Question: AWS Connect -Transfer Calls to a role that doesnt recieve calls

"Hello,I have users that need to transfer a call to a manager but the manager has selected a status that stops all incoming calls from a round robin. Is there anyway that some sort of status or something similar be setup so that users can transfer these calls without the manager going onto the round robin?Thanks,FollowComment"

Answer: "0Hello,I believe you want to keep the Tag for AWS connect instead of Direct Connect in the question. However regarding transferring the calls, please check if the below link helps.Link- https://aws.amazon.com/premiumsupport/knowledge-center/connect-transfer-to-unavailable-agent/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 4 months ago"


Question: What is the recommended way of handling player authentication using Cognito?

"Hello, so recently I came across this very useful graphic outlining the recommended architecture for games using GameLift. From reading various answers on this forum as well as reading some blogs, these are the following points I have concluded (please correct me if I am wrong).Clients first authenticate themselves by passing their user-inputted credentials (username and password) to Cognito, and a token is generated by Cognito for the client to use in addition to other user information in future requests to a client-backend service that will handle all GameLift service requests.This client-backend service could be simple AWS Lambda functions that use the AWS GameLiftClient functions and models since it is not recommended to use the GameLiftClient class directly in your game client. Therefore, the client will go through Lambda directly instead.These Lambda functions will do all the dirty work in terms of using matchmaking potentially to find a game session, creating one if need be, and allocating a player session for the client. However, Lambda should just simply return the connection information for the client to join the game.My question is, are user credentials stored in Cognito, or are they stored in a database such as DynamoDB that is connected to Cognito. Basically, how does Cognito verify a user from a set of credentials? And to further expand on this, for OAuth 2.0, how does Cognito verify users when they input a set of credentials from external providers such as Facebook, Google, etc.?FollowComment"

Answer: "0Accepted AnswerCognito can work in two main ways (apologies if this is an over simplification) of modelling users:You can create Users in Cognito (see UserPools) which maintain whatever data you want to model ie username, password etc and you would create your sign-in/sign up workflows here. Here all the user information is modeled and held by Congito.OrYou have an known user population ie Facebook, Google etc that supports OAuth style workflows. You basically get an identity token that Cognito can use to validate the user but no user data is held by Cognito.See https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-getting-started.htmlRegardless, of which user 'pool' model you have you then provide an integration with an Identity Pool (or just Cognito) where users exchange their user identity for an AWS identity; short lived credentials that are attached to some role with a policy to take some actions in an AWS account.Typically this will look like:https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-scenarios.html#scenario-identity-poolCognito offers a lot of different workflows, but I would first ask yourself, do you want to model users in Cognito or do you want to use an existing set of identities (ie Twitch, Facebook etc) and does that identity provider plug into Cognito identity exchange?For Cognito and OAuth2.0 please see: https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/Hope that makes some sense.For Cognito specific questions you may want to try the main AWS forums: https://forums.aws.amazon.comCommentSharerePost-User-5332620answered 3 years ago0Hey Pip, thanks for the response.Could you also confirm the 3 points that I listed out for the recommended flow for getting players into games? I just want to make sure that game clients are supposed to call cognito functions directly from the aws sdk rather than call an aws lambda function that calls cognito functions. I read that the reasoning behind this is that cognito has some kind of secure password transfer protocol so that the credentials never actually get sent to the server, is this somewhat true?CommentSharerePost-User-5100160answered 3 years ago0Just another follow up, I have later found that the recommended approach is to use API Gateway to host these lambda functions. Therefore, game clients should make HTTP requests to these APIs hosted on gateway, which will handle the matchmaking stuff and return connection details. Of course, the request will require AWS tokens returned from Cognito after successful identification through either an external provider or user-defined pools. I just want to make sure that this somewhat aligns with the recommended practices for integrating with GameLift.My next question would also be where should one store the access token and refresh token returned from Cognito? Would the game's local storage be safe? I am not sure where else to put these tokens so that the clients can easily access them to call API Gateway APIs. However, I am not sure how sensitive these credentials are as well as how safe local game storage is.CommentSharerePost-User-5100160answered 3 years ago0@REDACTEDUSERWe are using system pretty much same as you have described, except that we are generating JSON token, and every call throught API Gateway is authorized, and if token expires, new token is generated and returned in same callback back to the user, so it can be stored locally.And for point 3. client is requesting throught API that he want's to play, you can pass anything that you need to have for matchmaking (rank, game mode, selected character), than in callback you will include matchmaking ticket ID, and later you can every 10second check ticket status (also from client side), so player can have information about game session, and when ticket status is COMPLETED you will have connection informations on client (ip address and port) and you can open level from unreal with that informations.-Tahir S.CommentSharerePost-User-0847331answered 3 years ago"


Question: About deploying EFS on ECS Fargate

"Hello Guys,I have deployed EFS on 3 different task. one of them deployed successfully and I can Upload subjects in EFS and I can test it. but when I try to upload an object in the other Containers unfortunately It couldn't upload. all of the SG and ports which should I configure in Container and EFS side are correct.can you help me please?FollowComment"

Answer: "0Hello! Some more information on what kind of error you're getting would help narrow this down. If you're certain security groups are correct (which is where I mess up a lot), the next thing you should look at are permissions.Here's a helpful blog post that dives deeper into the subject.https://aws.amazon.com/blogs/containers/developers-guide-to-using-amazon-efs-with-amazon-ecs-and-aws-fargate-part-2/CommentShareRay Kanswered 7 months agoemirvsh 7 months agoHello! thanks for your reply, actually I have done all of the materials mentioned in this link. Still, about Policy, when I want to save a Policy to the FS, it gives me an Invalid Policy Error. I have searched for this error but couldn't find any resource to resolve it. could you help me with this issue if you face this kind of problem, please?Share0Hello,I solved thıs problem, that was about container path in task definition. when you want to deploy an EFS, we have to write container path in container definition part.BRCommentShareemirvshanswered 7 months ago"


Question: Workspaces RDP connection failure

"I've signed up for the first time to AWS a few days ago. I have no knowledge regarding AWS.I've tried to connect to the Workspaces via the AWS free tier using this article -https://aws.amazon.com/premiumsupport/knowledge-center/connect-workspace-rdp/It seems I've done everything well according to the article 1-7 steps, but I failed to understand how to configure according to the 8th step (the last one).The problem is that I fail to figure out which public IP should I set, and with which user should I sign in with via the RDPIv'e tried to connect to the Workspaces Desktop via different RDP softwares, but all seemed to failWhat should I do? How do I connect successfully via the RDP?FollowComment"

Answer: "0You should connect using the Amazon WorkSpaces Client software, not RDP. The public endpoint for streaming is not for RDP protocol, so that is not a possible way to connect. You can connect via RDP if you create a connection to the VPC (ala VPN) and the private IP.CommentShareEXPERTStevieStetsanswered 9 months ago"


Question: block access to ec2 instance

one of our developer has quit the organization and he has the original pem file that gives access to our ec2 instance. so what steps can we take to avoid any misdoings by him?FollowComment

Answer: "2Here are the steps to replace the key, Add or remove a public key on your instance.You could also restrict SSH via the security group assigned to the instance.You may want to use Sessions Manager to login to the instance which allows you to control access using IAM instead of SSH keys.CommentShareEXPERTkentradanswered a month ago0Check out this document - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replacing-key-pair.htmlCommentShareSydanswered a month ago0Ensure SSH access over the public Internet isnt permitted.If it is, you will need to change the SSH keyOtherwise ensure said developer doesnt have any remote access to the environment.CommentShareGary Mcleananswered a month ago"


Question: Deploy updated container to existing CDK stack

"I have a Fargate service deployed with ecs_patterns.ApplicationLoadBalancedFargateService and I'd like it to roll out a new container that has been pushed to the ECR repo used for this service.I have a pipeline producing the new container for the service but if I run cdk synth and then deploy after, CDK does not detect a change when it generates the CloudFormation changeset as the container tag does not change (latest). I updated it so the build pushes a unique container tag to SecretsManager and resolves this during deploy but this also doesn't work as the reference to the tag isn't picked up during changeset creation (would only pull the tag when deploying).What's the best way to get CDK to deploy a new version of the container? Pass tag in dynamically or should I just go with CodeDeploy?FollowComment"

Answer: "0Accepted AnswerI would find a way to reference the same image tag in your cdk app that you use in your image build/tag/push stage.For example, if you had a docker stage that pushed an image using the environment variable CODEBUILD_RESOLVED_SOURCE_VERSION as the tag like:docker build -t $IMAGE_REPO_NAME:$CODEBUILD_RESOLVED_SOURCE_VERSION .docker push $IMAGE_REPO_NAME:$CODEBUILD_RESOLVED_SOURCE_VERSIONYou could then reference that tag in your CDK app:const tag = process.env.CODEBUILD_RESOLVED_SOURCE_VERSION;const image = ecs.ContainerImage.fromEcrRepository(ecrRepo, tag);new ApplicationLoadBalancedFargateService(this, 'Service', {  taskImageOptions: {    image: image,    ...  },  ...});CommentSharecorymhallanswered 4 years ago"


Question: Delivering my website by cloudfront/S3 and my customers using my service with their domain

"Hello,I have a web-product and each one of my customers have a basic web site which, in some cases, proxy their customer's calls to my services, but they would like to mantain their origin domain.For example:I expose my service frontend by cloudfront with domain test.company.com; my customers expose their website:customer1.comcustomer2.comcustomerN.comDuring the surfing on customerN.com website, the user clicks a button and customerN.com website proxy the call to test.customerN.com (test.customerN.com is a DNS CNAME managed by the customer which calls a cloudfront exposed by my company via test.company.com)How do I manage this case?Thank you in advanceFollowComment"

Answer: 1Set up a separate CloudFront distribution for each customer all pointing to your service as the origin. You can then set each of the separate domains as the Alternate Domain in each distribution. See: Using custom URLs by adding alternate domain names (CNAMEs).CommentShareEXPERTkentradanswered 5 months ago


Question: InvalidIdentityTokenException Using fromWebToken

"I'm trying to get short-term credentials from STS using fromWebToken in Javascript v3 SDK. I'm getting:InvalidIdentityTokenException: The ID Token provided is not a valid JWT. (You may see this error if you sent an Access Token)const getTokenFromIdp = async () =>  {    const token = await auth.tokenManager.get("idToken");    return(token.idToken);  }  var oidcCredentials = fromWebToken({    roleArn: "arn:aws:iam::2222333344445556:role/OIDCroleReadS3",    roleSessionName: "session_111",    durationSeconds: 7200,    webIdentityToken:  getTokenFromIdp()  })const s3client = new S3({    region: "us-east-2",    credentials:  oidcCredentials,  });Here's the decoded JWT:{  "sub": "00u3xs70zpX2OiH1n697",  "name": "Fred Flint",  "email": "fred.flint@atko.email",  "ver": 1,  "iss": "https://cis.demo-connect.us/oauth2/default",  "aud": "0oa49zm0l8U4WHON5697",  "iat": 1679326542,  "exp": 1679330142,  "jti": "ID.jl6Jdp2W9AQn9PgtoUk70JMSakxkXDzFXhxHkqhPG6I",  "amr": [    "swk"  ],  "idp": "00o3xs70qnrVWzeJf697",  "nonce": "PqcXAaUIs6lOLvvddQF6r64eEDBKgrB6veq6B02uP7RjwxatgL4YVlkWtQYpTfEf",  "preferred_username": "fred.flint@atko.email",  "auth_time": 1679326540,  "at_hash": "lBn-EyIp98zRI9FqfAUOlw"}If I copy the encoded token value from console log returned from getTokenFromIdp() and hardcode the webIdentityToken property, the STS accepts the value. The token value is good when I test in jwt.io, so I'm confident that it's a valid identity token. Is there some other property check that could be failing that would give me this error message?  I've seen a separate error message for audience mismatch, so I don't think that's a problem here.BTW, in the example at https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Examples, the WebIdentityToken doesn't look like a JWT.  Thanks!FollowComment"


Question: ioT analytics datastore issue

"Hi, I cannot get data from IoT Analytics Channel to the Analytics datastore.I'm able to get the messages in Channel from IoT Core; kindly help me with this.I suspect pipeline is not excecuting.FollowCommentSidd 8 months agoI think the pipeline is not executing, but not able to find the issue.Share"

Answer: "0Please refer to some troubleshooting steps listed in Troubleshooting AWS IoT Analytics - https://docs.aws.amazon.com/iotanalytics/latest/userguide/troubleshoot.html. May be theseHow do I know if my messages are getting into AWS IoT Analytics?Why is my pipeline losing messages? How do I fix it?Why is there no data in my data store?Also you can check cloudwatch to check if there is an issue with the rule. https://docs.aws.amazon.com/iot/latest/developerguide/diagnosing-rules.html and the message payload syntax https://docs.aws.amazon.com/iotanalytics/latest/userguide/payload-syntax.htmlCommentShareEXPERTAWS-User-Nitinanswered 8 months agoSidd 8 months agoMy messages are coming. I can see it on the channel.I created the pipeline and defined the rule but was still not able to see it.pipeline is not working,hence no dataKindly tell me how to solve the issue.ShareAWS-User-Nitin EXPERT8 months agoPlease follow and cross check all the troubleshooting steps applicable in here https://docs.aws.amazon.com/iotanalytics/latest/userguide/troubleshoot.html . Make sure the region and channel name used in the rule are correct. To ensure your data is reaching the rules engine and the rule is being executed correctly, you might want to add a new target to store incoming messages in the Amazon S3 bucket temporarily. Feel free to show the sample of payload which rules sendsShareSidd 8 months agoI checked but could not figure it out.I have not defined any activities in the pipeline, can that be the reason?Share"


Question: i want to directly move a csv file from my laptop to aws data lake using aws pipeline? is it possible to so ? if yes how?

i want to directly move a csv file from my laptop to aws data lake using aws pipeline?is it possible to so ? if yes how?FollowComment

Answer: "0Greetings!Yes, it is possible to move a CSV file from your laptop to an AWS Data Lake using AWS Data Pipeline. AWS Data Pipeline is a service that helps you process and move data between different AWS storage services, as well as on-premises data sources, at specified intervals.To move a CSV file from your laptop to an AWS Data Lake, follow these steps:Set up AWS CLI and Data Pipeline:Install the AWS Command Line Interface (CLI) on your laptop. Follow the instructions provided by AWS: https://aws.amazon.com/cli/Configure the AWS CLI by running aws configure and entering your AWS access key, secret key, and default region. Learn more about the configuration process here: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.htmlEnsure you have AWS Data Pipeline service enabled in your account.Create an S3 bucket:Create an Amazon S3 bucket, which will be used as a temporary storage location for the CSV file before it's moved to the Data Lake. Use the following command to create a bucket:aws s3api create-bucket --bucket my-bucket-name --region my-regionUpload the CSV file to the S3 bucket:Upload your CSV file from your laptop to the S3 bucket using the following command:aws s3 cp /path/to/your/csv-file.csv s3://my-bucket-name/csv-file.csvSet up the Data Lake:Assuming you're using AWS Glue as your Data Lake, create a database and a table that matches the schema of your CSV file. Follow the AWS Glue documentation to set up your Data Lake: https://docs.aws.amazon.com/glue/latest/dg/console-tables.htmlCreate a Data Pipeline:Sign in to the AWS Management Console and navigate to the Data Pipeline service.Click on "Create new pipeline".Provide a name and description for the pipeline.For the "Source" stage, choose "S3" and provide the path to your CSV file in the S3 bucket (e.g., s3://my-bucket-name/csv-file.csv).For the "Destination" stage, choose "AWS Glue Data Catalog" and provide the database and table name that you created in your Data Lake.You can configure additional options such as error handling, scheduling, etc., based on your requirements.Click "Create Pipeline" to create the pipeline.Activate the pipeline:Once the pipeline is created, you need to activate it to start the data transfer process. Click on the "Activate" button in the pipeline details page.Monitor the pipeline:You can monitor the progress and status of the pipeline on the Data Pipeline console. Once the pipeline is completed, your CSV file will be moved from the S3 bucket to the Data Lake.Please let me know if I answered your questionCommentShareZJonanswered 3 months agorePost-User-1675689 3 months agoThank you for your responsebut when i try to create a new data pipeline in the source i have limited templetes to select from and no option for the destinationThese options i haveAWS Command LineRun AWS CLI commandExport DynamoDB table to S3Import DynamoDB backup data from S3Run job on an Elastic MapReduce clusterFull copy of RDS MySOL table to S3Incremental copy of RDS MysQL table to S3 Load S3 data into RDS MySqL tableFull copy of RDS MySOL table to RedshiftIncremental copy of RDS MySOL table to RedshiftLoad data from S3 into RedshiftShare"


Question: Handling large number of small files on storage gateway

"vmwares frozen after transferring large numbers of small files, less than 100kb. The file transfer resumes after restarting of vmwares. What is the best way to implement the file gateway to handle this?FollowComment"

Answer: "0Hi, I don't have your gateway and complete issue details to make specific recommendations. In general, I would recommend looking into the file gateway metrics when you see the error. If there are any VM resource constraints, I would recommend adding additional hardware resources based on the metrics. Since you are internal AWS, to further deep dive, you could also contact us on storage gateway interest slack channel. Thanks - Surya Pendyala.CommentShareSuryaanswered a year ago"


Question: How to delete group in  Cognito which is using lambda and javascript. It gave me 404 error.

"I am playing with this tutorial, https://aws.amazon.com/ko/blogs/mobile/new-real-time-multi-group-app-with-aws-amplify-graphql-build-a-twitter-community-clone/I wanted to add the delete function for cognito group. But I could not.This is What I did.1.amplify/backend/api/twittercommunity/schema.graphqltype Tweet @model @auth(rules: [{ allow: owner, operations: [create, delete] },{ allow: groups, groupsField: "community", operations: [read] }]) {content: String!community: String!}I add "delete"operations: [read, delete]amplify/backend/function/AdminQueries/src    app.js file:added thisconst {addUserToGroup,removeUserFromGroup,addAndJoinGroup,listGroups,deleteGroup,listGroupsForUser,listUsersInGroup,} = require('./cognitoActions');app.get('/deleteGroup', async (req, res, next) => {if (!req.body.groupname) {const err = new Error('Groupname is required');err.statusCode = 400;return next(err);}try {const username = req.apiGateway.event.requestContext.authorizer.claims.usernameconst response = await deleteGroup(username, req.body.groupname);res.status(200).json(response);} catch (err) {next(err);}});and  in the cogintoActions.jsasync function deleteGroup(username, groupname) {const params = {GroupName: groupname,UserPoolId: userPoolId};console.log('delete group', params)console.log(Attempting to remove ${groupname} from ${userPoolId});cognitoIdentityServiceProvider.deleteGroup(params, function (err, data) {if (err) console.log(err, err.stack);else console.log(data);});module.exports = {addUserToGroup,removeUserFromGroup,addAndJoinGroup,listGroups,listGroupsForUser,listUsersInGroup,deleteGroup};and the amplify/backend/function/AdminQueriesXYZ/AdminQueriesXYZ-cloudformation-template.jsonat the “PolicyDocument” section, added it."cognito-idp:DeleteGroup",and the src/utils.jsexport async function deleteGroup(groupName) {console.log('deleteGroup: ', groupName)await API.post(API_NAME,'/deleteGroup',{body: {groupname: groupName},headers: {'Content-Type': 'application/json',Authorization: ${(await Auth.currentSession()).getAccessToken().getJwtToken()}}});await invalidateRefreshToken();}and the delete button in the GroupPanels.jsOnly group-creator can delete the group, and should enter right name of the groupname to delete.async function handleDeleteGroupClick() {await deleteGroup(window.prompt('Group Name?'))refreshGroups()}<Button          size="small"          variation="link"          onClick={() => handleDeleteGroupClick()}          isDisabled={user.attributes.sub !== owner}>          delete        </Button>However, It gave an 404 error. I do not know how to fix it any more. please help me out.FollowComment"


Question: [kill request] RDS snapshot stuck in creating for months with no options available

"Hi there --If someone could kindly kill cluster-snapshot:database-1-final-snapshot on our account that would be lovely.It was created in April in us-east-1 and as far as I can tell there is absolutely nothing we can do to remove it as all actions are greyed out in the management console and API call:aws rds delete-db-cluster-snapshot  --db-cluster-snapshot-identifier=database-1-final-snapshotreturns:An error occurred (InvalidDBClusterSnapshotStateFault) when calling the DeleteDBClusterSnapshot operation: Cannot delete the snapshot because it is not currently in the available or failed state.Much obliged,DamianFollowComment"

Answer: "0Hello,You need to open a support ticket for this, they'll be able to do this rapidely and analyze why this has happened.RegardsCommentShareAWS-ADolganovanswered 7 months ago"


Question: Sagemaker Inference for Tensorflow Base64 Input Error through API Gateway

"When I am trying to call my Sagemaker TF endpoint using API Gateway -> Lambda Func by passing a Base 64 String (an image) I am getting an unsupported string error. I also tried with application/Json but I am still getting the error. Need Suggestion.In Notebook Instance this is how my input looks:input = {'instances': [{"b64": "iV"}]}In Lambda function I am doing this:instance = [{"b64": "b64string"}]pleasework=json.dumps({"instances": instance})response = runtime.invoke_endpoint(EndpointName=ENDPOINT_NAME_BASE64,ContentType='string',Accept='string' ,Body=pleasework)ERROR:Inference Error:An error occurred (ModelError) when calling the InvokeEndpoint operation: Received client error (415) from primary with message "{"error": "Unsupported Media Type: string"}".Incase if I pass application/json I get this error:Received client error (400) from primary with message "{    "error": "Failed to process element: 0 of 'instances' list. Error: INVALID_ARGUMENT: JSON Value: {\n    "b64": "iV"\n} Type: Object is not of expected type: uint8"}"FollowComment"

Answer: 0I would suggest testing invoking your model locally first and confirming what the input your model is expecting using the saved_model CLI. Kindly see this link: https://www.tensorflow.org/guide/saved_model#the_savedmodel_format_on_diskThen when invoking the model confirm that instance is in the correct input format shape your model expects.CommentShareMarcanswered 10 months ago


Question: Cloud9 Rails console

"Hello,When I run a rails console in Cloud9, it works by the display gets all messed up.  The line that I am typing on jumps to the center of the screen and it doesn't refresh the screen so there is text on top of text making it impossible to use. I tried on different browsers, same issue. Any ideas on how to fix this?ChuckFollowComment"


Question: Ground Truth - Active Learning Status

"I currently have a Ground Truth labeling job in progress for which I enabled the active learning feature. I see the activelearning folder in the output directory within s3, but all that's in there right now is a file called active_learning_info.json. The job is on its 4th batch of images, which at 250 for each batch, means it is at almost 1,000 objects labeled by Mechanical Turk workers at this point. Based on that as well as reading https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-output.html and https://aws.amazon.com/blogs/machine-learning/annotate-data-for-less-with-amazon-sagemaker-ground-truth-and-automated-data-labeling/ , I was expecting to see additional contents within the activelearning folder. Is that not accurate? How do I know if active learning is truly being (at least) attempted within this labeling job?Thank you!Edited by: naquent on May 16, 2019 1:05 PMFollowComment"

Answer: "0Answering my own question: I checked again this morning, and now I see all of the expected folders and files. I guess it just takes a while for it to show up. In this case, the lowest numbered folder in the activelearning folder is 8. My guess is that this is corresponding to the 8th batch, which would mean it took 8 batches of 250 images for it to start attempting active learning. Is that the correct understanding? Either way, I'll mark this thread as answered.CommentSharenaquentanswered 4 years ago0Apologize for the delay in the reply.That is correct. The lowest number of the folder would be when we started to "attempt" active learning. You should see input/output files that might throw some light on to which data objects were tried in those batches. But, this does not necessarily mean that it got auto annotated. The best way to check the objects that got auto annotated is the final output file where it would be marked by a metadata field "human-annotated":"no" after the job is done. Or, you can check the folder "intermediate" where we store the output of each batch.We hope this answers your question. Thank you for being a valued customer.CommentShareAWS-User-2263778answered 4 years ago"


Question: Rote 53 dns records of mail

I want to add dns records for my email which i purchased from third party and updated all the values on 13 april in route 53 but it did not refelct till in their platformFollowComment

Answer: 0Have you verified the TTL?CommentSharevtjeananswered a month ago


Question: Upgrading rds posgresql engine version fom 10.18 to 11.14

"The instance could not be upgraded because there are one or more databases with an older version of PostGIS extension or its dependent extensions (address_standardizer, address_standardizer_data_us, postgis_tiger_geocoder, postgis_topology, postgis_raster) installed. Please upgrade all installations of PostGIS and drop its dependent extensions and try again.I do not have even any postgis extension in use,  I was wondering if the problem is having other database instances?. I first upgraded from 9.x to 10.18 and everything worked fine, But now I do not know what else to try. The other instances remain in 9.x. Thanks in advanceFollowComment"

Answer: "0ok... I did find out how to deal with it...First, you really need to upgrade it in baby steps.This is my writeupPosgreSQL + PostGIS, from version 9.5 to 13.3First you need to go to the latest 9.5.25, this can be easily done using a simple AWS CLI modify command in your DB instance.Now update POSTGIS and any other extensions you have to the newest one, if in doubt, look up the newest version.I made a python script for myself that does update all DBs I have with the extension version I ask.postgis_version='2.2.5'postgis_topology_version='2.2.5'Next step, do change your version to 9.6.22, also change the machine the DB is running to something newer, this will help in the next steps (newer DB versions cannot run in older instances).postgis_version='2.5.2'postgis_topology_version='2.3.7'Now you may upgrade to version 10.17.postgis_topology_version='2.5.2'Once upgrade to version 10.17 is done, you may upgrade to 11.12... I think you can upgrade to 11.12 directly, without the 10.17 stop, but I was in no rush (and it was quick anyway).At version 11.12, you may now upgrade POSTGIS and any others.postgis_version='2.5.2next'postgis_topology_version='2.5.2next'Now you may upgrade to version 11.13, this will enable you to install version POSTGIS at version 3.1.4, allowing you to go up to postgres 13.3postgis_version='3.1.4'postgis_topology_version='3.1.4'And you are done. I hope this helps you.Also, if you have multiple databases in your instance, make sure all of them have the latest extensions before upgrading, and always run  SELECT * from pg_available_extension_versions where name='postgis'; to find which are the latest versions of the extensions before updating.CommentShareLucasCoppioanswered a year ago"


Question: Aws backup for documentdb

"Hi,I would like to know why on the aws backup panel there is no option to back up documentdb?Thanks!FollowComment"

Answer: "0Hi,Unfortunately, currently AWS Backup does not support backup solution for DocumentDB service. Currently, you can use AWS Backup solution for services: Aurora, DynamoDB, EC2, EBS, FSx, RDS, EFS and Storage Gateway.[+] https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#supported-resourcesPlease be informed, there is already an existing feature request for the DocumentDB support under AWS Backup service. However, we typically do not have ETA for feature requests, so I can't supply a time-frame for this. Hence, I would suggest keeping an eye out on following public announcement URLs which will be updated as soon as any AWS service feature is released.https://aws.amazon.com/new/https://aws.amazon.com/blogs/aws/Regards,PavithraCommentSharePavithra-AWSanswered 2 years ago"


Question: S3 Select doesn't delimite records when file is JSONL and GZIP

"HeyI am trying to use S3 Select on a gzipped file, containing JSONL records.My file is like this:{"foo": 1, "bar": True...}{"foo": 1, "bar": True...}{"foo": 1, "bar": True...}...I am using the following python code:stream = s3_client.select_object_content(            Bucket=bucket_name,            Key=object_key,            ExpressionType="SQL",            Expression="SELECT * FROM s3object s",            InputSerialization={"JSON": {"Type": "LINES"}, "CompressionType": "GZIP"},            OutputSerialization={"JSON": {"RecordDelimiter": "\n"}},            RequestProgress={"Enabled": False},        )        for record in stream["Payload"]:            ...My problem is that record is not a single JSONL, it is 65K bytes from the file.I am able to query line-by-line when the file is not gzipped.FollowComment"

Answer: "0Given the limitations of S3 Select, I would suggest that you use Athena/Glue to CREATE TABLE - This can be done using boto3 Glue methods if the schema is know or using a crawler as shown below.import boto3# Create an AWS Glue clientglue_client = boto3.client('glue')# Define the crawler settingscrawler_name = 'my-crawler's3_target_path = 's3://my-bucket/my-folder/'database_name = 'my-database'table_prefix = 'my-table-prefix'# Create the databaseglue_client.create_database(    DatabaseInput={        'Name': database_name    })# Create the crawlerglue_client.create_crawler(    Name=crawler_name,    Role='arn:aws:iam::123456789012:role/service-role/AWSGlueServiceRoleDefault',    DatabaseName=database_name,    Targets={        'S3Targets': [            {                'Path': s3_target_path            }        ]    },    SchemaChangePolicy={        'UpdateBehavior': 'UPDATE_IN_DATABASE',        'DeleteBehavior': 'LOG'    },    TablePrefix=table_prefix)# Start the crawlerglue_client.start_crawler(Name=crawler_name)CommentShareAnanth Tirumanuranswered 3 months ago"


Question: [QuickSight] Cannot add users to a group

"Hi everyone,I've added some users throught both IAM and email to quicksight, and I have created a group.But I cannot add users to my group :I go to Manage Group (in the right region)I select the group, and write their name / email address in the "Add user" fieldIt searches, and ends up finding no userDo you have any idea why this is occurring ?Thanks in advance, AllanFollowComment"

Answer: "0Accepted AnswerMaybe try to list users from cli to check the current users belonging to this AWS Account?aws quicksight list-users --aws-region REGION --identity-type IAM --aws-account-id 11111111-1111-1111-1111-111111111111CommentShareLuke Doroszanswered a month agorePost-User-4431537 19 days agoThanks for your answer Luke !I couldn't get it to work, we decided to postpone this project, and ask for extra support from someone more familiar with AWS.Have a nice dayShare"


Question: Amazon Connect + Salesforce integration -

"The call recording won't play from the contact lens player. I'm seeing a bunch of 400 errors in the console when the page loads. The player and transcripts load, but the actual audio isn't accessible. Could you help me get that working?it works as expected when viewing the record in Amazon Connect directly. This a CTI adapter integrationError seen in Lambda -[ERROR] KeyError: 'CloudFrontPrivateKey'Traceback (most recent call last):  File "/var/task/sfGenerateAudioRecordingStreamingURL.py", line 55, in lambda_handler    private_key = secrets['CloudFrontPrivateKey']FollowComment"

Answer: "0Hi, I've seen this happen previously when the Salesforce Lambda Lambda package hasn't been installed and fully configured.  the CTI Adapter relies on the Lambda package being installed and configured to enable you to play recordings.  Have you gone through that portion of the deployment yet?  https://amazon-connect.github.io/amazon-connect-salesforce-cti/docs/lightning/installation/04-salesforce-lambdas-manual-setupCommentShareAWS-User-9371299answered 6 months ago"


Question: Private API Gateway URL is not accessible

"I'm doing some PoC stuff around API Gateway, and I can't access the URL that API Gateway gives me after deploying the endpoint.  I have a VPC endpoint set up with Private DNS turned on.  I can access the API Gateway if I use one of the VPCE DNS names and set the Host header to the hostname of the provided API Gateway URL.  But if I log into an instance in the same subnet and try to curl the URL that API Gateway gives me, I just get this:$ curl -ivk https://{apiId}.execute-api.us-east-1.amazonaws.com/test  * About to connect() to {apiId}.execute-api.us-east-1.amazonaws.com port 443 (#0)  *   Trying {ip}... connected  * Connected to {apiId}.execute-api.us-east-1.amazonaws.com ({ip}) port 443 (#0)  * Initializing NSS with certpath: sql:/etc/pki/nssdb  * warning: ignoring value of ssl.verifyhost  * NSS error -5961  * Closing connection #0  * SSL connect error  curl: (35) SSL connect error  What am I missing?FollowComment"

Answer: 0I discovered that the version of CentOS on the instance I was connecting with had an older version of curl which didn't handle the SSL transaction correctly.  Launching a new instance with the Amazon Linux AMI resulted in a successful HTTP transaction.CommentSharedoomchildanswered 4 years ago


Question: Shared AMI based on Debian 10 AMI shows as a Debian 9 Instance

"The original EC2 instance has the following "AMI location":aws-marketplace/debian-10-amd64-20220328-962-b737a64d-81d4-4b8c-92c0-25161dfcb706An AMI was created from this EC2 instance.After sharing with another account the shared AMI will not launch because its Marketplace ID is seen as a Debian 9 AMI (nor supported).How is this possible? Is there a known fix or workaround?Thanks,MarkFollowComment"


Question: Are Graviton instance types not supported for SageMaker multimodel endpoints?

"I am trying to create a multimodel endpoint using an ml.c7g.xlarge instance type. The error I get is: “MultiModel mode is not supported for instance type ml.c7g.xlarge.” However, according to the documentation on AWS, “Multi-model endpoints are currently supported for all CPU instances types and on single-GPU instance types.” (https://docs.aws.amazon.com/sagemaker/latest/dg/multi-model-endpoints.html#multi-model-endpoint-instance). Subsequently, I tried ml.c6g.xlarge and see that that also is not supported. Are Graviton instance types not supported in general? If so, why?FollowComment"

Answer: "0Hi,Unfortunately, Graviton based instances are not supported for multi-model endpoints in Amazon SageMaker.Multi-model endpoints currently support all the CPU instance types and on single-GPU instance types.-> Please find the below list of Compute optimized instance types (no GPUs):ml.c5.largeml.c5.xlargeml.c5.2xlargeml.c5.4xlargeml.c5.9xlargeml.c5.12xlargeml.c5.18xlargeml.c5.24xlarge-> Supported instances for multi-model endpoints using GPU backed instances:[+] https://docs.aws.amazon.com/sagemaker/latest/dg/multi-model-endpoints.html#multi-model-support-gpuCommentShareSUPPORT ENGINEERVenkata_Manswered 2 months agorePost-User-9949271 2 months agoThanks. However, the documentation says all CPU types. Are Graviton instance types not CPU instance types? Is the documentation wrong? Can you give context on why Graviton instance types are not enabled? Is this a feature that may become available in the future?Share"


Question: Ec2 Instance terminated on launch

"Hello,Im having an issue in eu-central-1 region.   Im creating a small instance of t2.small from ami I had taken couple of month back.After creating the instance its terminated automatically, event trough termination protection is enabled.After the instance launched: aws ec2 describe-instances --instance-id i-05b16bd4d5f252c81      "StateReason": {                 "Message": "Server.InternalError: Internal error on launch",                 "Code": "Server.InternalError"                    },                    "State": {                        "Code": 48,                        "Name": "terminated"                    }FollowComment"

Answer: "0Issue resolved, I was attaching eni with 5 private ip's.there is a limit for number of ip's the instance can have.CommentSharealexmmacanswered 4 years ago"


Question: What is a Personalize "context-aware solution" ?

"This blog post about "contextual recommendations" says this feature requires a "context aware solution  with a User Personalization or Personalized Ranking recipe".  In the blog, hrnn-metadata is not listed as a compatible recipe yet it is used it in the demo afterwards.What is a context aware solution? Which Personalize recipe can learn from interaction context?FollowComment"

Answer: "0Accepted AnswerContext - is metadata in an interaction dataset (up to five metadata fields).You could use any metadata based recipe (HRNN-metadata(legacy), HRNN-cold(legacy), Personalized-Ranking, User-Personalisation).Context aware solution is when you could pass context (device, location) as an attribute when you ask for a recommendation and Personalize will provide recommendation with attention to a context (For example, Amazon Personalize can provide different recommendations when a user is browsing on a mobile device than when that same user is browsing on a desktop.)https://docs.aws.amazon.com/personalize/latest/dg/how-it-works-dataset-schema.htmlCommentShareAleksandr_Panswered 3 years ago"


Question: AWS S3 Replication With Lifecycle Policy - Cross Account

"I have a script that copies over object and their metadata from bucket A to bucket B which existst in another account. Once the objects are copied over from bukcet A, they are not needed anymore. So I want to add a lifecycle policy to only bucket A that will delete the objects after 2 days. Since am copying object and their metadata from bucket A, does this means the lifecycle policy applies to bucket B eventhough there is no lifecycle configuration for it? When copied over, do the objects in bucket B still expire after the 2 days?Edited by: Asuman on Jan 23, 2020 5:52 AMFollowComment"

Answer: "0https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-what-is-isnot-replicated.htmlAWS states that there are stuff like the object metadata, Unencrypted objects, Object tags, if there are any are replicated during the replication process. It also states bucket/object configuration like the lifecycle policy are not replicated across account. That answered my quaestio :)CommentShareAsumananswered 3 years ago0https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-what-is-isnot-replicated.htmlAWS states that there are stuff like the object metadata, Unencrypted objects, Object tags, if there are any are replicated during the replication process. It also states bucket/object configuration like the lifecycle policy are not replicated across account. That answered my quaestio :)CommentShareAsumananswered 3 years ago"


Question: How do I move an Entity Framework or EF Core app with Babelfish?

What are the steps to migrate .NET Entity Framework apps to PostgreSQL with Babelfish?FollowComment

Answer: "0Hi, @lightYour question is very interesting!I have previously enabled Babelfish.https://dev.classmethod.jp/articles/babelfish-for-aurora-postgresql-ga/I think you can use the same procedure to create an Aurora PostgreSQL with Babelfish enabled and specify the Aurora host in connectionStrings.Entity Framework should issue standard SQL queries to Aurora (TDS), so I think it works unless you have a special query syntax.CommentShareEXPERTiwasaanswered a year ago"


Question: RDS MySQL engine version 5.7.36 deprecated/missing

"I have an RDS instance using MySQL engine version 5.7.36. RDS recommends updating to a newer minor 5.7 engine version, but no versions are available to choose when modifying the instance. describe-db-engine-versions doesn't list 5.7.36, but does list 5.7.34 and 5.7.37, and newer versions after that. Snapshots taken from the instance cannot be restored, because creating a new instance using the version the snapshots specify is not allowed.5.7.36 is still documented on https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Concepts.VersionMgmt.html as supported until April 2023. As far as I can see there are no notifications that it's deprecated.There was a Health notification in January of impending end of support but no indication of this behavior:Starting March 20, 2023 00:00:01 AM UTC, you will not be able to create new RDS instances with MySQL minor versions 8.0.27, 8.0.26, 8.0.25, 8.0.23, 5.7.36, 5.7.34 and 5.7.33 from either the AWS Console or the CLI. We recommend you to upgrade your databases before April 20, 2023. RDS will upgrade your MySQL databases running minor versions 8.0.27, 8.0.26, 8.0.25, 8.0.23, 5.7.36, 5.7.34 and 5.7.33 as well as any instances restored from the snapshots of these versions to the latest minor version during a scheduled maintenance window between April 20, 2023 00:00:01 UTC and May 20, 2023 00:00:01 UTC. On May 20, 2023 00:00:01 AM UTC, any MySQL databases running minor versions 8.0.27, 8.0.26, 8.0.25, 8.0.23, 5.7.36, 5.7.34 and 5.7.33 that remain will be automatically upgraded to the latest minor version by RDS regardless of instances’ scheduled maintenance window.So, upgrades should be available until April 20, and even today new instances should still be able to be created with these versions. Every other version listed in the notification is still currently available, except 5.7.36.To me this indicates an error or mistake on the part of AWS. What are my options here?FollowComment"

Answer: "1It is not clear what the issue is that is preventing you from upgrading. But you should be able to use the AWS Cli to request the upgrade. I am showing here that there are several versions available for you to upgrade your instance to.  hth.aws rds describe-db-engine-versions --engine mysql --include-all --filters Name=status,Values=deprecated --engine-version 5.7.36 --query "DBEngineVersions[*].ValidUpgradeTarget[*].{EngineVersion:EngineVersion}" --output text5.7.375.7.385.7.395.7.405.7.418.0.238.0.278.0.288.0.32CommentShareMODERATORphilawsanswered 3 months agojflatnes 3 months agoThanks, yes, the API does still allow the upgrade. But there doesn't seem to be any reason why the web console shouldn't list those upgrade options, which seems to be the case across multiple instances that use 5.7.36. Is it simply that the console doesn't list any upgrade options if what you're on currently is deprecated? That doesn't seem like it would be right.Share0I agree. We are looking into it. thanks,CommentShareMODERATORphilawsanswered 3 months ago"


Question: cname for Elasticache Global Datastore primary cluster?

"Is there a way to have a cname that points to the primary cluster of Elasticache Global Datastore?The cname should stay the same and will always point to the primary cluster, even if it is changed to a different region.Thanks.FollowComment"

Answer: "3Yes, it is possible to have a CNAME that points to the primary cluster of an Elasticache Global Datastore. You can create a CNAME record in your DNS settings that points to the endpoint of the primary cluster.However, if you want the CNAME to always point to the primary cluster, even if it is changed to a different region, you will need to update the CNAME record each time the primary cluster is changed. This can be done manually or through an automated process.Alternatively, you can use a service like Amazon Route 53 to create a DNS failover configuration that automatically redirects traffic to the primary cluster, even if it is changed to a different region. With Route 53, you can create a failover record set that includes the primary cluster endpoint and any standby endpoints. Route 53 will monitor the health of the primary cluster and automatically update the DNS records to point to a standby endpoint if the primary cluster becomes unavailable. When the primary cluster is restored, Route 53 will update the DNS records to point back to the primary cluster.CommentShareGovind Kumaranswered a month ago"


Question: Can datasync use s3 multi-region access point as its 'source location'

I have a producer-account-A that requires to make exact same data available in s3 buckets in 2 regions eu-west-1 and eu-central-1. I'm planning to use S3 Multi-region access point in producer-account-A to help me do replication centrally.The consumer account B is using eu-west-1 as its primary region and would like to use datasync to consume data from producer-account-A's s3-multi-region-access-point.Does datasync in consumer-account-B support s3 multi-region-access-point as its 'source location' ?FollowComment

Answer: "0Hello,When a DataSync agent is activated over a public endpoint, the DataSync service will communicate directly with the created S3 source and destination locations.  When an agent is activated via a private endpoint, the service will transfer data over network interfaces created in your VPC.https://docs.aws.amazon.com/datasync/latest/userguide/datasync-network.html#required-network-interfacesThe DataSync documentation provides a tutorial on configuring a cross account and cross region Amazon S3 to Amazon S3 data transfer.https://docs.aws.amazon.com/datasync/latest/userguide/tutorial_s3-s3-cross-account-transfer.htmlCommentShareDarryl_Dioanswered 5 days ago"


Question: X-Pack alternative

"A customer is currently using Elastic Cloud for their ES. They're looking to move to AWS ES, but since we don't support X-Pack, they're asking how they can secure the Kibana instance that's included in the domain.FollowComment"

Answer: 0Accepted AnswerThe most common approach is to introduce a Proxy EC2 instance in front of Amazon ES and Kibana as described in the 2nd part of the following blog post:https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/You can then implement whatever form of authentication/authorization you want on e.g. NGINX.An alternative would be to use API Gateway and AWS Lambda for a server-less approach.CommentShareAWS-User-7011152answered 6 years ago


Question: Performance : How does AWS Nitro System provide better performance for SAP workloads?

Performance : How does AWS Nitro System provide better performance for SAP workloads?NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.FollowComment

Answer: "1The Nitro system enables EC2 High Memory instances to operate as fully integrated EC2 instances, while presenting them as bare-metal servers. All the CPU and memory on the host are directly available for your SAP workloads without a hypervisor, allowing for maximum performance. With virtualization overheads removed, near-bare metal performance is achieved. Due to this, about ~5-15% more HANA working memory is available, improving overall performance of the SAP System.NOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.CommentShareDeep_Kanswered a year ago"


Question: Adding SSL to Lightsail Plesk Instance website?

"In Lightsail I create a Linux/Unix + Plesk Hosting Stack on Ubuntu Instance. The domain name I used (domain.com) is registered with eNom.I added the Nameservers that point to the instance at eNom.I created the StaticIP for the InstanceI created a site using Plesk (domain.com)I can't get the SSL to work for the webmail or mail. It does work for just the (domain.com) not the www. and I can't use a Wildcard either.I added the subdomains to the Lightsail DNS to see if that would work, it doesn't.What else can I try?FollowComment"

Answer: 0Have you followed the steps in Pointing your domains to your Amazon Lightsail distributions https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-point-domain-to-distributionYou need to add an alias record for your domainCommentShareleftbrainstuffanswered a month ago0I did finally find that alternative and it works better than the Nameserver solution suggested.I also discovered that there is no need to attach a domain to an instance if you are using Plesk. I believe anyway.Thanks for the response.CommentShareFlyingPenguinanswered a month ago


Question: How to source route Availability Zone to closest Direct Connect location?

"I have 1 VPC with 3 subnets, 1 for each Availability Zone A,B,C.I have 2 Private VIF terminated on the VGW.Each VIF uses a different Direct Connect location.The network latency from hosts in Availability Zone A is best to Direct Connect location 1.The network latency from hosts in Availability Zones B and C is best to Direct Connect location 2.How can I configure routing so that:1.) Hosts in Availability Zone A prefer the VIF using Direct Connect location 1 and use Direct Connect location 2 as backup.2.) Hosts in Availability Zone B and C prefer the VIF using Direct Connect location 2 and use Direct Connect location 1 as backup.FollowComment"

Answer: "0Set "AS_PATH prepending" as described in the following document.https://docs.aws.amazon.com/directconnect/latest/UserGuide/private-transit-vif-example.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-3360667 2 months agoSorry this answer is incorrect. This would result in traffic from all 3 Availability Zones using the same VIF. My question explains the Availability Zone A subnet should use VIF 1 and Availability Zone B, C subnets use VIF 2.ShareRiku_Kobayashi EXPERT2 months agoIn the active/active case, "AS_PATH prepending" must be the same value so that load balancing occurs.So I found it difficult to route to a specified VIF for a specific subnet only.Share0It is not possible to do on-premises style PBR (policy based routing) like that with VGW.How did you conclude the below?The network latency from hosts in Availability Zone A is best to Direct Connect location 1. The network latency from hosts in Availability Zones B and C is best to Direct Connect location 2.CommentShareEXPERTTushar_Janswered 2 months agorePost-User-3360667 2 months agoThank you for your comment. A simple traceroute shows hop times.Share"


Question: Connecting a Domain Name to Lightsail Instance

"Hello all!Our domain, xxxxx.org, is registered with Network Solutions. From there, our domain is pointed to our network for Active Directory purposes. We have subdomains; vpn.xxxxx.org is pointed to an IP Address for Meraki ClientVPN access, employees.xxxxx.org is pointed to an IP Address for our Employee Portal, webapps.xxxxx.org is pointed to an IP Address for a web applications we have running in our DMZ.I would like to point websites.xxxxx.org to my LightSail Instance. My assumption would be to point websites.xxxxx.org to my instance's Public IP Address (3.17.xxx.xxx). This was done yesterday via an A Record around 1pm EST.I also created a Global DNS Zone (on the LightSail Instance). The zone was created with the xxxxx.org domain. Within the zone, I added an A Record for subdomain websites.xxxxx.org and pointed it to the Public IP Address (stated as xxxxxweb_01_staticIP within the system).When I go to websites.xxxxx.org, nothing pops up. I'm taking to a "Site Can't Be Reached" page (DNS_PROBE_FINISHED_NXDOMAIN).What am I missing or where did I go wrong?Any help would be appreciated!Thanks,-CEdited by: ClaytonDaniels on Aug 10, 2021 12:03 PMEdited by: ClaytonDaniels on Aug 10, 2021 12:03 PMFollowComment"

Answer: 0Disregard... I forgot to update MY OWN DNS server to point websites.xxxxx.org to the Instance IP.CommentShareClaytonDanielsanswered 2 years ago


Question: AWS Greengrass - Boto3 credentials

"Hi there,I am not sure if my problem is related to either an AWS Greengrass or an AWS IoT Core, so forgive me before hand in any case.To summarize what is happening, I am using the boto3 framework within a AWS Greengrass native component, since I need to send some files to a bucket S3 in determined conditions... but it only works if I include the keys directly in code as it is shown below:s3 = boto3.client(service_name='s3', region_name='eu-west-1',aws_access_key_id="XXXXXXXXXXXXXXXXXXXX",aws_secret_access_key="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")If not, the component breaks in the middle of the boto3 upload operation. The AWS Greengrass part is working perfectly, since I am able to see data in the MQTT tester, but the other part does not work if I am not including that "work around".That is something I do not like at all, because is extremely insecure. So, is there another way to do this? Do I have to link the boto3 with the device AWS Greengrass credentials in some way? Is there any guide you have I can follow?Thanks beforehand, any help would be appreciatted.Looking forward to hearing from you.Kind regards.Daniel.FollowComment"

Answer: "1Hi Daniel,Have you included a dependency on aws.greengrass.TokenExchangeService in your component recipe? You must do this in order to use credentials. See this documentation about it: https://docs.aws.amazon.com/greengrass/v2/developerguide/interact-with-aws-services.htmlCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years agoSudhakarReddy-AWS a year agoAfter adding the below dependency to recipe file, it worked for me and I was able to put objects in S3."ComponentDependencies": {"aws.greengrass.TokenExchangeService": {"VersionRequirement": "^2.0.0","DependencyType": "HARD"}Thanks,SudhakarShare0Hi Michael,Thank you very much for replying, and to do so quickly!!Yes, I read the link you have shared some days ago, and I included those lines already, but sadly, it did not worked. I am attaching both the recipe and the service role permissions so as you might be able to see if I am doing something wrong (perhaps not including in the second json the line "iot:DescribeCertificate"?).Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi Daniel,Please provide the Greengrass log file and the log file from your component to further debug the issue.Thanks,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Thank you very much again for answering so fast!! You may find attached both greengrass and component logs, and also the code I am using as artifact. It has been reduced only for the s3 bucket procedure in order to be easily read.Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi Daniel,The logs that you attached show that TokenExchangeService did fetch credentials properly with an expiration of 1 hour. Your component would have requested and received those credentials. I do not see any sort of error in your component's log file, so I'm not sure what error you are referring to.Please also provide the recipe for your component.Thank you,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Thank you very much for answering!! I would like to apologize, since due to the "try and except" sentences, the previous code attached will execute in "a right way", so I am updating all files again with the new test avoiding those parts.Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi,The policy you attached shows permissions for s3-dani bucket and NOT s3-naturgy which is the bucket that your code is using; this would explain why you're getting an AccessDenied error.Please fix the policy or change the S3 bucket that you're uploading to and it should work.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Do not worry, I fixed the s3 bucket names some days ago, you are watching that because I just uploaded an old file. The test has been made with both buckets pointing to the same place (s3-naturgy). Take a look to the logs, and tell me if you see something that I am missing.Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0You have not provided any new logs. From the logs you provided the very clear problem is that you do not have the proper permissions. Ensure that you do not have any AWS credentials on the device from any other source, such as /home/pi/.aws/credentials.Verify that you are updating the proper IAM role by following the IoT Role Alias that your device is using to the IAM console and verifying the permissions in that IAM role.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Thank you for answering again!First of all: Yes, the logs are related to my post from "Sep 3, 2021 3:00 AM".Secondly, regarding to what you say:Ensure that you do not have any AWS credentials on the device from any other source, such as /home/pi/.aws/credentials.I found a file in that route, where I can see my credentials:pi@raspberrypi:~ $ cat /home/pi/.aws/credentials[default]aws_access_key_id = XXXXXXXXXXXXXXXXXXXXaws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXShould I erase it?Verify that you are updating the proper IAM role by following the IoT Role Alias that your device is using to the IAM console and verifying the permissions in that IAM role.That is a bit messy, could you explain it better / is there any tutorial I might follow? If that is something related to the policy, you can check the one attached to the account.More clues that could help:If I execute the following lines in a python3 console, it works:pi@raspberrypi:~/Pictures $ python3Python 3.7.3 (default, Jan 22 2021, 20:04:44)[GCC 8.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import boto3AWS libcrypto resolve: searching process and loaded modulesAWS libcrypto resolve: found static aws-lc HMAC symbolsAWS libcrypto resolve: found static aws-lc libcrypto 1.1.1 EVP_MD symbols>>> src_dir = '/home/pi/Pictures/Humidity.jpg'>>> s3 = boto3.client(service_name='s3')>>> s3.upload_file(src_dir, "s3-naturgy", 'pictures/Humidity.jpg')>>>S3Humidity.jpgjpg6 Sep 2021 11:42:43 AM CEST277.6 KB EstándarThanks beforehand, looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi again Michael,I was writing that it worked, but it was not, so this reply can be ignored since I did not know how to erase it - Take the previous one into consideration, not this.Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi,Yes you should remove the AWS credentials file as the AWS SDK will read the credentials from there instead of getting them from Greengrass. Completely remove /home/pi/.aws/credentials.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi again Michael,It is still not working :(. I am attaching again both all results and files from the latest test.Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0What is the name of the IAM role which you are modifying to provide S3:PutObject permissions?I think you must be changing the wrong role since you still have an AccessDenied error.The default name if you used our automatic provisioning would be GreengrassV2TokenExchangeRole. So if you are not changing the role with that exact name, you are likely changing the wrong role.CommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,MichaelDombrowski-AWS wrote:What is the name of the IAM role which you are modifying to provide S3:PutObject permissions?I think you must be changing the wrong role since you still have an AccessDenied error.Forgive me beforehand if I am wrong, but I do not believe it could be something related to permissions, and I will try to explain it further below:1- The policy was attached in a previous post, and as you can see, the "S3:PutObject" permission has been included.2- If I open a python3 console, I can send the picture without writing the credentials by executing the commands bellow:pi@raspberrypi:~ $ python3Python 3.7.3 (default, Jan 22 2021, 20:04:44)[GCC 8.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import boto3AWS libcrypto resolve: searching process and loaded modulesAWS libcrypto resolve: found static aws-lc HMAC symbolsAWS libcrypto resolve: found static aws-lc libcrypto 1.1.1 EVP_MD symbols>>> src_dir = '/home/pi/Pictures/Humidity.jpg'>>> s3 = boto3.client(service_name='s3')>>> s3.upload_file(src_dir, "s3-naturgy", 'pictures/Humidity.jpg')*Note: This works ONLY if the .aws folder is been created with the user's credentials - we have talked about deleting this previously.It is important to point If that folder does not exist, the output shown is different:pi@raspberrypi:~ $ python3Python 3.7.3 (default, Jan 22 2021, 20:04:44)[GCC 8.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import boto3AWS libcrypto resolve: searching process and loaded modulesAWS libcrypto resolve: found static aws-lc HMAC symbolsAWS libcrypto resolve: found static aws-lc libcrypto 1.1.1 EVP_MD symbols>>> src_dir = '/home/pi/Pictures/Humidity.jpg'>>> s3 = boto3.client(service_name='s3')>>> s3.upload_file(src_dir, "s3-naturgy", 'pictures/Humidity.jpg')Traceback (most recent call last):File "<stdin>", line 1, in <module>File "/home/pi/.local/lib/python3.7/site-packages/boto3/s3/inject.py", line 131, in upload_fileextra_args=ExtraArgs, callback=Callback)File "/home/pi/.local/lib/python3.7/site-packages/boto3/s3/transfer.py", line 279, in upload_filefuture.result()File "/usr/local/lib/python3.7/dist-packages/s3transfer/futures.py", line 106, in result_return self.coordinator.result()File "/usr/local/lib/python3.7/dist-packages/s3transfer/futures.py", line 265, in result_raise self.exceptionFile "/usr/local/lib/python3.7/dist-packages/s3transfer/tasks.py", line 126, in call_return self.execute_main(kwargs)_File "/usr/local/lib/python3.7/dist-packages/s3transfer/tasks.py", line 150, in execute_main_return_value = self.main(**kwargs)_File "/usr/local/lib/python3.7/dist-packages/s3transfer/upload.py", line 694, in mainclient.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)_File "/home/pi/.local/lib/python3.7/site-packages/botocore/client.py", line 386, in api_call_return self.make_api_call(operation_name, kwargs)_File "/home/pi/.local/lib/python3.7/site-packages/botocore/client.py", line 692, in make_api_calloperation_model, request_dict, request_context)_File "/home/pi/.local/lib/python3.7/site-packages/botocore/client.py", line 711, in make_request_return self.endpoint.make_request(operation_model, request_dict)File "/home/pi/.local/lib/python3.7/site-packages/botocore/endpoint.py", line 102, in make_request_return self.send_request(request_dict, operation_model)_File "/home/pi/.local/lib/python3.7/site-packages/botocore/endpoint.py", line 132, in send_requestrequest = self.create_request(request_dict, operation_model)File "/home/pi/.local/lib/python3.7/site-packages/botocore/endpoint.py", line 116, in create_requestoperation_name=operation_model.name)File "/home/pi/.local/lib/python3.7/site-packages/botocore/hooks.py", line 356, in emit_return self.emitter.emit(aliased_event_name, **kwargs)File "/home/pi/.local/lib/python3.7/site-packages/botocore/hooks.py", line 228, in emit_return self.emit(event_name, kwargs)_File "/home/pi/.local/lib/python3.7/site-packages/botocore/hooks.py", line 211, in emitresponse = handler(**kwargs)File "/home/pi/.local/lib/python3.7/site-packages/botocore/signers.py", line 90, in handlerreturn self.sign(operation_name, request)File "/home/pi/.local/lib/python3.7/site-packages/botocore/signers.py", line 162, in signauth.add_auth(request)File "/home/pi/.local/lib/python3.7/site-packages/botocore/crt/auth.py", line 32, in add_authraise NoCredentialsError()botocore.exceptions.NoCredentialsError: Unable to locate credentialsSo, if I am able to send once without writing my credentials, independently of the method (in this case, using the python console), the IAM permissions should not be the problem, but I insist, I am not sure.Thanks beforehand for answering and for your patience. Looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0Hi,AccessDenied can really only be attributed to lacking the proper permissions. I understand that you say the role has S3:PutObject, which is why I asked you for the role name.Please provide me with the role name which you are editing and which you shared the policy with me.You should not have any AWS credentials on the device stored in .aws. When running from Greengrass, Greengrass provides your component credentials through the ECS Credentials Provider. Therefore, it is expected that your application should fail if you do not run it inside of Greengrass (when you manually use the command line). If you include credentials in the .aws directory, your application may use those credentials instead of the ones provided by Greengrass since the ECS provider is one of the last things that boto3 tries to use.MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,My user is named as "naturgy", and it does not have a role itself, it has an embedded policy (know in AWS as "inline policy") named "naturgy_policy", which only affects to my user. And within it, all lines shared before in the "policy" file can be found.I do not know if that is what you wanted, let me know otherwise.Thanks beforehand, looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago0So the reason why it isn't working is because you have not given Greengrass the required policy. I assume that you used the Greengrass automatic setup, therefore the IAM role is called GreengrassV2TokenExchangeRole. You need to edit the role GreengrassV2TokenExchangeRole to give it the required S3:PutObject permissions.Once you do that it will work.MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Bingo!! That was the key, it is working now!!! So, only for me to understand properly and not having an "it works" as a final feedback, we have to give permissions to that role, which will be used by the boto3 for the credentials exchange, and it needs the permissions to fullfil the action, am I right? If that is true, do I really need to include S3:PutObject in the user policy?Looking forward to hearing from you and many thanks for your support and for your patience!!!Kind regardsDaniel.CommentSharedpergarcanswered 2 years ago0I'm very glad that worked.No, your IAM user has nothing to do with anything, so it does not need S3:PutObject. For Greengrass, only the Greengrass role needs the appropriate permisisons.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Hi Michael,Perfect, understood!! Again, thank you very much for your support and your patience.Kind regards.Daniel.CommentSharedpergarcanswered 2 years ago"


Question: AWS WorkSpaces Administrative Templates in Group Policy Management Agent Editor does not contain Classic Administrative Templates folder

"I am trying to allow python to be downloaded into my workspace.I followed the instructions in this workshop: https://catalog.us-east-1.prod.workshops.aws/workshops/ba8389fd-99a1-4010-a95e-d691a2c08311/en-US/workspacesadmin/pcoipadm to add Group Policy to my workspace and then I followed these instructions https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-troubleshooting.html#msi_wont_install to enable installation of python.My "Administrative Templates: Policy definitions (ADMX files) pulled from central store." folder in Group Policy Management Agent Editor does not contain all the folders it should. In my WSP workspace I only see an "Amazon" folder and "All Settings file", in my Administrative Templates folder, missing others and the necessary Classic Administrative Templates folder to complete my task. I repeated the entire tutorial on PCOIP workspace and had a similar issue ("Administrative Templates: Policy definitions (ADMX files) pulled from central store." folder did not contain the Classic Administrative Templates folder).Please advise!FollowComment"


Question: IOT - Collecting industrial machine data - what hardware?

"Starting to use AWS IOT for collecting manufacturing data off of machines on the floor. That data could be productivity (when was the machine on or cycled) or process (what temperature is the over). Of course the kinds of data collected could get out of hand real quick, the potential is endless.My question is about hardware. It is confusing. Let's say I have 50 machines and I want to send a MQTT packet to AWS IOT for each machine each time that machine was cycled. We currently have one machine and I am using a Opto22 Rio to collect a few simple data points and sent a MQTT message to AWS. They run in the $750 each range currently.We started out using Raspberry Pi's for this but they were a bit painful. For us the pain of writing the python, securing the devices, putting the pi in a plastic din rail was not worth the low cost of the equipment.The questions:Is this a reasonable piece of hardware to use for this? Seems a bit overpowered and expensive for no more than what it is doing.Would this be considered a gateway and my sensors/inputs be considered things?In our use case (many machines with a few inputs) what kind of hardware solution would you recommend for collecting the data and sending the MQTT packet to AWS with?FollowComment"

Answer: "1Is this a reasonable piece of hardware to use for this? Seems a bit overpowered and expensive for no more than what it is doing.I think the answer depends a lot on scale; how many of these will you deploy? By your own admission, it saved you a lot of time and effort compared to the Pi. The answer also depends on how robust this needs to be (temperature, dust ingress, water ingress, vibration, shock and so forth); this device might pay for itself if it's more robust than cheaper alternatives.Would this be considered a gateway and my sensors/inputs be considered things?I would say that your inputs/machines have more need to be Things in AWS IoT if you need granularity for security and/or if each machine would be managed individually (configuration, command/control, software updates etc). If all you are doing is ingesting data, there's probably not a strong case to model each machine as an individual Thing.In our use case (many machines with a few inputs) what kind of hardware solution would you recommend for collecting the data and sending the MQTT packet to AWS with?I recommend you search the AWS Partner Device Catalog: https://devices.amazonaws.com/search?page=1 . I note that Opto 22 have a device in the catalog: https://devices.amazonaws.com/detail/a3G0h0000076iDGEAY/groov-EPIC . You will find many possible alternatives. Please also consider to reach out to your nearest AWS office to dive deeper into your requirements.CommentShareEXPERTGreg_Banswered a year agoflycast a year agoThanks Greg. I really appreciate the time and guidance. It can be pretty daunting when first starting.Please also consider to reach out to your nearest AWS office to dive deeper into your requirements.Do I need to have a service contract for this?ShareGreg_B EXPERTa year agoNo contract required.Share"


Question: How To Fail CodeDeploy When Hook Throws StdErr - Windows

"Hi, I have CodeDeploy setup with an appspec file that calls a BeforeInstall.cmd and an AfterInstall.cmd. This is run on a Windows EC2 machine. I am finding that when there are stderr that occur within those hook scripts, the main CodeDeploy does not fail but shows as a success. I have seen people mention that you can somehow check the exit code but am unsure how to do this? Can someone shed some light on this please? Essentially, I would like the deployment to fail if there are any stderrs that occur.thanksFollowComment"


Question: Lambda functions are not displayed

"Hello everyone, everything good?Currently, in my console, my lambda functions are not showing up, an error display panel appears at the top of the screen, but no errors are displayed, and no lambda is displayedThis is an screenshot:FollowComment"

Answer: 1The thing that stands out here is where it says "Last fetched 53 years ago". There are quite a few other questions which ask the same thing; and the general consensus is that there is an issue with the account so please contact the support team to resolve this.CommentShareEXPERTBrettski-AWSanswered 3 months ago


Question: move files between s3 buckets upon complete load

"Hi team,I have an s3 bucket that accepts 20 CSV files through SFTP transfer, I want to move those 20 files to another s3 bucket for treatment only and only if ALL 20 files have been loaded on the first bucket.what is the best option to do that transfer under the condition that all 20 files are completely loaded in the first bucket to trigger the transfer to the second bucket?If I use lambda that listens for s3 PutObject Event, there is no risk of parallel invocation if 20 events are generated at the same time?Thank you.FollowComment"

Answer: "0Accepted AnswerI would use a Lambda function triggered by any create action that had logic like this:get count of objects in bucketif count = 20 then   get create datetime for triggered object   get create datetime of objects in the bucket   loop through datetimes      find the oldest create datetime  if triggered object datetime = oldest datetime     move the files  endendCommentShareEXPERTkentradanswered a year ago0Why do you have to wait at all? Why not move them one at a time? Also, this action is idempotent. If the file was already moved, it can return success.CommentShareRodney Lesteranswered a year ago"


Question: Unable to set Lambda memory over 3008MB

"I have a Lambda with the following configuration:Region: us-east-1 (N. VIrginia)Runtime: nodejs16Inside my accounts service quotas, I can see that my maximum function size is 10240 (10gb).However, attempting to update to anything beyond 3008MB results in the following error:'MemorySize' value failed to satisfy constraint: Member must have value less than or equal to 3008According to this post, N. Virginia is a supported region.I have seen numerous other posts about this issue and I tried contacting AWS technical support but I do not have a support plan and I was told by the account support rep to post so here I am /shrug.Thanks!FollowComment"

Answer: "1Accepted AnswerThat link to a previous post about this covers it pretty thoroughly.  As @Brettski-AWS mentions it's a known account-based issue.Your Basic (free) support doesn't cover technical support but this is an Account issue so you can raise a support case for it.  Please follow the approach another person on that previous post used:I filed a request in the Support Center as: Account & Billing, Service: "Account", Category: "Other Account Issues", Severity: "General Question".CommentShareEXPERTskinsmananswered 15 days agoEXPERTalatechreviewed 15 days agoJoe Siefers 15 days agoI did that but the account rep I got would not help and said I needed to post  - I guess I can try again and hope I get someone willing to help.Shareskinsman EXPERT15 days agoThe trick is to not raise it as a technical issue, and stress it's an account issue.  Quote @Brettski-AWS, he's very high profile.  I can't tell you his real name without checking with him first but let me know if you get stuck.ShareJoe Siefers 12 days agoThey were able to solve the issue - thanks!Share"


Question: IAM role based mongo auth with sts assumeRole

"We have a use case wherein we want to access mongoDB database via IAM role based authentication mechanism . We have attached an IAM role to the DB and while making connection to db from lambda , for iam role based auth we require temp security credentials like key, secret and security token . For that we are using sts.assumeRole method which gives temporary security credentials by assuming the role (one atttached to DB) . To allow Sts.assumeRole to work we are required to add the arn of user(lambda) in the trust policy of the IAM which we want to assume . We instead want to make it work by adding arn of role or by policy way and not by adding the arn of user(lambda) . We arent able to do that . Is there a way possible to achieve this?FollowComment"

Answer: "0Hello,I hope you're doing well.Thank you for reaching out to us with your concern.From your query, it seems that you would like to allow AWS role ARN in the trust policy, instead of using IAM user arn. Please let me know if I misunderstood anything.I would suggest you to refer the following AWS knowledge center article, to achieve your use case.https://repost.aws/knowledge-center/lambda-function-assume-iam-roleAs you mentioned that you are currently providing IAM user arn instead of IAM role arn. Hence, you must be making the request from an IAM User instead of IAM role. In order to use IAM role arn to assume a specific role B, you must need to make the request from a IAM Role A. For example, Currently you must be using IAM user to make a request Role B to assume role. In order to allow IAM role A to assume role B, you first need to Assume role A. As you are using a lambda function, you can specify IAM role for Lambda function[1] which have permission to call AssumeRole API action, after doing that your can make change in IAM role B's trust policy and allow IAM role A arn in the trust policy which is used by your lambda function.Moreover, as I have only limited information, I would need more data to understand your use case much better. I regret for the inconvenience caused. To understand your use case further, I would request you raise a technical support case ticket, where we can go deep dive into the use case and suggest you policy based on your environment resources.References[1] https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.htmlCommentShareSUPPORT ENGINEERAWS-User-1614122answered 2 months ago"


Question: Invitation email to the workspace user

"There is no option for inviting the user again from the workspace console.According to the Amazon Workspace Document, there will be a "send invite" option in invite user page.For referencehttps://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-users.htmlThank you in advanceFollowComment"

Answer: "0On the Workspaces management console, upon clicking the "actions" menu for a selected workspace, among the drop down items, select the option "Invite Users".This will display the preview of the email content. Right below this, on the right side of the screen is where you can find the option "send invite".CommentShareAWS-User-2332965answered 3 months ago"


Question: StartSpeechSynthesisTask is too slow

"Looks like audio is available on S3 only after been fully synthesized. So I will continue to use my text chunking code in order to get faster playing. Amazon, is it not possible to stream incomplete audio?FollowComment"

Answer: "0Hi zdanevich-vitaly-andreevich,Thanks for contacting us!By design audio file produced by StartSpeechSynthesisTask is available for download once it's finished.Generally Amazon S3 never adds partial objects, so it is not possible for an object to appear in S3 if it's not completely uploaded.If you requirement is low latency then I recommend using SynthesizeSpeech operation.On the other hand if you're synthesizing very long texts and you still care about latency you can combine those two in the way that you synthesize first chunk using SynthesizeSpeech and the rest using StartSpeechSynthesisTask.Thanks,HubertCommentShareAWS-User-6109288answered 4 years ago0Hi,I wanted to use audio files synthesized by Polly with my Alexa skill, but had to stop that activity.Alexa takes a session during 8 seconds and then stops responding, but the StartSpeechSynthesisTask takes at least 20-30 seconds even for short sentences - 60 - 80 characters.I found in the Alexa Skills development documentation, that the described scenario is not allowed by AWS due to security reasons. Audio files that are used with SSML <audio /> element, must be in public access and no authentication is required: https://developer.amazon.com/en-US/docs/alexa/custom-skills/speech-synthesis-markup-language-ssml-reference.html#audioI'm interested in if there are any ways to reduce the gap between the StartSpeechSynthesisTask and the moment when S3 object is fully generated? Is it because of any guards/checks/restrictions for the scenario on AWS side, or due to the nature of Polly and S3 services?Thanks in advance!DenisCommentShareFooBarBazzanswered 2 years ago"


Question: Failed to describe Instance. An unknown error has occurred

"I am unable to access my EC2 instance from the instance list, in order to terminate it. The message I see is 'Failed to describe instance i-0dc43742188d8aea1'. I am unable to terminate this and it is continuously charging me, is there something I can do to terminate it?FollowComment"

Answer: "0Accepted AnswerWas able to access my instances from my phone on a different network. All good now! Thanks to AWS support for asking me to try that.Looks like the error message was due to my network/browser interfering with https://ca-central-1.console.aws.amazon.com/. Something along those lines.CommentShareBezosphereanswered a year ago0Can you provide some more details about your set-up?When you say "I am unable to access my EC2 instance", how are you trying to access the EC2 machine? Are you trying to ssh into it? If so, are you going over the internet, because from what you have mentioned, you seemed to have removed the IPSec VPN connection from your corporate network to AWS. If that is correct, can you check if the security groups for the EC2 machine allows SSH traffic from the internet? Earlier, you may have connected from your corporate network's CIDR range and that may have been allowed in the security group.When you say "I am unable to terminate this", are you trying to terminate the EC2 machine from the AWS console?CommentShareEXPERTIndranil Banerjee AWSanswered a year agoBezosphere a year agoThanks for the reply. I am strictly referring to when I navigate to EC2 > Instances, the list says "An unknown error occured" as opposed to showing the list of my instances.I am worried now because I am being charged for the instance, but I cannot terminate it at all or open a support ticket since I am on a Basic Plan :(ShareIndranil Banerjee AWS EXPERTa year agoIf you cannot access from the console, have you tried from the AWS CLI - https://docs.aws.amazon.com/cli/latest/reference/ec2/index.htmlShareBezosphere a year agoMy Instance is on Canada ca-central-1 which doesn't seem to have the CLI optionShare"


Question: Wds configuration

Dhcp server option required to configure wdsFollowComment


Question: Eventbridge scheduler Synchronous Lambda invocations

"Hi everyone,I'm trying to use eventbridge scheduler to run my lambda synchronously and I'm receiving the error below.Someone know if this will be implemented soon ?I would like to give more power to eventbridge scheduler retries because as the comunication is asynchronous, eventbridg scheduler only fails if there is an infrastructure or overload issue.My idea for example is that eventbridge scheduler retries for an hour 50 times if my lambda function fails because there was a 500 http issue.I'm genereting the scheduler by aws-sdk v3, using universal targets to set "InvocationType: RequestResponse". See https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.htmlThanks{    "name": "ValidationException",    "$fault": "client",    "$metadata": {        "httpStatusCode": 400,        "requestId": "4e696e3b-bca2-4400-8246-3b334749c8c1",        "attempts": 1,        "totalRetryDelay": 0    },    "message": "Invalid RequestJson provided. Reason Synchronous Lambda invocations are not yet supported. Please provide InvocationType parameter with value Event to invoke Lambda asynchronously."}FollowComment"

Answer: "3Accepted AnswerAs always AWS won't make their release timeline visible other than very rough roadmap plans in Partner briefings etc.  I wouldn't hold my breath on this one - synchronous invocation is more about getting a result back to the caller and being able to retry on application errors.  On the other hand you want to retry because of infrastructure/overload errors so I think you should look at another approach.Lambda supports Maximum Event Age and Maximum Retry Attempts for asynchronous invocations.Failed events can be sent to a DLQ; they contain the original event payload plus RequestID, ErrorCode (3-digit HTTP error code) and ErrorMessage (truncated to 1KB).Lambda Destinations for asynchronous invocations provides visibility into Lambda function invocations and routes the execution results to AWS services. Async invocations are queued, and results can be sent to Lambda, SQS, SNS or EventBridge, separately for Success/Failure.  So this gives you more options to extend your retries if the max event age & retry attempts settings above don't cover it.You could also use Step Functions though Lambda Destinations is probably a better and cheaper solution. With Step Functions you could use the Callback Pattern with a heartbeat timeout; if your lambda doesn't send back a token to say it's run, then the heartbeat timeout allows you to invoke asynchronously again for another set of retries.CommentShareEXPERTskinsmananswered a month agoRodrigo Itursarry 23 days agoHi @skinsman for your replay.Lambda retries are not enough (only 2 retries max) for my use case. Eventbridge scheduler seems to be crooked on this.Because I'm rookie on AWS I didn't know about  step functions but seems to fit on my solution.Thanks youShare"


Question: API deployed to Elasticbeanstalk suddenly stopped working

"Hi,I'm pretty new to AWS. We deployed our node.js app to Elasticbeanstalk, while creating Postgres database on RDS. So all worked fine for few weeks and since yesterday, I suddenly cannot access the service. It does not response. I tried looking at logs on Elasticbeanstalk but it's empty after December 1st.In Chrome Network inspect, it just says: Failed to load response data. Resource with given identifier does not exist. We were using free tier. I am sure something happened with the start of new month, but don't know what. I guess our plan expired or something like that.Also, I've tried accessing the environment using ssh (with valid .pem file, it worked before). However, now it says Permission definedWhat could be an issue here?Thanks in advanceFollowComment"


Question: How to use codecommit submodules in CodeBuild

"I am trying to use CodeBuild with submodule in CodeCommit repository, but when the build reach DOWNLOAD_SOURCE phase, I got following error:Submodule error repository not found for primary source and source version refs/heads/masterI used the relative path in submodule registration like ../another-repository.In the documentation of CodeBuild, I can't find anything about usages of submodules, nor anything to the git submodules checkbutton in Source setup section.How to use submodules correctly in CodeBuild?FollowComment"


Question: Elastic disaster recovery - failed to failback

"Hi everyone, i have been trying to test AWS elastic disaster recover, i have successfully initiate drill and also initiate recovery. but the problem is when i try to test failback, i have failed. i already create an account using failback user with recommended credential. ![credential]when i tried to failback it comeback with this error.![error]i hope there are someone who can help me with this ? is there anything that i miss in the configuration ?for region i use ap-southeast-1.FollowComment"

Answer: "0i update the question. insert screenshot.CommentShareJeff-learninganswered a year agoAWS-User-2560483 2 months agoHi Jeff, how did you fix the issue since I am also facing issues. I appreciate if you can explain how you fixed it. ThanksShare"


Question: AWS Schema Conversion Tool - Troubleshooting a Connection Error?

"I have a security / permission / connection problem using SCT.I'm using SCT locally to migrate my SQL Server DB to an Aurora DB in AWS. I get a "Connection wasn't established. Check connection properties." error. The log file is no use, all it has is a caught Java exception and stack trace: "com.amazon.sct.dbloader.exceptions.DbLoaderHandledException".I created the Aurora DB with public access.In SCT my connection details are:Server name: mobile-reports-instance-1.c9vuf469uzhv.us-east-1.rds.amazonaws.comPort: 5432Database: I tried both regional cluster, "mobile-reports-instance-1" and writer instance names: "mobile-reports"Username: postgresAnd the correct passsword.How can I troubleshoot this? I have no information to go on.  Do I need to add an internet gateway to my DB or is that done when I select "allow public access"?FollowComment"

Answer: 0It looks to me like you haven't installed the postgresql driver.Install the SQL Drivers and AWS Schema Conversion Tool on Your Local ComputerThis frustrated me for a couple hours a few months ago.  I found these step by step walk throughs very useful.Database Migration Step-by-Step WalkthroughsCommentShareTim Seyfriedanswered 10 months ago


Question: Multiple API keys and the flow rate limit in the usage plan

"I associate an API with a usage plan and multiple API keys with the usage plan.In addition, I set the flow rate limit in the usage plan.When the API is executed using an API key and the request exceeded error (429 error) occurs, if the API is executed using another API key, does the request exceeded error (429 error) occur?FollowComment"

Answer: "0Accepted AnswerAccording to this answer, if multiple clients execute the same API using different API keys, the flow rate can't be limited by the total number of requests to the API, right?Not with usage plans, no.I want to realize a per-API flow rate limit instead of a per-client flow rate limit.Unfortunately we do not support API level throttling rates today. We do support method level throttling rates that would be global to all callers. These can be used in addition to usage plan throttling.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago0Hello:Usage plan limits are applied per key. Keys within the same plan do not share the limit.Hope this clarifies.Regards,BobCommentShareEXPERTAWS-User-0395676answered 3 years ago0Thanks for answering.According to this answer, if multiple clients execute the same API using different API keys, the flow rate can't be limited by the total number of requests to the API, right?I want to realize a per-API flow rate limit instead of a per-client flow rate limit.CommentShareakazakianswered 3 years ago"


Question: ec2 instance not showing my all available volumes

"I am trying to attach a new volume to an ec2 instance but not able to view all my volumes, i even put all the volumes in same availability zone still not able to find all. Because of this i am not able to perform detach and attach a new volume to the instance.FollowComment"

Answer: "0Your post needs some more information, where are the volumes you cannot see? new volume and new volume 2 appear to be visible in your screenshot, can you select them with the checkbox on the left and go to actions > attach volume?CommentShareNick Triantafillouanswered 5 months ago0Its not the instance which shows volume , its EBD dashboard where you create and volumes are visible. The 2 available volumes shown in screenshots can be attached like below:-Select one volume at a time -- actions tab -- click attach -- select the instance -- you can either have device ID used as default or customize it as per requirement and click attach at the bottom.Also i have seen this issue recently where you create EBS volume in account and it takes ~1 min to show up in the EBS dashboard , just refresh it and it will be visible.CommentShareShashank Abhishekanswered 5 months ago"