Question: Signature Does Not Match Error when sending to S3 from an AWS IoT client.

"I'm working on an embedded device that will send logs to an S3 bucket.  It uses an MQTT client to publish a link request and receive a generated URL on a subscribed topic.  It then uses the URL to upload a log file to S3.  My code base is the AWS embedded C SDK.The code successfully connects to the AWS endpoint to request and receive the URL.  It then uses libcurl to upload the file with HTTPS.When the code attempts to upload the file to S3, the it gets back a 403 error with this message: "The request signature we calculated does not match the signature you provided. Check your key and signing method."I'm confused since those keys were used for the AWS IoT request with no issues.I searched online for this error but nothing I saw applied to this use case.  Has anybody else had a similar issue where device keys work for the AWS IoT side but not the S3 side?Thanks in advance for help on this.SOLVEDBit by the newline in the MD5 file.  Used a different utility and got through.Edited by: GaryKB on Aug 19, 2020 5:19 AMFollowComment"

Answer: 0Fixed issue with the MD5.CommentShareGaryKBanswered 3 years ago


Question: CloudFront integration with Elastic Beanstalk not working

"Hi,I have a RoR application successfully deployed to AWS ElasticBeanstalk. This app is being asked for data from a front-end deployed in Netlify which uses the https protocol.Not so long ago I had an SSL certificate issue when I tried to access the was EB application, which I solved by adding an SSL Certificate to the Load Balancer associated with the EC2 instance. Ever since I fixed the certificate issue for https traffic, I have been dealing with a CORS error, which from what I have been reading has to do with some request headers not present.As a first step, I went to my RoR code and made sure the cors configuration was accurate. Then, I tried to add those headers directly to the load balancer, which I later found to be impossible. Some people suggested Mounting CloudFront on top of the balancer and adding the headers to that CouldFront distribution so that is what I am currently working on. Unfortunately I keep running into some issues. One in particular has been difficult to solve. When I copy the CloudFront distribution domain name, and try it in the browser I keep getting this error: : xn--awseb-awseb-4sam6k5ro0wu-2125335482-i31v.us-west-2.elb.amazonaws.com refused to connect.”The Bold section on that error represents my load balancer’s DNS name, which makes me think that CloudFront is effectively sending the traffic down to the load balancer, but for some reason it stops there. I should point out that without adding CloudFront, every time I test my app with Postman, my load balancer effectively delivers the content I requested.Anyways, I am trying to add CloudFront to my infrastructure so that I can add request headers and avoid getting the CORS error when I request data from and https origin and I was wondering if there was anyone willing to offer advice or even better, meet via zoom or any other video chat platform and look at my setup for a brief moment.Please feel free to look me up on linkedIn at:https://www.linkedin.com/in/tyler-charawell-75a811132/Tyler Charawell | LinkedInOrhttps://www.linkedin.com/in/albertogonzalez1091/Alberto González Sáenz | LinkedInThank you!FollowCommentlarryjkl 7 days agoIt sounds like you are using CloudFront in front of Beanstalk; do you need the traffic from CloudFront to the LBaaS/Beanstalk to be encrypted / SSL ? ( Traffic from the client to CloudFront will be https ) : It's easier to configure if not.SharerePost-User-8094945 7 days agoYes, the traffic from the client has to be https. Http to http works just fine for us right now and was much easier to configure haha.Share"


Question: Number of concurrent AWS console users

"Looking for a way to show the number of concurrent AWS console users over time. Would like a graphical and / or tabular representation of how many users in my AWS account are accessing the console.Bonus, report of number of API calls, grouped by console and otherwise, over time.FollowComment"

Answer: "0Accepted AnswerI'm not sure if you can get "concurrent" users exactly, but you can use a combination of CloudTrail and CloudWatch metrics to get pretty close to what you're asking for. First, you want to create a CloudTrail for AWS management events in your AWS account to capture ConsoleLogin events and other API calls. You can read about that here:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html.That will involve creating an S3 bucket to store all of the data, and you'll want to enable CloudWatch Logs as well, so you'll be creating a new CloudWatch log group for that. Once you have the trail created, with data storage in S3, and logs flowing to CloudWatch, then you can create metrics to watch for specific things, like the ConsoleLogin event that you are wanting.See here for info about creating a CloudWatch metric:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.htmlYou'll want to specify a pattern like this: {$.eventName = "ConsoleLogin"}. That will count every time someone logs in using the console, so you'll be able to visualize that metric to see how many people are logging in. Unfortunately, I'm not aware of a "ConsoleLogout" event, so you can't really get concurrent users in this way, as you won't be able to see when users log out of the console (or when their session expires, for instance). But that might not be important to what you're looking for either.Regarding the number of API calls, grouped by console and otherwise, you can use a similar approach for that. You can create two separate metrics, one for Console API calls and one for Other API calls, then create visualizations for those as well. In that case, the pattern for your metric should start with something like {$.eventType = "AwsApiCall"} and then include an additional criteria against the user agent, something like {$.userAgent = "*Console*"} to get those that came through the Console, for example. The userAgent is the only reasonably reliable field I've seen in those events to determine the source of the API calls.You might also explore the use of dimensions to capture the value of the userAgent directly, and use that to perform group by's. See here for a bit more on that:https://docs.aws.amazon.com/en_us/AmazonCloudWatch/latest/logs/ExtractBytesExample.htmlAlso, if you just want a periodic look into the CloudTrail data, you can use Athena to query the CloudTrail log files directly from S3. There is a bit of setup required in Athena to make the data structure available, but after that you can straight SQL queries to view all of the ConsoleLogin events or all of the AwsApiCall event types, grouped by userAgent, for instance. See here for more:https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.htmlCommentShareCraig Halleyanswered a year ago0Thanks for the direction. I created an Athena query to report on the number of logins per day. Not exactly what I was looking for  but close enough.Not very elegant I know but it works for me.SELECT count(eventname) AS count,       DATE(from_iso8601_timestamp(eventtime)) AS dateFROM "default"."your-table-name"WHERE eventname = 'ConsoleLogin'and from_iso8601_timestamp(eventtime) > current_timestamp - interval '90' dayGROUP BY DATE(from_iso8601_timestamp(eventtime))ORDER BY DATE(from_iso8601_timestamp(eventtime))Sample outputcountdate45/13/202285/14/202285/16/2022135/17/202285/18/202255/19/2022CommentShareAWS-Alfieanswered a year ago"


Question: No solution stack named 64bit Amazon Linux 2018.03 v2.10.1 running Go

"Hello,Trying to create ElasticBeanStalk application running Go.I have tried to create the bean stalk manually and it works for my account.But, using Terraform getting error -aws_elastic_beanstalk_environment.am-sync-dev: InvalidParameterValue: No Solution Stack named '64bit Amazon Linux 2018.03 v2.10.1 running Go 1' found.status code: 400, request id: 4f5cd8b6-9b9d-40b9-bf75-05c36851fb6fI have tried following names -64bit Amazon Linux 2018.03 v2.9.4 running Go 1.11.464bit Amazon Linux 2018.03 v2.9.4 running Go64bit Amazon Linux 2018.03 v2.9.4 running Go 1None of the above worked for meThank youSincerely,ManjiriFollowComment"

Answer: "0Hi yancy,Thanks for reaching out.The availability of a given solution stack depends on the region. "64bit Amazon Linux 2018.03 v2.9.4 running Go 1.11.4" might not be available across all regions.Also, note that, depending on how recently your AWS account was created, you may not have access to older solution stacks. Presently, "64bit Amazon Linux 2018.03 v2.10.0 running Go 1.11.5" is the latest solution stack in the regions where it is available.Thanks,Rahul.CommentShareAWS-User-2500988answered 4 years ago0Hello,Thank you for your reply.I kindof reversed engineered ! I created a elastic beanstalk application manually (AWS console).And then used AWS CLI to get the environment information -"aws elasticbeanstalk describe-environments --application-name am-sync-manual --region us-west-2"The Solution stack name returned in the payload is -"SolutionStackName": "64bit Amazon Linux 2018.03 v2.10.1 running Go 1.11.5",Thank you, my problem is solvedCommentShareManjirianswered 4 years ago0Glad to hear, Yancy.Thanks,Rahul.CommentShareAWS-User-2500988answered 4 years ago"


Question: "The NextJS app build is encountering a failure due to the expiration of the token after one hour, which is generated during the build time."

"We are facing an issue while implementing ISR in our NextJS application deployed on AWS Amplify.Currently, we are generating more than 22,000 static pages, which has increased our NextJS application build time to more than an hour. However, we are encountering an error message during the build process which states that the AWS token generated at build time has expired after one hour. The error message reads as follows: "ExpiredToken: The provided token has expired. at Request.extractError (/root/.//node_modules/@sls-next/s3-static-assets/node_modules/aws-sdk/lib/services/s3.js:711:35)".We are looking for a solution to either increase the time for the token or refresh the token to avoid the build failure. Alternatively, if there is any other way to implement this process, we would appreciate your guidance.I would appreciate it if you could please assist us in resolving this issue as soon as possible.Thank you in advance for your assistance.FollowComment"

Answer: "0It seems that the problem you are facing is related to AWS credentials expiring during the build process. The AWS SDK that your NextJS application uses to communicate with AWS services requires valid AWS credentials to access AWS resources, such as S3 buckets.The error message you provided suggests that the AWS access token that was generated at the start of the build process has expired. AWS access tokens are typically valid for a limited period of time, this period is usually set to 1 hour (3,600 seconds.) by default. After this period of time, the token becomes invalid and any AWS API calls made with that token will fail.To solve this issue, you can either increase the length of time the token is valid or refresh the token before it expires. You can do this by updating the AWS IAM user policy to provide a longer lifetime for your IAM access token or by using AWS Cognito to generate temporary credentials that can be refreshed automatically. You can also consider using an AWS role that has the necessary permissions to access the required resources and using AWS Security Token Service (STS) to assume the role.The  steps to follow in case you want to follow the iam role approach look like the following:•Create a new IAM policy that grants the necessary permissions to your NextJS application.•Create a new IAM role that can assume this policy.•Configure your NextJS application to assume this role using the AWS SDK.•Enable AWS STS to allow your NextJS application to generate temporary credentials that can be updated automatically.•Update your NextJS application to update AWS credentials before they expire.•I hope this helps! Let me know if you have any other questions or need additional guidance.Here you can find an example of policy that provides access to an s3 bucket, you can adapt this policy to your particular scenario.    "Version": "version number",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:ListBucket",                "s3:GetObject",                "s3:PutObject"            ],            "Resource": [                "arn:aws:s3:::your-bucket-name",                "arn:aws:s3:::your-bucket-name/*"            ]        },        {            "Effect": "Allow",            "Action": "sts:GetFederationToken",            "Resource": "*",            "Condition": {                "NumericLessThan": {                    "aws:TokenExpirationTime": {                        "AWS:EpochTime": 432000                    }                }            }        }    ]}You can adjust the AWS:EpochTime condition to set the maximum duration for your IAM access token. For example, if you want your IAM access token to last for 12 hours, set the AWS:EpochTime value to 432000 (12 hours in seconds).You can find additional information using this resource and this other.CommentShareDavid Canswered a month ago"


Question: java.net.ConnectException: Connection refused (Connection refused)  Getting error while accessing  AWS OpenSearch 1.2  from cognito

"Upgraded AWS Elastic search to Amazon OpenSearch  1.2. After the upgrade not able to login  dashboard. Configured AWS cognito for authentication.  Before upgrade it worked, not sure why its failing after upgrade, given permissions by changing policies. Getting below errorjava.net.ConnectException: Connection refused (Connection refused).Please suggest for any solution.FollowComment"


Question: "Managed - dedicated IP , Amazon ses"

"I enabled Managed - dedicated IP for my account from 1.2.2023 and do configuration set to send form this pool , but i test more times still using shared IP and no Ip found in managed pool while i charging for these services ,please note: i don't have stranded dedicated IPFollowComment"

Answer: "0Hello,The dedicated IPs (managed) feature will automatically allocate your first dedicated IP address once your sending volume reaches hundreds of emails over a period of a few days. This ensures that the IP you send from can build a sending reputation and improve deliverability. (If you don’t expect your sending volume to be at this level, you should be using shared IP addresses. See the comparison table in Dedicated IP addresses for Amazon SES to review the type of IP addresses that are best for how you send email.)https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip.htmlBR,MoCommentShareMoanswered 2 months ago"


Question: IoT custom resource - possible race condition

"Not sure if it's just me, or if anyone else has experienced this possible race condition, but I have an IoT custom resource construct like the following in a large stack:      const thing = new cr.AwsCustomResource(this, 'thing', {        onCreate: {          service: 'Iot',          action: 'createThing',          parameters: {            thingName: '001',            thingTypeName: 'thing-type'          },          physicalResourceId: cr.PhysicalResourceId.of(Date.now().toString()),        },        onDelete: {          service: 'Iot',          action: 'deleteThing',          parameters: {            thingName: '001'          },        },        policy: cr.AwsCustomResourcePolicy.fromSdkCalls({          resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,        }),      });      thing.node.addDependency(thingType);...that sometimes runs fine following a cdk deploy, and sometimes throws a message like this:18:14:21 | CREATE_FAILED        | Custom::AWS                         | thing/Resource/DefaultReceived response status [FAILED] from custom resource. Message returned: User: arn:aws:sts::123456789012:assumed-role/Dev-AWS679xxx-xxx/Dev-AWS679xxx-xxx is not authorized to perform: iot:CreateThing on resource: arn:aws:iot:xxx:xxx:thing/001 because no identity-based policy allows the iot:CreateThing action (RequestId: xxxxx)It's as if sometimes the policy is not attached to the assumed role in time before the action to create the thing is carried out.I'll see if I can produce a small stack that can repeat the condition but in the meantime I'm sending this out in case others have experienced this behaviour.Thanks,GaryFollowComment"

Answer: "0Hi - Thanks for reaching out. Are you hard coding this or this is just an example. Also for race condition I am assuming that you may have another thread/procedure trying to do the same at the same time. If yes, do you want to check existence of the IoT thing in IoT core before proceeding and if exists, then do run this construct. Just a thought.CommentShareEXPERTAWS-User-Nitinanswered 2 months agogary 2 months agoHi Nitin, creation of this thing using this construct is just for test purposes. This construct creates the thing. I need to use a custom resource here because I want to add the thing to a thing types (and cannot do this using the cfn L1 construct). I have nothing else trying to do anything in parallel, it's all left to cdk/cfn. Sometimes cdk attaches the policy (see the policy statement in the custom resource) and executes the construct in that order, sometimes it tries to execute the construct before the policy is attached. At least, that's what I think is happening. I'll investigate furtherShare"


Question: Policy config for Firehose format conversion glue access

"I'm looking to set up format conversion for my firehose delivery stream.  The configuration involves specifying a role with access to glue to determine the output schema.  I haven't been able to find the exact requirements for this role anywhere in the docs, the only descriptor is "The role that Kinesis Data Firehose can use to access AWS Glue."What actions/resources does a policy need to specify for firehose to be able to use the role for format conversion?FollowComment"

Answer: "0Hello,I understand that you have been having issues specifying the appropriate policy to give Firehose permission to access AWS glue for format conversion.The below statement, which can be added to your current policy, is taken from the official AWS documentation [1]:Grant Kinesis  Data  Firehose Access to AWS Glue for Data Format ConversionIf your delivery stream performs data-format conversion, Kinesis Data Firehose references table definitions stored in AWS Glue. To give Kinesis Data Firehose the necessary access to AWS Glue, add the following statement to your policy. For information on how to find the ARN of the table, see Specifying AWS Glue Resource ARNs (https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html).{"Effect": "Allow","Action": ["glue:GetTable","glue:GetTableVersion","glue:GetTableVersions"],"Resource": "table-arn"}[1]Controlling Access with Amazon Kinesis Data Firehose - Amazon Kinesis Data Firehose (https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-glue)Please let me know if this response helps to resolve your issue or if you have any other questions.CommentShareJessica_Canswered 10 months agoSUPPORT ENGINEERSumukhi_Previewed 10 months ago"


Question: DB Instance class droprown is empty when attempting to modify existing RDS Database

"I received the notice that my current instances will be deprecated and wanted to change the DB instance Class.  There was a similar post but I have tried Chrome, Firefox, and Edge with the same result.  The field is empty and there are no options in the dropdown.FollowComment"

Answer: "0Frequently when I see empty dropdowns on AWS frontend it is caused by the backend returning an informative error but the frontend not interpreting it or showing the error. I suggest watching your network traffic and looking endpoints not returning Http Status 200 and then checking the body of the Response.CommentSharejfunkanswered 2 months ago-1Please use cli and it will work.CommentShareDevinder-theDBGuyanswered a year ago-1Hi There,I understand you have received the notice that your current instances will be deprecated and wanted to change the DB instance Class but the field is empty and there are no options in the dropdown.I strongly suggest that as a workaround you use the AWS CLI to perform the changes [1]RDS modify a DB Instance [2]Amazon Aurora Modifying an Aurora DB cluster [3]I hope you find this information helpful.======References=====[1] https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/modify-db-instance.html[2] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html[3] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Modifying.html#Aurora.Modifying.InstanceCommentShareMfaneloanswered a year ago"


Question: CORS ISSUE unable to post request

"I could not post data from this url :https://onlinetestfrontend.s3.ap-northeast-1.amazonaws.com/student_form_apigatewaywithCors.htmlcan some one please help.form post action :http://springbootinmemory-env.eba-fedwtjib.ap-northeast-1.elasticbeanstalk.com/studentI Assume it is a free service ..please ignore if it is paid service or route to correct channelFollowCommentalatech EXPERT3 months agoDoes your springboot app handle cors?SharerePost-User-5159498 3 months agomy spring boot code does not handle cors.I dont want to control cors at code level and want  to control from external application/configuration.Please suggest.Spring boot Code Link :https://github.com/andrewsselvaraj/springbootinmemory/blob/master/spring-boot-h2-database-example/src/main/java/com/efreelearn/controller/StudentController.javaSharealatech EXPERT3 months agoNot sure you have a choice here, see answer below ;)Share"

Answer: "0Hi,with the given information,  you should enabling CORS at application level.This is a good list of ways to do that in Springboot: https://www.baeldung.com/spring-corsLet me knowCommentShareEXPERTalatechanswered 3 months ago"


Question: Does AWS Charge for Throttled requests ?

"Hi,I have question regarding request throttling. I want to put throttling limit on API Gateway and Lambda to avoid misuse of service (DDoS). Please clarify followingDoes AWS charge for throttle requests ? e.g. And if throttled requests count towards usage ?If API Gateway is protected with authentication , does amazon charge for failed authentication attempts ?Regards,ImranFollowComment"

Answer: "0Take a look at this - https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-pricing.htmlDoes AWS charge for throttle requests ? e.g. And if throttled requests count towards usage ?Throttled requests are not charged by API Gateway. Requests are throttled after they don't fall under the defined usage plan or the default account level quota. Please clarify what do you mean by "if throttled requests count towards usage ?"If API Gateway is protected with authentication , does amazon charge for failed authentication attempts ?No, API Gateway doesn't charge if authentication fails.Edited by: ankitay-aws on Jun 18, 2020 10:01 AMCommentShareAWS-User-2168324answered 3 years ago0Hi,Thanks for your reply. I guess you have already answers the first part. I wanted to know if the request is throttled regardless within usage plan or not is counted towards billing , or if the request is failed authentication attempt.The second part of the question is regarding lambda, which means if we set the concurrency on Lambda, and I assume any throttled requests are not charged in that case either ?CommentShareimranarsanswered 3 years ago0Yes, API Gateway will bill the request if it ends up calling your backend integration and gets throttled. In your case, backend integration is the Lambda function.CommentShareAWS-User-2168324answered 3 years ago"


Question: Data Wrangler PCA Error Py4JJavaError: breeze.linalg.NotConvergedException

"I added PCA to my flow, I chose the numeric values, added a value for components and clicked preview. This error pops up: OperatorCustomerError: Py4JJavaError: breeze.linalg.NotConvergedException:I do not know what it means and I have searched for answers and have not found anything that applies to my issue.I just wanted to update that if I choose 2 attributes, any two that are numeric, and I choose 2 components it will work. As soon as I choose a third I get the error. I chose 2 different ones and tried it multiple times with success, but a third and I get the error.FollowComment"


Question: Amazon Textract boto3 response changed when using in lambda

Our application is looking for response from textract to be in a certain format all the time.Wanted to know how to call textract from lambda(python) by giving a specific version ?  Our script is always calling the latest version of textract.Can you please point me to code snippet or an example on how we could call by giving version number ?Thanks.FollowComment

Answer: "0Hi, thank you for using Textract. Textract did update the table model to support merged_cells and table_headers. https://aws.amazon.com/about-aws/whats-new/2022/03/amazon-textract-updates-tables-check-detection/The update adds a new BlockType called "MERGED_CELLS" and Relationships Type "MERGED_CELL" and an EntityType "COLUMN_HEADER". If you don't need those, you can ignore them.Outside of those additions the response is the same as the "older" one with all CELLs of a TABLE being the CHILD Relationship. See: https://docs.aws.amazon.com/textract/latest/dg/how-it-works-tables.htmlI recommend using https://pypi.org/project/amazon-textract-response-parser/ for parsing the response in Python.CommentShareAWS-User-0574899answered a year ago0There is no difference in response format when calling Textract from Lambda vs. locally or from an EC2 instance. BUT Lambda does not always include the latest SDK version.Check https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for more information. You may have to install the same boto3 version (here is an example: https://aws.amazon.com/premiumsupport/knowledge-center/lambda-python-runtime-errors/).I usually use containers with Lambda now (generated with SAM or CDK) where I have full control.CommentShareMartin Schade _AWS_answered a year ago"


Question: Is it possible to cancel AWS Lightsail containers deploy?

There does not seem to be an option to stop an unintended Lightsail cointainers deploy.How do you cancel a deploy as it's happening?FollowComment

Answer: 0Thank you for the feedback. Currently there is no way to cancel an ongoing deployment but a new deployment can be made once the current one finishes. We will consider the feedback for future improvements.CommentSharesisira_nanswered a year agorePost-User-3858501 7 months agoWe have the same problem. Deployment is on pending status for days.Share


Question: JAR size affect the response time of lambda?

"Hi,I'm making some experiments regarding the impact of JAR size on Lambda Cold Starts and response times. I have created 3 JARs of different sizes.JAR SizeResponse time10mb1s64mb6s100mb12sIn Cludwatch logs I can see that init durations for all these Lambas is on average ~620ms, but for every lambda the response time is different and I don't know why. The code is the same(there is no logic -> all of them are returning a String), differences in size are due to different maven dependencies that I added. All of them are from AWS SDK.Is this normal?FollowComment"

Answer: 1Yes. the size of function package can affect the cold start time. You can refer this blog (https://aws.amazon.com/ko/blogs/compute/operating-lambda-performance-optimization-part-2/)CommentShareAWS-User-1317674answered a year agoEXPERTBrettski-AWSreviewed a year ago


Question: "NICE DCV behind Nginx reverse proxy, "Failed to communicate with server.""

"I have Nginx running on an Amazon Linux EC2 instance. It is listening for connections to https://dcv01.example.com and then using proxy_pass with a wildcard cert to serve the DCV client from an internal IP address.  The page displays properly with no SSL errors. However, instead of the login prompt, I get a red message that says "Failed to communicate with server.".I attempted to use the allowed-http-host-regex with the value ^(www\.)?dcv01\.example\.com$, but then I get a 403.I also tried allowed-ws-origin-regex, but it does nothing different (still get Failed to communicate...)What do I need to do to get DCV working behind a reverse proxy?FollowComment"

Answer: 1Accepted AnswerI realized this was due to websockets not being proxied.  Adding the following to my server block fixed the issue.proxy_http_version 1.1;proxy_set_header Upgrade $http_upgrade;proxy_set_header Connection "upgrade";CommentShareFusionScottanswered 4 months ago


Question: Automated schedule in CloudWatch using UTC timezone

"Hi - My customer is using  automated schedule in CloudWatch to trigger various functions and it's kind of widely across the teams. Currently CW schedules are mostly based on UTC and in the event of DST (Day Light Savings), the team has to manually reset the UTC and teams are complaining on this. Anybody came across this and i didn't see any PFR also related to this. Any suggestion here pls.FollowComment"

Answer: "0This is no out-of-the-box solution. You will have to implement a custom solution, but there are several approaches publicly available using Lambda:On Github, On Medium, Using EventBridge SchedulerCommentShareAWSdaveanswered 4 months ago"


Question: How can I access S3 bucket objects using Signed Url from a lambda

"Hi,When I store a permanent IAM key with S3 access on the lambda, I can successfully access bucket objects.However when I try to attach a role to the lambda with the required permissions, and the below code in my application, I get 403 errors in the frontend:const s3Client = new S3({    credentials: {      accessKeyId: process.env.AWS_ACCESS_KEY_ID,      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,      sessionToken: process.env.AWS_SESSION_TOKEN,    },    signatureVersion: 'v4',    region: CI ? process.env.AWS_REGION : process.env.AWS_REGION_LAMBDA,  })I am generating signed urls for upload and download, and everything is working fine with the permanent IAM key, just not with the Lambda role (As is recommended by AWS current guidelines).FollowComment"

Answer: "0The credentials that the Lambda function is operating with are relatively short-lived - they may expire by the time the presigned URL is used. Hence it is better in this case to have long-lived credentials which are used for creating the URL - as you are doing now.CommentShareEXPERTBrettski-AWSanswered 4 months agoManav 4 months agoIsn't current AWS policy to use role based access control for lambda? When I go to create a permanent IAM key it prompts me what the key will be used for - and if I select for accessing resources from within AWS then it recommends RBAC over a permanent IAM key.ShareBrettski-AWS EXPERT4 months agoYes, you should absolutely use roles for Lambda functions - 100%. But in this case the presigned URL may outlive the lifetime of the Lambda function and (therefore) also the lifetime of the credentials. So you would create some long-lived credentials; store them securely (in Parameter Store for example); scope the permissions so that only the Lambda function has access to those permissions; and scope the permissions for the credentials so that they can only access the objects the you want the presigned URL to access.Share"


Question: "The web acl is associated with the Application Load Balancer in the AWS region. After a few hours, it is found that the association has been cancelled"

"I want the web acl to be associated with the Application Load Balancer in the AWS region, after a few hours, I found that the association was cancelled, repeated many times with the same result, and in the Application Load Balancer configuration item integrated service (AWS WAF) shows: This Application Load Balancer does not support WAF, I don't know where the configuration is wrong，thank youFollowComment"

Answer: "0Hi,This could be because of the disassociation of the WEB-ACL.look into cloud trial logs for disassociate-web-acl api call.https://docs.aws.amazon.com/cli/latest/reference/wafv2/disassociate-web-acl.htmlAlso, there are Restrictions on multiple associationYou can associate a single web ACL with one or more AWS resources, according to the followingrestrictions:• You can associate each AWS resource with only one web ACL. The relationship between web ACL andAWS resources is one-to-many.• You can associate a web ACL with one or more CloudFront distributions. You cannot associate a webACL that you have associated with a CloudFront distribution with any other AWS resource type.https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.htmlCommentShareSara_Aanswered 10 months agorePost-User-1130890 10 months agoWhere can I view the cloud trial log of the disassociate-web-acl api call.No exception log was found in WAF Overviewand I just associate a single web ACL with multiple Application Load Balancers.So I still don't know the reason for this problem.Thank you for your answerShare"


Question: Multi Camera Support for Panorama

"Hello AWS,Our company (aidant.ai) is considering using AWS Panorama as our appliance of choice to analyze video streams and provide AI inference.We are currently using Nvidia RTX2070 GPUs at the local appliance and are able to run 4 video streams per GPU.The question:How many videos streams (assume HD resolution1080p) can each Panorama support for running AI inference, say, human detection?Thanks in Advance,Ari Telias, CTOAiDANT.aiEdited by: AriTelias on Feb 21, 2021 11:14 AMFollowComment"

Answer: "1Hi,This is quite a challenging question: the Panorama appliance runs a Jetson AGX Xavier architecture, which is significantly different than RTX. For instance, it sports specific deep learning accelerators (DLA) that offload the GPU for deep learning inference workload, making it hard to compare the number of TensorCores or Cuda Cores. It also depends on the frame rate you are looking at. Also keep in mind that NVidia Jetson platform does use a lot less energy than standard grade RTX video cards.At this stage, you would have to test your workload with a development kit (do reach out to AWS representative if you feel you need support to perform these tests). AWS is collecting more datapoints from customers using the appliance and from internal usage for benchmark purpose. The Panorama service team may have more insights about the framerate you could potentially achieve given your video frame rates, resolutions, model size and architecture.--Michaël HoarauAWS AI/ML Specialist Solutions ArchitectCommentSharemichoaraanswered 2 years ago0Thank you!CommentShareAriTeliasanswered 2 years ago"


Question: "Can anyone point me at an Example that runs on Visual Studio 2022, Xamarin, S3"

"I am looking for an S3 example that runs on Visual Studio 2022 Community Edition with Mobile Development with .NET (Xamarin Forms). To start with I would like to Create a bucket, upload and object, read an object, delete object, delete bucket. On GITHub I have found aws-sdk-net-samples, there is a console app that does what I need, but when I try and port it into VS2022 with Xamarin, I hit a host of problems, one really good example would really help.FollowComment"


Question: Code deploy agent installation issue

"Having issue while installing code deploy agent in EC2 instance Linux as it is showing as "no implicit conversion of array into string"  ," if file.exist?(path)FollowComment"

Answer: 0Hi - Assuming this is for Amazon Linux or RHEL you can perhaps follow https://docs.aws.amazon.com/codedeploy/latest/userguide/codedeploy-agent-operations-install-linux.htmlCommentShareEXPERTAWS-User-Nitinanswered 2 months ago


Question: Problem with closing an account I don't have access to

"I've been practising with aws organizations and AWS SecurityHub and I've created child organizations on domain, that I don't have access to... I cannot delete it because I have an error saying that I need to have valid Payment method attached, but to do it I need to first login into that organization...I'm in point where I have no idea what should I do...Where should I startFollowComment"

Answer: "0Hi There,I'm so sorry to hear about this, it's not the experience we strive for.I recommend reaching out to our Support team for this issue, you can create a support case for this concern here: http://go.aws/support-center. If you're having trouble accessing your account, you can get help by completing this contact form: http://go.aws/account-support.Best regards,— Aimee K.CommentShareEXPERTAWS Support - Aimeeanswered 4 months ago0For member account to leave AWS Organization. Billing information must be added using the root user of the member account. By default, you don't have access to the root user password in a member account that was created using AWS Organizations. If required, recover the root user password by following the steps at ( https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_access-as-root)For more details on removing member account, refers to the documentation at:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.htmlCommentShareronald_lanswered 3 months ago"


Question: create lambda using terraform in a separate repo

"I need to create a lambda function without putting any source, so that terraform script will just create a lambda. This will be in infra repo you can say that where I am just provisioning the services.Then in another repo which will be used by developers where we will have a application code which needs to be deployed in that lambda.So when I am creating the lambda using terraform in Infra repo, then source_path seems mandatory... please suggest how I can achieve this.FollowComment"

Answer: "4Accepted Answeryou can use the filename parameter to specify a dummy source file for the functionlike the followingresource "aws_lambda_function" "my_lambda" {  function_name = "my-lambda-function"  role         = aws_iam_role.lambda_role.arn  handler      = "index.handler"  runtime      = "nodejs14.x"  filename     = "/dev/null"  source_code_hash = "0" # Required to bypass source_code_hash validation when no source code is specified}Once you've created the Lambda function in your infrastructure repository, you can then reference it in your application repository using the function's ARN. You can use a data source to look up the ARN by function name:data "aws_lambda_function" "my_lambda" {  function_name = "my-lambda-function"}resource "aws_lambda_alias" "my_alias" {  name             = "my-lambda-alias"  function_name    = data.aws_lambda_function.my_lambda.arn  function_version = "$LATEST"}hope this helps to youCommentShareEXPERTsdtslmnanswered 2 months agovneekhra 2 months agoHi, I have tried this and it works if we do terraform plan, but its not working when applying it│ Error: creating Lambda Function (): operation error Lambda: CreateFunction, https response error StatusCode: 400, RequestID: 00000000-0000-0000-0000-000000000, InvalidParameterValueException: Uploaded file must be a non-empty zipShare"


Question: "EC2 instance failure, wont start"

I got an email :"EC2 has detected degradation of the underlying hardware hosting your Amazon EC2 instance (instance-ID: i-0b0da3b7135256146) associated with your AWS account (AWS Account ID: ***********) in the us-gov-west-1 region. Due to this degradation your instance could already be unreachable. We will stop your instance after 2022-01-27."I tried to stop it.  Didn't work.  I force stopped it.  It finally stopped the next day.I tried to start it per this :"We recommend that you stop and start the instance which will migrate the instance to a new host."Instance state remains "Stopped".How can I get this instance running ASAP?FollowComment

Answer: "0Accepted AnswerThis is what I get :$ aws ec2 start-instances --instance-ids i-0b0da3b7135256146{"StartingInstances": [{"InstanceId": "i-0b0da3b7135256146","CurrentState": {"Code": 16,"Name": "running"},"PreviousState": {"Code": 16,"Name": "running"}}]}Instance state is till "Stopped" and I still cannot access.CommentShareAWS-User-1296388answered a year ago0You should just be able to start the instance via the AWS Console or CLI, at which point, it should start again. If it fails to start via the Console, you may be able to see more useful diagnostic information by running the following command at the CLI:aws ec2 start-instances --instance-ids <instance-id>CommentShareEXPERTMichael_Fanswered a year ago0The cli return is telling the truth, the console - not so much.  I had to get out and back into the console to see it running.a related question :I see where people stop and start their ec2 somewhat regularly.  Does this practice somehow help with "underlying" problems?CommentShareAWS-User-1296388answered a year ago0What about taking a snapshot from the EBS and start a new instance with this snapshot?CommentShareYuxianganswered a year ago"


Question: Is it possible clip video without output settings

"Hi, I am trying MediaConvert to clip videos with specific timecode ranges.However when I tried the job I must set some output settings such as bitrate mode and its quality.I just want to use the input file's codec setting as output.Is there any way I can use?ThanksFollowComment"

Answer: "0hello!MediaConvert supports clipping by HH:MM:SS:FF timecode on the input file, so that the clip applies to all output types made by the job.Regarding your second question, yes MediaConvert can inherit many of the output settings from the input settings, such as aspect ratio, frame rate and other parameters. Target video bitrate and CODEC are two values you must specify.  However we can automate those selections using Presets and Templates.MediaConvert supports the use of pre-defined output settings,  known as Output Presets.  You can define these once, and use them on any or all future jobs you submit, to get consistent output.Taking that concept one step further, MediaConvert supports Job Templates which can combine a variety of input settings, plus output settings, plus preferences for Job Queue, job priority and other job details into a giant 'preset' which would likely give you the level of automation you are looking for.Many customers have implemented a 'job template chooser' Lambda function that decides which MediaConvert template to apply to a newly arrived file based on the output of a file analyzer such as mediainfo or ffmpeg; both of which can be run by the Lambda Function to gather information about the newly arrived file.  Note, the runtime of a Lambda Fn is capped at 15 minutes; this includes transfer time to read the asset from S3.  Larger files requiring longer transfer times can be analyzed the same way using a temporary EC2 instance.I hope this answers your question. Have a great day!Edited by: robclem on Nov 24, 2021 3:20 PMCommentSharerobclemAMZNanswered 2 years ago0Thanks for your reply. It answered all my questions.CommentSharerayray811answered a year ago"


Question: ECR multiple PolicyExecutionEvent executions at the same second.

"We recently went to pull an image from ECR and it no longer existed.Our ECR repositories have a simple Lifecycle policy:{  "rules": [    {      "rulePriority": 2,      "description": "Expire untagged images",      "selection": {        "tagStatus": "untagged",        "countType": "imageCountMoreThan",        "countNumber": 5      },      "action": {        "type": "expire"      }    },    {      "rulePriority": 6,      "description": "Image Retention",      "selection": {        "tagStatus": "any",        "countType": "imageCountMoreThan",        "countNumber": 50      },      "action": {        "type": "expire"      }    }  ]}We found that for this repository, the PolicyExecutionEvent ran five times at the same time (EPOCH).  And the result was that it run our rule 6 for those five times and the result was only 12 remaining tagged images.A quick script found that we had a few other repositories with this multi-run issue:#!/bin/bash# find_ecr_lifecycle_events.shfor repo in $( aws ecr describe-repositories --query "repositories[].repositoryName" | jq -r '.[]' |sort )do    echo $repo    aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=PolicyExecutionEvent --lookup-attributes AttributeKey=ResourceName,AttributeValue=arn:aws:ecr:us-east-1:${ACCOUNTID}:repository/${repo} --max-items 50 | jq .Events[].EventTime  |sort |uniq -c |grep -v '^   1 ' | sed 's/^/    /'doneDoes anyone know why AWS sometimes runs this policy multiple times?  Should we not be using an imageCoundMoreThan operator?Thanks!FollowComment"


Question: NotExportable error. Can't export an EC2 instance as OVA image.

"It looks like multiple users are facing the same issue from a couple of days ago. https://github.com/aws/aws-sdk/issues/203As part of our automated release process, the OVA image will be exported at the end.The automation worked well until a couple of days ago. We are seeing the below error.An error occurred (NotExportable) when calling the CreateInstanceExportTask operation: The snapshot ID (xxx) of the instance neither is owned by current user nor had been previously imported through VMIE.Here is the command which I used.aws ec2 create-instance-export-task --instance-id xxx --target-environment vmware - -export-to-s3-task DiskImageFormat=vmdk,ContainerFormat=ova,S3Bucket=xxx,S3Prefix=xxxHere is my environmentaws-cli/1.21.6 Python/3.8.10 Linux/5.10.16.3-microsoft-standard-WSL2 botocore/1.21.42FollowCommentMichael_F EXPERTa year agoHave you verified that none of the limitations discussed in https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#vmexport-limits are an issue?ShareAWS-User-Lucidum-Su a year agoThe snapshot ID in the error message is always snap-09c7d0ffed591d4c2. It is a public snapshot. I don't know how it is related to my EC2 instance.Share"

Answer: "0Hello,Thank you for reaching out to re:Post. I understand that you are having an error while you are having a problem exporting an EC2 instance as an OVA image.From my investigation, your error is specific to the CLI command create-instance-export-task. This issue has been escalated and has been fixed in March 17, 2022.Please contact if you have any further questions, and feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources.CommentSharekedkormeanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: AWS S3 HTTPS connection(TLS handshake) failed several time and success automatically.

"Hi,I am trying to HTTPS connection in the loop until it is connected with the "s3.amazonaws.com" to download one file. I was using the below older CA certificateIssuer: C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Rootand observed that TLS handshake failed with error (-0x2700 Failed to verify peer certificate!) and after several retries, the S3 server TLS handshake pass automatically.I have observed same thing with the below OpenSSL commandopenssl s_client -connect s3.amazonaws.com:443 -CAfile <older s3 server CA cert>**Verify return code: 20 (unable to get local issuer certificate)** After several retries Verify return code: 0 (ok)I would like to know why after several retries S3 server exchanges the older CA certificate during the handshake? and why the retries count is not fixed?Regards,ArjunFollowComment"


Question: Pricing API requires credentials ?

"I' creating a control panel for the cloud.All examples online show something like this :pricing_client = boto3.client('pricing', region_name='us-east-1')But only by setting access key and secret key, it workssession = boto3.Session(    aws_access_key_id='xxxxx',    aws_secret_access_key='xxxxx',    region_name='us-east-1')pricing_client = session.client('pricing', region_name='us-east-1')Is the Pricing API accessible only via credentials?Will I get billed for the same or is this a free service? There will be 100 API calls per each of 100 users per day, so that would be 10,000 API queries per day.I am thinking of storing the result in redis so that only the first fetch of a particular combination would be via AWS API and subscequent queries via redis. Good / Bad idea ?FollowComment"

Answer: "0AWS offers two APIs that you can use to query prices:With the AWS Price List Bulk API, you can query the prices of AWS services in bulk. The API returns either a JSON or a CSV file. The bulk API retains all historical versions of the price list.With the AWS Price List Query API, you can query specific information about AWS services, products, and pricing using an AWS SDK or the AWS CLI. This API can retrieve information about certain products or prices, rather than retrieving prices in bulk. This allows you to get pricing information in environments that might not be able to process a bulk price list, such as in mobile or web browser-based applications. For example, you can use the query API to fetch pricing information for Amazon EC2 instances with 64 vCPUs, 256 GiB of memory, and pre-installed SQL Server Enterprise in the Asia Pacific (Mumbai) Region. The query API serves the current prices and doesn’t retain historical prices.Reference : https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/price-changes.htmlCommentShareEXPERTAWS-User-Nitinanswered 2 months ago"


Question: Send alert when Usage is very low for AWS resources

"Hi All,Is there a way to Set up Inactive Alert: Setting up alerts for all instances that were running at any time during the last 14 days and alerts you if the daily CPU utilisation was 10% or less and network I/O was 5 MB or less on 4 or more days.Regards,Rajesh BFollowComment"

Answer: 2You could leverage TrustedAdvisor integration with CloudWatch alerts.See references for inspiration:https://github.com/aws/Trusted-Advisor-Tools/tree/master/LowUtilizationEC2Instanceshttps://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-events-ta.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/trusted-advisor-cost-optimization/CommentShareEXPERTalatechanswered 4 months ago0You can use AWS Trusted advisor to do this for you.CommentShareEvolate-Timanswered 4 months ago


Question: Suspected Spam caller when using AWS Connect

"I set up an AWS connect instance, claimed a number and set up users and queues with a caller Id. When an agent makes a call the customer doesn't see the specified caller id, instead gets "Suspected Spam". The calls are made to Australia, either from Australia or from the Philippines.FollowComment"

Answer: "0Phone numbers can get on these list for various reasons which potentially is not in direct control of the Customer of AWS.I'd recommend to open an AWS Support Ticket and may check the CNAM section on the Administrator Guide (even it's for the US).You can also setup an alternative number in Amazon Connect to be shown on outbound numbers to overcome that issue.CommentSharefaddianswered a year ago0Hi there,As part of changes within the US Public Telephone network and a move to alternative reputation mechanisms, as of March 31, 2023, Amazon Connect no longer sets CNAM configurations.We conducted research between January and March 2023, that showed CNAM was seen by fewer than 7% of users. This is due to changes within support for mobile providers and due to the migration to app-based reputation mechanisms.All existing CNAM configurations set up before March 2023, are still in place. We will continue to focus on supporting modern replacement mechanisms added to our marketplace, for example, First Orion and Neustar.You can view the below link for more information: https://docs.aws.amazon.com/connect/latest/adminguide/queues-callerid.html#enroll-in-CNAM-servicesCommentShareEXPERTAWS-samfredanswered 2 months ago"


Question: How to delete a cloud formation stack in DELETE_FAILED status?

I have a stack that will not delete.It has a custom resource that failed creation. I went through the steps here to delete the custom resource and the custom resource deleted properly.Later I tried to delete the stack. It went into the DELETE_IN_PROGRESS state and all the resources were deleted. It then hung for about 40 minutes and finally changed state to DELETE_FAILED with no other information.If I try to delete again it goes into the state DELETE_IN_PROGRESS and about 40 minutes later returns to the state DELETE_FAILED. Since all resources are already deleted it does not present a list of resources to retain.I have tried recreating some resources. But deleting the stack still hangs for 40 minutes and fails.Has anyone found a way around this problem? We only have a basic support account are are unable to create a technical support issue and paying the several hundred dollars for a single month of support seems a bit excessive. Has anyone been able to get Amazon to delete a stack like this with only a basic support account?FollowComment

Answer: "0Answering based from the previous post: https://repost.aws/questions/QUMgNTrrY-TNq96WhqEB4AIA/how-delete-a-cfn-stack-delete-failed-internal-errorA couple options:If you can see the stack and the resources, you could recreate the resources with the same logical resources and then try deleting again. This may give you more options than what you're seeing above.For technical support from AWS, you could sign up and then cancel when the case is closed - this may be a prorated charge as well. However, there is a minimum of 1 month for the charge. Developer Support costs only $29 a month though.Link -- https://aws.amazon.com/premiumsupport/faqs/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agorePost-User-4183690 8 months agoIt is a stack with 131 resources so recreating will be time consuming.And unfortunately support costs a maximum of $29 or 3% of your monthly charges. 3% of our monthly charges is well above $29.I was hoping that someone had found another solution. But I will probably have to end up recreating the resources and trying again. And maybe signing up for one month of developer support.I do thank you for responding!Share"


Question: Quicksight: Change KPI visualization's Value and Target Value display column name

"Hi all,I am setting up several KPI visualizations on my dashboard. I would like to show current value as default value, difference with previous on the left, and previous value on the right. My issue is that I cannot assign generic display names to these values, instead I am forcing to use the column name values. Though, I cannot call all the columns "Previous". Is there maybe a hidden way to chose display names as you would do with a table?FollowComment"


Question: Does Babelfish support table partitioning via CREATE PARTITION?

Does Babelfish for Aurora PostgreSQL support SQL Server's CREATE PARTITION command?FollowComment

Answer: "0Accepted AnswerAt the time of this writing, April 2022, Babelfish version 1.2.1 does not support CREATE PARTITION. Be sure to check back frequently for Babelfish updates.Babelfish version comparisonDifferences between Babelfish and SQL ServerCommentSharelightanswered a year ago"


Question: Lightsail - development and production sites

"I'd like a way of setting up a development and production copies of the same website.At some point, the development copy would be migrated (copied) to the production site.Bearing in mind that I'd want to keep a static address, SSL, path names, domain name etc for the production site.This is in a way looking at an agile approach with regular updates.Is this the right approach for best practices using Lightsail/Wordpress?Alternatively, is it possible to use a snapshot to create a development Lightsail copy and then re-transfer back to production.  In essence, the development site is only in use temporarily.FollowComment"

Answer: "0This doesn't have anything do with Lightsail ... it's just general configuration management.Take a look at git or subversion change control systems.You can do your development in one area on your lightsail instance, commit the changes to the change control system, deploy the changes to a QA location, test the changes in a pseudo-live environment, once you're sure everything works correctly, deploy the changes in the production location.david(who works on enterprise level change control software during the day)CommentShareDavid Ganswered 4 years ago"


Question: Textract Service Quota

For "StartDocumentTextDetection throttle limit in transactions per second" since every AWS account is defaulted to 15 is there a direct cost to increase this to let's say 50? What's the typical service quota limit increased to if 15 does not match your businesses needs anymore?FollowComment

Answer: "1Accepted AnswerThere is no additional charge for quota increase, you will only be charged for the consumption.https://aws.amazon.com/premiumsupport/knowledge-center/manage-service-limits/You can request for an increase in quota through service quotas -https://console.aws.amazon.com/servicequotas/homeThe new limit value depends on your business needs i.e. how many documents do you want to process per second, how many records can your application handle/consume per second, etc.Also, you may need to look at the need to increase the limit for 'GetDocumentTextDetection throttle limit in transactions per second' if your application code needs a higher value for this API as well.CommentShareRajesh Sanswered 10 months ago"


Question: AWS Translate enhancements

"Hi, can you advise if there are any enhancements on the AWS translate roadmap to handle large file sizes please?FollowComment"

Answer: "0Hi! What sizes are you currently passing on to AWS translate? Is preprocessing split not an available option?CommentShareDani Manswered a year ago0400 MB is the size of the files. Preprocessing split is an option, but will increase the cycle time, manual effort and defects if manual intervention (preprocessing) is required. IS there any enhancements that I can report to leadership that might cater for this file size without splitting the file please?CommentSharerePost-User-2162184answered a year ago"


Question: How to execute parallel dags in Airflow in EC2 Instance

"I have Installed Airflow as a service in EC2 Instance. It is working fine with Sequential execution. But While I am trying with Parallel execution I am facing Issues. It is not running parallel dags execution. I have installed PostgreSQL inside EC2 instance.Step1: I have installed Airflow.Step2: Installed the PostgresqlStep3: In airflow.cfg, modified to sequential Executor to Local Executor.Step4: Restarted the Airflow and scheduler.FollowComment"


Question: "Transcribe is not exporting SRT files, even though I checked the box... 4 times"

"I've submitted 4 jobs now to Transcribe, and it seems everything is messed up.  English-US is not an option in the language, it's not exporting the SRT files that I need.   And I don't know how to dispute the charges for the 4 jobs that did not export the SRT files.  What can I do?FollowComment"


Question: ORA-01578 in Oracle RDS SE/2 GovCloud West 3/1/2022

"In one instance in our RDS Oracle SE/2 in GovCloud West region, we have transactions that are receiving ORA-01578 error as shown:ORA-01578: ORACLE data block corrupted (file # 9, block # 149082)ORA-06512: at line 108ORA-01110: data file 9: '/rdsdbdata/db/ORCL_A/datafile/o1_mf_tp_pmdb__htvs55dx_.dbf'ORA-26040: Data block was loaded using the NOLOGGING optionjava.sql.SQLException: ORA-01578: ORACLE data block corrupted (file # 9, block # 149082)ORA-06512: at line 108ORA-01110: data file 9: '/rdsdbdata/db/ORCL_A/datafile/o1_mf_tp_pmdb__htvs55dx_.dbf'ORA-26040: Data block was loaded using the NOLOGGING optionORA-06512: at line 67Since this is a managed RDS instance, we are unclear about how best to proceed with resolving this issue, particularly if this indicates an underlying hardware issue on the RDS instance. Can anyone please advise next steps?Thanks for your time.FollowComment"

Answer: "0The approach to fix/address this issue depends on the type of segment that block is holding i.e. if its a temporary table, application table, index.Meaning, if this block turns out to be holding temporary table, then you can skip that block after following this - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.Database.html#Appendix.Oracle.CommonDBATasks.SkippingCorruptBlocksIf its an index, you can rebuild it or use dbms packages to repair it.If its an application table, then do a PITR using the backups, skip the corrupted block(s) and import the table from restored RDS.I would say, validate the database using RMAN to see if there are any more corruptions ( https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.RMAN.html#Appendix.Oracle.CommonDBATasks.ValidateDB )and reach out to support for more help.CommentShareD-Raoanswered a year ago"


Question: Training Metric logging on SageMaker experiment tracking: how to get time-series metrics with visualisation

"I am using the sagemaker python SDK to train a bespoke model. I have defined my metric_definition regexes and passed them to the estimator like:num_re = "([0-9\\.]+)(e-?[[01][0-9])?"metrics = [    {"Name": "learning-rate", "Regex": f"lr: {num_re}"},    {"Name": "training:loss", "Regex": f"loss: {num_re}"},    # ...]estimator = Estimator(    image_uri=training_image_uri,    # ...    metric_definitions=metrics,    enable_sagemaker_metrics=True,)When I run training, these metrics are visible in my logs and I can also see them in SageMaker Studio in Trial Components > Metrics (tab) as a grid of numbers like:Name | Minimum | Maximum | Standard Deviation | Average | Count | Final valuelearning-rate | 8.889 | 8.907 | 0.010392304845413657 | 8.898 | 4 |8.907...Which suggests that the regexes are correctly matching on the logsHowever, I am not able to visualise any graphs for my metrics. I have tried all of:Sagemaker Studio > Trial components > charts. It is only possible to plot things like learning-rate_min (i.e. a point value not a time-series metric)SageMaker aws console > training > training jobs > <select job> > Scroll to Monitor section. Here I can see metrics like CPUUtilization over time but for my metrics there is just an empty graph for each metric that I have defined that says 'No data available'SageMaker aws console > training > training jobs > <select job> > Scroll to Monitor section > View algorithm metrics (opens in CloudWatch) > Browse > select metric (e.g. learning-rate and 'Add to Graph' . I filter by the correct time period and go the Graphed metrics (1) tab, even after updating the period to 1 second I am not able to see anything on the graph.I'm not sure what the issue is here but any help would be much appreciatedFollowCommentAWS-User-0823707 a year agoWhen you describe your training job, what do you see in FinalMetricDataList?https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker.html#SageMaker.Client.describe_training_jobShare"

Answer: "0Hi - this is the OP:Thanks for your response. Yes I should have stated in the original question: I am logging these metrics to the console every iteration and can see them in view logs in the console. The issue is that I'm not able to:view the parsed metrics for the period (I can only see the mean/max/min/...)get visualisations of these metricsCommentShareAWS-User-6087540answered a year agorePost-User-8999462 4 months agoWere you able to find a way to visualize experiments metrics ? I just started using SM experiments and can't find a way to visualize metrics !Share0Hello, Thank you for contacting us.I understand you are not able to visualize any graphs for your metrics, even though you see them in "Trial Components > Metrics (tab)".SageMaker parses the Cloudwatch logs for your training job and emits metrics from the parsed logs as defined in the metrics_definition. The Cloudwatch logs for your training job depends on your train.py script. For example, If you wish to have metrics per step (or per 100 steps), your script needs to print the metrics per step (or per 100 steps) so that it is there in the Cloudwatch logs. Please see the documentation linked below for more information.https://docs.aws.amazon.com/sagemaker/latest/dg/training-metrics.html#define-train-metricsAnd I am providing you with examples from our official AWS Github Repository in [1] and [2] which provides an Entry Script which emits custom metrics for a Hyper-parameter Tuning Job. Please compare them with your script.[1] https://github.com/aws/amazon-sagemaker-examples/tree/master/hyperparameter_tuning/tensorflow2_mnist[2] https://github.com/aws/amazon-sagemaker-examples/tree/master/hyperparameter_tuning/tensorflow_mnistIf you still have difficulties, I recommend to cut a support case and provide more detail about your account information and script/config. Due to security reason, we cannot discuss account specific issue in the public posts.Thank you.CommentShareAWS-User-2745758answered a year ago"


Question: Failed to mount rootfs on a bare metal instance

"Hi,I am trying to install Xen hypervisor on a bare-metal instance.After installing Xen, I rebooted the instance but it failed to boot.Below is the system logs.Why was it not able to mount the rootfs? The storage was the same one that the instance was using before installing Xen.[   80.425165] VFS: Cannot open root device "UUID=436cf32d-5e3d-46ca-b557-f870c8a25794" or unknown-block(0,0): error -6[   80.425833] Please append a correct "root=" boot option; here are the available partitions:[   80.426365] 103:00000    8388608 nvme0n1 [   80.426367]  (driver?)[   80.426784]   103:00002    8387567 nvme0n1p1 24ca9e81-01[   80.426786] [   80.427226] 103:00001    8388608 nvme1n1 [   80.427228]  (driver?)[   80.427645] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)[   80.428171] CPU: 25 PID: 1 Comm: swapper/0 Not tainted 5.11.0-1027-aws #30~20.04.1-Ubuntu[   80.428692] Hardware name: Amazon EC2 m5.metal/Not Specified, BIOS 1.0 10/16/2017[   80.429171] Call Trace:[   80.429337]  dump_stack+0x74/0x92[   80.429561]  panic+0x101/0x2e3[   80.429765]  mount_block_root+0x299/0x31d[   80.430031]  mount_root+0x38/0x3a[   80.430250]  prepare_namespace+0x13f/0x18d[   80.430518]  kernel_init_freeable+0x262/0x288[   80.430804]  ? rest_init+0xba/0xba[   80.431031]  kernel_init+0xe/0x116[   80.431256]  ret_from_fork+0x22/0x30[   80.431728] Kernel Offset: disabledFollowComment"

Answer: "0Hey, I was searching for the same issue to get solve. Luckily, it was already solved here https://repost.aws/knowledge-center/ec2-linux-kernel-panic-unable-mount and this could help.CommentShareYobitel_Abishekanswered 24 days ago"


Question: Difference in vCore and vCPU | EC2 and EMR

"I am new to AWS and EMR things. I actually wanted to know the difference between vCPU and vCore.In the documentation, https://aws.amazon.com/ec2/instance-types/ it shows that m4.large has 2 vCPU and 8GiB and I verified this by SSHing to the master node that there were 2 CPUs at work.Now, when I spin off the EMR cluster with m4.large as an instance type, then in the Hardware section of cluster shows the description of Instance type as 4 vCore, 8GiB; EBS storage 32 GiB.I am confused between the concepts. I will appreciate if someone can clarify with my doubts.FollowComment"

Answer: "0This has been an issue for some time now but there was never a clear reason given by AWS that I know of.[1] https://forums.aws.amazon.com/message.jspa?messageID=833300[2] https://forums.aws.amazon.com/thread.jspa?threadID=266092From my observations, this has been "corrected" with the m5 generation. However, this makes it difficult to configure the spark executor resources for a cluster with a fleet using multiple generations of instance types, which is what is recommended by AWS: https://aws.amazon.com/blogs/big-data/best-practices-for-running-apache-spark-applications-using-amazon-ec2-spot-instances-with-amazon-emr/My only guess is that the virtual cores / hardware threads are being taken into account here incorrectly when presented to YARN and since AWS has already made this generally available they can't roll it back because customers have already had to work around it.CommentSharesasquatch85answered 4 years ago0When you choose an instance type using the AWS EMR Management Console, the number of vCPU shown for each Instance type is the number of YARN vCores for that instance type, not the number of EC2 vCPUs for that instance type.http://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-purchasing-options.htmlEMR console will be picking theyarn.nodemanager.resource.cpu-vcoresvalue for the respective instance type which is set  from a predefined fixed mapping done by EMR service for every instance type / Family.  For some instance types/families like M5's, EMR made vCore same as Ec2 vCPU's. And for some other instance types(Like M4 family), the setting is double the actual Ec2 vCPU's.For example : EMR used 80 vcore’s for m4.10xlarge whereas Ec2 reports vCPU's as 40.So it seems that the intent here is to report VCore usage at the YARN level, as opposed to the actual ec2 instance level.The discrepancy on the EMR Console exists because we're trying to represent a cluster's compute power from YARN perspective. Since EMR clusters run applications according to their YARN settings,  some decision may have been made to deem this a better representation of the compute resources than ec2's vCPU.The reason this is done is  to ensure that YARN runs enough containers to max out the CPU as much as possible. EMR determined at the introduction of some instance type families, that for a majority of use-cases, without doubling this value, the instances CPUs will usually be underutilized because most of the time applications are I/O bound. That is, if vCPUs were set to the actual number of CPUs for these instance types, you'd get about one YARN container per actual vCPU, but those containers would spend most of their time blocked on I/O anyway, so you could probably actually run more containers in order to max out the CPU.Amazon EMR makes an effort to provide optimal configuration settings as defaults for each instance type for the broadest range of use cases(types of application and Engines like MapReduce and Spark).  However it is possible that you may need to manually adjust these settings for the needs of your application. This value may be changed via the Configuration API referencing the yarn.nodemanager.resource.cpu-vcores for your different applications and workloads using "yarn-site" classification.https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.htmlhttps://hadoop.apache.org/docs/r2.8.3/hadoop-yarn/hadoop-yarn-common/yarn-default.xmlCommentSharemannem-awsanswered 4 years ago"


Question: Will EKS cluster running on v1.20 get auto upgraded from AWS end - Non Managed Cluster

"We have a few clusters running EKS 1.22 and 1.20. V1.22 is reaching EOL (04 Jun 2023) and will be auto-upgraded to a higher version as per the following document: https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-release-calendar . Just curious about v1.20, which has already reached EOL since 15 Feb 2023. Is there any chance of v1.20 getting auto-upgraded also?FollowComment"

Answer: "0Hi, can you explain a little bit what you mean by Non Managed Cluster ?  EKS is managed by default, did you get an exception ?CommentShareRolyanswered a day ago0Hello.Thank you for ask your question in re:post. Please let me address your query.Kubernetes is a fast-growing project, new minor version (1.2X) updates are available on average every three months. Past a certain point (usually 1 year), the Kubernetes community stops releasing bug and CVE patches. Additionally, the Kubernetes project does not encourage CVE submission for deprecated versions. This means that vulnerabilities specific to an older version of Kubernetes may not even be reported, leaving customers exposed with no notice and no remediation options in the case of a vulnerability.This is an unacceptable security posture for EKS and their customers, leading to the current policy of automatic upgrades to newer versions. [https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html]The automatic upgrade is a measure in order to keep the Control Plane components in a supported Kubernetes version. After the End of Life you should be prepared to see an EKS Control Plane upgrade at any moment. AWS will not notify you the exact date, and you will be responsible to upgrade the data plane if needed (Worker Nodes, Controllers, Deployments, etc...)As recommendation, do not wait until the automatic upgrade happen. Instead, please upgrade proactively your clusters to a supported version before the End of Life.For more information about the Upgrade policy and how to upgrade, please review the corresponding section in the EKS Best practices Guide [https://aws.github.io/aws-eks-best-practices/upgrades/]CommentShareHugo Vanswered a day ago"


Question: Reusable Lambda for Multiple Event Types (Java)

"I want to write an AWS Lambda function that is able to respond to various types of event types: API Gateway, Kinesis, S3, etc.The API/SDK I need to work with is Java.I'd like to create a general-purpose handler, but it appears that each service has its own event type and does not derive from some common parent event type.Is there a pattern or a best practice for creating an AWS Lambda function that can be used with a variety of event types? Or do I need to create a custom handler for each event type?FollowComment"

Answer: "0Hi Brian,One approach is to try to find a common “parent” to all those event types. As everything is an object in Java, you could argue that your handler could accept Object type as the event.The drawback is that then you ll have to cast and use instanceof operator, not ideal but it will work.Another approach is to use Map and/or Inputstream as shown here: https://docs.aws.amazon.com/lambda/latest/dg/java-handler.html.Hope it helpsCommentShareEXPERTalatechanswered 2 months agoBrian 2 months agoUsing Object and instanceof does work, but isn’t really a lot different than having a handler per event type.The issue with the Map or InputStream is that the event is serialized and I have essentially the same problem as before in that each event has a different format. :(Share"


Question: Do I use Lambda InvokeAsync or Amazon SQS event source for extracting data from Amazon S3?

"I want to know the best way to extract data from thousands of Amazon S3 files. I want to use the Amazon S3 Put trigger to invoke an AWS Lambda function that initiates an API call to Amazon Textract to extract data from these S3 files. This process doesn't need to be synchronous because the documents will be uploaded to S3 once a month.Because the concurrency limit of Lambda is 1000 (in some Regions), and the process can be asynchronous, I'm considering the option of using a decoupled Amazon SQS queue with a Lambda function. I'm also aware that Lambda can handle asynchronous invocations.Under what conditions do I use Amazon SQS instead of Lambda InvokeAsync?FollowComment"

Answer: "0Accepted AnswerFor your use case, you might choose to use the Amazon SQS queue to ensure better control over retries and concurrency. [Amazon Textract has relatively low API limits][1]. Therefore, if you use Amazon S3 Put triggers directly to extract the data, a burst of files might lead to throttling. Having Amazon SQS in the middle allows you to have better control and visibility over information, such as how many messages are yet to be processed and how many times the failed messages can be retried.[1]: https://docs.aws.amazon.com/general/latest/gr/textract.htmlCommentShareEXPERTAdam_Wanswered 2 years ago"


Question: Nice DCV cannot access the X server / libGL error

"Hi all,while trying to setup Nice DCV on a Linux Rocky8 G4 instance, it seems like I'm running into the issue that DCV is not able to access the X server. I am following the installation guide on https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux.html and everything works fine except when I test the post installation stepsudo DISPLAY=:0 XAUTHORITY=$(ps aux | grep "X.*\-auth" | grep -v grep | sed -n 's/.*-auth \([^ ]\+\).*/\1/p') xhost | grep "SI:localuser:dcv$"it gives me an empty return.Since I was not able to find anything in the dcv server logs I tried to run the server anyway and created a session.The generated session log gave me the following error:2022-10-26 23:47:48,219549940 [5851] INFO  session-starter - DCV-GL fallback enabled on 'session1'2022-10-26 23:47:48,279122009 [5851] INFO  session-starter - Launch Xdcv: /usr/bin/Xdcv -sessionid 'session1' -auth '/run/user/1000/dcv/session1.xauth' -displayfd 4 -logfile '/var/log/dcv/Xdcv.rocky.session1.log' -output 800x600+0+0 -output 800x600+800+0 -output 800x600+1600+0 -output 800x600+2400+0 -enabledoutputs 1  -verbose 3 -dpi 96 -nolisten tcp2022-10-26 23:47:48,307583861 [5851] INFO  session-starter - Xdcv started on display ':1'2022-10-26 23:47:48,310070531 [5851] INFO  session-starter - Use Xauthority file: /run/user/1000/dcv/session1.xauth2022-10-26 23:47:48,342130989 [5851] INFO  user-autostart - Webcam Injection: disabled (inject-device='none')2022-10-26 23:47:48,489715652 [5851] INFO  session-starter - Launch DCV agent: /usr/libexec/dcv/dcvagent --mode full --session-id session1 --display :1 --settings-path /etc/dcv/dcv.conf --log-level info --log-dir /var/log/dcv --log-max-file-rotations 10 --log-rotation-suffix 0 --log-max-file-size 0 --log-rotation-interval 0 --log-rotate-at-startup2022-10-26 23:47:48,491441457 [5851] INFO  session-starter - Launch init script: /etc/dcv/dcvsessioninit2022-10-26 23:47:48,494010588 [5851] INFO  session-starter - Using shell /bin/bashStarting session: /etc/X11/xinit/Xsession2022-10-26 23:47:48,510666812 [5851] INFO  session-starter - Init script launched with pid '5967' and sid '5967'libGL error: No matching fbConfigs or visuals foundlibGL error: failed to load driver: swrastlibGL error: No matching fbConfigs or visuals foundlibGL error: failed to load driver: swrastCould this be the reason why I am not getting the hoped return while doing the post installation step above?Maybe someone has stumbled over this already prior and has a solution.Many thanks!FollowCommentKarstenNISP 7 months agoCan you show the output ofnvidia-smips -ef PIPE grep X   (please replace PIPE with the pipe symbol - re:post complains about non-english ...;)Share"

Answer: "1Accepted Answer@KarstenNISP After watching the installation video on your page I figured it out: I missed opening up the firewall for the ports (*facepalm). I am able to get the connection running now (even though the post step check is still not returning SI:localuser) Many thanks!CommentSharepancanswered 7 months agoKarstenNISP 7 months agoCongratulations!! Great to hear!Share1Looks good to me$ sudo DISPLAY=:0 XAUTHORITY=$(ps aux | grep "X.-auth" | grep -v grep | sed -n 's/.-auth ([^ ]+).*/\1/p') glxinfo | grep -i "opengl.*version"sed: -e expression #1, char 23: invalid reference \1 on `s' command's RHSOpenGL core profile version string: 4.6.0 NVIDIA 510.85.02OpenGL core profile shading language version string: 4.60 NVIDIAOpenGL version string: 4.6.0 NVIDIA 510.85.02OpenGL shading language version string: 4.60 NVIDIAOpenGL ES profile version string: OpenGL ES 3.2 NVIDIA 510.85.02OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.20CommentSharepancanswered 7 months agopanc 7 months agoand PS thank you for your help! I'm going for the learning curve ;)Share1following up, here are the requested outputs:$ nvidia-smiThu Oct 27 16:28:23 2022+-----------------------------------------------------------------------------+| NVIDIA-SMI 510.85.02    Driver Version: 510.85.02    CUDA Version: 11.6     ||-------------------------------+----------------------+----------------------+| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC || Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. ||                               |                      |               MIG M. ||===============================+======================+======================||   0  Tesla T4            On   | 00000000:00:1E.0 Off |                    0 || N/A   28C    P8    13W /  70W |    231MiB / 15360MiB |      0%      Default ||                               |                      |                  N/A |+-------------------------------+----------------------+----------------------++-----------------------------------------------------------------------------+| Processes:                                                                  ||  GPU   GI   CI        PID   Type   Process name                  GPU Memory ||        ID   ID                                                   Usage      ||=============================================================================||    0   N/A  N/A      2877      G   /usr/libexec/Xorg                  73MiB ||    0   N/A  N/A      2918      G   /usr/bin/gnome-shell              156MiB |+-----------------------------------------------------------------------------+$ ps -ef | grep Xroot        2877    2874  0 16:17 tty1     00:00:00 /usr/libexec/Xorg vt1 -displayfd 3 -auth /run/user/42/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -novtswitch -verbose 3rocky       3324    1850  0 16:31 pts/0    00:00:00 grep --color=auto XWhile going down the rabbit hole I noticed that echo $DISPLAY also returns an empty line. Trying it with export DISPLAY=':0' did not lead to anything, so I am assuming something else is the culprit?CommentSharepancanswered 7 months ago1The above looks fine.  Can you verify OpenGL is supported properly:sudo DISPLAY=:0 XAUTHORITY=$(ps aux | grep "X.-auth" | grep -v grep | sed -n 's/.-auth ([^ ]+).*/\1/p') glxinfo | grep -i "opengl.*version"BTW - in case you want to use a ready made Rocky 8 AMI - on the Marketplace you can find: https://aws.amazon.com/marketplace/pp/prodview-3hpigxwiuk3z6CommentShareKarstenNISPanswered 7 months ago"


Question: aws opensearch/elasticsearch in vpc private subnet times out after cognito redirection

"nginx server redirects to cognito and authentication is successful but redirect to the elasticsearch URL times out. Both the EC2 and opensearch are in the same VPC, same security group. Opensearch is in private subnet, nginx EC2 is in public subnet. All other troubleshooting steps in user pool, user identity pool, opensearch cognito config including IAM roles/policies looks right to me. What am I missing? Please let me know for more details. Thanks for your help.FollowComment"

Answer: "0Hi,Please read this medium post a read it carefully following all the steps ( I have written the post 6 months ago).https://medium.com/p/1f0b784cab3bLet me know!CommentShareacmanjonanswered 3 months agorePost-User-5669095 2 months agoThanks for sharing. We got rid of cognito. However, if the ES is placed in VPC, how do we upload data or send a POST request from outside of VPC. Seems instance profile auth or any http signing request fails by timing out. I could access the kibana dashboard using nginx proxy. But ES just redirects to the root so we are able to upload data to the ES API.Share"


Question: Amazon Workspaces 5.0 Client issues?

"Our organization has recently started deploying the 5.0 release of the Amazon Workspaces Desktop Client (specifically the Windows version, and most if not all of the Workspaces are running on PCoIP, in case it is relevant). Since doing so, we have noticed an increase in users having issues with their USB devices functioning properly in Amazon Workspaces. This primarily is manifesting as issues where their USB headsets will not be recognized after only a few minutes into their session, but we have been noticing it is causing strange issues with users' keyboards as well where the Caps Lock and Num Lock will not behave as expected inside of Amazon Workspaces despite working just fine on the host PC.The keyboard issue has only started cropping up in any sort of noticeable numbers since the 5.0 client has begun deployment in our organization earlier this month. The headset issues are something that we are used to seeing, but have historically been able to resolve with standard troubleshooting methods such as adjusting the audio settings on the host PC, making sure that the user is not muted inside or outside of Amazon Workspaces, repairing the client and driver installations, restarting the Windows Audio Service inside and outside of Amazon Workspaces, rebooting the workspace and/or local PC, etc.Typically, if those steps don't resolve the issue, we can point to a user's slow or unstable internet connection as a likely culprit or narrow it down to a hardware issue with the headset or PC. Since we started deploying the 5.0 Amazon Workspaces client, however, we have seen many more users having issues with their headset dropping out and not being recognized by the workspace client despite us replacing the hardware and confirming that they have exceptional internet speeds.We are starting to roll back users who have issues to the last stable build as a short-term fix, but I haven't seen much being mentioned about this outside of my IT organization and was wondering if others have noticed the same issues? There seem to be some bugs with the USB handling in this release based on the way the problems are manifesting.FollowCommentjwalkerwc 10 months agoWe are having the same keyboard issues. The Num Lock and Caps Lock will become reversed from the PC's operating system, so if the user has the Caps turned on (light illuminated on keyboard), it will be off in Workspaces. Restarting the workspace client can sometimes fix it temporarily.SharerePost-User-2922631 6 months agoWe are still having this issue as of 11-22-2022.  Just received updates a couple of days ago and seems to have made it worse.  Before we could reset the On Screen Keyboard to Number Lock and it would hold for several days.  After the last update, we have to reset it every time we log on.  We are an accounting firm and work with numbers all day long.  This is very frustrating.Share"

Answer: "3We are also seeing issues with the caps/num lock not being in sync. We are suggesting users roll back to a pre 5.0 version of the workspace but that is difficult since they need to uninstall and reinstall. How can we get a resolution to this?CommentSharerePost-User-8283250answered 9 months ago3We are also having an issue with the caps/num lock not being in sync between the local machine and the workspace.  What can we do to get to the bottom of this and get this issue resolved?  I am going to submit a support ticket as well.CommentSharerePost-User-2575699answered 9 months ago0(Deleted my original post because I made a comment instead of an answer. I'm a noob.)I'm having the same issues. Num lock became permanently inverted somehow between my host computer and AWS workstation. My PC is the only one running the Windows 64-bit client. We have about 10 Mac client users with no num-lock issues. Caps lock has always worked for me.Clean reinstall of the client didn't help. (To be fair, it did help the first two times, but not anytime after that.) Rebooting the remote workstation and host PC didn't help. Rebooting the AWS workstation while uninstalling and clean-installing the client, then rebooting the host before connecting to reset the num-lock states... didn't help. Reverting back to 4.x (even without rebooting the AWS workstation) resolved it and I haven't had an issue since. That seems to point to the issue being with the client app.I don't have any feedback about USB audio devices, since we only use WorkSpaces to access our ERP app, and sound is hardly ever used.I've also submitted a support ticket; we'll see where it goes. I'm happy with 4.x, but the last version was in Dec 2021.CommentSharerpsushianswered 6 months agorpsushi 6 months agoI got this response from support:I have reviewed your issue and checked internally with service team. This issue has been acknowledged as a bug and is being worked on for a solution. Unfortunately I do not have an exact ETA as to when this issue will be resolved. However, I can assure you that the internal team is working hard and actively in order to find a resolution....Please keep eye on the clients release and review release notes. If the fix is in the release then upgrade otherwise please continue using the existing client.Share0We are also experiencing headset issues with version 5.x.  USB headsets will intermittently stop working.  Closing and restarting Workspaces will temporarily fix it.We have found that switching to the 32 bit version avoids the issue.CommentSharerePost-User-4941104answered a year ago-2Thanks for reaching out. We are not aware of any bugs in the new version of the client. I suggest you open a support case so we can gather more information and resolve your issue.CommentShareJeremy_Sanswered a year agojwalkerwc 10 months agoWe have been having the keyboard (num & caps lock) issue for the past couple releases.SharerePost-User-0447696 7 months agoWe have had a ticket open with support for 132 days now. Amazon Engineers are well aware of the num lock sync issue but so far every fix we have tested for them has been unsuccessful. Case ID 10268231641Sharejwalkerwc 6 months agoThis is STILL an issue in the most recent version (5.5.0.3276)!!Share"


Question: Communication between two private ec2 instances

"Hosting tableau server HA on 3 AWS ec2 instance private subnet using bastion host on the public subnet,  but the worker ec2 is unable to communicate to host ec2.Though I can RDP the host ec2 from Worker ec2.FollowComment"

Answer: "0Hello,I would like a bit more clarification about the issue you're experiencing, however for an EC2 instance in public subnet (Bation Host) to communicate with another EC2 instance that is in a private subnet, you must have a managed network address translation (NAT) gateway to allow outbound internet access for resources in the private subnets.Instances in private subnets can connect to the internet through a public NAT gateway, but cannot receive unsolicited inbound connections from the internet. You create a public NAT gateway in a public subnet and must associate an elastic IP address with the NAT gateway at creation. You route traffic from the NAT gateway to the internet gateway for the VPCThe NAT gateway replaces the source IP address of the instances with the IP address of the NAT gateway.Further more, security groups play a vital role in maintaining the security and making sure the Bastion host doesn’t fail. The security groups of the private instances have to be changed to make sure that inbound RDP can be accessed through the Bastion Host’s IP address only.The rules of this security group should be applied to all the private instances, which need tighter security, and which need to be able to connect to the internet via a Bastion Host.Make sure to avoid access to IP addresses like 0.0.0.0/0. SSH and RDP connections can be authenticated with the help of private and public keys. Logging in to the private instances via the bastion host will require the bastion host to have the private keys. But storing private keys on a remote instance isn’t considered a safe security method.More inforamtion about NAT Gateways can be found here.I hope this helps.CommentShareLungaanswered a year agoAWS-User-2001144 a year agoThank you for replying! To explain the issue in detail, i have 1vpc, 3 public subnets, 3 private subnets, 3 Nat gateway,  in each public subnets, 3 ec2 one in each private subnet, i have to install my software in each ec2 and communicate them with each other, which i am not able to using their private ip, i tried to ping , but its gave me time out.  even though i have open ICMP port still cant ping in each other ec2sShareLunga a year agoHello, thanks for reaching out. I am going to replicate the issue on my side and come back with feedback.Share"


Question: AWS lambda with large size library

I want to use "rembg" library with AWS lambda python function.I tried to upload rembg library code to lambda layer or function code.AWS says that library file size is too large to include to lambda.Could you tell me the way to use rembg library in AWS lambda?FollowComment

Answer: "1Have you tried using a Container image for Lambda - those can be up to 10 GB in size.CommentShareEXPERTBrettski-AWSanswered 3 months ago1You have several limitations for AWS lambdahttps://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.htmlIf your zip file is bigger that 50 MB and you can made a direct upload, upload de file to S3 and deploy from there.https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-zip.htmlAnother option is use lambda layers. Package rembg as layer and you only need to  upload the custom code.If you are hitting the 250 MB limit for unzipped source code (including dependencies and lambdas), use a lambda container instead of .zipCommentShareCarlos Garcesanswered 3 months ago"


Question: Feature Request: Western Asia as Location on Route53 Geographic routing

"Hi, good evening.It would be great to have "Western Asia" as a location for Route53 Geographic routing.ThanksFollowComment"


Question: How is the function create_partition_index called in Glue Jobs?

"I would like to understand, how the function create_partition_index (https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-CreatePartitionIndex) can be called within a Glue Job.FollowComment"

Answer: "0Accepted AnswerTaking Glue Version 3.0 solved my problem.CommentShareThomas Muelleranswered a year ago0You would utilize the boto3 python module and make the API call with the required parameters.  See here for reference: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/glue.html#Glue.Client.create_partition_indexCommentShareDon_Danswered a year agoEXPERTFabrizio@AWSreviewed a year agoThomas Mueller a year agoThanks for your answer. I already tried to create a client at the end of my Glue job with client = boto3.client('glue'), but this object then does not offer a function client.create_partition_index (although it has a sublist of the function from the page you linked).ShareDon_D a year agoYou can use the latest version of boto3 by adding it as a module. https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-libraries.htmlShare"


Question: want to activate Disk Usage and Ram Usage metrics

I need to activate Disk Usage and Ram Usage metrics for my windows instances there are a lot of tutorial available for Linux but not for Windows please help.FollowComment

Answer: "2Accepted AnswerYou can find instructions on installing the CloudWatch Agent on Windows here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.htmlThe install steps cover downloading the MSI for Windows (step 1) and installing it with msiexec (step 3). You will need to attach a suitable IAM Role to the instance, but the steps for this do not depend on the OS. Finally, instructions for starting the Agent are at the bottom of the page.After it's installed, you can follow the steps for configuring it, which also cover Windows hosts: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.htmlCommentShareEXPERTJames_Sanswered a year ago"


Question: multiple VPN connections with same VPC

"Customers want to have two customer gateways for redundancy purposes, for a VPC.The destination (customer side) CIDR blocks, for EC2 routes remains the same.They already have the VPN connection established and working good for one router (customer side) .They desire to create another VPN connection with the second router. In order to do so:Create a new Customer gateway with the public IP for the second routerCreate a new VPN connection, linking the existing Virtual Private Gateway, that is linked with the VPCQuestion : Do we need VPN Gateway Route Propagation while creating the second VPN connection , so that virtual private gateway can publish the routes for the second VPN connection to the routing tables ?? , or that is done internally by the virtual private gateway ??FollowComment"

Answer: "1Accepted AnswerHello,Correct, customer can create a second connection and use the same routes, they will create a new CGW and a new VPN Connection (associated with the new CGW and the current VGW on the VPC).When both connections are up, we select one of the 4 tunnels and send the traffic to customer over it, the selection on our side is kind of random in case of "Static" VPNs, customer should check where the traffic is coming from in order to send the traffic accordingly.For these setups though, I would advise customer to use Dynamic Routing VPN, with BGP they can control the traffic flow both from AWS to On-Prem and On-Prem to AWS.Route propagation should always be enabled, route propagation is done on the Route Table so you don't need to enable Route propagation for any new connections, once its enabled on the Route Table it will work for all the VPN Connections on the same VGW.CommentShareAWS-User-7740238answered 5 years agoNy Sok 3 months agocan you advise if we use transit gateway with the same purpose? I am facing issue with static route on the transit gateway.Share"