Question: "'Access-Control-Allow-Origin' header value not equal to the supplied origin, POST method"

"I get the following message in the Chrome dev tools console when submitting a contact form on the /about.html section my portfolio web site:Access to XMLHttpRequest at 'https://123abc.execute-api.us-east-1.amazonaws.com/prod/contact' from origin 'https://myportfoliositeabc123.net' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value 'https://myportfoliositeabc123.net/' that is not equal to the supplied origin.I don't know how to troubleshoot this properly, any help is appreciated. Also where is the 'Access-Control-Allow-Origin' header has a value set? It is in the S3 bucket permissions > CORS, correct? Essentially, this is happening, and I'm  not sure how to fix it in AWS (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSAllowOriginNotMatchingOrigin)Here is a description of the AWS stack:Context, I am using an S3 bucket as static website using CloudFront and Route 53, this stuff works fine, has for years. When I added the form, I did the following to allow the HTTP POST request:Cloudfront, On the site's distribution I added a behavior with all settings default except:Path pattern: /contact (I am using this bc this is the API Gateway resource path ending)Origin and origin groups: S3-Website-myportfoliositeabc123.net.s3-website... (Selected correct origin)Viewer protocol policy: HTTP and HTTPSAllowed HTTP methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETECache HTTP methods GET and HEAD methods are cached by default: Checked OPTIONS boxOrigin request policy - optional: CORS-S3OriginResponse headers policy - optional: CORS-With-PreflightAPI Gateway, Created a REST API with all default settings except:Created a resource: /contactCreated a method: POSTFor /contact, Resource Actions > Enable CORS:Methods: OPTIONS and POST both checkedAccess-Control-Allow-Origin: 'https://myportfoliositeabc123.net' (no ending slash)Clicked "Enable CORS and Replace existing headers"Results are all checked green:✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Method Response Headers to OPTIONS method✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Integration Response Header Mappings to OPTIONS method✔ Add Access-Control-Allow-Origin Method Response Header to POST method✔ Add Access-Control-Allow-Origin Integration Response Header Mapping to POST methodCreated a stage called "prod", ensured it had the /contact resource, and deployed.At the /contact - POST - Method Execution, The test works as expected (triggers Lambda func that uses SES to send email, which I do actually receive).The only thing I feel unsure about with API Gateway is after I enable the CORS, I can't seem to find a place where that setting has been saved, and if I click again on enable CORS, it is back to the default form ( with Access-Control-Allow-Origin: '')*Amazon SES, set up 2 verified identities for sending/receiving emails via lamda.Lamda, set up a basic javascript function with default settings, the REST API is listed as a trigger, and does actually work as previously mentioned. The function code is:var AWS = require('aws-sdk');var ses = new AWS.SES({ region: "us-east-1" });var RECEIVER = 'myemail@email.com';var SENDER = 'me@myportfoliositeabc123.net';var response = {    "statusCode": 200,    "headers": {        "Content-Type": "application/json",        "Access-Control-Allow-Origin": "*"    },    "isBase64Encoded": false,    "body": "{ \"result\": \"Success\"\n}"}exports.handler = async function (event, context) {    console.log('Received event:', event);    var params = {        Destination: {            ToAddresses: [                RECEIVER            ]        },        Message: {            Body: {                Text: {                    Data: 'first name: ' + event.fname + 'last name: ' + event.lname + '\nemail: ' + event.email + '\nmessage: ' + event.message,                    Charset: 'UTF-8'                }            },            Subject: {                Data: 'Website Query Form: ' + event.name,                Charset: 'UTF-8'            }        },        Source: SENDER    };    return ses.sendEmail(params).promise();};The only thing i can think of here is to maybe update the response to have "headers": {"Access-Control-Allow-Origin": "https://myportfoliositeabc123.net"}S3 bucket that holds the site contents, in permissions > CORS, I have the following JSON to allow a post of the contact form (notice no slash):[    {        "AllowedHeaders": [            "*"        ],        "AllowedMethods": [            "POST"        ],        "AllowedOrigins": [            "https://myportfoliositeabc123.net"        ],        "ExposeHeaders": []    }]Permissions/Roles, Established Roles and permissions perAWS guide:  create dynamic contact forms for s3 static websites using aws lambda amazon api gateway and amazon sesvideo titled: "Webinar: Dynamic Contact Forms for S3 Static Websites Using AWS Lambda, API Gateway & Amazon SES"FollowComment"

Answer: "-1Hello,I am trying to understand your problem:You are using S3 + CloudFront + Route53 for static website hosting https://myportfoliositeabc123.netyou have a api gateway https://123abc.execute-api.us-east-1.amazonaws.com/prod/contact which you calling from your website javascript code and you getting CORS error. You have also enable CROS on your api gateway for this "POST" /contact method.Please try following to see if it resolve your issueOpen again API Gateway and select /contact resource and re configure CORS, fill Access-Control-Allow-Origin as https://myportfoliositeabc123.net and save the changesYou should see OPTION method added under /contact resource.Re-deploy your api under prod stageTest your website client code, check followingEnsure you client code is making POST method call to https://123abc.execute-api.us-east-1.amazonaws.com/prod/contactunder dev console you should see preflight OPTION method call happeningeventually your code should get response.I would also suggest to clean all configuration which you did in cloudfront which you listed in point 2. They are not required to have any kind of behaviour configuration for api gateway.CommentShareSumit Kumaranswered 4 months agolrmcc 4 months agoThanks for responding.In response to your suggestion to try to resolve the issue:Regarding #1, I had already done that. I should have mentioned that when either 1. when enabling CORS in the API Gateway or 2. when creating the POST method, the OPTIONS method appeared (As you mentioned happens in your #2). I have retried enabling CORS and redeploying a few times (as you mentioned in #3), since there is no state of CORS settings able to be viewed for a resource.In response to testing the client code:Regarding 1) I have verified the client code is making the POST method call to the correct API url.Regarding 2) I do see the preflight OPTION method call in Chrome's dev tools network section.Regarding 3) It does NOT get a response, and in the console thats where there is logged the CORS error.While this did not fix my problem, this prompted me to dig around the dev tools a bit more. I now realize there really is no mismatch (i thought it could be related to the trailing slash, but I see the dev tools "issues" area it lists "initiator context" and "Allowed Origin" as the exact same address. I will add images to the initial problem showing what the dev tools is displaying.The reason I update the Cloudfront behavior is based on this artice, which is the first issue I overcame  (https://aws.amazon.com/premiumsupport/knowledge-center/no-access-control-allow-origin-error/). I'll leave it be for now.I've updated the content of the question.ShareSumit Kumar 4 months agoOk are you providing allowed header? as you have seen doing CORS setting enabling on API Gateway console, and same you can also see in your screenshot OPTION method response header. If you are not using all headers, then just set those which you need.Share-1The problem was that the response in the lambda function had "Access-Control-Allow-Origin" set to "*".This should have been set to the exact origin, so if the origin is 'https://myportfoliositeabc123.net', then the response in the lamda function should have "Access-Control-Allow-Origin" set to 'https://myportfoliositeabc123.net' as shown below:var response = {    "statusCode": 200,    "headers": {        "Content-Type": "application/json",        "Access-Control-Allow-Origin": "https://myportfoliositeabc123.net"    },    "isBase64Encoded": false,    "body": "{ \"result\": \"Success\"\n}"}```CommentSharelrmccanswered 4 months agoSumit Kumar 4 months agochange * to https://myportfoliositeabc123.net does not matter. as * means allow all domains.. it kind of wildcard allow, hence you need to see what change made it working, if you really want to know.Share"


Question: Cognito presignup trigger fires twice or multiple time.

"Hi, I'm using an AWS Lambda function. Once any request from APP to Cognito to signUp users. Then I have set the Pre sign-up trigger to send OTP to the customer and return the event to Cognito.It happens sometime in the request, not all the time. it will trigger 3 times sometime and most of the time twiceAs per this linkhttps://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html#cognito-user-identity-pools-working-with-aws-lambda-triggers-using-lambdaImportant Amazon Cognito invokes Lambda functions synchronously. When called, your Lambda function must respond within 5 seconds. If it does not, Amazon Cognito retries the call. After 3 unsuccessful attempts, the function times out. This 5-second timeout value cannot be changed.FollowComment"


Question: Deployment-time variable substitution for subscription topic names?

"I have a lambda function deployed to several GG core device; all members of a single group.  I’d like them to be triggered by messages published to dedicated topics, for example:core:gg_1, responds to:cmd/gg_1/doTaskcore:gg_2, responds to:cmd/gg-2/doTaskcore:gg_n, responds to:cmd/gg_n/doTaskExamples in the docs all seem to use static topic names.  I see no way to parameterize subscriptions so that individual GG cores within a group listen on distinct topics.  Ideally, the subscription would support something like {coreName} in the topic; similar to policy variables in IoT Core.I believe this can be done manually using the lower level IOT SDK, building up subscriptions at runtime.  But I prefer to remain at the GG level.  To achieve the same effect in a declarative GG group deployment would require something like variables in topic names, with substitution being done before subscriptions are written to group.json.  But I don’t see any indication of this as a feature.I've considered putting tokens in the topic, and doing my own fix-up on group.json.  But that seems like a hack.  I've also thought about using shadow updates to covey the commands, but it feels like a misuse of the shadow's state model.Is there a way to create parameterized subscriptions so that topics are dedicated to a GG core ?FollowComment"

Answer: "0Hi,Do you mean you are trying to deploy one group to several GGCs? This is not recommended because when several devices try to connect to the cloud, only one will remain connected.DennisRead wrote:I have a lambda function deployed to several GG core device; all members of a single group.  I’d like them to be triggered by messages published to dedicated topics, for example:CommentShareShirley-awsanswered 3 years ago0Hi,No, I'm not trying to span a GG core across multiple groups.  All our GG cores are defined within a single group.  They run the same code, and should be operated and managed collectively.  Sorry if that was unclear in the question.At the end of this message is an excerpt from the AWS whitepaper on IoT Core topic design.  It shows device names as part of the topic name, allowing for targeted subscriptions and delivery.  That illustrates what I'm trying to do.  If I deploy a group with 100 GG cores, they all get the same subscriptions, so they all receive the same events.This project is a prototype refactoring of a solution originally built using raspberry pi devices running the IoT Core SDK.  That approach provided the flexibility I'm describing (e.g. each device constructed its own subscriptions, with thingName in the topic filter).  But it also required a lot of housekeeping code.  I'm evaluating the possibility of moving to greengrass.  So far it looks promising, but I'm stuck on how to to deploy GG core specific subscriptions.Hopefully this gives you a better understanding of my question.Thanks.Excerpt from AWS whitepaper: Designing MQTT Topics for AWS IoT CoreWhen you design MQTT topics for command requests, follow this structure:cmd/<application>/<context>/<destination-id>/<req-type>destination-id: Identifies the destination device or application for this message.By including the destination-id, the target device can subscribe to its own set ofcommand topics and receive any command requests.CommentShareDennisReadanswered 3 years ago0I’m marking this question as answered.  After reviewing the examples and documentation, it’s clear that I’ve misunderstood the relationship between groups and cores.I thought a group could manage multiple cores, but it seems that’s not the case.  So ‘thingName’ parameterization in group topic names is unnecessary, because each core will have its own group.Sorry for the confusion.CommentShareDennisReadanswered 3 years ago"


Question: Troubleshooting Email Tracking in Microsoft Outlook with Amazon SES

"I am using Amazon SES for sending emails and its email tracking feature, but I am unable to track the read status of the emails in Microsoft Outlook. What can be the possible reasons for this and how can I resolve them to ensure accurate tracking?FollowComment"


Question: TDS on bill payment

"How to TDS cut from the time of bill payment in aws, and is there any reimbursement.FollowComment"

Answer: "0Hello,This doc outlines Product refunds in the AWS Marketplace: https://docs.aws.amazon.com/marketplace/latest/userguide/refunds.html. Hope this helps.— Brian D.CommentShareEXPERTAWS Support - Briananswered 4 months ago"


Question: How to recover SSH access to EC2 instance?

"Hello, recently I set up the Hide.me VPN service in one of my EC2 instances, after starting the service I got disconnected from my SSH instance and I couldn't enter anymore. The instance seems to be up and running in the UI but I cannot access to it. Any help is much appreciated.FollowComment"

Answer: 0Here are the steps to gain access:Stop broken instanceDetach broken instance root volumeStart new instance that you can login toAttach broken instance volume to new instanceMount the broken instance volume at the OS levelFix/undo the configuration on the broken instance volumeUnmount/detach broken (now-fixed) instance volumeAttach now-fixed volume to broken instanceStart broken (now-fixed) instanceLoginCommentShareEXPERTkentradanswered 6 months ago


Question: IAM user access to S3: uploads fail

"Based on this:https://docs.aws.amazon.com/AmazonS3/latest/dev/example-policies-s3.html#iam-policy-ex0I created an IAM user and attached a policy similar to this (the only difference being using the real  bucket name instead of "examplebucket"):{   "Version":"2012-10-17",   "Statement":[      {         "Effect":"Allow",         "Action":[            "s3:ListAllMyBuckets"         ],         "Resource":"arn:aws:s3:::*"      },      {         "Effect":"Allow",         "Action":[            "s3:ListBucket",            "s3:GetBucketLocation"         ],         "Resource":"arn:aws:s3:::examplebucket"      },      {         "Effect":"Allow",         "Action":[            "s3:PutObject",            "s3:PutObjectAcl",            "s3:GetObject",            "s3:GetObjectAcl",            "s3:DeleteObject"         ],         "Resource":"arn:aws:s3:::examplebucket/*"      }   ]}When I log in as the new IAM user via the console, I can go to S3 and list all the S3 buckets, but there are two problems:In the main S3 window, there is an "Error" indication in the "Access" column for every bucket.  Screenshot here:https://testify4love.s3-us-west-2.amazonaws.com/maxi_bucket_access_error.jpgWhen I try to upload a file to examplebucket or a folder under it, the upload fails.Any suggestions would be welcome.FollowComment"

Answer: "0Accepted AnswerHi,Try attaching the following Policy to your user's group. With this policy, I was able to upload files to the specified bucket AND the access column was being displayed properly. Note: the first "Action" is required to properly display the Access column.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": [                "s3:ListAllMyBuckets",                "s3:GetBucketLocation",                "s3:GetBucketPublicAccessBlock",                "s3:GetAccountPublicAccessBlock",                "s3:GetBucketAcl",                "s3:GetBucketPolicyStatus"            ],            "Resource": "*"        },        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "s3:ListBucket",                "s3:GetObject*"            ],            "Resource": [                "arn:aws:s3:::examplebucket/*",                "arn:aws:s3:::examplebucket"            ]        },        {            "Sid": "VisualEditor2",            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObjectAcl",                "s3:GetObject",                "s3:DeleteObject",                "s3:PutObjectAcl"            ],            "Resource": "arn:aws:s3:::examplebucket/*"        }    ]}Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi Randy -  Thanks for your help.I tried this, and it did cure the "Access" column problem.  The proper status, such as "Public" is now displayed.  So, progress.And when I try to upload a file, the blue progress indicator goes to 100%, and says "Successful" -- which it was not doing before -- but then the file does not upload.  And there is an error indicated, like this:https://testify4love.s3-us-west-2.amazonaws.com/maxi_bucket_failures.pngI added your policy to the one I had before.  Should I delete the one I had created -- or at least removed it from this user?Thanks again!Edited by: mikeh100 on Aug 17, 2019 9:15 PMCommentSharemikeh100answered 4 years ago0Yes, please delete the one you created. Let me know if it works.-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks, Randy.  Unfortunately, that didn't seem to change anything.  Looking at the details of the failed upload, it says "forbidden".  I find I can download, by the way.OMG I just realized I had the bucket name wrong!  I put "mybucket" in the policy when the name was actually "mybucket.com".  When I corrected that, your policy worked. Thank you again, Randy!Edited by: mikeh100 on Aug 18, 2019 1:29 AMCommentSharemikeh100answered 4 years ago"


Question: Trying to Login PHP My Admin

Getting Below Error Messagemysqli_real_connect(): php_network_getaddresses: getaddrinfo failed: Name or service not knownFollowComment


Question: Workspaces deployment in multi account - Control Tower

"I am helping a customer with their Workspaces deployment. The customer has AWS Control Tower, with an account for networking (where AD will be deployed) and one for Workspaces. I am running through the setup now and I can’t seem to get AD to register.I created 4 subnets (2 private, 2 public) in the Workspaces account which I shared (using RAM) to the Network account. I set up managed AD on the Network account and selected the 2 private subnets that were shared from the Workspace account ( each subnet is in different AZ). I also shared managed AD with the Workspace account and set VPC peering.The last step prior to deploying Workspaces is to Register the AD directory, which requires two subnets in different AZs. When attempting to do so, the only subnets displayed on the register window are a private and public subnet which are in the same AZ.Additionally, when I attempt to launch a Workspace in the Workspace account it does not recognize the shared AD, instead it prompts to create a new directory.Questions:Are there any concerns with the architecture approach I have taken so far?How do I bypass/fix the issue I am facing with Registration of AD? I checked that the shared VPC has all 4 subnets (a private and public in one az, and another set of private and public subnet in a separate AZ).FollowComment"

Answer: "0Accepted AnswerAre there any concerns with the architecture approach I have taken so far?You cannot use WorkSpaces with Shared VPC, Shared Managed AD.How do I bypass/fix the issue I am facing with Registration of AD?In order to make this work for your setup, you need to setup AD Connector for WorkSpaces. This will require you to enable traffic routing to the AWS Account/VPC where the Managed AD is deployed. You can achieve this with VPC Peering or Transit Gateway.When attempting to do so, the only subnets displayed on the register window are a private and public subnet which are in the same AZ.Amazon WorkSpaces is not supported in all available AZ in certain regions. In US-EAST-1, the only AZ that is supported by Amazon WorkSpaces are use1-az2, use1-az4, and use1-az6. You can find this AZ mapping in RAM for the account.CommentShareEXPERTDzung_Nanswered 3 years ago"


Question: Does DMS drop and creates the target files in S3 target endpoints?

"Created a DMS task with source as Oracle and target as S3. I want to re-run the full load. I have set the DMS task to DROP_AND_CREATE. When I restart the DMS task, it's not dropping and recreating the files in S3 location.FollowComment"

Answer: 0it should delete the target files in s3 bucket. Please review dms task logs for error.also verify iam permissions for any missing delete permissions.CommentShareAWS-User-8174525-subhashanswered 10 months ago


Question: CloudWatch: count number of requests from cloudwatch logs and create alarm

I am logging userid in cloudwatch logs and need to count the no. of requests for the same userid in last 1 hour and have to create an alarm. Basically need to do that for each userid. So is there a way we can achieve this using Cloudwatch metric? Or any other AWS service?FollowComment

Answer: 0If I understood your requirement correctly you have a log group that captures records of user logging which includes the userid field and you need to set an alarm if one or many of these userids if they reach a certain threshold within an hour.I would suggest creating a metric filter on your log group as described here -> https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.htmlThen setup a cloudwatch alarm based on the metric filter you created -> https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_alarm_log_group_metric_filter.htmlCommentShareBisinaanswered 12 days agovneekhra 12 days agoso I need to setup this for each user id?Share


Question: AWS Redshift View Formating

"Hi Guys,After creating views in AWS Redshift SQL code is automatically formatted in a different way.I am encountering problems while trying to update previously created View.  After copying view code and pasting in editor I am getting an error.Is there any way to convert SQL View Code (automatically formatted) into standard SQL that can be rerun in Editor?Best regards,MichalFollowCommentAWS-User-6509414 2 months agoHi Michal,I understand that you're facing issues with updating views in AWS Redshift because the SQL code gets automatically formatted. To help you with this, you can use SQL formatting tools to convert the formatted code into standard SQL.Here's a simple approach to achieve this:Copy the automatically formatted SQL code from AWS Redshift.Use an online SQL formatter/beautifier to format the code in a standard and readable way. Some popular ones are:SQL Formatter (https://sqlformat.org/)Instant SQL Formatter (http://www.dpriver.com/pp/sqlformat.htm)Poor SQL (https://poorsql.com/)Paste the formatted code into your SQL editor, make the necessary changes to update the view, and execute the query.Remember that these tools might have some limitations when working with Redshift-specific syntax. Be sure to review the output carefully to ensure it is correct.Alternatively, if you prefer a more integrated solution, you can use an SQL client with built-in formatting support, like DBeaver, SQL Workbench/J, or JetBrains DataGrip. These tools allow you to format your SQL code within the editor itself, making it easier to work with AWS Redshift views.I hope this helps! Let me know if you have any other questions.Best regards,IsmaelShare"

Answer: "2Hi Michal,I understand that you're facing issues with updating views in AWS Redshift because the SQL code gets automatically formatted. To help you with this, you can use SQL formatting tools to convert the formatted code into standard SQL.Here's a simple approach to achieve this:Copy the automatically formatted SQL code from AWS Redshift.Use an online SQL formatter/beautifier to format the code in a standard and readable way. Some popular ones are:SQL Formatter (https://sqlformat.org/)Instant SQL Formatter (http://www.dpriver.com/pp/sqlformat.htm)Poor SQL (https://poorsql.com/)Paste the formatted code into your SQL editor, make the necessary changes to update the view, and execute the query.Remember that these tools might have some limitations when working with Redshift-specific syntax. Be sure to review the output carefully to ensure it is correct.Alternatively, if you prefer a more integrated solution, you can use an SQL client with built-in formatting support, like DBeaver, SQL Workbench/J, or JetBrains DataGrip. These tools allow you to format your SQL code within the editor itself, making it easier to work with AWS Redshift views.I hope this helps! Let me know if you have any other questions.Best regards,IsmaelCommentShareAWS-User-6509414answered 2 months ago"


Question: Tracking what is using a security group

"Hello,I am still at trying to clean up AWS account, and am needing some advice.In AWS - EC2 - Security Groups - I have several critical vulnerabilities there, and in lieu of just nixing the issues, as im SURE it will blow something up, how do I find what function(s) are using this security group.  So I can chase it back to its roots, see if they can be safely removed, or changed so the security value that is a vulnerability can be removed.THANKSFollowComment"

Answer: "1Check out this document. You can do it via the console as shown in the document or via the CLI:aws ec2 describe-network-interfaces --filters Name=group-id,Values=<group-id> --region <region> --output jsonHope this helpsCommentShareAWSJoeanswered 10 months agoE Gabrielli 9 months agoUnfortunately this will only catch resources in the current account, but if you have VPC peering you could have SG in a different account referencing it. You should loop on every account having a peering in fact.Share1Hello @BigD63We answered your question in the latest episode of AWS Supports You. Please take a look at the YouTube video here, and we hope it helps answer your question! https://www.youtube.com/watch?v=lzadlmq4LcMPlease don't hesitate to comment here if you have any follow up questions. If this helped to answer your question, please make sure to mark this question as answered.Have a great day!CommentShareEXPERTRob_Hanswered 10 months ago0This will definitely show you all the resources your security group is associate with aws ec2 describe-network-interfaces --filters Name=group-id,Values=<group-id> --region <region> --output json --query 'NetworkInterfaces'CommentShareDunieski Otanoanswered 8 months ago"


Question: How to delete MGN archives? and does it charges extra fees?

"Hi, I've ran MGN and recently disconnected the Data replication status. and now it's marked as archived. But is there any way to delete this archive? becasue I'm concerned that it may charge me extra fees if it's still in archive. Recourses related to MGN are all deleted such as EC2. Only MGN archive is still remaining.FollowComment"

Answer: "0Hello there,I see that you are concerned about the charges you would incur if you keep the server in archive so you would like to delete them. Please feel free to correct me if I am wrong.I reviewed the MGN Documentation in detail and found that you can mark a source server as archived once it has completed the replication.If you have completed the actual replication and deleted all the resources that were part of the replication process, archiving the source server would only mean that the source servers that completed the replication process will no longer be visible in the source servers list.Please note that the option will only make the UI simpler so that the user can monitor the source servers that are yet to complete the replication and cutover. Your actual source servers are not being stored and hence will not incur any charges.More details on the same here:[+] https://docs.aws.amazon.com/mgn/latest/ug/server-actions-main.html [+] https://aws.amazon.com/application-migration-service/pricing/Hope this helps.Regards,Harshavardhan GAmazon Web ServicesCommentShareSUPPORT ENGINEERHarshavardhan_Ganswered 9 months ago"


Question: CloudFormation - LaunchTemplate MarketType

"Customer is looking at using CloudFormation for launching a mix of On-Demand and Spot Instances for their application, and wanted to know what to put into the MarketType option to achieve that. It seems that the only acceptable value is Spot, so how would they handle doing a mix of On-Demand and Spot Instances? If they put Spot in for that value, it will only deploy Spot Instances. Is there a way to have it try Spot Instances and if the conditions aren't me, then launch On-Demand instances?FollowComment"

Answer: "0Accepted AnswerThe recommended approach for launching a mix of Spot Instances and On-Demand instances is by using EC2 Auto Scaling Groups. These will allow configuring a flexible approach with multiple instance types and availability zones, in order to follow best practices and tap into multiple Spot capacity pools. It will also allow the use of allocation strategies like Capacity Optimized to minimize the amount of interruptions and launch Spot Instances from the most-available capacity pools. Please refer to the Spot best practices user-guide page that details the allocation strategies, instance diversification, rebalance recommendation, etc. These will help to successfully adopt Spot for their Stateless, Fault-tolerant and flexible workloads.EC2 Auto Scaling does not dynamically modify the mix of On-Demand and Spot Instances in the group, so it will not launch On-Demand capacity if Spot Instances cannot be launched. However, if Spot best practices are followed (instance type + AZ diversification, using the capacity-optimized allocation strategy), it will increase the chance of achieving the desired scale with Spot Instances.CommentShareAWS-User-5950717answered 2 years ago"


Question: Using Glue for dimensional model ETL into Redshift

"A customer is wondering if they can use Glue for their dimensional model ETL. Would it be able to populate the dimensions and facts and load it into Redshift, or would they need to create a staging table in Redshift and then populate their dimensions and facts via querying with surrogate keys?I don't see why Glue wouldn't work for a dimensional model schema, but I'm having a really hard time finding sources and information about it.FollowComment"

Answer: "0Accepted AnswerGlue can definitely be used for loading dimensional data into Redshift. Approach will depend on what kind of dimension it is (SCD Type). And you can certainly generate surrogate ids in Glue. Example: I have used this in the past.def customer_id(custid):    x = int(str(hashlib.md5(custid.encode()).hexdigest()[:10]),16)    x = int(x)    return xHowever, make sure you follow the logic consistently across different datasets to produce consistent surrogate ids.Ideally, a staging table should be present and from staging to main table, you can govern the logic through redshift procedure or plain SQL depending upon the complexity.CommentShareVikas Omeranswered 3 years ago"


Question: AWS Cloud Front top referrers?

On cloud front there is a tab called top referrers which shows a request count? Does the number of request count represent the amount of people that have clicked the link? So that reflects amounts of views??FollowComment

Answer: "0Accepted AnswerThe request count in the referrers tab indicates the total number of HTTP/HTTPS requests from the domain name in the Referrer column. The referrers can be search engines, other websites that link directly to your objects, or your own websites. If a user enters the URL directly into the address line of a browser, there is no referrer for the requested object.To view more information about the CloudFront top referrers report, please use this link.CommentShareNickanswered a year ago0Thanks for your quick answer back, is there a way of finding out how many viewers we were having on a daily basis in CloudFront?CommentSharerePost-User-2405731answered a year ago"


Question: Aurora MySQL database got stuck in Upgrading status

"Hello,I tried to upgrade MySQL to the latest minor version available but it got stuck in Upgrading status. It's been more than 3 hours and still not finished. I already restored a snapshot to a new cluster/instance for my team to proceed but I still need to get the original cluster/instance working. What else can I do?Event logs:November 17th 2020, 2:03:48 pm UTC The crash loop due to OOMNovember 17th 2020, 1:46:18 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:45:56 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:23:41 pm UTC DB instance restartedNovember 17th 2020, 1:16:25 pm UTC DB instance restartedNovember 17th 2020, 1:16:12 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:00:26 pm UTC DB instance restartedNovember 17th 2020, 12:51:17 pm UTC The database process was killed by the OS due to excessive memory consumption. It is recommended to tune your database workload and/or parameter usage to reduce memory consumption.November 17th 2020, 12:49:12 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 12:48:10 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 12:47:01 pm UTC Error restarting mysql: Could not verify and start mysqld.November 17th 2020, 12:38:40 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...ThanksLinoFollowComment"

Answer: "0Apparently the configured max_connections parameter is too high for the instance type we're using. After adjusting it to its ideal value, the problem has been solved.CommentShareLinoanswered 3 years ago"


Question: CSP Issue when uploading new version in Elastic Beanstalk

I'm unable to upload a new version of my application. I get the following error in the browser's console:Refused to send form data to 'https://elasticbeanstalk-eu-west-1-412334503295.s3.eu-west-1.amazonaws.com/' because it violates the following Content Security Policy directive: "form-action 'self' https://console.aws.amazon.com/feedback/submit-feedback https://signin.aws.amazon.com/switchrole https://us-east-1.console.aws.amazon.com/feedback/submit-feedback https://eu-west-1.signin.aws.amazon.com/switchrole https://eu-west-1.signin.aws.amazon.com/oauth".FollowComment


Question: Redshift connection error

Getting `below error message while connecting to redshift(publicly accessible) via Lambda functionResponse{"errorMessage": "2022-04-06T05:33:16.775Z cb4cdf56-fbd7-4a2e-a2fd-1ec52f5a2a93 Task timed out after 60.06 seconds"}`FollowComment

Answer: "0Hi,Lambda functions have many potential reasons for a "Task timed out" error, especially when configured to run in a VPC.Even though a Lambda function's maximum invocation timeout limit is 15 minutes, other AWS services may have different timeout limits.By looking at the function's maximum value for the "Duration" metric at the time of the error, you can see that at least one invocation had a duration that reached the function's configured timeout value.When an invocation times out, an error metric will be recorded, but a Task timed out error message appears in the failed invocation's CloudWatch logs, not an Error message.  To determine why your function was timing out, you will need to examine the Cloudwatch logs of the timed out invocations.When your invocations generate requests to a downstream resource/API, make sure the libraries used by your function's code are configured to fail fast and retry.  While AWS SDK's will automatically retry failed/timed out network requests, note that the default settings are usually higher than the ideal setting for the average Lambda function.  For example, most Lambda functions are designed to run within a few seconds, but the default timeout value for a network request in AWS's Boto3 Python SDK is 60 seconds/attempt, and in Java, the default is 10 seconds/attempt .  If you are still using the default settings, please modify those settings to a value that will allow your function to retry quickly.If your function is creating new connections inside each invocation, note that re-using connections across invocations is a Lambda best practice.  Connection re-use is possible because Lambda will use a single environment to run many invocations.  This allows you to create network connections in the init section of your code, which can be used in the handler code for all invocations that run in that environment .  Be aware that Lambda purges idle connections over time; when your function is re-using connections, attempting to reuse a purged connection will result in a connection error.  To maintain a persistent connection from Lambda, use the keep-alive directive associated with your runtime.References :-https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-retry-timeout-sdk/https://aws.amazon.com/premiumsupport/knowledge-center/lambda-vpc-troubleshoot-timeout/Thank you !CommentSharePriyaAWS2020answered a year ago"


Question: How does GuardDuty work in a Shared VPC?

How will Guard Duty work with a Shared VPC?Who get's to see the findings?What will happen if the VPC owner has enabled Guard Duty but the participant hasn’t’?What’s the best practice?This topic came up a few times already - I'm using this post to document the answer from the GuardDuty & VPC service teams.FollowComment

Answer: "0Accepted AnswerThe general recommendation is that all participants and the owner of the Shared VPC should have Guard Duty enabled.By default, any GuardDuty findings will only be available to the account which owns the resource against which malicious activity was detected.  For example, if there are findings against an EC2 instance owned by a Shared VPC participant then only that participant AWS account will see those findings. The owner of the Shared VPC will not have access to findings related to participant resources.If findings need to be shared across accounts customers can follow the standard  administrator/member deployment model: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.htmlIf a participant hasn’t turned on GuardDuty but the owner has it running then no findings will be generated against that participants resources. Any findings against owner resources will still be generated as usual and sent to the owner account.CommentShareEXPERTAWS-User-7100868answered 4 years ago"


Question: Free Tier for RDS in Stockholm

"I've found there is no free tier for RDS (MariaDB is used, but it is most likely the same for other types) in Stockholm (eu-north-1) as there is no db.t2.micro. Is there any substitution ?FollowComment"

Answer: 0Please check if everything from the list is correctfirst 12 months are free750 hours per month of db.t2.micro database usage (applicable database engines)20 GB of general purpose (SSD) database storage20 GB of storage for database backups and database snapshotsI took it from here.CommentShareMGanswered a year ago0Hello WSZ87Please have a look at the following links :https://aws.amazon.com/rds/free/?p=ft&c=hp&z=5https://aws.amazon.com/rds/faqs/#free-tierThanksCommentShareKamalanswered a year ago0Thank you for the answers and I certainly cannot match the requirements for RDS free tier as I cannot use db.t2.micro (no such type in the mentioned region -> eu-north-1).The real question is whether I can use any other type of db EC2 instance to achieve it. It doesn't seem to work with db.t3.micro.CommentSharewsz87answered a year ago


Question: Send Config Rule results into AWS Security Hub using the Amazon EventBridge service

"Hi,I created Config Rule to only allow specific type instances to be used and, now I want to feed AWS Security Hub by Config Rule results using EventBridge to automate the process.How to send Config Rule results into AWS Security Hub as a finding using the Amazon EventBridge service ?FollowComment"

Answer: "1Hi,I understand you would like to know how to send Config Rule results into AWS Security Hub as a finding using the Amazon EventBridge service.Security hub uses AWS Config and AWS Config rules as its primary mechanism to evaluate the configuration of AWS resources. AWS Config rules can also be used to evaluate resource configuration directly.To your question and giving the fact that you created a Config Rule to only allow specific type instances to be used, I recommend using the custom action feature in security hub: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-custom-actions.htmlI hope this helps. Let me know if I answered your question by up voting my response as accepted or if you have any follow-up.Kind regards,AhmedReference:[1] https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-all-findings.html[2] https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.htmlCommentSharerePost-User-5076019answered 19 days ago"


Question: mongoDB atlas scaling with AWS regions

I have 6 EC2 Instances on different region on AWS. I have only one MongoDB server on MongoDB Atlas (AWS). I am having latency issue while updating Data to the database. what is the best way to scale my MongoDB server with My 6 EC2 instances.FollowComment

Answer: "0You can try one way you can apply the VPC peering from EC2 to MongoDB Atlas (AWS). As MongoDB Atlas as now VPC peering function.If you are trying to connect the MongoDB using public-facing network, then it might be slow.AWS launched instances in a different region may create a connection using inter-region cross VPC peering.So if you are following tradition way to whitelisting ACL's better try this it will reduce latency issue.please peer all the region's VPC (make sure there will not be any IP conflict) and try to connect using private connections.EDIT : 1There is no additional penalty with MongoDB in terms of using it out of region, but most database protocols are not optimized for high latency conditions. You might be much better off setting up a read replica in other regions.You can read this: https://www.mongodb.com/blog/post/optimizing-fast-responsive-reads-cross-region-replication-mongodb-atlasEDIT : 2If you can't push your database to multiple regions (by using read replicas for example), then you should consider using CloudFront in front of your application(website) to allow for caching of requests in the different regions.It won't technically improve the latency between application and database, but in terms of your user's perception of performance, it will be little speedy.CommentShareharshmanvaranswered 4 years ago0Here's a secure and cost-effective way you can connect to your MongoDB cluster using AWS IAM passwordless authentication. I think it is one of the fastest ways to connect to the DB as well.Link: https://vishnusblog.tech/secure-mongodb-with-aws-iam-passwordless-authentication-exampleYou could create a global EC2 role and assign it to all of your instances. Use that role to enable authentication with reference to the article mentioned.CommentSharevishnus17answered 10 months ago"


Question: WAF causes a timeout when a request has Transfer-Encoding: chunked in the headers

"As it says in the title, WAF is causing a timeout for a connection that has Transfer-Encoding: chunked in the headers of the request. It appears to happen when it is a GET request with nothing in the body.It is never hitting any of the rules.This feels like a bug to me, since there is no way to control this with any of the Rules if it isn't getting that far.How can I report this bug, or get a solution? As it is, we will have to stop using a WAF in front of our load balancers if there are random invisible timeouts caused like this.And yes, we know that that header is meaningless when the body is empty. Just concerned about the invisible failure.FollowComment"

Answer: "0Hi,Thank you for contacting AWS Re:post .I understand you have some clarifications regarding WAF causing timeouts for a connection that has Transfer-Encoding: chunked in the headers of the request.Looking at the issue, This would require further analysis and troubleshooting.I would suggest you to open a case with the WAF premium support team and provide details such as:--> Network Architecture--> Network Traffic Flow--> Any supported Logs (Access logs)--> Error outputThanks and have a nice day!CommentShareSUPPORT ENGINEERAnsh_C answered 2 months ago"


Question: App Runner Healthcheck failed on port 8080

Hello - I am trying to deploy Fast API on App runner and getting "Health check failed on port '8080" error.  The app doesn't get installed or created . I have tried even on port 80 but nothing works.Can you please advice how can i fix this issue ?  I am deploying using source code from git . Its an Python Fast API.RegardsFollowComment


Question: EFS volumes in manual backup plan does not satisfy Security Hub EFS.2 rule

"We have EFS volumes that are part of a manually created AWS Backup Plan. Yet, Security Hub mark my volumes as non compliant to "EFS.2 Amazon EFS volumes should be in backup plans". The same situation works for RDS as it find the backup plan and shows the snapshot in the RDS console.Is there something we did wrong when adding the EFS ressources to the backup plan or Is it just a missing feature?FollowComment"

Answer: "0If you have enabled automatic EFS backups using the method described in this document, there should be no problem.https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html#efs-2By the way, how did you activate the backup?CommentShareEXPERTRiku_Kobayashianswered 10 days ago0We do not use the automatic EFS backup functionality, we backup our EFS volumes in a backup plan directly in the AWS Backup service. This way all EFS/RDS resources of an application are grouped in the same plan.CommentSharegagf01answered 9 days ago"


Question: Is there a lambda layer repository? Or are there AWS-provided layers?

"I remember from the keynote that one practical use for layers is that you could potentially use layers developed by other parties. I was wondering, is there some kind of repository available where you can import an existing layer?For example, in the case of Java, it would be nice if Amazon provides its own SDK as a layer, so that you don't have to use the shade plug-in to make a fat jar. Does this already exist somewhere?It's not necessarily a lot of work to make, but if it's maintained centrally, that would be nice...FollowComment"

Answer: "0Accepted AnswerHi jvdb,Thanks for your interest in AWS Lambda. There isn't an AWS Lambda layer repository. I will pass on your suggestion to the appropriate team.ThanksawsSushantCommentShareAWS-User-3475007answered 4 years agoAli a month agoHello,is this still available in a repo ?can I dynamically determine this via some terraform data or cloudformation ?Share"


Question: Apache threads and db connections not cleaning up causing ELB high latency

"Environment:Elastic BeanstalkPHP 7.1 running on 64bit Amazon Linux/2.9.0Drupal 7Pre-fork MPMmod_php MaxRequestServers=128MaxRequestsPerChild= 1000Drupal page caching off due to personalization/regional customizations.Elasticache/Redis caching4-  t2.xlarge instancesClassic ELBELB timeout 60 /health check timeout 60 with 180 intervalmod_reqtimeout=14-28 body and head.KeepAlive onRDS/MySQL timeout and interactive 60 | db.m4.xlargeCloudFront serving images, css, etc.Ongoing issues:Many 408 errors in access logsApache processes (MaxRequestServers) maxing out; long running and are not cleaned upMany DB connections climbing fast with many sleeping processesNo DOS attacks that we are aware ofELB latency very high504 client errorsCPU and Memory for DB and Instances within the normal range.Autoscaling does not help since this is not a resource issue.NOTE: Enabling the Drupal page caching stabilizes the site but we cannot leverage the sites global/regional features so this is not an option.Also:  Could it be an issue with the underlying hardware or limits/throttle in AWS?Edited by: awsusr13 on Nov 6, 2019 10:57 AMFollowComment"

Answer: 0The solution was to increase the size of the Redis instance with more network throughput (m5).CommentShareawsusr13answered 4 years ago0The solution was to increase the size of the Redis instance with more network throughput (m5).CommentShareawsusr13answered 4 years ago


Question: DynamoDB Range-Key bit-wise search

"I have a problem where I have a Building and the building can be in multiple projects. I need to query all the buildings that belong to a specific project.I tried to do something like this but contains cannot be used to search for the flags.PK => company#BUILDINGSSK => buildingId#INFOLSI => flagsI know that:I can do it by duplicating the building record adding the project in the range key.Local Secondary Index per project cannot solve this as the number of projects is grater then 5Global Secondary Index can solve this ( but having many global secondary index ( one per project ) would increase writes cost for each building update ( the cost is not that big of a issue, but still have a  limit of 20, more than needed at the moment, but I wouldn't like to have that type of hard limit and would prefer to duplicate the records instead )This could be easily ( from users query perspective ) be solved using:Numeric range key and bit-wise to search for the project.String range key and contains instead of only begins_withString range key with pattern* something like Range Value = "01100" and search for begins_with "??1"I'm new to dynamoDB, and I'm migrating a mongoDB project to it. So I may be missing something.is there a easy way to solve this query problem that I'm unaware of?thanks in advanceFollowCommentalatech EXPERT3 months agoWould have project as partition key and buildings as sort keys help?Share"

Answer: "3Accepted AnswerYou need to understand DynamoDB by first understanding its underlying data structure, which can be likened to a B+ Tree. DynamoDB is not like MongoDB in the fact it does not allow you to create access patterns which are in-efficient. All of your requests must locate items which are stored physically together, which is why contains is not a valid function on a sort key. You must use begins_with or between etc.. as you can be guaranteed those items are close together. This ensures DynamoDB holds one of its key tenets, "Predictable performance at any scale".Querying all buildings that belong to a specific project is as simple as creating a GSI with project as the partition key.SELECT building FROM mytable.myindex WHERE project = '123'This would return you a list of buildings for that project.CommentShareEXPERTLeeroy Hannigananswered 3 months agoFazel 3 months agoThanks for the reply,knowing it's a B+ Tree helps a lot, thanks.  That explains why it lacks query capabilities in exchange for performance.But the query you gave don't help that much, as I need 1 GSI per project as one building record can be in multiple projects.Maybe extra records for projects??something likePK => companyId#ProjectSK => buildingsfield1 => buildingIdExtrafields => Other Project specific infoand querying for the main building record for extra info, duplicating the normally used to reduce the extra queriesShareLeeroy Hannigan EXPERT2 months agoThats exactly it, you want to vertically split the items having one per building attached to the project. Use the sort key to achieve a hierarchy.Share"


Question: What IAM Permissions are needed to do a CreateJob for S3 Batch?

"I am getting this error, and I can't figure out what permission to enable to allow me to create the job."An error occurred (AccessDenied) when calling the CreateJob operation: Access Denied"when I try to execute a create_job command with an s3control client in boto3, as part of a lambda function. (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3control.html#S3Control.Client.create_job).I'm trying to create a PUTCOPY job.I have granted the lambda function full S3 access via the AWS managed S3 policy, and I have granted the role that the S3 batch job is supposed to run under inside the create_job function full S3 access via the AWS managed S3 policy.Is there another permission I need to enable somewhere to allow CreateJob for S3 Batch?FollowComment"

Answer: "0Thanks for your question.The Lambda function's permissions govern what the Lambda function can do and the IAM role passed to S3 Batch Operations allows the feature to read your manifest, invoke Lambda, write the job report, etc.What you'll need to create the job are the permissions for "s3:CreateJob and iam:PassRole." So within boto3 this will be based on your user identity when you make the CreateJob call.CommentShareawsrwxanswered 4 years ago0Wrong forum sorryEdited by: dsmirnov on May 23, 2019 12:20 PMCommentSharedsmirnovanswered 4 years ago0Hi Rob, thanks for your reply and your explanation. I do have iam:PassRole added to the user identity that the Lambda Function runs under.However, for some reason, I do not see a CreateJob permission under S3 in my IAM when I look at the S3 permission. The only permission that comes up when I type "Create" in the search box is "CreateBucket". Is this permission present in the IAM console, or does it have to be added programmatically?Thank you!edit: to further clarify, since I posted the original message, I realized that I the CreateJob IS allowed with s3:* permissions enabled on both the user identity for the lambda function and the role that the S3 batch job runs under (there is apparently a short delay in the permissions change becoming consistent). However, when I did narrow back the permissions for production to be properly restrictive for production, I still get the access denied error. As noted by robwaws, the permissions needed for the lambda function that creates the S3 Batch Job are "s3:CreateJob and iam:PassRole", and so the question still is: where is the CreateJob permission located?Edited by: James3732 on May 24, 2019 6:27 AMCommentShareJames3732answered 4 years ago0Thanks for the update. We'll work to add more about CreateJob to our documentation and to include S3 Batch Operations API actions in the IAM visual editor. "s3:CreateJob" is the permission required to create the job and would be required by the user or Lambda function creating the job. The same entity would also need the "iam:PassRole" permission to pass the IAM role specified for the job to S3 Batch Operations.CommentShareawsrwxanswered 4 years ago0Great, thank you. I added the CreateJob permissions manually in the json editor, and now the code can create the job via boto3.Also, for the help of future readers: even after you add the CreateJob permission in the JSON editor, the console does show a warning hazard, with the text something like "IAM does not recognize one or more actions. The action name might include a typo or might be part of a previewed or custom service." I'm assuming this will disappear once AWS updates the IAM visual editor. Even though the warning shows up, the permission is applied.Thanks again for your help, robwaws.CommentShareJames3732answered 4 years ago"


Question: Redirect after login with aws-amplify/ui-angular 2.0

"Hi.I have a Angular application and I like to use  the new Authenticator IU compoment.The sample code only show a text message.<amplify-authenticator>  <ng-template    amplifySlot="authenticated"    let-user="user"    let-signOut="signOut"  >
Welcome {{ user.username }}!
    <button (click)="signOut()">Sign Out</button>  </ng-template></amplify-authenticator>I need to redirect from the login page to the root site. With the old version of the UI components I used "onAuthUIStateChange", but looks like no longer works on aws-amplify/ui-angular 2.0  ngOnInit(): void {    onAuthUIStateChange((authState, authData) => {      this.user = authData as CognitoUserInterface;      if (authState === AuthState.SignedIn) {        console.log("user successfully signed in!");        console.log("user data: ", authData);        this.router.navigate(['']);      } else {        console.log("Status: ", authState);      }    })  }What is the correct way to redirect after login on an Angular application with  aws-amplify/ui-angular 2.0?FollowComment"


Question: How to allign the  Name Servers of Route53 Public Hosted Zone and Registered Domains in CDK?

"In my account is an "registered domain" with 4 nameservers assigned to it.To originally created Public Hosted Zone was deleted as I want it to be created with the CDK deployment.When deploying the Route53 Public Hosted Zone it is each time creating a new set of Name Servers. Solution s then to update the Name Servers of the registered domain manually. This issue is described in the following link as well together with an manual fix: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-replace-hosted-zone.htmlProblem:I don't want to change the Name Servers manually, but directly with CDK.I didnt see any possibility in the Constructor to set the Hosted Zones when deploying https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53.PublicHostedZone.htmlNeither i saw how to change the name servers of the registered domain automatically via CDKWhen creating a ZoneDelegationRecord (see code in the following) i could add the target Name Servers but it fails during buildQuestion:How to create a Public Hosted Zone and link it to a registered Domain with both sharing the same Name Servers via CDK?Code:import * as route53 from 'aws-cdk-lib/aws-route53';import { RemovalPolicy, Tags, Duration } from 'aws-cdk-lib';const route53PublicHostedZone = new route53.PublicHostedZone(scope, 'route53PublicHostedZone', {    zoneName: 'myWhatEverDomain.com',  });const zoneDelegationRecord = new route53.ZoneDelegationRecord(scope, 'MyZoneDelegationRecord', {    // real NS Names are different of course    nameServers: [      'ns-1.awsdns-1.org',      'ns-2.awsdns-2.net',      'ns-3.awsdns-3.co.uk',      'ns-4.awsdns-4.com'],    zone: route53PublicHostedZone,    ttl: Duration.minutes(1),  });Error:Failed resources:myCdkStack | 16:53:12 | CREATE_FAILED        | AWS::Route53::RecordSet                   | MyZoneDelegationRecord (MyZoneDelegationRecordD1ECAA29) [Tried to create resource record set [name='myWhatEverDomain.com.', type='NS'] but it already exists] myCdkStack  failed: Error: The stack named myCdkStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE    at Object.waitForStackDeploy (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\util\cloudformation.ts:307:11)    at processTicksAndRejections (node:internal/process/task_queues:96:5)    at prepareAndExecuteChangeSet (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\deploy-stack.ts:355:26)    at CdkToolkit.deploy (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\cdk-toolkit.ts:201:24)    at initCommandLine (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\bin\cdk.ts:281:9)The stack named pmyCdkStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETEFollowComment"

Answer: "0As you noted, when creating a hosted zone, AWS Route 53 assigns a random selection of name servers to the hosted zone. The domain registrar must be configured with these name servers as in order to make your domain available on the internet. The documentation on replacing a hosted zone [1] refers to updating the domain registrar to reference these name servers to ensure the correct hosted zone is used to resolve DNS records. This is described in more detail in the documentation page on adding or changing name servers and glue records for a domain [2].While you can change the NS and SOA records for your AWS Route 53 hosted domains, this is most commonly used for white-labeling your name servers [3] and does not change the AWS Route 53 name servers that are associated with the Hosted Zone by AWS. It only changes the records returned by the hosted zone when queried.This is why the CDK build fails in your example code: the ZoneDelegationRecord is attempting to create new NS records for the parent domain when those records already exist. The CDK ZoneDelegationRecord [4] construct is used to delegate resolution to child zones, not to change name servers for the parent domain.If you would like to use the same set of name servers for multiple hosted zones, for example to simplify management, accelerate migration of multiple domains, or have consistent white-labeling across domains, you can use a reusable delegation set [5].The AWS CDK does not currently have any constructs for creating Reusable Delegation Sets or using a Delegation Set when creating a Public Hosted Zone. There is discussion on this topic on aws/awscdk issue #12756 [6] which includes an example custom resource for creating public hosted zones using a previously created DelegationSet. This concept could be extended with another custom resource for the Reusable Delegation Set using the corresponding AWS Route 53 APIs [7].[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-replace-hosted-zone.html[2] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html[3] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/white-label-name-servers.html[4] https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53.ZoneDelegationRecord.html[5] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-set[6] https://github.com/aws/aws-cdk/issues/12756[7] https://docs.aws.amazon.com/Route53/latest/APIReference/API-actions-by-function.html#actions-by-function-reusable-delegation-setsCommentShareMichael_Ranswered a year agorePost-User-4296173 9 months agoIs there a way to create a HostedZone with custom name servers? Or to update the HostedZone nameservers?ShareMichael_R 3 months agoYou can't create a HostedZone with custom name servers per se, however you can use reusable delegation sets [1] to have a consistent set of 4 AWS name servers across your HostedZones. This is most commonly used for white-labeling DNS servers consistently across an organization's HostedZones.[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-setShare"


Question: WorkSpaces Limit Reached

"WorkSpaces Limit ReachedYou have reached your current approved WorkSpaces limit of 0. Request a limit increase by contacting AWS Support.as descript,i can't use the machine.FollowComment"

Answer: "2Hello there,To resolve this issue, you can request a quota increase (service limit increase) using the following steps:Open the WorkSpaces Limits form.This can be found by going to the AWS Console then search for SupportSelect your desired regionCreate a case then select the Service Limits Increases.Select the Limit type you're requesting a quota increase for.Enter the New Limit ValueSelect Add another request to enter another increase request for the same limit type.Enter the Use Case Description explaining why you're requesting a limit increase (Please note that Request for more than 200 WorkSpaces or more than 20 Graphics/Graphics Pro WorkSpaces require additional information. Make sure you answer the additional questions listed within the request form in your use case description.)Enter Contact OptionsSelect submitFor more clarity on requesting a quota increase (service limit increase) please see the doucmentation on reference [1].If you are launching a graphics workspace, please note the the default value for the graphics workspace is 0, therefore you can request for a limit increase for that. See reference [2] for more information References:[1] https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html[2] https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-limits.htmlCommentShareAsenathianswered a year ago"


Question: update container definitions without redefine whole task definition in ECS

I trying to update only image inside ECS task definition:aws ecs register-task-definition --family some-family --container-definitions "$JSON" --execution-role-arn "arn:aws:iam::xxx:role/role-name"Where $JSON is definitely  same JSON description as before and only image key is changed (because ECR image tag is updated)And getting error:At least one of 'memory' or 'memoryReservation' must be specifiedIt is super annoying that we have to update whole container definitions just to be able update ECR image tag. But at least this JSON may be easily taken with describe-task-definition command.However the fact that we have to redefine whole Task Definition every time when Image tag is changed is ridiculous.Is it possible to update only container definitions or image tag (most perfect) inside current version?FollowComment

Answer: 0The current version of the AWS CLI currently require that you create a new task definition to update the Docker image of your application. You can find this information in the AWS CLI Command Reference documentation.There is also this issue that is currently open about this in the AWS CLI GitHub repository. You may find useful information there depending on the deployment method you use to update your ECS task. You can also contribute to the discussion if you want.CommentShareMichaelanswered 8 months ago0TASK202303240151581002711250 actionsCommentShareAna clara de Sousa Vianaanswered 2 months ago


Question: Verify foreign Elastic IP

"Hello everyone, as a software vendor deploying licensed tools, we would ask our customers to send us an elastic ip (eip) or a MAC address from an elastic network interface (eni), in order to have a **permanent **basis for our license keys.Now, in order to avoid unnecessary re-issuing new license keys, how can I verify, that the IP or the MAC address from the customer is really an elastic ip or eni?FollowComment"

Answer: 1Accepted AnswerUnfortunately there's no way to verify this information since EIPs really just come from a pool of available Public IPs. Unless of course you have API Access into the customer account to validate that it's configured as an EIP. Just the IP itself won't help.CommentShareEXPERTRob_Hanswered a year ago


Question: Image thumbnail not shown for images stored in FSx Windows Drive

"I am having an issue with the thumbnails not being shown for images stored on my FSx drive mounted to  AWS Workspaces.I have already attempted to troubleshoot the issue by ensuring that the thumbnails are enabled in the file explorer settings, but the issue persists. Any help would be appreciated.FollowComment"


Question: Customer Data Responsibllity

"Are there any cloud deployment models, or cloud service models, that DO NOT requirethe customer to take responsibility for managing their data (including encryption options)?Asked another way, Is the customer ALWAYS responsible for managing their data (includingencryption)?FollowComment"

Answer: "0Accepted AnswerCustomer Data encryption is always customer's responsibility as can be seen clearly in the Shared responsibility model.CommentShareEXPERTTushar_Janswered 5 months agoTrevor_C 5 months agoIf the deployment model, service model, or no other exceptions matter, then that's good enough for me.  From this point forward, I will say that the customer is responsible for the encryption of their data - NO MATTER WHAT!!!    Thanks Tushar JShare0Possibly SaaS where they encrypt the data for you (or at least should). The customer is responsible for their data in any cloud platform AWS, GCLOUD, or Azure. That's entirely by design.CommentShareEvananswered 5 months agoTrevor_C 5 months agoThanks for your reply Evan.  So, if the SaaS service model, where you say "they" encrypt the data for you, if the Customer doesn't take the initiative of encrypting their data in this service model (SaaS), and the data is breached, who is liable - customer or AWS?  If possible, I would love a response that offers a definitive answer, versus an opinion.  Thanks again Evan.Share"


Question: Need information about who and from where my instances deleted.

"My instances were deleted on 21st May 2022.How to get information about the who is deleted my instances.I contacted support but they said that it was deleted by API Call (API Call for delete cluster).So my question is:-How could an API call delete a whole Instance... that seems impossible.How do we find out what / who caused the API call?please guide me how to find above information other than contact to support.Thanks,FollowComment"

Answer: "0Hello thereThe solution to this problem would be to use AWS CloudTrail as it is a service that records the actions taken by a user, role, or an AWS service,see reference [1].CloudTrail is enabled on your AWS account when you create it. When activity occurs in your AWS account, that activity is recorded in a CloudTrail event. You can easily view recent events in the CloudTrail console by going to Event history.To find out more about how CloudTrail works, see reference [2].In order to create a trail, you can follow the steps mentioned in the documentation, see reference [3].After creating your trail, you can view your log files as specified in the documentation provided in [4].For CloudTrail workflow, see reference [5].References:[1] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html[2] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html[3] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html[4] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html#tutorial-step3[5] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-workflow.htmlCommentShareAsenathianswered a year ago0@Asenathi is correct that CloudTrail is the service for the job. In order to see the API calls, specifically the one you are looking for, you would've had to had CloudTrail turned on already. If you don't have it enabled, follow the info/documents that @Asenathi referenced.If you already had CloudTrail enabled and were looking to track down the exact API call, what you can do is go to the CloudTrail console by searching for CloudTrail in the search bar. On the left hand menu, select Event History and in the dropdown filter box select the Event name and search for DeleteCluster. You'll be able to actually click on the event and see the date, time, source, user name, and much more.Here's the DeleteCluster API reference documentation where you can get more information on that specific API call.CommentShareAWSJoeanswered a year ago"


Question: Error: WAFUnavailableEntityException

"I currently have some LBs associated with WAF Classic ,I'm trying to upgrade to WAFv2 by associating the LBs to WAFv2. When I attempt to perform the association, i get this error message "Error: WAFUnavailableEntityException: AWS WAF couldn’t retrieve the resource that you requested. Retry your request."It's my understanding that whenever you try to associate a LBs currently associated with a web acl to another Web ACL ,it removed it from the previous Web acl association.FollowComment"

Answer: "0The following document describes the error.https://docs.aws.amazon.com/ja_jp/waf/latest/APIReference/API_CreateWebACL.html#API_CreateWebACL_ErrorsAWS WAF couldn’t retrieve a resource that you specified for this operation. If you've just created a resource that you're using in this operation, you might just need to wait a few minutes. It can take from a few seconds to a number of minutes for changes to propagate. Verify the resources that you are specifying in your request parameters and then retry the operation.In my experience, I have also experienced errors when trying to tie to ALBs when creating Web ACLs.Try to run it after some time or try to set it in the ALB after creating the Web ACL.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Nodejs equivalent of IPC Socket implemention pn Python

"Hi,I have the below code to use the IPC socket on any device registered to Greengrass.But I could find a nice example to do it in nodejs. Is there a way to do it? I could not find where to set SVCUID parameter as in python version. My current non-working nodejs version is as follows:Nodejs Version:import { greengrass, iot, io, mqtt } from 'aws-iot-device-sdk-v2';...  const hostname =    process.env.AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT;  const clientBootstrap = new io.ClientBootstrap();  const configBuilder =    iot.AwsIotMqttConnectionConfigBuilder.new_websocket_builder()      .with_clean_session(false)      .with_socket_options(        new io.SocketOptions(io.SocketType.STREAM, io.SocketDomain.LOCAL, 3000)      );  const config = configBuilder.build();  config.host_name = hostname;  config.port = 8033;  const client = new mqtt.MqttClient(clientBootstrap);  const connection = client.new_connection(config);Python version:# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.# SPDX-License-Identifier: Apache-2.0import osfrom awscrt.io import (    ClientBootstrap,    DefaultHostResolver,    EventLoopGroup,    SocketDomain,    SocketOptions,)from awsiot.eventstreamrpc import Connection, LifecycleHandler, MessageAmendmentTIMEOUT = 10class IPCUtils:    def connect(self):        elg = EventLoopGroup()        resolver = DefaultHostResolver(elg)        bootstrap = ClientBootstrap(elg, resolver)        socket_options = SocketOptions()        socket_options.domain = SocketDomain.Local        amender = MessageAmendment.create_static_authtoken_amender(os.getenv("SVCUID"))        hostname = os.getenv("AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT")        connection = Connection(            host_name=hostname,            port=8033,            bootstrap=bootstrap,            socket_options=socket_options,            connect_message_amender=amender,        )        self.lifecycle_handler = LifecycleHandler()        connect_future = connection.connect(self.lifecycle_handler)        connect_future.result(TIMEOUT)        return connectionThanks,SukruFollowComment"

Answer: "1Accepted AnswerGreengrass IPC does not yet support NodeJS, but it is coming this year.You must use a supported SDK language: https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-requirementsCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 months ago"


Question: How to migrate step machine to another account

Is there any way to migrate step function/machine from one account to another?FollowComment

Answer: "1You can use the DescribeStateMachine API to get the all the information about the state machine, including the definition and then use the CreateStateMachine to create a new one in the other account.CommentShareEXPERTUrianswered a year ago0Hopefully you have used some Infrastructure as Code tool such as Cloudformation, SAM or CDK to create your Step Functions code. In that case you should be able to run the same IaC code by just modifying the parameters in another account.If you have created manually on the AWS console, you can try copying the generated Amazon States Language (ASL) JSON code and create a new Step Function in the new account and paste the copied ASL after modifying relevant parameters. However, with this approach, the other resources such as Lambda functions, SQS queues, SNS topics etc. etc. that are being referred to by the Step Functions need to exist in the new account.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: AWS SES Advisor

"Hi,I've started seeing quite a few entries in the Virtual Deliverability Manager "advisor" tab, and started reading through them.Apart from the BIMI records, which I have actually not set, I see that basically every single identity has some report saying something along the lines of "Missing SPF record", or "Missing DMARC" or "Misaligned MAIL FROM". The problem with these is that it's actually false statements.Because all of these records are exactly created as AWS SES wanted me to create, with the exact values it provided, and all of the records do also work I've verified manually.So, why is the Advisor not seeing these changes and updating accordingly? Any idea?FollowComment"


Question: Unable to update NS record - "Name server update failed"

"Hello,I wanted to transfer 2 domains out of Route53. The process for the first one was seamless, all changes were propagated instantly. Minutes after I wanted to go through the entire process with the second domain. Sadly it's failing on AWS side. In Route53 dashboard I see a notification saying "Name server update failed".I need to update NS records or I won't be able to transfer the domain. May I ask why is it failing?FollowComment"

Answer: "0I don't know why it was failing but I managed to transfer the domain without it. Possibly it failed earlier because the "transform process" has already been initiated.Anyway, this post can be closed now.CommentShareAWS-User-5508596answered a year ago"


Question: Back up from on-premis/my own machine to AWS backup.

Use case: I want to connect my machine with aws so that I can take a backup from my local machine.2. I want whatever I change in a particular folder on my local machine that will sync to aws backup and backup should take place.3. What are the ways i can take Backup from my local machine to AWS.FollowComment

Answer: 0Just a quick solution is to use the AWS CLI and sync the folder from your machine to a S3 bucket and then schedule that on regular intervals with cron on linux or task scheduler on windows.   See aws cli s3 sync reference.  Please be sure to accept answers if they help you.CommentShareMichael_Sanswered 7 months ago


Question: EC2 Server Status Check Failed

"Hello,I am using an EC2 free tier instance with Ubuntu, Mysql 8, Apache 2 and Php 7.From time to time, the instance status check fails and I need to reboot it manually.I eventually created an automatic reboot if the instance check stays failed for more than 1 minuteI also noted that when there is a heavy demand for the web app (eg in the morning when teachers access the school app) the server no longer responds to then resume ten minutes later.I want to know where to look for the error. Is there a log in AWS that could shed some light or do I need to look at the OS level?Any help would be most appreciatedThanksFollowComment"

Answer: "0Thanks for the answer. I am using a T3 micro instance with 1GB memory and 2 vCPUs.I checked the CPU credit balance over a period of 3 months and the balance has always stayed around 288 and barely went lower than 260 in some occasions.However, I check the Ubuntu log and came across this error message:Out of memory: Killed process  (mysqld)I got the impression MySql has been killed during the peak morning period.Is there a way to see my memory usage as a dashboard in AWS console?Also, what is the best way to increase my memory in this case?ThanksCommentShareKarveshanswered a year agoKarvesh a year agoAnd just now, i tried to SSH to my server, it will not log into it.it says: ssh: connect to host ... port 22: Connection timed outAnd on the AWS console, it says 1/2 checks passed: Instance reachability check failed.Rebooting the instance solved it again.I am a bit at a loss hereShare0You haven't mentioned what type of instance you're using. It sounds like you're using a T-series instance. These instance types run on a burstable CPU credit system; if the instance is busy then you will draw down on your credits until you reach a baseline level of performance which may be too low for your requirements.Two solutions:Use "unlimited mode" - your performance will not change when you run out of credits but we will charge for the time when you do.Use a non-T series instance which doesn't use the burstable CPU system (all of the other instance types).Note that you can monitor your CPU credits to see if this is what you're experiencing.More information is here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.htmlCommentShareEXPERTBrettski-AWSanswered a year ago0If rebooting fixes your issue then it sounds like you are running out of Memory. You could try creating an image of your existing instance, stop that instance, and create a new instance from that image on a larger instance. If you are on a micro, I would go up several tiers (medium or large) just for testing and see if that makes a difference. If you are still getting MySQL memory errors at that point then I'd say you have an issue with MySQL.https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/ec2-backup.htmlIf you want to log memory information then you need to install the CloudWatch agent. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/metrics-collected-by-CloudWatch-agent.htmlCommentShareJohn Voldanswered a year ago"


Question: SQL query freezes when connecting Aurora Postgresql cluster through RDS proxy endpoint

"Hi,We have tried to add RDS proxy to our AWS solution under development. Target database is Aurora cluster with Postgresql, containing geoinformation data(write + read instances).Our lambdas works fine when working directly with the Aurora cluster(until we want to speed things up and run more at the time and connections run out. That's why proxy is one thing we are trying to use).With proxy everything seems to be working fine until in some point it seems to freeze in some lambda until timeout occurs. No error message are given(or at least I can't find one).I have established VPN connection to the database and studied one of the freezed lambda code.By doing this I found out that e.g. running "db.run('SELECT id FROM geodata WHERE ST_Intersects(geom, ST_GeometryFromText(:wkt,3067))', **parameters)" in loop it freezes the prosessing in some point. maybe after 1-100 trys.The proxy seems to be happy if the query is done e.g. using id as selection criteria.If I use this same code directly with the Aurora cluster endpoint no problems occurs. Connection is created with pg8000.native.Connection.FollowCommentrePost-User-7371121 a year agoSome further studies are showing that I cannot use parameters in my SQL query(that :wkt given in parameters) and this could be the reason why the solution was failing with proxy?Share"

Answer: 0Accepted AnswerUsing psycopg2 was the solution. So some code refactoring was needed.CommentSharerePost-User-7371121answered a year ago


Question: EC2 instance unresponsive and won't stop

"Instance i-0db5c9933521bfe44 has become unresponsive. Repeated stop commands do not appear to have worked. Could you please restart the instance as soon as possible please. Regards,Patrick.FollowComment"

Answer: 0Instance state has finally gone to stopped. Now trying to start it again but getting "Error starting instancesThe service is unavailable. Please try again shortly.". This is in AWS London.CommentSharepbbeaumontanswered 4 years ago0I've just tried to launch a t2.micro instance and getting service unavailable as well. Is there a general outage in AWS London?CommentSharepbbeaumontanswered 4 years ago0Instance i-0db5c9933521bfe4 has now started and appears to be working correctly. Many thanks to whoever plugged it in again.CommentSharepbbeaumontanswered 4 years ago


Question: App Runner actions work very slow (2-10 minutes) and deployer provides incorrect error message

"App Runner actions work very slow for me. create/pause/resume may take 2-5 minutes for simple demo image (public.ecr.aws/aws-containers/hello-app-runner:latest)and create-service when image not found takes ~10 minutes:example #1 - 5 min to deploy hello-app image04-17-2022 05:59:55 PM [AppRunner] Service status is set to RUNNING.04-17-2022 05:59:55 PM [AppRunner] Deployment completed successfully.04-17-2022 05:59:44 PM [AppRunner] Successfully routed incoming traffic to application.04-17-2022 05:58:33 PM [AppRunner] Health check is successful. Routing traffic to application.04-17-2022 05:57:01 PM [AppRunner] Performing health check on port '8000'.04-17-2022 05:56:51 PM [AppRunner] Provisioning instances and deploying image.04-17-2022 05:56:42 PM [AppRunner] Successfully pulled image from ECR.04-17-2022 05:54:56 PM [AppRunner] Service status is set to OPERATION_IN_PROGRESS.04-17-2022 05:54:55 PM [AppRunner] Deployment started.example #2 - 10 min when image not found04-17-2022 05:35:41 PM [AppRunner] Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository.04-17-2022 05:25:47 PM [AppRunner] Starting to pull your application image.example #3 - 10 min when image not found04-17-2022 06:46:24 PM [AppRunner] Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository.04-17-2022 06:36:31 PM [AppRunner] Starting to pull your application image.but 404 error should be detected immediately and fail much  faster. because no need to retry 404 many times for 10 min, right?additionally the error message Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository is very confusing. it doesn't show image name and doesn't provide the actual cause. 404 is not related to access errors like 401 or 403, correct?can App Runner actions performance and error message be improved?FollowCommentrePost-User-8095604 a year agoI'm seeing long deploy times, as well. Roughly 5-10 minutes each for successful deploys.Share"


Question: AWS IoT for ESP32

"Hi, Wanted to know current avaiable solution for AWS, BLE and WiFi using ESP32. Can the available e.g. be directly used and modified?For development support what is available? if not free then what are plan prices.FollowComment"

Answer: "0Depending on your arch type, you can find compatible guides here. Take a look at the partner device catalog where you can choose the kind of ESP32 device you want to work with and take a look at the guides on their individual guide pages.For clarity: The partner devices are created by the partners which are third party vendors. AWS provides support for AWS IoT Core and FreeRTOS and other cloud offerings. The devices themselves are offered and priced by companies that build them.Hope that helps.CommentSharePronoy_Canswered a year agoAWS-User-5915743 a year agoHi, was looking for support from code development perspective of ESP32 for application of AWS-WiFi and BLE controlled devices. For such support wanted to know if its free, where to get support and if paid what are prices.Share"


Question: "No packages marked for update" -> Yet ALAS-2017-901 bulletin exists

"Seeing an issue w/ 2017.07 AMI missing this package.  Any idea where to locate it??Advisory: https://alas.aws.amazon.com/ALAS-2017-901.htmlkernel-4.9.51-10.52.amzn1.x86_64[ec2-user@ip-172-31-xxx-xxx ~]$ rpm -qa | grep -i kernelkernel-tools-4.9.43-17.39.amzn1.x86_64kernel-4.9.38-16.35.amzn1.x86_64kernel-4.9.43-17.39.amzn1.x86_64[ec2-user@ip-172-31-xxx-xxx ~]$ sudo yum updateLoaded plugins: priorities, update-motd, upgrade-helperamzn-main              | 2.1 kB  00:00:00amzn-updates          | 2.3 kB  00:00:00No packages marked for updateFollowComment"

Answer: 0anyone from AWS browsing these threads?CommentSharespideranswered 6 years ago0The root cause is the /etc/yum.conf file.  you need to manually update "releasever=2017.03" with "releasever=latest"& yum update.  I was able to obtain a newer version of the kernel but it is still behind and vulnerable...Remote package installed : kernel-4.9.51-10.52.amzn1Should be                : kernel-4.9.58-18.51.amzn1CommentSharespideanswered 6 years ago


Question: AWS service for business events published by microservices

Is there an AWS service where microservices can log events(with flexible schema) like json documents but these can be queried. I want to publish events for business analysis and debugging.FollowComment

Answer: "0Hi kuldeepiitg,a typical approach is to centralize logs in special AWS account, and one way is outlined here: https://docs.aws.amazon.com/whitepapers/latest/microservices-on-aws/distributed-monitoring.html#centralizing-logs and https://docs.aws.amazon.com/solutions/latest/centralized-logging-on-aws/overview.html.Depending on your workload, microservices (serverless or container based) have capability to have S3 and CloudWatch as target destination, often with streaming capabilities such as Kinesis Data Firehose. From there, to high performant search engines such as CloudWatch Insights, AWS OpenSearch/Kibana and/or Athena.Hope it clarifiesCommentShareEXPERTalatechanswered 3 months ago"


Question: Issue: Date and Time on AWS server hosting my WordPress website is off by 8 days in the future.

AWS is hosting our WordPress website and roughly a month ago the pages that use a calendar/time (date & time) are now off by eight (8) days in the future.  These are primarily Event pages the now drop off 8 days early (before the event date.)  My research as determined it is not a Word Press issue but that the date and time on the server that is hosting the site is off by 8 days and a few hours.  Is this setting on the server something I have control access to?  If so how?  If not how do I go about getting AWS support to look into the issue?FollowComment

Answer: "0What you are looking for is a time synchronization service.  That will allow you to use NTP to sync the time on your EC2 instances every couple of hours or so.  AWS now provides one to all user for free.  See here. https://aws.amazon.com/blogs/aws/keeping-time-with-amazon-time-sync-service/. There is documentation for setting up an NTP client for Amazon Linux and WIndows in the article.  If you use Ubuntu, check here https://ubuntu.com/server/docs/network-ntpBestCraigCommentShareCraig Simonanswered a month ago"


Question: Customizing the Docker Run Command on Elastic Beanstalk

"I'm running a single container setup on Elastic Beanstalk using the Amazon Linux 2 Docker platform.The container is running a third-party image that is fully functional only when its hostname matches an issued license file.With the previous iteration of Docker platform on Amazon Linux, it was possible (though never officially supported) to override the docker run command by using an ebextension to patch the /opt/elasticbeanstalk/hooks/appdeploy/pre/04run.sh script to inject -h MY_HOST. This does not seem to work on Amazon Linux 2.Is there any officially supported way to set the hostname of a container running on Elastic Beanstalk using the Amazon Linux 2 Docker platform? Thanks for any help you can provide.FollowComment"


Question: Read permission error after MQTT Moquette Broker restarts with active client connection (Windows)


Question: How Long ill LightSail be down

Does anyone know how long LightSail will be downFollowComment

Answer: 0Please take a look at duplicate question here: https://repost.aws/questions/QUCYbnscvGQWKzImlmolkJSQ/lightsail-downCommentShareGiorgio@AWSanswered a year ago


Question: Amplify Next.JS Hosting Env Var Accessible during getInitialProps

"I am hosting a NextJs 13 App on Amplify. In my custom _app.tsx file, I have a getInitialProps function that references an env-var not prefixed with NEXT_PUBLIC_. This means that the variable will not be accessible outside the Node runtime. However, the initial load of getInitialProps runs on the server, so this shouldn't be a problem.However, when trying to access the variable, it is undefined. Other env-vars that are prefixed with NEXT_PUBLIC_ are, which means the process is not running on Node.The app works as expected when run locally, which leads me to think this is an issue with how Amplify hosts the app.FollowComment"


Question: How to enable Logical Replication for existing Aurora PG 13 Cluster?

"We are considering enabling logical (streaming) replication on our existing Aurora PG 13 cluster for CDC?We want to keep our aurora read replicas as is, but I haven't found good resource that explains how to achieve both, OR what is the implication for existing read replicas.Our current understanding is that we might have to stand up 2x current nodes in our cluster which would be way too expensive for us.FollowComment"

Answer: "2You can enable logical replication by setting the parameter rds.logical_replication parameter in Cluster Parameter group. There will not be any impact on the existing Aurora replicas/reader instances in the cluster. Additionally, you do not need to add new instances in the cluster just because the logical replication is enabled.Refer - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html#Aurora.Replication.AuroraPostgreSQLCommentShareprasanth_awsanswered 2 years agoEXPERTJohn_Freviewed a year agoAWS-User-4365303 2 years agoThanks for confirming!Share2Thank you for reaching out. Since you mentioned CDC, I will also recommend you to review this document since it provides guidance on the enabling Logical replication for CDC.[Using a PostgreSQL database as an AWS DMS source  - Enabling change data capture (CDC) using logical replication  - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.SecurityCommentShareSUPPORT ENGINEERArnab_Sanswered 2 years agoAWS-User-4365303 2 years agoThanks @arnab, the intention is to run CDC indefinitely (i.e we are not just migrating DB), does DMS still solve the problem cleanly and cost effectively?Share"


Question: Issues Communicating to Cognito from App Mesh

"Hey everyone,I currently have an App Mesh setup that consists of three ECS Fargate services and also a virtual service/node in order to connect to Elasticache. This is all working properly. The final piece which we are having trouble with is communication from one of our services to Cognito.We saw from some forum posts that App Mesh will only flawlessly communicate with AWS services which have url's that end in amazon.com. Accessing Cognito user pools unfortunately has url's which end in amazoncognito.com and for some reason that's not currently supported by App Mesh.From advice found online it was reccomended to setup a virtual service/node for each cognito user pool url that our service needs to communicate with, similiar to what we did in order to communicate with Elasticache. We setup a virtual service and named it the exact DNS name of the cognito user pool url ([userPoolName].auth.us-east-1.amazoncognito.com). The virtual node is listening via TCP protocol on port 443. We also created a backend referencing this new virtual service in the source virtual service which we can call auth service.After applying these changes and testing we are seeing the following error from our auth service. After doing so and attempting to communicate Cognito we receive that following error: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.IO.IOException: Unable to read data from the transport connection: Connection reset by peer. ---> System.Net.Sockets.SocketException (104): Connection reset by peer --- End of inner exception stack trace A note that our auth service is handling the TLS negotiation.Anyone have any ideas on how I can get this working properly?Thanks so much.FollowComment"


Question: [IoT Core] Duplicate messages from topic forwarding rule

"Hi,I have created a topic forwarding rule in AWS IoT Core using this rule.SELECT * from 'data/device01' WHERE temperature > 35This rule forwards messages to the topic 'data/alarms'. I used QoS 0.I observed duplicate messages like this from the subscription of 'data/alarms'data/alarmsAugust 05, 2020, 14:36:01 (UTC+0900)ExportHide{  "device": "device02",  "temperature": 35.02,  "brightness": 12,  "humidity": 87,  "time": "2020.08.05 07:36:01"}data/alarmsAugust 05, 2020, 14:36:01 (UTC+0900)ExportHide{  "device": "device02",  "temperature": 35.02,  "brightness": 12,  "humidity": 87,  "time": "2020.08.05 07:36:01"}Interesting part is where sometimes there are duplicates and sometimes not.Question: Is this expected behavior of IoT Core?Thanks,FollowComment"

Answer: "0Accepted AnswerThe AWS IoT Core message broker defines MQTT Quality of Service level zero like so:In AWS IoT Core, subscribing to a topic with QoS level 0 means that amessage is delivered zero or more times. A message might be deliveredmore than once. Messages delivered more than once might be sent with adifferent packet ID.https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.htmlCommentShareSounavoanswered 3 years ago"