,We are currently connecting to the OData interface located inside the VPC through Appflow, referring to SAP's blog, and currently receiving the following error:Error authenticating to connector: Unauthorized request: msg=The request to SAP failed with the status code: 401 and error message: Unauthorized.On the common errors page for AppFlow I can't find this error and also searching community forums didn't really help so far. Has anyone ever experienced this problem or has any suggestion how to resolve this? Any help is very much appreciated.Liuyang.FollowComment"

Answer: "0Hi Liuyang,When attempting to connect to a SAP system using the Appflow SAP connector, the following scenarios can result in error code 401:The basic authentication credentials provided in the connection parameters are not correct. When the basic authentication parameters are not keyed in correctly, SAP will reject the request with HTTP error code 401.The SAP user that is used for establishing the connection is locked or does not exist. Please verify the SAP user data to ensure the user is not locked and has all the required permissions.The SAP system has been configured for single sign-on (SSO) using the SAML IDP provider, or it has been configured for Kerberos. Appflow currently supports Basic and OAuth 2.0 as authentication mechanisms. If your SAP system is configured for SSO, switch to OAuth 2.0 as the authentication mechanism. If you use basic authentication when setting up your SAP system for SSO, SAP will not execute the basic logon as part of the logon procedure.When establishing a connection via private link, make sure the network load balancer is highly available and has been enabled for cross-zone load balancing. Additionally, ensure the target group does not preserve the client IP address when forwarding the traffic to your target IP. If these are not configured accordingly, it can lead to 401 errors.Your security groups associated with SAP instances do not allow traffic from the load balancer on the required HTTP/HHTPS ports; this can lead to a 401 error. Ensure your security groups associated with SAP allow traffic from the load balancer on the required HTTP and HTTPS ports.Hope this helps.CommentShareKK Ramadossanswered 12 days ago"


Question: Drive mappings in windows ami

"Hi, we have a Windows ami with a number of pre-defined EBS volumes, on ec2Launch v1 there was a powershell script to ensure the drive letters for those volumes where kept the same.The most recent base ami uses EC2launch V2 which doesn't have this facility (it has a GUI which doesn't seem to work).  Has anyone any links to how to get volume to drive mappings working consistently?TIAFollowComment"

Answer: "0Hi :)Greetings from AWS! Hope you're safe and doing well.Thank you for posting your query on AWS re:Post. My name is Aakash and it is my pleasure to assist you today.From your query, I understand that you would like to know how we initialize the disks and map them with drive letters using EC2launchV2.EC2launchV1 or simply EC2launch allows to map drive letters to volumes on your EC2 instance. The script initializes drives that are not already initialized and partitioned. To achieve this, you need to specify the settings in 'DriveLetterMappingConfig.json' as mentioned at[1]-- Note: You can test this setting in EC2launchV1 by running the script named 'InitializeDisks.ps1' at 'C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts'EC2launchV2 service supports all EC2Config and EC2Launch features[2]. As you are already aware, one of it's tasks is: Set drive letters for any additional volumes and extend them to use available space[3].It provides a GUI access via EC2launch.exe. It has a volumes tab[4] which allows you to initialize the volumes that are attached to the instance. Enabling sets drive letters for any additional volumes and extends them to use available space. If you select All, all of the storage volumes are initialized. If you select Devices, only devices that are specified in the list are initialized. You must enter the device for each device to be initialized.You can find the device name of the volume on AWS console or you can use the ebsnvme-id.exe tool at 'C:\ProgramData\Amazon\tools' (works only on Nitro Instance type[5]).In simple words, you have to open the EC2launch.exe-->Volumes-->Select Initialize if you want to initialize a volume-->devices-->Enter the device name as seen on console and drive letter-->Save. The agent-config.yml file at 'C:\ProgramData\Amazon\EC2Launch\config' will be configured accordingly. To test, please run the 'Amazon EC2launch' service from 'services.msc'.I have tested the same and it is working in my environment. The 'agent-config.yml' file looks like:task: initializeVolumeinputs:initialize: devicesdevices:- device: xvdiletter: KThe 'agent.txt' log file output was:2023-04-05 13:41:32 Warning: Device is not empty, skipping initialization: xvdi2023-04-05 13:41:32 Info: Drive letter 'K' is specified for device 'xvdi'2023-04-05 13:41:32 Info: Successfully changed drive letter for device 'xvdi' to 'K'-Note: Initialization of disk happens only if it is empty as mentioned at [6]. But the device name was changed according to what was defined in the 'yml' fileIf this is not working as expected or there is some confusion regarding this, please reach back to us via a technical support case[7] with the log files present at the following location:'agent.txt' and 'err.txt' at 'C:\ProgramData\Amazon\EC2Launch\log'You can also post the error here.I hope that the given information is helpful to you. If you feel we can provide any additional assistance with regard to this matter, please do not hesitate to let us know and we would be glad to continue working on this issue with you.Thank you and Have a great day ahead!References:[1]Initialize drives and map drive letters: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch.html#ec2launch-mapping[2]Configure a Windows instance using EC2Launch v2: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch-v2.html[3]EC2launchV2 task: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch-v2-overview.html#ec2launch-v2-tasks[4]How to use Volume Tab to configure EC2launchV2 task:  https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch-v2-settings.html#ec2launch-v2-ui (Step 6)[5] Nitro System: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances[6]Disk not empty: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launchv2-troubleshooting.html#ec2launchv2-troubleshooting-ebs-initialize[7]Technical Support case: https://support.console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERAakash_Sanswered 2 months ago"


Question: FleetIQ Cannot update Game Server status from UTILIZED to AVAILABLE from CLI and SDK

"I have set up my AWS account and I am integrating fleetIQ in a sample spring boot java project. I have created a Game Server Group named "TestGameServerGroup" and in my backend code I am listing the game server group. After that I am registering Game Server name "game-server-1" in my sample EC2 spring boot project.Now when I update the status of the game server "game-server-1" to "UTILIZED" I cannot change it back to "AVAILABLE". I am trying to update it with SDK and CLI both, but none of it works.The error that I am getting is "An error occurred (InvalidRequestException) when calling the UpdateGameServer operation: Unable to update game server from UTILIZED to AVAILABLE"Command used to set UTILIZED status"aws gamelift update-game-server --game-server-id game-server-1 --utilization-status UTILIZED --health-check HEALTHY --game-server-group-name TestGameServerGroups"Command used to set AVAILABLE status which gives InvalidRequestException."aws gamelift update-game-server --game-server-id game-server-1 --utilization-status AVAILABLE --health-check HEALTHY --game-server-group-name TestGameServerGroups"Why am I getting this error and can we directly update status to AVAILABLE after setting to UTILIZED? When are we supposed to set these particular statuses? Am I supposed to call any other GameLift FleetIQ API before setting status to AVAILABLE?FollowComment"

Answer: "1Accepted AnswerHi,This is an expected error. You may not update a game server's utilization status from UTILIZED to AVAILABLE.This doc has a basic guideline on when to update your game server utilization status, down in "Update game server status": https://docs.aws.amazon.com/gamelift/latest/fleetiqguide/gsg-integrate-gameserver.htmlIn short, your game client will attempt to acquire a game server by calling ClaimGameServer. From there, either the Game Server Group will look for an AVAILABLE Game Server OR the given Game Server must be in AVAILABLE status. If an AVAIlABLE Game Server is found, in 60 seconds either the game client or game server needs to call UpdateGameServer to set that Game Server to UTILIZED.CommentShareJuneHoP_AWSanswered 9 months agoEXPERTToni_Sreviewed 9 months agoUmang Desai 9 months agoYes. Basically, when a game session ends we have to deregister that server and register a new server in its place to maintain capacity and utilize the EC2 instance.For example, out of 100 total capacity of EC2, 50 are being utilized and 5 are getting deregistered, so the servers available to be claimed are 45. To fully optimize resource usage, we need to register 5 new server in that particular EC2 instance.Also need to check the server is not in draining state/getting terminated before creating new servers.Share"


Question: AWS Service that can act like Lambda without a time limit?

"My web app processes photos on a large scale. A user might upload 20,000 images at once to be processed. I upload them to S3 and then process them.Like Lambda allows, I need to be able to trigger the processing of the photos via API Gateway, have multiple instances running at once that are isolated from each other, and when the instance is done running it stops with the ability to scale to 0 when there is no demand (like at night time) or scale to virtually unlimited if there are 10,000 that upload photos at the same time.Lambda would be perfect for this but with the 15 minute limit it will not work as some jobs could take up to 2 hours to finish.Is there another AWS service that would allow me to do what I need but not have the time limit? I looked into Fargate and Batch but they do not seem to really work for the requirements.FollowComment"

Answer: "3I suggest using your preferred trigger s3, eventbridge or sqs/sns to start a step function which can then start a fargate task (Which does not have 15min time limit). You can also add additional logic and error handling to the step functionCommentShareEXPERTPeter_Ganswered a year ago1Hi -What you are looking for is an equivalent of GCP's Cloud Run.While I'm curious what others have to suggest, there is no exact Cloud Run equivalent in AWS.There are couple of things -You can have a small Fargate task running, and scale up when requests comes in; or simply use App Runner. This approach while not giving you absolutely 0 cost when there is no request, the overhead is very small;You can also use AWS Batch, Lambda, SQS, Step Function etc. to process the upload in an asynchronous manner, this is the closest to what you want to achieve. AWS Batch is made for the use case you described, not sure why you believe it would not work for you;You also have the option to write your own logic, for example, use Lambda function to trigger a set of automation that creates let's say a new ECS task, and at the end of processing, trigger another Lambda function within the task that deletes the task.CommentShareJason_Sanswered a year ago"


Question: How to avoid circular dependency between transit gateway and route table?

In Cloudformation template I have an option to define AssociationDefaultRouteTableId and PropagationDefaultRouteTableId for TransitGateway.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgateway.htmlType: AWS::EC2::TransitGatewayProperties:   ...  AssociationDefaultRouteTableId: String  ...  PropagationDefaultRouteTableId: StringBut TransitGatewayRouteTable has mandatory parameter TransitGatewayId and this causes a circular dependency between route table and transit gateway :-(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroutetable.htmlType: AWS::EC2::TransitGatewayRouteTableProperties:   ...  TransitGatewayId: StringIs there a way to get around this somehow and actually set AssociationDefaultRouteTableId and PropagationDefaultRouteTableId for transit gateway from Cloudformation template ?FollowComment

Answer: 1Accepted AnswerI don't think you'll be able to do this how you are trying as the circular dependency will always be there.One way that you may be able to achieve the same outcome is by using a custom lambda resource to modify the TGW defaults after it's created. Here is an example from github: https://github.com/alexandrespbr/vpcsharednfw/blob/3aad9e78c08610b2e3602364158f78867338db39/egressVpc.yaml#L475CommentShareChris Pollardanswered a year agoKallu a year agoThanks! This is my thinking as well. The only thing it doesn't explain why such parameters were made available for TransitGateway resource type you can not possibly use. Looks like a bug and missing feature (that ability to set route table id's).Share


Question: ModuleNotFoundError: No module named 'airflow.providers.slack'

"Hello All,I am using Airflow 2.2 on MWAAAttached is my requirements.txt. I am using slack to send a notification but I am getting an error as "ModuleNotFoundError: No module named 'airflow.providers.slack' ". I have already installed this module saw its installation through  Cloudwatch logs also. However, Airflow is not detecting this module. Kindly help me out.Requirements.txt :alembic==1.7.7anyio==3.5.0apache-airflow-backport-providers-amazon==2021.3.3apache-airflow-providers-amazon==3.2.0apache-airflow-providers-ftp==2.1.2apache-airflow-providers-http==2.1.2apache-airflow-providers-imap==2.2.3apache-airflow-providers-slack==4.2.3apache-airflow-providers-sqlite==2.1.3apispec==1.3.3argcomplete==1.12.3asn1crypto==1.5.1attrs==20.3.0Babel==2.9.1beautifulsoup4==4.10.0blinker==1.4boto3==1.15.18botocore==1.18.18cached-property==1.5.2cachelib==0.6.0cattrs==1.10.0certifi==2021.10.8cffi==1.15.0chardet==3.0.4charset-normalizer==2.0.12click==7.1.2clickclick==20.10.2colorama==0.4.4colorlog==4.0.2commonmark==0.9.1configparser==3.5.3connexion==2.13.0croniter==0.3.37cryptography==36.0.2decorator==5.1.1defusedxml==0.7.1Deprecated==1.2.13dill==0.3.4dnspython==2.2.1docutils==0.16email-validator==1.1.3Flask==1.1.4Flask-Admin==1.5.4Flask-AppBuilder==2.3.4Flask-Babel==1.0.0Flask-Caching==1.3.3Flask-JWT-Extended==3.25.1Flask-Login==0.4.1Flask-OpenID==1.3.0Flask-Session==0.4.0Flask-SQLAlchemy==2.5.1flask-swagger==0.2.14Flask-WTF==0.14.3funcsigs==1.0.2future==0.18.2graphviz==0.19.1gunicorn==20.1.0h11==0.12.0httpcore==0.14.7httpx==0.22.0idna==2.10importlib-metadata==4.11.3importlib-resources==1.5.0inflection==0.5.1iso8601==1.0.2itsdangerous==1.1.0Jinja2==2.11.3jmespath==0.10.0json-merge-patch==0.2jsonpath-ng==1.5.3jsonschema==3.2.0lazy-object-proxy==1.4.3lockfile==0.12.2lxml==4.8.0Mako==1.2.0Markdown==2.6.11MarkupSafe==2.0.1marshmallow==2.21.0marshmallow-enum==1.5.1marshmallow-oneofschema==3.0.1marshmallow-sqlalchemy==0.23.1mypy-boto3-rds==1.21.34mypy-boto3-redshift-data==1.21.34natsort==8.1.0packaging==21.3pendulum==1.4.4ply==3.11prison==0.2.1psutil==5.9.0pycparser==2.21Pygments==2.11.2PyJWT==1.7.1pyparsing==3.0.7pyrsistent==0.18.1python-daemon==2.3.0python-dateutil==2.8.2python-nvd3==0.15.0python-slugify==4.0.1python3-openid==3.2.0pytz==2021.3pytzdata==2020.1PyYAML==6.0redshift-connector==2.0.905requests==2.23.0rfc3986==1.5.0rich==12.2.0s3transfer==0.3.7scramp==1.4.1setproctitle==1.2.2six==1.16.0slack-sdk==3.15.2slackclient==1.3.2sniffio==1.2.0soupsieve==2.3.2SQLAlchemy==1.3.24SQLAlchemy-JSONField==0.9.0sqlalchemy-redshift==0.8.9SQLAlchemy-Utils==0.38.2swagger-ui-bundle==0.0.9tabulate==0.8.9tenacity==4.12.0termcolor==1.1.0text-unidecode==1.3thrift==0.16.0typing_extensions==4.1.1tzlocal==1.5.1unicodecsv==0.14.1urllib3==1.25.11watchtower==0.7.3websocket-client==0.54.0Werkzeug==0.16.1wrapt==1.14.0WTForms==2.3.3zipp==3.8.0zope.deprecation==4.4.0Thanks.XiFollowCommentAWS-User-4565951 a year agoI'm having a similar issue with Snowflake module.Where are you seeing the error? In the Airflow UI or somewhere else?Share"

Answer: 0Try adding  slack_sdk>=3.0.0 as well.CommentSharekayelvoanswered a year ago


Question: Amazon Linux 2022 ECR Basic Scan

"From another post regarding an updated GLIBC of 2.27+, it was suggested to use preview of Amazon Linux 2022.This does in fact solve a request to update GLIBC, however, also introduces a new issue where images built from AL2022 fail the Basic Scan in ECR with UnsupportedImageError: The operating system 'amzn' version '2022' is not supported.Is there a recommended way to push/scan new images from AL2022 since the AL2 images were supported for basic scans?FollowComment"

Answer: 0Looks like you might have to live without container scanning since AL2022 is yet in preview and not GA. There are already requests for including it for ECR scanning - https://github.com/aws/containers-roadmap/issues/1800--SydCommentShareSydanswered 10 months ago


Question: SVM went misconfigured

"Hello, SVM went into misconfigured state with error as below.Amazon FSx is unable to communicate with your active directory domain controller's. Please delete your storage virtual machine and create a new one once allowed network traffic between FSx and your domain controller's.can you please help us in resolving the issue by making svm to available stateFollowComment"

Answer: "0Hello there,The error you are seeing can occur due to network connection issue between Amazon FSx and AD Domain Controller. I suspect you are using FSx for ONTAP, if not, do pardon me.To resolve this issue, we have documented the troubleshooting steps which are given below. Please follow all the steps and it should ideally resolve the issue.https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/join-svm-to-ad.html#cannot-reach-domain-controllerI would also suggest you to confirm if pre-requisites are met, which are given below for using self-managed AD.https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-manage-prereqs.htmlDo let me know if you have any other questions.Thanks for reaching out, good day!CommentShareSUPPORT ENGINEERMahin_Sanswered 8 days ago"


Question: Performance drop on AWS T3 instances - Linux

"The issue with performance drop when having just a couple of hundreds of connections might be typical to AWS T3 instances.  Our server-side Apache modules maintain "sleeping" connections to clients, which is not quite typical for regular web applications. Any time a new request come for a host PC, the client's server-side Apache instance wakes up and puts the request's data into a queue for the host PC and signals its server-side Apache instance, which wakes up and sends the data to the host PC. Hence, every data exchange through the server involves quite a few of server processes scheduling. It appears that our T3 starts experiencing lagging of the AWS scheduling at some point, which is not reflected in CPU usage.FollowComment"

Answer: "1Hello,The data provided is insufficient to determine the cause. There could be lots of factors to check while dealing with issues with respect to LAG.When you say LAG, what exactly is observed ? How do you determine that ? How is the connectivity from your Host-PC to the AWS instance ? What tools have you used to determine whether it is latency/compute related ? Have you checked the top, vmstat, iostat, df-kh output to eliminate all the factors that could cause potential issues ? Also, what is the output of netstat - anp ? Have you also tried to upgrade the instance from t3 medium to a higher one ?Do you have an AWS Support plan ? I believe the AWS engineers would be the best to determine on how to move forward with the same. Hope this helps.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoEXPERTChris_Greviewed 10 months ago"


Question: [Announcement] Extension to Mandatory Upgrade Schedule for Amazon Aurora

"Dear Amazon Aurora customers,Last month, we informed you via email and the Personal Health Dashboard of a mandatory upgrade to Aurora v1.14 in your maintenance window in the period between September 18, 2017 at 00:00 UTC and September 24, 2017 at 23:59 UTC.We missed including some of you or some of your clusters in that notification. Proceeding with the upgrade on the original timeline means some of you won’t have adequate time to test your production loads on Aurora v1.14.As a result, we are resetting the timeline for the mandatory upgrade that was previously announced. No further action is required for clusters already running Aurora v1.14. For all other clusters running earlier versions of Aurora, you have the option to upgrade your DB clusters to the latest version of Aurora through October 22, 2017 at 23:59 UTC. See the following link for instructions on how to perform the upgrade: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.DatabaseEngineUpdates.html.We encourage you to use this period to test your workload against the latest release. You can clone your existing DB clusters (http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.Clone.html), which will automatically receive the latest software. Once the clone has been created, you can subject it to workload tests to verify that there are no performance or stability issues.If you haven’t upgraded your database clusters by the end of the above period, we will automatically upgrade your DB clusters to the latest version of Aurora in your maintenance window in the period between October 23, 2017 at 00:00 UTC and October 29, 2017 at 23:59 UTC. We recommend that you review the maintenance windows for eligible instances as they often default to the same timeframe.Should you have any questions or concerns, the AWS Support Team is available on the community forums and through AWS Premium Support at http://aws.amazon.com/support.Sincerely,Amazon Web ServicesFollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: SSM inventory - checking NVMe and ENA versions

"Hello,I have setup ssm inventory expecting to see NVMe and ENA driver/package versions, which is not occuring.I can see cloudwatch, ssm agent etc versions.I would like to audit/check/update all aws components on EC2 fleet.  Any thoughts if inventory can do this or other options?thank youFollowComment"


Question: My route53 domain is not propagating

Hello I bought a domain through Route53 videopaintbox.com but as far as I can tell it is not propagating.  I have configured various subdomains but nothing seems to be working - I cannot access anything on that domain.FollowComment

Answer: "0HelloPlease check if the domain is active or not from the who.is i am able to see the information of the domain, I hope this domain registrar is AWS https://who.is/whois/videopaintbox.com , Can you check you have hostedzone and domains are active?When you register a new domain, ICANN requires that we get confirmation that the email address for the registrant contact is valid. To get confirmation, we send an email that contains a link. (If you don't respond to the first email, we resend the same email up to two more times.) You have between 3 and 15 days to click the link, depending on the top-level domain. After that time, the link stops working.If you don't click the link in the email in the allotted amount of time, ICANN requires that we suspend the domain. For information about how to resend the confirmation email to the registrant contact, see Resending authorization and confirmation emails.Information here/; https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-domain-unavailable.html#troubleshooting-domain-unavailable-didnt-click-linkCommentShareGKanswered a year ago"


Question: Possible to prevent Application Load Balancers from routing direct-IP access to target groups?

"When we all launch ALBs, they can be resolved by IP - that's just how the internet works (I get it).In our case, however, all legitimate traffic will have an FQDN in the host header, e.g.:valid requestGET https://validdomain.com/fooinvalid requestGET https://10.23.122.110/fooI've pulled up the ALB listener rules, and it seems that while it is able to examine the Host header, it is not possible to use regular expressions in the condition - which makes it useless in this scenario.  Had it accepted regex, I'd have been able to block IPV4/6 patterns and respond with a fixed 400.Has anyone solved ensuring that requests have a domain in the host request?Thanks!AlexFollowCommentRodney Lester 9 months agoYou can use the HOST header in your application to return a HTTP 400 Bad Request when the host doesn't match what you wish.Share"

Answer: "0Hello,At the moment ALB Host conditions[1] doesn't support regex expressions.However, I would like to suggest you one workaround to achieve your use case as follows:Setup listener rule with "Host" header condition in which you can provide the valid hostnames using which the clients should access the target behind ALB. This will route all the request with valid hostnames to your target group.Now in order to deflect any client requests with "Host" header value set to an "IP address", you can use default rule action of your listener to give a fixed response e.g. 400 Bad Request to clients. This will allow you send the required response for all the request which does not have valid host header value.I hope the above workaround will be useful to you. Feel free to reach out to us in case of any further queries.Thanks! JayReferences:[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#http-header-conditionsCommentShareSUPPORT ENGINEERJAY_Janswered 9 months ago"


Question: Can't delete EBS app or env

"Hello,I'm starting to learn AWS and tried to standup a .Net core example app using Elastic Beanstalk. After messing around with it for a bit I wanted to delete the app and env but now the env is stuck in "Suspended" health and cannot get it deleted. It appears due to having a chain of dependencies of security groups, network interfaces, ec2 instances, etc that I'm not familiar with. I tried following the dependencies back and removing them but everything fails for one reason or another.The last spot I got to was deleting the network interface. I don't know if this is the interface for the entire VPC or just the EC2 instance that no longer exists but I get a permission denied message.FollowComment"

Answer: "0Hi thereFrom the note, I understand you starting  to learn AWS and tried to standup a .Net core example app using Elastic Beanstalk. After messing around with it for a bit you wanted to delete the app and env but now the env is stuck in "Suspended" health and cannot get it deleted. It appears due to having a chain of dependencies of security groups, network interfaces, ec2 instances, etc that you're not familiar with. You tried following the dependencies back and removing them but everything fails for one reason or another. Please correct me if my understanding is wrong.First you need to terminate your environment. Elastic Beanstalk terminates all AWS resources associated with your environment, such as Amazon EC2 instances, database instances, load balancers, security groups, and alarms.To terminate your Elastic Beanstalk environmentOpen the Elastic Beanstalk console, and in the Regions list, select your AWS Region.In the navigation pane, choose Environments, and then choose the name of your environment from the list.Please note if you have many environments, use the search bar to filter the environment list.Choose Environment actions, and then choose Terminate environment.Use the on-screen dialog box to confirm environment termination.I hope the above information is helpful.References:1.https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/dotnet-core-tutorial.htmlCommentShareNonkululekoanswered a year ago"


Question: How do I return a COUNT of items with AppSync?

"Hi all, quick question here, let's say I have 2 tables in DynamoDB: CITIES and COUNTRIES. I use AppSync to make queries to these tables and I want to return the COUNT of items (i.e. cities) in "Spain", how can I do that? Also, how can I return the total count of items in a table?Thanks in advance!FollowComment"

Answer: "1To do it in a performant way you might have to keep track of the count (usually in the "parent").For example, you can add a property "count" in the Countries and keep it updated (immediately or periodically).CommentSharemullasseryanswered 6 months agojesusER 5 months agoWouldn't that increase the number of API requests to make? I thought about what you suggested and it will work well with the COUNTRIES and CITIES since they are unlikely to change oftenly. However, what about other scenarios like USER and BLOGS?For example, I will need to have 2 mutations (i.e. createBLOG and updateUSER, to create the blog in the BLOG table and update the user's "count_total_blogs" field in the USER table respectively). Would it be possible to do this via a single mutation/API request? Just trying to be optimal here, if AppSync doesn't allow a COUNT of items I will consider your solution but also like to know what other options there are.Share"


Question: S3 gzipped content automatically unzipped when downloading with a client software

"Hi,we have quite a large amount of files stored to S3 and have used it without any problems. Files have Content-Encoding gzip, Content-Type application/octet-stream. What has now changed is that when accessing files using S3 URL with (for example) an HTTP tool most of the files are fine but some are served unzipped, having no Content-Encoding in the header. Data in S3 has not changed, earlier these same files were downloaded fine. This problem seems to happen only when using HTTP, HTTPS is fine. Unfortunately we have an older application using HTTP that now fails. Any ideas what is going on and how to prevent this?FollowCommentrePost-User-4127687 10 months agoAdditional information about the problem: this only seems to occur with files that have executable code in themShare"


Question: IoT Core Rule SQL - Access 'Thing' attribute

"Hi,I'd like to enrich messages received by an IoT Core rule with the value of an attribute assigned to the 'Thing' representation of my device, but the only way to do this seems to be to use the aws_lambda SQL function as described here: https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-functions.html#iot-func-aws-lambda, which seems a rather awkward way of accessing information already stored and managed inside of IoT Core.Is there a better way of accessing 'Thing' attributes within an IoT Core rule SQL statement?Many thanks.FollowComment"

Answer: "1Accepted AnswerAt this time, there's no handy SQL function to retrieve Thing attributes.If you use a Lambda to call DescribeThing, please be aware also of the service limits that you may hit if processing a lot of messages. The DescribeThing limit is adjustable. However, if you have very heavy load, it may be better to store the attribute information somewhere else (in a shadow, DynamoDB, etc).CommentShareEXPERTGreg_Banswered a year ago"


Question: Custom Source Link from LEX synced with Kendra

"Hi,We have a Lex and Kendra Setup here our Lex and Kendra is synced so if LEX is unable to give a direct answer it give this search to Kendra and Kendra is Giving answer with a Source link, That source link is contaning a S3 URL with a Token, But here we want Lex gives answer from Kendra but it must give a custom URL, which is associated with our Bucket and have Cloudfront with it. In Below imagethere is a Source link, if i click on this link it directly open a S3 URL for our Existing file.Due to that S3 link our bucken name publicly open, We already created a Cloudfront and a subdomain for that and we want Lex should give us Our Costom domain not direct S3 link.ThanksFollowComment"


Question: AWS S3 Get object not working. Getting corrupt file

"I have a .zip file on an S3 bucket. When I try to get it and save it as a file it is corrupt and can't be opened. I don't know what to do, is really hard to get that S3 zip file. I am using this code as a guide https://docs.aws.amazon.com/AmazonS3/latest/userguide/download-objects.html. I'm currently on Unity, but the SDK for .NET should work.  The resulted file has the first 7.4 kb all NULL. This is the code that gets the zip file, returns the buffer, and saves it with File.WriteAllBytes:/// <summary>    /// Get Object from S3 Bucket    /// </summary>    public async Task<byte[]> GetZip(string pFile)    {        try        {            Debug.Log("KEY: " + pFile);            GetObjectRequest request = new GetObjectRequest            {                BucketName = S3Bucket,                Key = pFile            };            using (GetObjectResponse response = await S3Client.GetObjectAsync(request))            using (Stream responseStream = response.ResponseStream)            {                Debug.Log("Response stream");                if (responseStream != null)                {                    byte[] buffer = new byte[(int)response.ResponseStream.Length];                    int result = await responseStream.ReadAsync(buffer, 0, (int)response.ResponseStream.Length);                    Debug.Log("Stream result: " + result);                    File.WriteAllBytes(songPath, buffer);                    Debug.Log("Readed all bytes: " + buffer.Length + " - " + ((int)response.ResponseStream.Length));                    return buffer;                }                else                {                    Debug.Log("Response is null");                }            }                    }        catch (AmazonS3Exception e)        {            // If bucket or object does not exist            Debug.Log("Error encountered ***. Message:"+ e.Message + " when reading object");        }        catch (Exception e)        {            Debug.Log("Unknown encountered on server. Message:"+ e.Message + " when reading object");        }        return null;    }FollowComment"

Answer: "1C# Directly supports writing the stream to a file:using (var response = await S3Client.GetObjectAsync(request))using (var responseStream = response.ResponseStream)using (var outputFileStream = new FileStream(songPath, FileMode.Create)){    await responseStream.CopyToAsync(outputFileStream);}CommentSharewparadanswered a year agoNicolasAbo17 a year agoIt worked but I had to use this:byte[] buffer = new byte[(int)response.ContentLength];using (var outputFileStream = new MemoryStream(buffer)){await responseStream.CopyToAsync(outputFileStream)}File.WriteAllBytes(CustomSongsManager.CustomFolder + pFile, buffer);ThanksShare0Ok. Fiddled with your code a bit. And got NoSupported errors on responseStream.Length.I changed to code to using response.ContentLength and it started working for me.This is the code I ended up with:async Task<byte[]> GetZip(string pFile){    try    {        Console.WriteLine("KEY: " + pFile);        Amazon.S3.Model.GetObjectRequest request = new Amazon.S3.Model.GetObjectRequest        {            BucketName = S3Bucket,            Key = pFile        };        using (Amazon.S3.Model.GetObjectResponse response = await S3Client.GetObjectAsync(request))        using (Stream responseStream = response.ResponseStream)        {            Console.WriteLine("Response stream");            if (responseStream != null)            {                byte[] buffer = new byte[(int)response.ContentLength];                int result = await responseStream.ReadAsync(buffer, 0, (int)response.ContentLength);                Console.WriteLine("Stream result: " + result);                File.WriteAllBytes(songPath, buffer);                Console.WriteLine("Readed all bytes: " + buffer.Length + " - " + ((int)response.ContentLength));                return buffer;            }            else            {                Console.WriteLine("Response is null");            }        }    }    catch (Amazon.S3.AmazonS3Exception e)    {        // If bucket or object does not exist        Console.WriteLine("Error encountered ***. Message:"+ e.Message + " when reading object");    }    catch (Exception e)    {        Console.WriteLine("Unknown encountered on server. Message:"+ e.Message + " when reading object");    }    return new byte[0];}GetZip(pFile).Wait();CommentShareJaccoPKanswered a year agoNicolasAbo17 a year agoI tried it but stills returns a corrupted zip file. I'm using the same sdk but in Unity. The zip file I get has the first 7.4 kb all at NULL.ShareJaccoPK a year agoWith these versions?  <ItemGroup>    <PackageReference Include="AWSSDK.Core" Version="3.7.11.13" />    <PackageReference Include="AWSSDK.S3" Version="3.7.9.13" />  </ItemGroup>ShareJaccoPK a year agoOn that page I still can find many different versions.aws-sdk-netstandard2.0.zipaws-sdk-net45.zipaws-sdk-net35.zipShareJaccoPK a year agoI am not sure. I think you have the right one. Not sure though if I can help any further on my Mac :-)ShareNicolasAbo17 a year agoIn Unity I just imported the .dll files. I downloaded the files from here: https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/unity-special.html. My version for core is 3.3.0.0 and for S3 is also 3.3.0.0. I downloaded the aws-sdk-netstandard2.0.zip. I'm going to try downloading the aws-sdk-net45.zip instead and see if it worksShareShow 3 more comments0Is the file truly corrupt or has it been unzipped and you didn't expect it to be?  From memory the Content Encoding metadata on the object in S3 will influence whether a zip file is transparently unzipped on the fly.CommentShareEXPERTskinsmananswered a year agoNicolasAbo17 a year agoIn the bucket, the file is a zip file. I didn't know it could be unzipped on the fly. If that's the case how can I save the folder with its content? Or how can I change it so it downloads as a zip file? Please can you be more specific, the content metadata of the file in the bucket is application/zipShare"


Question: can customer cancel their savings plan?

"customer purchased savings plan by mistake, can they cancel it?FollowComment"

Answer: "1As CloudJason mentioned, the normal policy is no. You cannot cancel a SavingsPlan if you've purchased as they are a contractual agreement between you and AWS for a discount on services. But if it was purchased in error, you can request a cancellation but it's not guaranteed to be approved.CommentShareEXPERTRob_Hanswered a year ago0If it's rather soon after purchasing, and the first time you've done this, you can contact support and they will usually cancel it, usually a day or two.  If it was a mistake there are times support will escalate and cancel it although they don't often like to do that as it is a contract and they don't want people backing out of them.CommentShareCloudJasonanswered a year ago0I made a mistake when calculating the amount of my saving plan, I changed the amount in hours for the amount per month, I immediately noticed the error but I was not able to cancel. My plan that was supposed to be around 40USD/month went to 29k USD/monthCommentShareTiagospemanswered 10 months ago"


Question: AWS SES PHP SDK Problem

"I used the example SES code given to send an SES email through PHP by Amazon (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-using-sdk-php.html). Using PHP and the SES example in my application, the php file works perfectly fine when I call it through "php sendpass.php" in the console (email sends and console gets confirmation). But when I open that same page in a browser, the line "$result1 = $SesClient->sendEmail([]);" causes a "500 internal server error" and fails to execute the code. Even removing the meat from the function causes this problem, I've no where to turn for information on this because it seems like no one else is having this problem, is it a problem with the SDK?FollowCommentwdavjones a year agoI'm guessing this is an AWS credential issue but that is just a guess without a proper error message. Check your webserver's log file for a better error message?Share"

Answer: "2Accepted AnswerWhen you run it locally, you have a different environment than when it runs via your web browser and your web server. Make sure you have your AWS credentials properly available to your script. You also should be able to look in your server error logs to see details of what's causing the error. Finally, you can surround the call to sendEmail([...]) with a try { sendEmail([...]); } catch (Exception $e) { echo "<pre>"; print_r($e); echo "</pre>"; } to see if that catches the error and displays what's going on.For our purposes, we have the AWS credentials in a text file on the server in a non-public path that the script can access and then we use the CredentialProvider to ... provide the credentials. ;)use Aws\Credentials\CredentialProvider;use Aws\Ses\SesClient;$provider = CredentialProvider::ini('default', '/path/to/credentials.file');$provider = CredentialProvider::memoize($provider);$sesClient = SesClient::factory([  'region' => 'us-east-1',  'version' => 'latest',  'credentials' => $provider,]);CommentSharePurdyanswered a year ago"


Question: Logged in using Private Key but denied permission for home directory with Lightsail instance

"Hello Forum;Question: Can someone tell me why I cannot access my home folder after logging in with my ftp programs?I am using:the username as follows: ec2-userthe Lightsail Static IP addressthe private key I downloaded from the Lightsail Instances -> Connect tabFileZilla logs in fine but the server won't let me access the home directory.The Notepad++ program does the same as FileZilla. It logs in but won't let me access the home directory.Logs in fine using ec2-user for the username, static IP, and private key.Access is denied when I click to enter home directory.FileZilla Site ManagerI have looked through the questions in this forum for an answer. I have found answers for similar issues with the EC2 instances; but have not found an answer for the issue that I am having with accessing the server with my Lightsail instance.I was thinking that I may not have the permissions set correctly with Lightsail  -> Networking -> Firewall settings. I have tried to find a proper Firewall setting that would allow access but have had no success.I am using cPanel. I have looked through the Security settings with cPanel but have not found a setting that would help with my problem.I would appreciate if someone could help me with my problem.Thank you in advance.FollowComment"

Answer: "1Accepted AnswerThis can happen if you (the ec2-user) do not have read permisson on /home.The following would have been done as root:[root@ip-172-31-46-162 ~]# cd /home[root@ip-172-31-46-162 home]# ls -lastotal 00 drwxr-xr-x.  3 root     root      22 May 16 00:31 .0 dr-xr-xr-x. 18 root     root     237 May  1 19:03 ..0 drwx------.  3 ec2-user ec2-user  74 May 16 00:31 ec2-user[root@ip-172-31-46-162 home]# chmod o-r .[root@ip-172-31-46-162 home]# ls -lastotal 00 drwxr-x--x.  3 root     root      22 May 16 00:31 .0 dr-xr-xr-x. 18 root     root     237 May  1 19:03 ..0 drwx------.  3 ec2-user ec2-user  74 May 16 00:31 ec2-user[root@ip-172-31-46-162 home]#Now as ec2-user you can still login but cannot display the contents of the parent directory:[ec2-user@ip-172-31-46-162 ~]$ pwd/home/ec2-user[ec2-user@ip-172-31-46-162 ~]$ ls -lastotal 120 drwx------. 3 ec2-user ec2-user  74 May 16 00:31 .0 drwxr-x--x. 3 root     root      22 May 16 00:31 ..4 -rw-r--r--. 1 ec2-user ec2-user  18 Jan 28 22:29 .bash_logout4 -rw-r--r--. 1 ec2-user ec2-user 141 Jan 28 22:29 .bash_profile4 -rw-r--r--. 1 ec2-user ec2-user 492 Jan 28 22:29 .bashrc0 drwx------. 2 ec2-user ec2-user  48 May 16 00:35 .ssh[ec2-user@ip-172-31-46-162 ~]$ cd ..[ec2-user@ip-172-31-46-162 home]$ ls -lasls: cannot open directory '.': Permission denied[ec2-user@ip-172-31-46-162 home]$If the above is the same as on your host here, SSH in as ec2-user, sudo su - to root and chmod o+r /home, and see if that makes a difference.(NB you must have execite permssion on /home in order for you to be able to traverse through it to your home directory, which from the screenshots we can see you're able to do. And if you didn't have this you couldn't authenticate in the first place with your SSH public key in ~/.ssh).CommentShareRWCanswered 20 days agoHarvey Norris 20 days agoRWC;Thank you for responding to my question.I got the issue figured out, finally. This problem has had me stymied for a few days.I changed the permissions in the home directory and sub-directories. I changed the permissions to 755. I am now able to connect with FileZilla and Notepad++.Thanks again.Share"


Question: Ebs snapshot backup

HiIs there any possibility of running an OS script before the EBS volume backup starts?FollowComment

Answer: "0Hello,The only way is to find the backup time and schedule the script in the OS before that backup timeframe.CommentShareVetrivelanswered 2 days ago"


Question: ENI marked as in-use after deleing the Lambda resource attached to it.

"I had this issue before and was able to fix it by simply destroying the Lambda resource; however, this time it's stuck on in-use even after deleting the associated Lambda. Any idea why it's not becoming available instead of in-use ?Error detaching network interfaceeni-078feb502bae65147: You are not allowed to manage 'ela-attach' attachments.Any help to resolve this would be much appreciatedEdited by: Praveen-Premarratne on Jul 2, 2020 7:52 AMEdited by: Praveen-Premarratne on Jul 3, 2020 5:07 AMFollowComment"

Answer: "0This is solved now. It was a CloudFormation stack that booked the ENI from deletion.Once the CloudFromation stack was destroyed, it worked.CommentSharePraveen-Premarratneanswered 3 years ago"


Question: Migrating databsase from mongodb to documentdb

I am currently migrating my data from MongoDB to DocumentDB and want to use further use Documentdb as my permanent database. Now I first dumped the files and restored it on my documentDB cluster. I can also access the Documentdb cluster from mongoshell and I can see my database in Documentdb. Now my issue is that I am not able to use the database when I add the URI to my React application. It just doesn't work i tried several ways but it still didn't work. What can be the issue? I even followed the documentation.FollowCommentMihai A 2 months agoHello. What's the error you're receiving? Amazon DocumentDB has TLS in transit enabled by default and you need to specify the CA bundle certificate - see https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html#connect_programmatically-tls_enabledShare


Question: Visualizing AWS Config data using Amazon Athena and Amazon QuickSight Blog Problem

"Hello, I am currently having a problem following along this blog post: https://aws.amazon.com/blogs/mt/visualizing-aws-config-data-using-amazon-athena-and-amazon-quicksight/ along with this blog which is referenced: https://aws.amazon.com/blogs/mt/how-to-query-your-aws-resource-configuration-states-using-aws-config-and-amazon-athena/So far I have created an AWS Config rule, created and configured an S3 bucket to receive the Config data, created an Amazon Athena table for my Config data as well as the lambda function. I also have two t2.micro instances running with configurations that make it non-compliant.Every time I run the simple example query (https://aws.amazon.com/blogs/mt/how-to-query-your-aws-resource-configuration-states-using-aws-config-and-amazon-athena/) to list EC2 instances of type "t2.micro" no results show.My database name in Athena is different than the one shown in the blogs. So I have replaced the database name "sampledb" to "default" wherever applicable.Also, it mentions to edit the region and dt partition keys, based on the Region and date of the given configuration snapshot files in the Lambda function but I do not see where I can do that. The function should automatically retrieve my region and date.Let me know if you require more information.Thanks.FollowComment"


Question: Problem with Timestamps since we changed our tables' classification to 'delta'

"Previously we were using the Symlink Manifest format to query Delta tables, using Athena, stored in our S3 buckets; we recently noticed that Athena added support to query Delta format tables without using the Symlink Manifest, so we dropped our Glue tables and re-created them using Glue Crawlers with Delta source changing their classification to 'delta'.Some users are reporting troubles when querying views and tables that depended on these tables re-created as 'delta' , some examples are:my_view is stale or in invalid state: column [my_column] of type timestamp(3) with time zone projected from query view at position 13 cannot be coerced to column [my_view_column] of type timestamp(3) stored in view definitionpyathena.error.OperationalError: NOT_SUPPORTED: Unsupported Hive type: timestamp(3) with time zone.and similar issues related to timestamp(3) with timezone, we never had this type of issue with the Symlink Manifest and we think since the Metadata, now that is registered as 'delta', is more specific Athena detects this incompatibility.We found that casting these timestamp(3) with timezone columns to timestamp when creating the views seems to sort the problemIs there any specific reason for this sudden change in compatibility?FollowComment"

Answer: "0Hello,Timestamp with Time Zone is not supported by the glue crawler or by Athena.[+] https://repost.aws/questions/QUiFhuBzMrR3-QQV1W4XgIgA/no-time-with-time-zone-data-type-in-aws-glue-crawlerIf you have a table column of type TIMESTAMP, Athena expects the corresponding column or property of the data to be a string in the format YYYY-MM-DD HH:MM:SS.SSS (note the space between the date and time), or a built-in time type like those for Parquet, ORC, or Ion. Please refer: https://docs.aws.amazon.com/athena/latest/ug/data-types.htmlYour finding about casting these timestamp(3) with time zone columns to timestamp is one of the workarounds suggested by us to fix this issue.In your case, if you didn't face any issue with Timestamp with Time Zone columns when used with the Symlink Manifest, please consider to create a support case with AWS Technical support and provide some sample data for detailed investigation. Refer below for creating a support case with AWS: https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareDimpy Sanswered 23 days ago"


Question: Charges for RDS in Free-Tier account

"I have a PostgreSQL RDS database in AWS which is in a free-tier periodI have launched the database for free-tier but still I am getting charged for the RDS every month, which is of the type "$0.131 per GB-month of provisioned gp2 storage running PostgreSQL", why I am getting charged for this, like this charge for the inbound/outbound transfer, database backups or basically what I am exceeding above free-tier limits for which I am chargedKindly provide me a solution for how I can avoid these charges, I should change the RDS configurations, change the storage type, or any other step I can take so, that I can avoid these chargesFollowComment"

Answer: "0Hi,The Amazon RDS free tier applies to Amazon RDS for MySQL, MariaDB, PostgreSQL and SQL Server (running SQL Server Express Edition).The free usage tier applies across all AWS Regions except GovCloud (US) and Asia Pacific (Osaka) Local. Your usage is calculated each month across all regions and automatically applied to your bill. For example, you will receive 750 Micro DB Instance hours for free across all of the Regions, not 750 hours per Region. Note that free usage does not accumulate from one billing period to the next.750 hours of Amazon RDS Single-AZ db.t2.micro, db.t3.micro, and db.t4g.micro Instances usage running MySQL, MariaDB, PostgreSQL databases each month. If running more than one instance, usage is aggregated across instance classes.750 hours of Amazon RDS Single-AZ db.t2.micro Instance usage running SQL Server (running SQL Server Express Edition) each month.20 GB of General Purpose (SSD) DB Storage*20 GB of backup storage for your automated database backups and any user-initiated DB Snapshots*Backup storage is free up to 20 GB or the size of your DB storage, whichever is less, and requires you to have at least one DB instance running in your account. If you exceed these limits, or if you terminate all DB instances in your account, backup storage will be charged at standard RDS rates.Please check if you have provisioned RDS in the right instances (Single-AZ db.t2.micro, db.t3.micro, and db.t4g.micro) and also the storage type, the usage on the storage. Provisioning on instances that are not supported by free tier will incur charges.ThanksArunCommentShareArunanswered 3 months ago"


Question: "Why is the number 0x232b318c in AZ_CRC("Game", 0x232b318c)?"

"According to AppearsInAddComponentMenu's document example ...->Attribute(AZ::Edit::Attributes::AppearsInAddComponentMenu, AZ_CRC("Game", 0x232b318c))...Why is the number 0x232b318c in AZ_CRC("Game", 0x232b318c)?Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERThere is a post build utility called crc_fix.exe that is invoked by waf. This utility scans .cpp files for the AZ_CRC macro and then calculates the CRC32 value for it. 0x232b318c is the CRC32 value for the string "Game" in hexadecimal format.This is done as a compile time performance optimization, CRC32 are often used as unique identifiers throughout the code, their calculation is not insignificant in terms of performance cost, so by doing it during compilation it is avoided altogether.SharerePost-User-2322203answered 5 years ago0I really don't think that is a GUID, I think we use GUID in AZ_EDITOR_COMPONENT() macro..SharerePost-User-6460635answered 5 years ago0It is a GUID, so just a genuine identifier for the gem, every component needs to have one. Normally you can generate this number with the "Generate GUID" Tool in Visual Studio. Or it is auto generated by the Amazon Launcher on creation of the gem, not sure of this atm.SharerePost-User-1270003answered 5 years ago0I got it, so it's recommended to add the hex number after the string for this macro to improve performance.SharerePost-User-6460635answered 5 years ago0I just tried the crc_fix.exe, I see that it can't detect the AZ_CRC in the cpp files.I typed this cmd:crcfix -v -log:timestamp.log C:\Amazon\Lumberyard\LumberyardSDK\dev\Empty_Project\Gem\Code\Source*where C:\Amazon\Lumberyard\LumberyardSDK\dev\Empty_Project\Gem\Code\Source\ is my source location.Its output is ...CrcFix: Unchanged for all the files.SharerePost-User-6460635answered 5 years ago"


Question: SYNTAX_ERROR: line 1:10: Function to_number not registered

"I am getting the error message in the title box when attempting to run a query. I believe the following line is where the problem is : TO_NUMBER(TO_CHAR(T1."INVOICE_DATE" ,'YYYY')) "c1",FollowComment"

Answer: "1TO_NUMBER is not a function that works in Athena.Rather use cast(value AS type) or try_cast(value AS type).For example try CAST(TO_CHAR(T1."INVOICE_DATE" ,'YYYY') AS int)Reference: Please refer to Functions in Athena  https://docs.aws.amazon.com/athena/latest/ug/presto-functions.htmlCommentShareAnanth Tirumanuranswered 8 months ago0SELECT   cast(TO_CHAR(T1."INVOICE_DATE" ,'YYYY')) "c1",Errorline 1:49: mismatched input ')'. Expecting: <expression>CommentSharerePost-User-0008739answered 8 months ago"


Question: Aurora Serverless AppSync error: invalid cluster id

"Hi,I am trying to use Aurora Serverless as a datasource for AppSync but I am unable to get it to work. Every time I try to run a query or mutation I get this error;RDSHttp:{"message":"ERROR: invalid cluster id: app-develop-aurora-rds"}I don't know why it's saying this as I've looked on the RDS console and the cluster ID is definitely correctI am running this on us-east-1 and have manually enabled the Data API on the console but I just cannot seem to get this workingEdited by: mogzilla on Mar 30, 2019 6:10 AMFollowComment"

Answer: "0That combination should work (Data API in us-east-1).What database engine are you running in your cluster?CommentShareAWS-User-0691748answered 4 years ago0I'm running Aurora MySQLCommentSharemogzillaanswered 4 years ago0Thanks. Can you PM me your AWS Account ID and your AppSync API ID and I'll have a look at your configuration.CommentShareAWS-User-0691748answered 4 years ago0Sure thing, message has been sent. Thanks!CommentSharemogzillaanswered 4 years ago0Thanks! I followed up via PM as well.CommentShareAWS-User-0691748answered 4 years ago0For anyone else who has this issue, the dbClusterIdentifier value in your cloudformation needs to be the ARN of the DB cluster rather than a reference to itCommentSharemogzillaanswered 4 years ago"


Question: MariaDB RDS stalls while upgrading

"Our RDS database has been in state 'Upgrading' for over 5 hours. It appears it was applying an Automatic minor version upgrade to mariadb 10.4.26.I cannot connect to the database in any way; I can only view error/mysql-error-running.log which displays this:[] Added new Mazter_info '' to hash table[] /rdsdbbin/mysql/bin/mysqld: ready for connections.Version: '10.4.25-MariaDB-log' socket: '/tmp/mysql.sock' port: 3306 Source distribution[] /rdsdbbin/mysql/bin/mysqld (initiated by: rdsadmin[rdsadmin] @ localhost []): Normal shutdown[] Event Scheduler: Purging the queue. 8 events[] InnoDB: FTS optimize thread exiting.[] InnoDB: Buffer pool(s) load aborted due to user instigated abort at 221023 10:23:00[] InnoDB: Dumping of buffer pool not started as load was incomplete[] InnoDB: Starting shutdown...[] InnoDB: Removed temporary tablespace data file: "ibtmp1"[] InnoDB: Shutdown completed; log sequence number 14512830675889; transaction id 27562688049[] /rdsdbbin/mysql/bin/mysqld: Shutdown completeIt appears the only option right now is to restore to the latest backup (the option to Reboot is unavailable), but I don't know if this will leave the database in an unstable/incomplete state.Is there something else I could check or do? Should I just wait?FollowComment"

Answer: "0The problem was the storage space; it was below 10% which wasn't enough for the update.The database eventually came back but apparently lost data, so we did restore from the latest backup.CommentSharerePost-User-2865640answered 7 months ago"


Question: AWS LoadBalancer not redirecting HTTPS (GoDaddy DNS)

"Hi everyone,I am trying to configure my AWS ELB but I am having some troubles.I have the following:1 EC2 (for testing with Apache and as a VirtualHost I have host.mydomain.com and host1.mydomain.com)1 ELB (HTTP/HTTPS allowed) - for example it is elb1.aws.com (for example to keep it easy)GoDaddy Subdomains/Domains/DNSNow, in GoDaddy I created an A record for host.mydomain.com to point to the EC2 to make sure it works. And it does work and I can navigate the website via HTTP/HTTPS.In GoDaddy I also created a CNAME => host1.mydomain.com that points to the ELB (elb1.aws.com)If I do a ping of host1.mydomain.com I get the ELB IP. So all good here.Now, if I use my browser (and the ELB SecGroup is HTTP/HTTPS allow) I get ERR_CONNECTION_REFUSED.I am not sure why. Anyone have ideas?How does the AWS ELB forward the traffic? Is there a configuration missing on my side?Thanks and I look forward to hearing from you.RobFollowComment"

Answer: "0Hi Roberto,What type of load balancer is it? ALB? NLB? Classic ELB?Are you attempting to connect to the load balancer URL via HTTP or HTTPS? If HTTPS, do you have a valid certificate attached to the listener on the load balancer?Can you please share your load balancer configuration?Edited by: JayG50 on Sep 30, 2019 11:01 AMCommentShareJustinG50answered 4 years ago0Hi Jay,The load balancer is an Application Loadbalancer.I have a valid HTTPS certificate and the LoadBalancer imported the certificate without problems.I am trying to connect to:host1.mydomain.com that points to the loadbalancer and the ALB should forward the request to the server but apparently it is not.I can see that the LoadBalancer can definitely reach the EC2 instance as I see:"GET / HTTP/1.1" 429 6206 "-" "ELB-HealthChecker/2.0"So the healthcheck works fine.I might have found an issue with the security group that I am still investigating. Probably the problem is related to that.Edited by: RobertoS on Sep 30, 2019 2:02 PMCommentShareRobertoSanswered 4 years ago0Hi Roberto,You may also want to look at how your target groups are configured and the ports they are listening on when traffic is forwarded from the listener. If your ALB is connecting to the EC2 instances via HTTP but the instances are configured to redirect to HTTPS, you will definitely have connectivity issues. Unless you need end-to-end encryption, you might want to try to disable HTTPS on the EC2 instances and only use HTTP to rule that out as the issue.It would look something like this:User -> (HTTPS) ALB -> Forward to Target group -> (HTTP) EC2CommentShareJustinG50answered 4 years ago0Yes, I fixed the problem. I had some problem with Security Groups.Thanks all.CommentShareRobertoSanswered 4 years ago"


Question: How to implement S3 replication for existing objects in CDK?

"I already can replicate existing objects from aws console by setting up a batch job.But how to do the same thing in CDK?Currently, in CDK, I can only implement live replication for a new created bucket, not for existing objects. Here is// create a new bucket and add replication rule // How to do replication for an existed bucket? const source = new cdk.aws_s3.CfnBucket(this, "SourceBucketNew", {      bucketName: `replication-source-bucket-${this.account}`,      versioningConfiguration: {        status: "Enabled",      },      replicationConfiguration: {        role: role.roleArn,        rules: [          {            destination: {              bucket: dest.bucketArn,            },            status: "Enabled",          },        ],      },    });FollowComment"

Answer: "0If you did not create the bucket with the CDK app, it is not possible to change the replication without a direct API call outside of CloudFormation. You would need to make that change using an AWSCustomResource.There is a bit more context as to why this is the case here: https://github.com/aws/aws-cdk/issues/10348#issuecomment-692672755CommentSharePaul Frederiksenanswered 9 months ago"


Question: lex bot web integration using api

"I'm trying to integrate a lex bot into a simple web page that takes the input from the user and pass it to the api, then the api response should be displayed into the same page as any simple chat bot, the problem is that I always get this error :caught ReferenceError: AWSRequestsAuth is not definedalthough the aws_requests_auth is installed correctly.this is the script I use fro the web page :`<!DOCTYPE html>  <title>My Chatbot Page</title>
My Chatbot Page
  <input id="user-input" type="text" placeholder="Type your message here">  <button id="send-btn">Send</button>

        `FollowComment"

Answer: 0Try changing AWSRequestsAuth to AWS.AWSRequestsAuth.CommentShareThomas_Ranswered a month agoayoub a month agochanging AWSRequestsAuth to AWS.AWSRequestsAuth I got this error :dex2.html:35 Uncaught TypeError: AWS.AWSRequestsAuth is not a constructorShare


Question: How does apigateway support different regions

"I want build services in regionA with Account A, so that regionB with accountB,  regionC with accountC can send api requests with apigateway to service in regionA. So I want to know that the mechanism of apigateway support different regions and the process of authenticating the different regions. Thanks!FollowCommentrePost-User-4701749 10 months agoforgot to attention, region A is CN region, and region B and region C based in US-east, is it accessible in api gateway?Share"

Answer: "2API Gateway doesn't care where the requests are coming from (except for private APIs). This means that they can be from the same region, from other regions, or from clients all over the world. All it cares is that the client presents the right credentials.API Gateway supports several authorization methods: IAM, Cognito and custom. In your case, because the API clients are actually services running in AWS, I would recommend using IAM authorization. You will need to establish an API Gateway resource policy that allows the other accounts to call the API. You will also need to create IAM roles in the other accounts that allow access to the API.You can find more information here.CommentShareEXPERTUrianswered 10 months ago0To add to that, when you make requests from your Account B in Region B, or Account C in Region C using the IAM authorization, you'll need to sign the request using AWS SigV4 (see https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html)CommentShareCloudNinjaanswered 10 months ago0For some additional info, please have a look at this post which covers a number of scenarios for building a global application or API .. https://repost.aws/questions/QUSs8ODCyJSRWR7mawaUIl4g/multi-region-strategy-for-api-gatewayCommentSharemicahanswered 10 months ago"


Question: Ubuntu Linux free tier getting into "Instance reachability check failed" at least once in 24hrs.

"Ubuntu Linux free tier getting into "Instance reachability check failed" at least once in 24hrs.I have MySQL and Tomcat installed with a very small JSP application installed (the application has around 4 pages).   At present, I am the only one accessing the pages and still seeing this issue.Any suggestions would be much appreciated.FollowComment"

Answer: "1Accepted AnswerHello SankarThank you for your question, I would start by checking the console logs and instance screenshot when the instance starts failing reachability checks,To get console output1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/2. In the left navigation pane, choose Instances, and select the instance.3. Choose Actions, Monitor and troubleshoot, Get console logs.To get screenshot1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/2. In the left navigation pane, choose Instances, and select the instance.3. Choose Actions, Monitor and troubleshoot, Get instance screenshot.Instance status check failures may occur for the following reasons and you can review the following documentation to troubleshoot unreachable instances.Since your issue occurs "atleast once every 24hours" this could be attributed to resource over utilization, this knowledge center article will help with narrowing down your issue. Generally Linux doesn't allow you the option to log resource utilization as these metrics are analyzed in real time, You can use tools like ATOP or SAR to log utilization and review them later once accessibility to your instance has been restored. Sharing guide to configure ATOP and SAR on this link and how to use these tools for review can be viewed hereFeel free to update the thread with any questions you might have, thanksCommentShareSUPPORT ENGINEERLundianswered a month ago"


Question: Does dynamodb have commit and rollback transaction http APIs?

"My traditional app has the following style of doing transaction against a database such as postgres or oracle.Acquire a read-committed transaction from the server.Use that transaction "object" for subsequent db requests.Based on how those request(s) were serviced - commit or rollback the transaction accordingly.In other words, I am trying to combine independent db operations (aka requests) under the same transaction session. My application has control on how that session is managed.Does dynamodb allow for this kind of use case?FollowComment"

Answer: "1DynamoDB does not provide the ability to ROLLBACK a transaction like you would do on a relational system. However, it does provide Transactional API's which allow for ACID compliance. You can submit batches of up to 100 items as a single request and ensure that wither all requests succeed or none at all.For your use-case you may be able to make use of version control:https://aws.amazon.com/blogs/database/implementing-version-control-using-amazon-dynamodb/CommentShareEXPERTLeeroy Hannigananswered 9 months ago"


Question: [AI/ML] Data acquisition and preprocessing

"Hi,Customer who loads the e-bike data to S3 wants to get AI/ML insight from sensor data.The e-bike sensor data are size about 4KB files each and posted in S3 buckets.The sensor data is put into format like thistimestamp1, sensorA, sensorB, sensorC, ..., sensorZtimestamp2, sensorA, sensorB, sensorC, ..., sensorZtimestamp3, sensorA, sensorB, sensorC, ..., sensorZ...Then these sensor data are put into one file about 4KB size.The plan I have is toRead S3 objectsParse S3 object with Lambda. I thought about Glue but wanted to put data in DynamoDB where Glue does not seem to support. Also, Glue seems to be more expensive.Put the data in DynamoDB with bike ID as primary key and timestamp as sort key.Use SageMaker to learn with the DynamoDB data. There will be separate discussion on choosing which model and making time-series inferencing.If we need to re-learn, it will use the DynamoDB data, not from S3. I think it will be faster to get data from DynamoDB instead from the raw S3 data.Also, I think we can filter out some bad input or apply little modification to DynamoDB data (shifting time stamps to the correct time, etc.)Make inferencing output based on the model.What do you think? Would you agree? Would you approach the problem differently?Would you rather learn from S3 directly via Athena or direct S3 access?Or would you rather use Glue and Redshift?But the data about 100MB would be sufficient to train the model we have in mind.Glue and Redshift maybe overkill.Currently, Korea region does not support Timestream database. So, time series database closest in Korea could be DynamoDB.Please share your thoughts.Thanks!FollowComment"

Answer: "0Accepted AnswerThoughts about DynamoDBPer GB, DynamoDB is around 5X more cost per GB of data stored. On top of that, you have RCU/WCU cost.I would recommend keeping data in S3. Not only is it more cost effective, but with S3, you do not have to worry about RCU/WCU cost or throughput of DynamoDB.SageMaker notebooks and training instances can read directly from S3, and S3 has high-throughput. I don't think you will have a problem with 100 MB datasets.If you need to prep/transform your data, you can do the transformations "in place" in S3 using Glue, Athena, Glue DataBrew, GlueStudio, etc.Glue and DynamoDBI thought about Glue but wanted to put data in DynamoDB where Glue does not seem to support.Glue supports both Python and Spark jobs. If you use a Glue Python job, you can import the boto3 (AWS SDK) library and write to DynamoDB.Other strategiesHow is your customer ingesting the sensor data / how is it being written to S3? Are they using AWS IoT Core?Regardless, the pattern you've described thus far is:Device -> Sensor data in S3 -> Transform with Lambda -> store data in DynamoDBAn alternative approach you could consider is using Kinesis Firehose with Lambda transformations. This will allow you to do "in-line" parsing / transformation of your data before it is ever written to S3, this removing the need to re-read the data from S3 and apply transformations after the fact. Firehose also allows you to write the stored data in formats such as Parquet, which can help with cost and subsequent query performance.If you want to store both raw data and transformed data, you can use a "fanout" pattern with Kinesis Streams/Firehose, where one output is raw data to S3 and the other is a transformed stream.CommentShareAWS-User-9164621answered 2 years ago"


Question: IPv6 availability?

"Just wondering if there's a rough ETA on IPv6 availability. I'm assuming it's either planned or was tentatively-planned at some point as there's a disabled drop-down box with IPv4 pre-selected.Use case is typical websites: since some clients send an AAAA request 25ms or so before attempting an A record, IPv6 would be nice to have.Ideally the set-up here would provide at least a couple public-facing Anycast IPv6 addresses within the accelerator, and simply route them through to the IPv4 elastic IPs. For flexibility though I suppose 3 options in the dropdown might be useful: IPv4, IPv6, IPv4+IPv6.Thanks.FollowComment"

Answer: "0Hey Matt,Thank you for your feedback. AWS Global Accelerator does not support IPv6 currently. This feature is in our backlog and we have taken note of your request. Various factors affect feature releases, and we are unable to provide specific release times at this point.Regards,Marco CagnaCommentShareAWS-User-5708333answered 4 years ago0I understand. Thanks for the response.-MattCommentSharemgadientanswered 4 years ago0Hello,Has there been any updates regarding IPv6 support on Global Accelerator?We're planning to use Global Accelerator, but we have customer demand for IPv6. A rough estimate would really help decide whether to switch from our current cloud provider to AWS.Thank you!CommentShareCgtanswered 3 years ago0Hello,Thank you for reaching out about the status of IPv6 support on AWS Global Accelerator. Currently, AWS Global Accelerator does not support IPv6. This feature is on our development backlog. Various factors affect feature releases, and we are unable to provide specific release timelines at this point.Thank you,AdityaCommentShareAWS-User-6308612answered 3 years ago0What is the best practice in the mean time?To enable both ipv6 and ipv4?  Or just use ipv4?  Will we have clients who simply cannot reach the site with only ipv4 in 2021?For maximum availability, I presume both must be enabled - but that damages the benefit of the accelerator.I am doing that and seeing about 50% of traffic bypassing the global accelerator and using ipv6.CommentSharedrostanoloneanswered 2 years ago0Thank you for your question. Currently, AWS Global Accelerator supports only IPv4 traffic. In the meantime, if you have a dual-stack endpoint serving both IPv4 and IPv6 traffic, you would be able to use AWS Global Accelerator to only accelerate the traffic for IPv4 clients. The IPv6 clients would have to connect directly to the dual-stack endpoint instead of the AWS Global Accelerator IP addresses. However, as you mentioned, the IPv6 traffic will not get the performance benefits from AWS Global Accelerator. Please drop us a note at global-accelerator-pm@amazon.com with your current architecture and use case and we would be able to provide additional recommendations based on your architecture.CommentShareAWS-User-6308612answered 2 years ago0Our company is looking for IPv6 support as well.We use Global Accelerator for the root domain due to static IP requirement and cloudfront for the subdomains. The site access is controlled by IP sets. due to GA not supporting IPv6 we have ask the users both IPv6 and IPv4 to whitelist.I know I can disable IPv6 on cloudfront and its not the solution to the problem.CommentSharemiyuruanswered 2 years ago0Just wondering if there's a rough ETA on IPv6 availability.Now 3 years later IPv6 is becoming a more urgent requirement (e.g. governments require it) and lack thereof a bit of an embarrassment to be honest.With "This feature is in our backlog" is it now planned for the foreseeable future?Looking forward to the original question, quoted above, getting answered :).CommentSharerepost-aws-jeroenanswered a year ago0They have finally added ipv6 support for global accelerator: https://aws.amazon.com/fr/blogs/aws/new-for-aws-global-accelerator-internet-protocol-version-6-ipv6-support/CommentSharesteven_brahamanswered 10 months ago"


Question: Possible CLI Bug: Dynamo DB endpoint URL does not work locally with active and correct credentials set

"Summary:Dynamo DB commands from the CLI do not work when real credentials are set up.  The 'endpoint-url' flag should work around this and recognize that localhost endpoints can be hit with no credentials given the default setup of the AWS Dynamo Docker image.Output of command after setting credentials: An error occurred (ResourceNotFoundException) when calling the DescribeTable operation: Cannot do operations on a non-existent tableIs there a fix or workaround for this?System:MacOS Monterey version 12.0.1,Macbook Pro - M1 - 2020'aws --version' ->aws-cli/2.4.11 Python/3.9.10 Darwin/21.1.0 source/arm64 prompt/offTo reproduce:-- Start from a terminal that does NOT have AWS Credentials set up via environment variables or anything else-- Start up a local Dynamo DB Instance on Docker:  docker pull amazon/dynamodb-local  docker run -p 8000:8000 --name=ddblocal -d amazon/dynamodb-local-- Create a table:aws dynamodb create-table    --attribute-definitions "[{ \"AttributeName\": \"key\", \"AttributeType\": \"S\"}, { \"AttributeName\": \"valueA\", \"AttributeType\": \"S\"}]"     --table-name test_table     --key-schema "[{\"AttributeName\": \"key\", \"KeyType\": \"HASH\"}, {\"AttributeName\": \"valueA\", \"KeyType\": \"RANGE\"}]"     --endpoint-url "http://localhost:8000"    --provisioned-throughput "{\"ReadCapacityUnits\": 100, \"WriteCapacityUnits\": 100}"    --region local-- Query the table (to prove it works):aws dynamodb describe-table --table-name test_table --region local --endpoint-url "http://localhost:8000"-- Set your real AWS Credentials:export AWS_ACCESS_KEY_ID="<REAL KEY ID HERE>"export AWS_SECRET_ACCESS_KEY="<REAL SECRET KEY HERE>"export AWS_SESSION_TOKEN="REAL TOKEN HERE>"-- Query the table again (This one fails for me - see output above)aws dynamodb describe-table --table-name test_table --region local --endpoint-url "http://localhost:8000"FollowComment"

Answer: "0This is a known IssueDynamoDBLocal doesn't work properly with M1(ARM) processors. We don't have plans to directly support it right now, but our Docker containers do work.If you have docker download then you can run the following code:docker pull amazon/dynamodb-local:latestdocker run -p 8000:8000 amazon/dynamodb-local:latestThis will pull the latest version, run the docker container, and bind it to port 8000 which would be the same thing if you were to run it locally.CommentShareAWS-User-4973242answered a year ago"


Question: why COMPONENT_VERSION_REQUIREMENTS_NOT_MET occured in iot greengrass v2 group

"I am in the process of deploying edge devices with greengrass v2 group. Here is a documentation of the processhttps://catalog.us-east-1.prod.workshops.aws/workshops/8d1c3528-8abb-4674-a2b9-d15fa593c392/en-US/image-classification/deploy-em-agent#deploy-componentAs you proceed, you deploy from the greengrass group and get an error like COMPONENT_VERSION_REQUIREMENTS_NOT_MET.The components I am using are as follows.  The problematic part of the list seems to be sagemaker edge manager. I think it's clear because there is no problem when I deploy without that component. So I checked the documentation...aws.greengrass.Cli2.9.6aws.greengrass.Nucleus2.9.6aws.greengrass.SageMakerEdgeManager1.3.2aws.greengrass.TokenExchangeService2.0.3It says that the following conditions must be met However, I don't see anything wrong with the version I'm using. Do you have any idea how to fix this?Greengrass Nucleus>=2.0.0 <3.0.0softTokenExchangeService>=0.0.0hardFollowComment"

Answer: "1You can check in the /greengrass/v2/logs/greengrass.log which is the exact component that is creating the conflict. Check also that there is only 1 deployment targeting the core device by looking under the Deployments tab in the Core devices screen. If there are more than 1 deployment, check that the component's versions in the different deployments are not conflicting.CommentShareEXPERTMassimilianoAWSanswered a month ago"


Question: Batch job retry

Can we resubmit batch job with increased memory and increased CPU if the job fails with given instance size ?FollowComment

Answer: "0HiYou can change the job definition with a high number of vCPU's and Memory, but please check the service quota and make sure if that fits with your limits, else request an increase through support. Check Quota here: https://console.aws.amazon.com/servicequotas/Best practices on AWS Batch and the use of right compute resources/memory is detailed here: https://aws.amazon.com/blogs/hpc/aws-batch-best-practices/ThanksArunCommentShareArunanswered 3 months ago"


Question: Searching S3 objects

"A customer wants to search s3 objects by filename, metadata and tags.Is there any solutions that can help with this?Thank you.FollowComment"

Answer: "0Accepted AnswerThe problem using API calls is that the client will be charged for the list requests (which can go up if they have a large number of objects). Details about s3 related costs here: https://aws.amazon.com/s3/pricing/The easiest way is to use S3 Inventory and run your searches from there.More details about this feature and which fields are available on the report here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/configure-inventory.htmlCommentShareCarlos_Panswered 2 years ago0Although not an AWS native service, there is Mixpeek, which runs text extraction like Tika, Tesseract and ImageAI on your S3 files then places them in a Lucene index to make them searchable.You integrate it as follows:Download the module: https://github.com/mixpeek/mixpeek-pythonImport the module and your API keys: from mixpeek import Mixpeek, S3 from config import mixpeek_api_key, awsInstantiate the S3 class (which uses boto3 and requests): s3 = S3(     aws_access_key_id=aws['aws_access_key_id'],     aws_secret_access_key=aws['aws_secret_access_key'],     region_name='us-east-2',     mixpeek_api_key=mixpeek_api_key )Upload one or more existing S3 files:     # upload all S3 files in bucket "demo"                 s3.index(bucket_name="demo")     # upload one single file called "prescription.pdf" in bucket "demo"     s3.index_one(s3_file_name="prescription.pdf", bucket_name="demo")Now simply search using the Mixpeek module:     # mixpeek api direct     mix = Mixpeek(         api_key=mixpeek_api_key     )     # search     result = mix.search(query="Heartgard")     print(result)Where result can be: [     {         "_id": "REDACTED",         "api_key": "REDACTED",         "highlights": [             {                 "path": "document_str",                 "score": 0.8759502172470093,                 "texts": [                     {                         "type": "text",                         "value": "Vetco Prescription\nVetcoClinics.com\n\nCustomer:\n\nAddress: Canine\n\nPhone: Australian Shepherd\n\nDate of Service: 2 Years 8 Months\n\nPrescription\nExpiration Date:\n\nWeight: 41.75\n\nSex: Female\n\n℞  "                     },                     {                         "type": "hit",                         "value": "Heartgard"                     },                     {                         "type": "text",                         "value": " Plus Green 26-50 lbs (Ivermectin 135 mcg/Pyrantel 114 mg)\n\nInstructions: Give one chewable tablet by mouth once monthly for protection against heartworms, and the treatment and\ncontrol of roundworms, and hookworms. "                     }                 ]             }         ],         "metadata": {             "date_inserted": "2021-10-07 03:19:23.632000",             "filename": "prescription.pdf"         },         "score": 0.13313256204128265     } ] Then you parse the resultsCommentSharerePost-User-6014071answered 5 months ago"


Question: YUM update error EC2 Could not retrieve mirrorlist https...

"Wherenever I run Sudo YUM update on an new EC2 intance I get this error:Could not retrieve mirrorlist https://amazonlinux-2-repos-us-west-2.s3.dualstack.us-west-2.amazonaws.com/2/core/latest/x86_64/mirror.list error was12: Timeout on https://amazonlinux-2-repos-us-west-2.s3.dualstack.us-west-2.amazonaws.com/2/core/latest/x86_64/mirror.list: (28, 'Failed to connect to amazonlinux-2-repos-us-west-2.s3.dualstack.us-west-2.amazonaws.com port 443 after 4982 ms: Connection timed out')```Here are the things I've already checked:1. NACL and Security Groups already have inbound Port 80 and port 443 open2. Outbound NACL and Security Groups is already Open to all TCP3. Internet Gateway correctly attached4. Have given this EC2 a Public, elastic IP, and that still didn't work.Not sure what else I'm missing?FollowComment"

Answer: "1Accepted AnswerYour inbound NACL is wrong.it dont need inbound 80,443.It needs inbound ephemeral ports open range 32768-65535https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.htmlIf issue persist, you can use VPC Reachability analyzer to find out where traffic is getting blocked.https://aws.amazon.com/blogs/aws/new-vpc-insights-analyzes-reachability-and-visibility-in-vpcs/Accept answer if it helps resolving the issueCommentShareMuhammadanswered 5 months agoEXPERTTushar_Jreviewed 5 months agoblackGlitterGuy 5 months agoThis did it. Thank you.I had to give the s3 Bucket end point full access, rather than some more restricted access to get Yum to update... but it's working now. Thanks for the reply!Share1The instance needs to be in a public subnet where the route table attached to the subnet has a rule routing traffic to the internet gateway. Or in a private subnet where the route table attached to the subnet has a rule routing traffic to a NAT Gateway/Instance.CommentShareEXPERTkentradanswered 5 months agoblackGlitterGuy 5 months agoThe Subnet's Routable has 0.0.0.0/0 Rule to the My Internet Gateway. I double checked my Launch template to ensure that this Route Table is associated with the Subnet that the EC2 instance is attached to when it is created.Share"


Question: invoke permission error on lambda ALB target group

"I have the following stack with a lambda, lambda permission, lambda role, and an ALB target group:Resources:  MyFunction:    Type: AWS::Lambda::Function    Properties:      FunctionName: CloudwatchMetricsLambda      Runtime: python3.7      Code:        S3Bucket: some-bucket-with-code        S3Key: deployment.zip      Handler: src/index.lambda_handler      Role: !GetAtt MyFunctionLambdaRole.Arn      Timeout: 20  ALBLambdaPermission:    Type: AWS::Lambda::Permission    Properties:      Action: lambda:InvokeFunction      FunctionName: !GetAtt MyFunction.Arn      Principal: elasticloadbalancing.amazonaws.com      SourceAccount: !Ref AWS::AccountId  ALBTargetGroup:    Type: AWS::ElasticLoadBalancingV2::TargetGroup    DependsOn:      - ALBLambdaPermission      - MyFunction    Properties:      Targets:        -          Id: !Sub ${MyFunction.Arn}      TargetType: lambda  MyFunctionLambdaRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Statement:          - Effect: Allow            Action: sts:AssumeRole            Principal:              Service:                - lambda.amazonaws.com      ManagedPolicyArns:        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole      Policies:        - PolicyName: WriteCloudWatch          PolicyDocument:            Statement:              -                Effect: Allow                Action:                  - logs:CreateLogGroup                  - logs:CreateLogStream                  - logs:PutLogEvents                Resource: arn:aws:logs:*:*:*              -                Effect: Allow                Action:                  - cloudwatch:PutMetricData                Resource:                  - '*'When I try to deploy this lambda I get the following error:ALBTargetGroup UPDATE_FAILED API: elasticloadbalancingv2:RegisterTargets elasticloadbalancing principal does not have permission to invoke arn:aws:lambda:{region}:{account_id}:function:CloudwatchMetricsLambda from target group arn:aws:elasticloadbalancing:{region}:{account_id}:targetgroup/CloudwatchMetricsLambdaGroup/group_idLoad balancers don't have roles. And the principal "elasticloadbalancing.amazonaws.com" is given permissions to invoke the lambda. This works fine if I click in the console and make it happen. But it does not work in cloudformation.What am I doing wrong here? I've tried this several ways and spent about half a day on this issue. I'm sure it's user error, but I just don't see where/how?FollowComment"

Answer: "0Hi,I went down so many rabbit holes on this one :-)To get this to work, all you need to do is remove:SourceAccount: !Ref AWS::AccountIdSo, your ALBLamdaPermission should look like the following and it will get to CREATE_COMPLETE.  ALBLambdaPermission:    Type: AWS::Lambda::Permission    Properties:      Action: lambda:InvokeFunction      FunctionName: !GetAtt MyFunction.Arn      Principal: elasticloadbalancing.amazonaws.com-randyCommentShareRandyTakeshitaanswered 4 years ago0This is not recommended by AWS: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html#prepare-lambda-functionWe recommend that you include the --source-arn parameter to restrict function invocation to the specified target group.CommentSharejoelbarencoanswered 3 years ago0So then, what is recommended, I have an identical setup but my "SourceArn" is the target group (because that's what aws docs said to do).https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html#prepare-lambda-functionBut I am receiving the same error...Lambda perms:AlbInvokePermission:  DependsOn:     - Function    - TargetGroup  Type: AWS::Lambda::Permission  Properties:    FunctionName: !Sub '${Function.Arn}'    Action: 'lambda:InvokeFunction'    Principal: elasticloadbalancing.amazonaws.com    SourceArn: !Ref TargetGroupYes, I know that removing the SourceArn will "resolve" this issue, but will allow blanket access from ANY alb, which I definitely do not want.Error:elasticloadbalancingv2:RegisterTargets elasticloadbalancing principal does not have permission to invoke {lambda _arn} from target group {target_group_arn}Edited by: HarryCaveMan on Jan 8, 2020 11:51 AMEdited by: HarryCaveMan on Jan 8, 2020 11:54 AMEdited by: HarryCaveMan on Jan 8, 2020 11:56 AMEdited by: HarryCaveMan on Jan 8, 2020 12:00 PMCommentShareHarryCaveMananswered 3 years ago0So the issue I was having assigning my target group was due to a circular dependency between the target group and the lambda permission. I was able to work around this by naming the target group then building the arn as a string in the lambda permission:AlbInvokePermission:  Type: AWS::Lambda::Permission  Properties:    FunctionName: !Sub '${Function.Arn}'    Action: 'lambda:InvokeFunction'    Principal: elasticloadbalancing.amazonaws.com    SourceArn: !Sub 'arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:targetgroup/TargetGroupName/*'With this target group definition:TargetGroup:  DependsOn:    - AlbInvokePermission  Type: AWS::ElasticLoadBalancingV2::TargetGroup  Properties:    Name: TargetGroupName    TargetType: lambda    Targets:      - Id: !Sub '${Function.Arn}'CommentShareHarryCaveMananswered 3 years ago0For me, named TargetGroup has some random integer after it's name in ARN (I've named TargetGroup after it was created, in subsequent CFN template updates).edit: nevermind, I've noticed the asterisk at the end (aws forum text url-encoding "feature" does not help to see details here).edit2: unfortunately, asterisk does not work for me. Might be, not only for me: https://stackoverflow.com/questions/56347601/aws-can-lambda-permission-policy-have-a-source-from-target-group-with-wildcardsEdited by: askarkalykov on Apr 17, 2020 1:35 AMEdited by: askarkalykov on Apr 17, 2020 1:46 AMCommentShareaskarkalykovanswered 3 years ago0hey any solution for this because I don't want to add this after everything created in cloudformation and I guess it is a bad practice so eagerly waiting for a way to avoid this circular dependency problem so we can directly target the refCommentSharechamutanswered 3 years ago"


Question: SES team deny Production Access request

"Hello. My name is Ashini. I am AWS customer.I hope to receive some kind of feedback from AWS regarding my case 9316169001.The situation is the following: I need AWS SES for the content delivery. Simple Email Service configurations and domain verification was made by me. After reading a lot of documents and information in the network I decide to make a Production request. Sandbox mode limits my abilities.I make a request according to all the rules and was writing there everything they were asking for.What is the result?"Thank you for providing us with additional information regarding your sending limits. We are unable to grant your request at this time."I can't understand the reason why my request was denied. Maybe SES isn't looking for customers or what?If you know how to get Production Access, please help me!FollowComment"

Answer: "1Hello Ashini,In general, when requesting access to SES production the AWS SES Trust and Safety team will review the request details (use case, handling bounces ..etc[[1]]), the details must comply with the AWS Acceptable Use Policy ( http://aws.amazon.com/aup/ ) and read the Amazon SES Service Terms (section Amazon Simple Email Service (SES) of http://aws.amazon.com/service-terms/ ).That said please note that the Production access and Limit Increase requests decision is under the sole discretion of AWS SES Trust and Safety team and when they take decisions, it depends greatly on how the service will be used and if it can impact the AWS SES negatively.When they do deny the request, they'll do so while stating what other information they'd need, I can see that you would like to understand better why you have got the above feedback, and why the production request is denied, hence I would like to suggest that you work with them via same case to ensure that you get required support as needed, please reach out to them again to understand why they have denied the request.Once you reach out to them, they might ask you follow-up questions such us but not limited :What is the nature of your business, and how do you plan to use Amazon SES to meet the needs of your business?How do you collect the email addresses that are on your mailing list?How do your subscribe and unsubscribe processes work?How do you handle bounces and complaints?Please reply to the support case for further investigations/details.References :[[1]] Moving out of the Amazon SES sandbox - https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlCommentShareAbdallahAWSanswered a year ago"


Question: Can we call external functions (such as Amazon Location Service functions) in Neptune?

"Let's consider we like to call a user defined function which calls an Lambda function (where a rest API call grabs the geolocation of an address) inside a Gremlin query in Neptune. IF yes, how?Please check this link that the same thing happens in Amazon Aurorahttps://aws.amazon.com/blogs/database/access-amazon-location-service-from-amazon-aurora/Many thanksFollowComment"

Answer: "0The closest related feature that exist in Neptune today is the integration with Elasticsearch/OpenSearch, which allows users to perform a full-text search query against an external OpenSearch index.  https://docs.aws.amazon.com/neptune/latest/userguide/full-text-search.htmlFor RDF workloads, the SPARQL query language offers a federated query feature (using the SERVICE clause) to query an external SPARQL endpoint and return a set of triples/quads that can then be used as part of the query against Neptune.  Instead of making a call to an external SPARQL endpoint, this could also be used against a REST API such that the API returned the results in the proper format.  https://docs.aws.amazon.com/neptune/latest/userguide/sparql-service.htmlOther than that, we don't have the ability to call other external APIs/functions from any of the other query languages supported inside of Neptune.CommentShareTaylor-AWSanswered 8 months ago"