Question: AWS Cloud Front top referrers?

On cloud front there is a tab called top referrers which shows a request count? Does the number of request count represent the amount of people that have clicked the link? So that reflects amounts of views??FollowComment

Answer: "0Accepted AnswerThe request count in the referrers tab indicates the total number of HTTP/HTTPS requests from the domain name in the Referrer column. The referrers can be search engines, other websites that link directly to your objects, or your own websites. If a user enters the URL directly into the address line of a browser, there is no referrer for the requested object.To view more information about the CloudFront top referrers report, please use this link.CommentShareNickanswered a year ago0Thanks for your quick answer back, is there a way of finding out how many viewers we were having on a daily basis in CloudFront?CommentSharerePost-User-2405731answered a year ago"


Question: Aurora MySQL database got stuck in Upgrading status

"Hello,I tried to upgrade MySQL to the latest minor version available but it got stuck in Upgrading status. It's been more than 3 hours and still not finished. I already restored a snapshot to a new cluster/instance for my team to proceed but I still need to get the original cluster/instance working. What else can I do?Event logs:November 17th 2020, 2:03:48 pm UTC The crash loop due to OOMNovember 17th 2020, 1:46:18 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:45:56 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:23:41 pm UTC DB instance restartedNovember 17th 2020, 1:16:25 pm UTC DB instance restartedNovember 17th 2020, 1:16:12 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 1:00:26 pm UTC DB instance restartedNovember 17th 2020, 12:51:17 pm UTC The database process was killed by the OS due to excessive memory consumption. It is recommended to tune your database workload and/or parameter usage to reduce memory consumption.November 17th 2020, 12:49:12 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 12:48:10 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...November 17th 2020, 12:47:01 pm UTC Error restarting mysql: Could not verify and start mysqld.November 17th 2020, 12:38:40 pm UTC Error restarting mysql: Engine bootstrap failed with no mysqld process running...ThanksLinoFollowComment"

Answer: "0Apparently the configured max_connections parameter is too high for the instance type we're using. After adjusting it to its ideal value, the problem has been solved.CommentShareLinoanswered 3 years ago"


Question: CSP Issue when uploading new version in Elastic Beanstalk

I'm unable to upload a new version of my application. I get the following error in the browser's console:Refused to send form data to 'https://elasticbeanstalk-eu-west-1-412334503295.s3.eu-west-1.amazonaws.com/' because it violates the following Content Security Policy directive: "form-action 'self' https://console.aws.amazon.com/feedback/submit-feedback https://signin.aws.amazon.com/switchrole https://us-east-1.console.aws.amazon.com/feedback/submit-feedback https://eu-west-1.signin.aws.amazon.com/switchrole https://eu-west-1.signin.aws.amazon.com/oauth".FollowComment


Question: Redshift connection error

Getting `below error message while connecting to redshift(publicly accessible) via Lambda functionResponse{"errorMessage": "2022-04-06T05:33:16.775Z cb4cdf56-fbd7-4a2e-a2fd-1ec52f5a2a93 Task timed out after 60.06 seconds"}`FollowComment

Answer: "0Hi,Lambda functions have many potential reasons for a "Task timed out" error, especially when configured to run in a VPC.Even though a Lambda function's maximum invocation timeout limit is 15 minutes, other AWS services may have different timeout limits.By looking at the function's maximum value for the "Duration" metric at the time of the error, you can see that at least one invocation had a duration that reached the function's configured timeout value.When an invocation times out, an error metric will be recorded, but a Task timed out error message appears in the failed invocation's CloudWatch logs, not an Error message.  To determine why your function was timing out, you will need to examine the Cloudwatch logs of the timed out invocations.When your invocations generate requests to a downstream resource/API, make sure the libraries used by your function's code are configured to fail fast and retry.  While AWS SDK's will automatically retry failed/timed out network requests, note that the default settings are usually higher than the ideal setting for the average Lambda function.  For example, most Lambda functions are designed to run within a few seconds, but the default timeout value for a network request in AWS's Boto3 Python SDK is 60 seconds/attempt, and in Java, the default is 10 seconds/attempt .  If you are still using the default settings, please modify those settings to a value that will allow your function to retry quickly.If your function is creating new connections inside each invocation, note that re-using connections across invocations is a Lambda best practice.  Connection re-use is possible because Lambda will use a single environment to run many invocations.  This allows you to create network connections in the init section of your code, which can be used in the handler code for all invocations that run in that environment .  Be aware that Lambda purges idle connections over time; when your function is re-using connections, attempting to reuse a purged connection will result in a connection error.  To maintain a persistent connection from Lambda, use the keep-alive directive associated with your runtime.References :-https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-retry-timeout-sdk/https://aws.amazon.com/premiumsupport/knowledge-center/lambda-vpc-troubleshoot-timeout/Thank you !CommentSharePriyaAWS2020answered a year ago"


Question: How does GuardDuty work in a Shared VPC?

How will Guard Duty work with a Shared VPC?Who get's to see the findings?What will happen if the VPC owner has enabled Guard Duty but the participant hasn’t’?What’s the best practice?This topic came up a few times already - I'm using this post to document the answer from the GuardDuty & VPC service teams.FollowComment

Answer: "0Accepted AnswerThe general recommendation is that all participants and the owner of the Shared VPC should have Guard Duty enabled.By default, any GuardDuty findings will only be available to the account which owns the resource against which malicious activity was detected.  For example, if there are findings against an EC2 instance owned by a Shared VPC participant then only that participant AWS account will see those findings. The owner of the Shared VPC will not have access to findings related to participant resources.If findings need to be shared across accounts customers can follow the standard  administrator/member deployment model: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.htmlIf a participant hasn’t turned on GuardDuty but the owner has it running then no findings will be generated against that participants resources. Any findings against owner resources will still be generated as usual and sent to the owner account.CommentShareEXPERTAWS-User-7100868answered 4 years ago"


Question: Free Tier for RDS in Stockholm

"I've found there is no free tier for RDS (MariaDB is used, but it is most likely the same for other types) in Stockholm (eu-north-1) as there is no db.t2.micro. Is there any substitution ?FollowComment"

Answer: 0Please check if everything from the list is correctfirst 12 months are free750 hours per month of db.t2.micro database usage (applicable database engines)20 GB of general purpose (SSD) database storage20 GB of storage for database backups and database snapshotsI took it from here.CommentShareMGanswered a year ago0Hello WSZ87Please have a look at the following links :https://aws.amazon.com/rds/free/?p=ft&c=hp&z=5https://aws.amazon.com/rds/faqs/#free-tierThanksCommentShareKamalanswered a year ago0Thank you for the answers and I certainly cannot match the requirements for RDS free tier as I cannot use db.t2.micro (no such type in the mentioned region -> eu-north-1).The real question is whether I can use any other type of db EC2 instance to achieve it. It doesn't seem to work with db.t3.micro.CommentSharewsz87answered a year ago


Question: Send Config Rule results into AWS Security Hub using the Amazon EventBridge service

"Hi,I created Config Rule to only allow specific type instances to be used and, now I want to feed AWS Security Hub by Config Rule results using EventBridge to automate the process.How to send Config Rule results into AWS Security Hub as a finding using the Amazon EventBridge service ?FollowComment"

Answer: "1Hi,I understand you would like to know how to send Config Rule results into AWS Security Hub as a finding using the Amazon EventBridge service.Security hub uses AWS Config and AWS Config rules as its primary mechanism to evaluate the configuration of AWS resources. AWS Config rules can also be used to evaluate resource configuration directly.To your question and giving the fact that you created a Config Rule to only allow specific type instances to be used, I recommend using the custom action feature in security hub: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-custom-actions.htmlI hope this helps. Let me know if I answered your question by up voting my response as accepted or if you have any follow-up.Kind regards,AhmedReference:[1] https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-all-findings.html[2] https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.htmlCommentSharerePost-User-5076019answered 17 days ago"


Question: mongoDB atlas scaling with AWS regions

I have 6 EC2 Instances on different region on AWS. I have only one MongoDB server on MongoDB Atlas (AWS). I am having latency issue while updating Data to the database. what is the best way to scale my MongoDB server with My 6 EC2 instances.FollowComment

Answer: "0You can try one way you can apply the VPC peering from EC2 to MongoDB Atlas (AWS). As MongoDB Atlas as now VPC peering function.If you are trying to connect the MongoDB using public-facing network, then it might be slow.AWS launched instances in a different region may create a connection using inter-region cross VPC peering.So if you are following tradition way to whitelisting ACL's better try this it will reduce latency issue.please peer all the region's VPC (make sure there will not be any IP conflict) and try to connect using private connections.EDIT : 1There is no additional penalty with MongoDB in terms of using it out of region, but most database protocols are not optimized for high latency conditions. You might be much better off setting up a read replica in other regions.You can read this: https://www.mongodb.com/blog/post/optimizing-fast-responsive-reads-cross-region-replication-mongodb-atlasEDIT : 2If you can't push your database to multiple regions (by using read replicas for example), then you should consider using CloudFront in front of your application(website) to allow for caching of requests in the different regions.It won't technically improve the latency between application and database, but in terms of your user's perception of performance, it will be little speedy.CommentShareharshmanvaranswered 4 years ago0Here's a secure and cost-effective way you can connect to your MongoDB cluster using AWS IAM passwordless authentication. I think it is one of the fastest ways to connect to the DB as well.Link: https://vishnusblog.tech/secure-mongodb-with-aws-iam-passwordless-authentication-exampleYou could create a global EC2 role and assign it to all of your instances. Use that role to enable authentication with reference to the article mentioned.CommentSharevishnus17answered 10 months ago"


Question: WAF causes a timeout when a request has Transfer-Encoding: chunked in the headers

"As it says in the title, WAF is causing a timeout for a connection that has Transfer-Encoding: chunked in the headers of the request. It appears to happen when it is a GET request with nothing in the body.It is never hitting any of the rules.This feels like a bug to me, since there is no way to control this with any of the Rules if it isn't getting that far.How can I report this bug, or get a solution? As it is, we will have to stop using a WAF in front of our load balancers if there are random invisible timeouts caused like this.And yes, we know that that header is meaningless when the body is empty. Just concerned about the invisible failure.FollowComment"

Answer: "0Hi,Thank you for contacting AWS Re:post .I understand you have some clarifications regarding WAF causing timeouts for a connection that has Transfer-Encoding: chunked in the headers of the request.Looking at the issue, This would require further analysis and troubleshooting.I would suggest you to open a case with the WAF premium support team and provide details such as:--> Network Architecture--> Network Traffic Flow--> Any supported Logs (Access logs)--> Error outputThanks and have a nice day!CommentShareSUPPORT ENGINEERAnsh_C answered 2 months ago"


Question: App Runner Healthcheck failed on port 8080

Hello - I am trying to deploy Fast API on App runner and getting "Health check failed on port '8080" error.  The app doesn't get installed or created . I have tried even on port 80 but nothing works.Can you please advice how can i fix this issue ?  I am deploying using source code from git . Its an Python Fast API.RegardsFollowComment


Question: EFS volumes in manual backup plan does not satisfy Security Hub EFS.2 rule

"We have EFS volumes that are part of a manually created AWS Backup Plan. Yet, Security Hub mark my volumes as non compliant to "EFS.2 Amazon EFS volumes should be in backup plans". The same situation works for RDS as it find the backup plan and shows the snapshot in the RDS console.Is there something we did wrong when adding the EFS ressources to the backup plan or Is it just a missing feature?FollowComment"

Answer: "0If you have enabled automatic EFS backups using the method described in this document, there should be no problem.https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html#efs-2By the way, how did you activate the backup?CommentShareEXPERTRiku_Kobayashianswered 8 days ago0We do not use the automatic EFS backup functionality, we backup our EFS volumes in a backup plan directly in the AWS Backup service. This way all EFS/RDS resources of an application are grouped in the same plan.CommentSharegagf01answered 7 days ago"


Question: Is there a lambda layer repository? Or are there AWS-provided layers?

"I remember from the keynote that one practical use for layers is that you could potentially use layers developed by other parties. I was wondering, is there some kind of repository available where you can import an existing layer?For example, in the case of Java, it would be nice if Amazon provides its own SDK as a layer, so that you don't have to use the shade plug-in to make a fat jar. Does this already exist somewhere?It's not necessarily a lot of work to make, but if it's maintained centrally, that would be nice...FollowComment"

Answer: "0Accepted AnswerHi jvdb,Thanks for your interest in AWS Lambda. There isn't an AWS Lambda layer repository. I will pass on your suggestion to the appropriate team.ThanksawsSushantCommentShareAWS-User-3475007answered 4 years agoAli a month agoHello,is this still available in a repo ?can I dynamically determine this via some terraform data or cloudformation ?Share"


Question: Apache threads and db connections not cleaning up causing ELB high latency

"Environment:Elastic BeanstalkPHP 7.1 running on 64bit Amazon Linux/2.9.0Drupal 7Pre-fork MPMmod_php MaxRequestServers=128MaxRequestsPerChild= 1000Drupal page caching off due to personalization/regional customizations.Elasticache/Redis caching4-  t2.xlarge instancesClassic ELBELB timeout 60 /health check timeout 60 with 180 intervalmod_reqtimeout=14-28 body and head.KeepAlive onRDS/MySQL timeout and interactive 60 | db.m4.xlargeCloudFront serving images, css, etc.Ongoing issues:Many 408 errors in access logsApache processes (MaxRequestServers) maxing out; long running and are not cleaned upMany DB connections climbing fast with many sleeping processesNo DOS attacks that we are aware ofELB latency very high504 client errorsCPU and Memory for DB and Instances within the normal range.Autoscaling does not help since this is not a resource issue.NOTE: Enabling the Drupal page caching stabilizes the site but we cannot leverage the sites global/regional features so this is not an option.Also:  Could it be an issue with the underlying hardware or limits/throttle in AWS?Edited by: awsusr13 on Nov 6, 2019 10:57 AMFollowComment"

Answer: 0The solution was to increase the size of the Redis instance with more network throughput (m5).CommentShareawsusr13answered 4 years ago0The solution was to increase the size of the Redis instance with more network throughput (m5).CommentShareawsusr13answered 4 years ago


Question: DynamoDB Range-Key bit-wise search

"I have a problem where I have a Building and the building can be in multiple projects. I need to query all the buildings that belong to a specific project.I tried to do something like this but contains cannot be used to search for the flags.PK => company#BUILDINGSSK => buildingId#INFOLSI => flagsI know that:I can do it by duplicating the building record adding the project in the range key.Local Secondary Index per project cannot solve this as the number of projects is grater then 5Global Secondary Index can solve this ( but having many global secondary index ( one per project ) would increase writes cost for each building update ( the cost is not that big of a issue, but still have a  limit of 20, more than needed at the moment, but I wouldn't like to have that type of hard limit and would prefer to duplicate the records instead )This could be easily ( from users query perspective ) be solved using:Numeric range key and bit-wise to search for the project.String range key and contains instead of only begins_withString range key with pattern* something like Range Value = "01100" and search for begins_with "??1"I'm new to dynamoDB, and I'm migrating a mongoDB project to it. So I may be missing something.is there a easy way to solve this query problem that I'm unaware of?thanks in advanceFollowCommentalatech EXPERT3 months agoWould have project as partition key and buildings as sort keys help?Share"

Answer: "3Accepted AnswerYou need to understand DynamoDB by first understanding its underlying data structure, which can be likened to a B+ Tree. DynamoDB is not like MongoDB in the fact it does not allow you to create access patterns which are in-efficient. All of your requests must locate items which are stored physically together, which is why contains is not a valid function on a sort key. You must use begins_with or between etc.. as you can be guaranteed those items are close together. This ensures DynamoDB holds one of its key tenets, "Predictable performance at any scale".Querying all buildings that belong to a specific project is as simple as creating a GSI with project as the partition key.SELECT building FROM mytable.myindex WHERE project = '123'This would return you a list of buildings for that project.CommentShareEXPERTLeeroy Hannigananswered 3 months agoFazel 3 months agoThanks for the reply,knowing it's a B+ Tree helps a lot, thanks.  That explains why it lacks query capabilities in exchange for performance.But the query you gave don't help that much, as I need 1 GSI per project as one building record can be in multiple projects.Maybe extra records for projects??something likePK => companyId#ProjectSK => buildingsfield1 => buildingIdExtrafields => Other Project specific infoand querying for the main building record for extra info, duplicating the normally used to reduce the extra queriesShareLeeroy Hannigan EXPERT2 months agoThats exactly it, you want to vertically split the items having one per building attached to the project. Use the sort key to achieve a hierarchy.Share"


Question: What IAM Permissions are needed to do a CreateJob for S3 Batch?

"I am getting this error, and I can't figure out what permission to enable to allow me to create the job."An error occurred (AccessDenied) when calling the CreateJob operation: Access Denied"when I try to execute a create_job command with an s3control client in boto3, as part of a lambda function. (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3control.html#S3Control.Client.create_job).I'm trying to create a PUTCOPY job.I have granted the lambda function full S3 access via the AWS managed S3 policy, and I have granted the role that the S3 batch job is supposed to run under inside the create_job function full S3 access via the AWS managed S3 policy.Is there another permission I need to enable somewhere to allow CreateJob for S3 Batch?FollowComment"

Answer: "0Thanks for your question.The Lambda function's permissions govern what the Lambda function can do and the IAM role passed to S3 Batch Operations allows the feature to read your manifest, invoke Lambda, write the job report, etc.What you'll need to create the job are the permissions for "s3:CreateJob and iam:PassRole." So within boto3 this will be based on your user identity when you make the CreateJob call.CommentShareawsrwxanswered 4 years ago0Wrong forum sorryEdited by: dsmirnov on May 23, 2019 12:20 PMCommentSharedsmirnovanswered 4 years ago0Hi Rob, thanks for your reply and your explanation. I do have iam:PassRole added to the user identity that the Lambda Function runs under.However, for some reason, I do not see a CreateJob permission under S3 in my IAM when I look at the S3 permission. The only permission that comes up when I type "Create" in the search box is "CreateBucket". Is this permission present in the IAM console, or does it have to be added programmatically?Thank you!edit: to further clarify, since I posted the original message, I realized that I the CreateJob IS allowed with s3:* permissions enabled on both the user identity for the lambda function and the role that the S3 batch job runs under (there is apparently a short delay in the permissions change becoming consistent). However, when I did narrow back the permissions for production to be properly restrictive for production, I still get the access denied error. As noted by robwaws, the permissions needed for the lambda function that creates the S3 Batch Job are "s3:CreateJob and iam:PassRole", and so the question still is: where is the CreateJob permission located?Edited by: James3732 on May 24, 2019 6:27 AMCommentShareJames3732answered 4 years ago0Thanks for the update. We'll work to add more about CreateJob to our documentation and to include S3 Batch Operations API actions in the IAM visual editor. "s3:CreateJob" is the permission required to create the job and would be required by the user or Lambda function creating the job. The same entity would also need the "iam:PassRole" permission to pass the IAM role specified for the job to S3 Batch Operations.CommentShareawsrwxanswered 4 years ago0Great, thank you. I added the CreateJob permissions manually in the json editor, and now the code can create the job via boto3.Also, for the help of future readers: even after you add the CreateJob permission in the JSON editor, the console does show a warning hazard, with the text something like "IAM does not recognize one or more actions. The action name might include a typo or might be part of a previewed or custom service." I'm assuming this will disappear once AWS updates the IAM visual editor. Even though the warning shows up, the permission is applied.Thanks again for your help, robwaws.CommentShareJames3732answered 4 years ago"


Question: Redirect after login with aws-amplify/ui-angular 2.0

"Hi.I have a Angular application and I like to use  the new Authenticator IU compoment.The sample code only show a text message.<amplify-authenticator>  <ng-template    amplifySlot="authenticated"    let-user="user"    let-signOut="signOut"  >
Welcome {{ user.username }}!
    <button (click)="signOut()">Sign Out</button>  </ng-template></amplify-authenticator>I need to redirect from the login page to the root site. With the old version of the UI components I used "onAuthUIStateChange", but looks like no longer works on aws-amplify/ui-angular 2.0  ngOnInit(): void {    onAuthUIStateChange((authState, authData) => {      this.user = authData as CognitoUserInterface;      if (authState === AuthState.SignedIn) {        console.log("user successfully signed in!");        console.log("user data: ", authData);        this.router.navigate(['']);      } else {        console.log("Status: ", authState);      }    })  }What is the correct way to redirect after login on an Angular application with  aws-amplify/ui-angular 2.0?FollowComment"


Question: How to allign the  Name Servers of Route53 Public Hosted Zone and Registered Domains in CDK?

"In my account is an "registered domain" with 4 nameservers assigned to it.To originally created Public Hosted Zone was deleted as I want it to be created with the CDK deployment.When deploying the Route53 Public Hosted Zone it is each time creating a new set of Name Servers. Solution s then to update the Name Servers of the registered domain manually. This issue is described in the following link as well together with an manual fix: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-replace-hosted-zone.htmlProblem:I don't want to change the Name Servers manually, but directly with CDK.I didnt see any possibility in the Constructor to set the Hosted Zones when deploying https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53.PublicHostedZone.htmlNeither i saw how to change the name servers of the registered domain automatically via CDKWhen creating a ZoneDelegationRecord (see code in the following) i could add the target Name Servers but it fails during buildQuestion:How to create a Public Hosted Zone and link it to a registered Domain with both sharing the same Name Servers via CDK?Code:import * as route53 from 'aws-cdk-lib/aws-route53';import { RemovalPolicy, Tags, Duration } from 'aws-cdk-lib';const route53PublicHostedZone = new route53.PublicHostedZone(scope, 'route53PublicHostedZone', {    zoneName: 'myWhatEverDomain.com',  });const zoneDelegationRecord = new route53.ZoneDelegationRecord(scope, 'MyZoneDelegationRecord', {    // real NS Names are different of course    nameServers: [      'ns-1.awsdns-1.org',      'ns-2.awsdns-2.net',      'ns-3.awsdns-3.co.uk',      'ns-4.awsdns-4.com'],    zone: route53PublicHostedZone,    ttl: Duration.minutes(1),  });Error:Failed resources:myCdkStack | 16:53:12 | CREATE_FAILED        | AWS::Route53::RecordSet                   | MyZoneDelegationRecord (MyZoneDelegationRecordD1ECAA29) [Tried to create resource record set [name='myWhatEverDomain.com.', type='NS'] but it already exists] myCdkStack  failed: Error: The stack named myCdkStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE    at Object.waitForStackDeploy (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\util\cloudformation.ts:307:11)    at processTicksAndRejections (node:internal/process/task_queues:96:5)    at prepareAndExecuteChangeSet (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\deploy-stack.ts:355:26)    at CdkToolkit.deploy (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\lib\cdk-toolkit.ts:201:24)    at initCommandLine (C:\Users\myUser\AppData\Roaming\npm\node_modules\aws-cdk\bin\cdk.ts:281:9)The stack named pmyCdkStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETEFollowComment"

Answer: "0As you noted, when creating a hosted zone, AWS Route 53 assigns a random selection of name servers to the hosted zone. The domain registrar must be configured with these name servers as in order to make your domain available on the internet. The documentation on replacing a hosted zone [1] refers to updating the domain registrar to reference these name servers to ensure the correct hosted zone is used to resolve DNS records. This is described in more detail in the documentation page on adding or changing name servers and glue records for a domain [2].While you can change the NS and SOA records for your AWS Route 53 hosted domains, this is most commonly used for white-labeling your name servers [3] and does not change the AWS Route 53 name servers that are associated with the Hosted Zone by AWS. It only changes the records returned by the hosted zone when queried.This is why the CDK build fails in your example code: the ZoneDelegationRecord is attempting to create new NS records for the parent domain when those records already exist. The CDK ZoneDelegationRecord [4] construct is used to delegate resolution to child zones, not to change name servers for the parent domain.If you would like to use the same set of name servers for multiple hosted zones, for example to simplify management, accelerate migration of multiple domains, or have consistent white-labeling across domains, you can use a reusable delegation set [5].The AWS CDK does not currently have any constructs for creating Reusable Delegation Sets or using a Delegation Set when creating a Public Hosted Zone. There is discussion on this topic on aws/awscdk issue #12756 [6] which includes an example custom resource for creating public hosted zones using a previously created DelegationSet. This concept could be extended with another custom resource for the Reusable Delegation Set using the corresponding AWS Route 53 APIs [7].[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-replace-hosted-zone.html[2] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html[3] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/white-label-name-servers.html[4] https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53.ZoneDelegationRecord.html[5] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-set[6] https://github.com/aws/aws-cdk/issues/12756[7] https://docs.aws.amazon.com/Route53/latest/APIReference/API-actions-by-function.html#actions-by-function-reusable-delegation-setsCommentShareMichael_Ranswered a year agorePost-User-4296173 9 months agoIs there a way to create a HostedZone with custom name servers? Or to update the HostedZone nameservers?ShareMichael_R 3 months agoYou can't create a HostedZone with custom name servers per se, however you can use reusable delegation sets [1] to have a consistent set of 4 AWS name servers across your HostedZones. This is most commonly used for white-labeling DNS servers consistently across an organization's HostedZones.[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-setShare"


Question: WorkSpaces Limit Reached

"WorkSpaces Limit ReachedYou have reached your current approved WorkSpaces limit of 0. Request a limit increase by contacting AWS Support.as descript,i can't use the machine.FollowComment"

Answer: "2Hello there,To resolve this issue, you can request a quota increase (service limit increase) using the following steps:Open the WorkSpaces Limits form.This can be found by going to the AWS Console then search for SupportSelect your desired regionCreate a case then select the Service Limits Increases.Select the Limit type you're requesting a quota increase for.Enter the New Limit ValueSelect Add another request to enter another increase request for the same limit type.Enter the Use Case Description explaining why you're requesting a limit increase (Please note that Request for more than 200 WorkSpaces or more than 20 Graphics/Graphics Pro WorkSpaces require additional information. Make sure you answer the additional questions listed within the request form in your use case description.)Enter Contact OptionsSelect submitFor more clarity on requesting a quota increase (service limit increase) please see the doucmentation on reference [1].If you are launching a graphics workspace, please note the the default value for the graphics workspace is 0, therefore you can request for a limit increase for that. See reference [2] for more information References:[1] https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html[2] https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-limits.htmlCommentShareAsenathianswered a year ago"


Question: update container definitions without redefine whole task definition in ECS

I trying to update only image inside ECS task definition:aws ecs register-task-definition --family some-family --container-definitions "$JSON" --execution-role-arn "arn:aws:iam::xxx:role/role-name"Where $JSON is definitely  same JSON description as before and only image key is changed (because ECR image tag is updated)And getting error:At least one of 'memory' or 'memoryReservation' must be specifiedIt is super annoying that we have to update whole container definitions just to be able update ECR image tag. But at least this JSON may be easily taken with describe-task-definition command.However the fact that we have to redefine whole Task Definition every time when Image tag is changed is ridiculous.Is it possible to update only container definitions or image tag (most perfect) inside current version?FollowComment

Answer: 0The current version of the AWS CLI currently require that you create a new task definition to update the Docker image of your application. You can find this information in the AWS CLI Command Reference documentation.There is also this issue that is currently open about this in the AWS CLI GitHub repository. You may find useful information there depending on the deployment method you use to update your ECS task. You can also contribute to the discussion if you want.CommentShareMichaelanswered 7 months ago0TASK202303240151581002711250 actionsCommentShareAna clara de Sousa Vianaanswered 2 months ago


Question: Verify foreign Elastic IP

"Hello everyone, as a software vendor deploying licensed tools, we would ask our customers to send us an elastic ip (eip) or a MAC address from an elastic network interface (eni), in order to have a **permanent **basis for our license keys.Now, in order to avoid unnecessary re-issuing new license keys, how can I verify, that the IP or the MAC address from the customer is really an elastic ip or eni?FollowComment"

Answer: 1Accepted AnswerUnfortunately there's no way to verify this information since EIPs really just come from a pool of available Public IPs. Unless of course you have API Access into the customer account to validate that it's configured as an EIP. Just the IP itself won't help.CommentShareEXPERTRob_Hanswered a year ago


Question: Image thumbnail not shown for images stored in FSx Windows Drive

"I am having an issue with the thumbnails not being shown for images stored on my FSx drive mounted to  AWS Workspaces.I have already attempted to troubleshoot the issue by ensuring that the thumbnails are enabled in the file explorer settings, but the issue persists. Any help would be appreciated.FollowComment"


Question: Customer Data Responsibllity

"Are there any cloud deployment models, or cloud service models, that DO NOT requirethe customer to take responsibility for managing their data (including encryption options)?Asked another way, Is the customer ALWAYS responsible for managing their data (includingencryption)?FollowComment"

Answer: "0Accepted AnswerCustomer Data encryption is always customer's responsibility as can be seen clearly in the Shared responsibility model.CommentShareEXPERTTushar_Janswered 5 months agoTrevor_C 5 months agoIf the deployment model, service model, or no other exceptions matter, then that's good enough for me.  From this point forward, I will say that the customer is responsible for the encryption of their data - NO MATTER WHAT!!!    Thanks Tushar JShare0Possibly SaaS where they encrypt the data for you (or at least should). The customer is responsible for their data in any cloud platform AWS, GCLOUD, or Azure. That's entirely by design.CommentShareEvananswered 5 months agoTrevor_C 5 months agoThanks for your reply Evan.  So, if the SaaS service model, where you say "they" encrypt the data for you, if the Customer doesn't take the initiative of encrypting their data in this service model (SaaS), and the data is breached, who is liable - customer or AWS?  If possible, I would love a response that offers a definitive answer, versus an opinion.  Thanks again Evan.Share"


Question: Need information about who and from where my instances deleted.

"My instances were deleted on 21st May 2022.How to get information about the who is deleted my instances.I contacted support but they said that it was deleted by API Call (API Call for delete cluster).So my question is:-How could an API call delete a whole Instance... that seems impossible.How do we find out what / who caused the API call?please guide me how to find above information other than contact to support.Thanks,FollowComment"

Answer: "0Hello thereThe solution to this problem would be to use AWS CloudTrail as it is a service that records the actions taken by a user, role, or an AWS service,see reference [1].CloudTrail is enabled on your AWS account when you create it. When activity occurs in your AWS account, that activity is recorded in a CloudTrail event. You can easily view recent events in the CloudTrail console by going to Event history.To find out more about how CloudTrail works, see reference [2].In order to create a trail, you can follow the steps mentioned in the documentation, see reference [3].After creating your trail, you can view your log files as specified in the documentation provided in [4].For CloudTrail workflow, see reference [5].References:[1] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html[2] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html[3] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html[4] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html#tutorial-step3[5] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-workflow.htmlCommentShareAsenathianswered a year ago0@Asenathi is correct that CloudTrail is the service for the job. In order to see the API calls, specifically the one you are looking for, you would've had to had CloudTrail turned on already. If you don't have it enabled, follow the info/documents that @Asenathi referenced.If you already had CloudTrail enabled and were looking to track down the exact API call, what you can do is go to the CloudTrail console by searching for CloudTrail in the search bar. On the left hand menu, select Event History and in the dropdown filter box select the Event name and search for DeleteCluster. You'll be able to actually click on the event and see the date, time, source, user name, and much more.Here's the DeleteCluster API reference documentation where you can get more information on that specific API call.CommentShareAWSJoeanswered a year ago"


Question: Error: WAFUnavailableEntityException

"I currently have some LBs associated with WAF Classic ,I'm trying to upgrade to WAFv2 by associating the LBs to WAFv2. When I attempt to perform the association, i get this error message "Error: WAFUnavailableEntityException: AWS WAF couldn’t retrieve the resource that you requested. Retry your request."It's my understanding that whenever you try to associate a LBs currently associated with a web acl to another Web ACL ,it removed it from the previous Web acl association.FollowComment"

Answer: "0The following document describes the error.https://docs.aws.amazon.com/ja_jp/waf/latest/APIReference/API_CreateWebACL.html#API_CreateWebACL_ErrorsAWS WAF couldn’t retrieve a resource that you specified for this operation. If you've just created a resource that you're using in this operation, you might just need to wait a few minutes. It can take from a few seconds to a number of minutes for changes to propagate. Verify the resources that you are specifying in your request parameters and then retry the operation.In my experience, I have also experienced errors when trying to tie to ALBs when creating Web ACLs.Try to run it after some time or try to set it in the ALB after creating the Web ACL.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Nodejs equivalent of IPC Socket implemention pn Python

"Hi,I have the below code to use the IPC socket on any device registered to Greengrass.But I could find a nice example to do it in nodejs. Is there a way to do it? I could not find where to set SVCUID parameter as in python version. My current non-working nodejs version is as follows:Nodejs Version:import { greengrass, iot, io, mqtt } from 'aws-iot-device-sdk-v2';...  const hostname =    process.env.AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT;  const clientBootstrap = new io.ClientBootstrap();  const configBuilder =    iot.AwsIotMqttConnectionConfigBuilder.new_websocket_builder()      .with_clean_session(false)      .with_socket_options(        new io.SocketOptions(io.SocketType.STREAM, io.SocketDomain.LOCAL, 3000)      );  const config = configBuilder.build();  config.host_name = hostname;  config.port = 8033;  const client = new mqtt.MqttClient(clientBootstrap);  const connection = client.new_connection(config);Python version:# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.# SPDX-License-Identifier: Apache-2.0import osfrom awscrt.io import (    ClientBootstrap,    DefaultHostResolver,    EventLoopGroup,    SocketDomain,    SocketOptions,)from awsiot.eventstreamrpc import Connection, LifecycleHandler, MessageAmendmentTIMEOUT = 10class IPCUtils:    def connect(self):        elg = EventLoopGroup()        resolver = DefaultHostResolver(elg)        bootstrap = ClientBootstrap(elg, resolver)        socket_options = SocketOptions()        socket_options.domain = SocketDomain.Local        amender = MessageAmendment.create_static_authtoken_amender(os.getenv("SVCUID"))        hostname = os.getenv("AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT")        connection = Connection(            host_name=hostname,            port=8033,            bootstrap=bootstrap,            socket_options=socket_options,            connect_message_amender=amender,        )        self.lifecycle_handler = LifecycleHandler()        connect_future = connection.connect(self.lifecycle_handler)        connect_future.result(TIMEOUT)        return connectionThanks,SukruFollowComment"

Answer: "1Accepted AnswerGreengrass IPC does not yet support NodeJS, but it is coming this year.You must use a supported SDK language: https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-requirementsCheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 months ago"


Question: How to migrate step machine to another account

Is there any way to migrate step function/machine from one account to another?FollowComment

Answer: "1You can use the DescribeStateMachine API to get the all the information about the state machine, including the definition and then use the CreateStateMachine to create a new one in the other account.CommentShareEXPERTUrianswered a year ago0Hopefully you have used some Infrastructure as Code tool such as Cloudformation, SAM or CDK to create your Step Functions code. In that case you should be able to run the same IaC code by just modifying the parameters in another account.If you have created manually on the AWS console, you can try copying the generated Amazon States Language (ASL) JSON code and create a new Step Function in the new account and paste the copied ASL after modifying relevant parameters. However, with this approach, the other resources such as Lambda functions, SQS queues, SNS topics etc. etc. that are being referred to by the Step Functions need to exist in the new account.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: AWS SES Advisor

"Hi,I've started seeing quite a few entries in the Virtual Deliverability Manager "advisor" tab, and started reading through them.Apart from the BIMI records, which I have actually not set, I see that basically every single identity has some report saying something along the lines of "Missing SPF record", or "Missing DMARC" or "Misaligned MAIL FROM". The problem with these is that it's actually false statements.Because all of these records are exactly created as AWS SES wanted me to create, with the exact values it provided, and all of the records do also work I've verified manually.So, why is the Advisor not seeing these changes and updating accordingly? Any idea?FollowComment"


Question: Unable to update NS record - "Name server update failed"

"Hello,I wanted to transfer 2 domains out of Route53. The process for the first one was seamless, all changes were propagated instantly. Minutes after I wanted to go through the entire process with the second domain. Sadly it's failing on AWS side. In Route53 dashboard I see a notification saying "Name server update failed".I need to update NS records or I won't be able to transfer the domain. May I ask why is it failing?FollowComment"

Answer: "0I don't know why it was failing but I managed to transfer the domain without it. Possibly it failed earlier because the "transform process" has already been initiated.Anyway, this post can be closed now.CommentShareAWS-User-5508596answered a year ago"


Question: Back up from on-premis/my own machine to AWS backup.

Use case: I want to connect my machine with aws so that I can take a backup from my local machine.2. I want whatever I change in a particular folder on my local machine that will sync to aws backup and backup should take place.3. What are the ways i can take Backup from my local machine to AWS.FollowComment

Answer: 0Just a quick solution is to use the AWS CLI and sync the folder from your machine to a S3 bucket and then schedule that on regular intervals with cron on linux or task scheduler on windows.   See aws cli s3 sync reference.  Please be sure to accept answers if they help you.CommentShareMichael_Sanswered 7 months ago


Question: EC2 Server Status Check Failed

"Hello,I am using an EC2 free tier instance with Ubuntu, Mysql 8, Apache 2 and Php 7.From time to time, the instance status check fails and I need to reboot it manually.I eventually created an automatic reboot if the instance check stays failed for more than 1 minuteI also noted that when there is a heavy demand for the web app (eg in the morning when teachers access the school app) the server no longer responds to then resume ten minutes later.I want to know where to look for the error. Is there a log in AWS that could shed some light or do I need to look at the OS level?Any help would be most appreciatedThanksFollowComment"

Answer: "0Thanks for the answer. I am using a T3 micro instance with 1GB memory and 2 vCPUs.I checked the CPU credit balance over a period of 3 months and the balance has always stayed around 288 and barely went lower than 260 in some occasions.However, I check the Ubuntu log and came across this error message:Out of memory: Killed process  (mysqld)I got the impression MySql has been killed during the peak morning period.Is there a way to see my memory usage as a dashboard in AWS console?Also, what is the best way to increase my memory in this case?ThanksCommentShareKarveshanswered a year agoKarvesh a year agoAnd just now, i tried to SSH to my server, it will not log into it.it says: ssh: connect to host ... port 22: Connection timed outAnd on the AWS console, it says 1/2 checks passed: Instance reachability check failed.Rebooting the instance solved it again.I am a bit at a loss hereShare0You haven't mentioned what type of instance you're using. It sounds like you're using a T-series instance. These instance types run on a burstable CPU credit system; if the instance is busy then you will draw down on your credits until you reach a baseline level of performance which may be too low for your requirements.Two solutions:Use "unlimited mode" - your performance will not change when you run out of credits but we will charge for the time when you do.Use a non-T series instance which doesn't use the burstable CPU system (all of the other instance types).Note that you can monitor your CPU credits to see if this is what you're experiencing.More information is here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.htmlCommentShareEXPERTBrettski-AWSanswered a year ago0If rebooting fixes your issue then it sounds like you are running out of Memory. You could try creating an image of your existing instance, stop that instance, and create a new instance from that image on a larger instance. If you are on a micro, I would go up several tiers (medium or large) just for testing and see if that makes a difference. If you are still getting MySQL memory errors at that point then I'd say you have an issue with MySQL.https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/ec2-backup.htmlIf you want to log memory information then you need to install the CloudWatch agent. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/metrics-collected-by-CloudWatch-agent.htmlCommentShareJohn Voldanswered a year ago"


Question: SQL query freezes when connecting Aurora Postgresql cluster through RDS proxy endpoint

"Hi,We have tried to add RDS proxy to our AWS solution under development. Target database is Aurora cluster with Postgresql, containing geoinformation data(write + read instances).Our lambdas works fine when working directly with the Aurora cluster(until we want to speed things up and run more at the time and connections run out. That's why proxy is one thing we are trying to use).With proxy everything seems to be working fine until in some point it seems to freeze in some lambda until timeout occurs. No error message are given(or at least I can't find one).I have established VPN connection to the database and studied one of the freezed lambda code.By doing this I found out that e.g. running "db.run('SELECT id FROM geodata WHERE ST_Intersects(geom, ST_GeometryFromText(:wkt,3067))', **parameters)" in loop it freezes the prosessing in some point. maybe after 1-100 trys.The proxy seems to be happy if the query is done e.g. using id as selection criteria.If I use this same code directly with the Aurora cluster endpoint no problems occurs. Connection is created with pg8000.native.Connection.FollowCommentrePost-User-7371121 a year agoSome further studies are showing that I cannot use parameters in my SQL query(that :wkt given in parameters) and this could be the reason why the solution was failing with proxy?Share"

Answer: 0Accepted AnswerUsing psycopg2 was the solution. So some code refactoring was needed.CommentSharerePost-User-7371121answered a year ago


Question: EC2 instance unresponsive and won't stop

"Instance i-0db5c9933521bfe44 has become unresponsive. Repeated stop commands do not appear to have worked. Could you please restart the instance as soon as possible please. Regards,Patrick.FollowComment"

Answer: 0Instance state has finally gone to stopped. Now trying to start it again but getting "Error starting instancesThe service is unavailable. Please try again shortly.". This is in AWS London.CommentSharepbbeaumontanswered 4 years ago0I've just tried to launch a t2.micro instance and getting service unavailable as well. Is there a general outage in AWS London?CommentSharepbbeaumontanswered 4 years ago0Instance i-0db5c9933521bfe4 has now started and appears to be working correctly. Many thanks to whoever plugged it in again.CommentSharepbbeaumontanswered 4 years ago


Question: App Runner actions work very slow (2-10 minutes) and deployer provides incorrect error message

"App Runner actions work very slow for me. create/pause/resume may take 2-5 minutes for simple demo image (public.ecr.aws/aws-containers/hello-app-runner:latest)and create-service when image not found takes ~10 minutes:example #1 - 5 min to deploy hello-app image04-17-2022 05:59:55 PM [AppRunner] Service status is set to RUNNING.04-17-2022 05:59:55 PM [AppRunner] Deployment completed successfully.04-17-2022 05:59:44 PM [AppRunner] Successfully routed incoming traffic to application.04-17-2022 05:58:33 PM [AppRunner] Health check is successful. Routing traffic to application.04-17-2022 05:57:01 PM [AppRunner] Performing health check on port '8000'.04-17-2022 05:56:51 PM [AppRunner] Provisioning instances and deploying image.04-17-2022 05:56:42 PM [AppRunner] Successfully pulled image from ECR.04-17-2022 05:54:56 PM [AppRunner] Service status is set to OPERATION_IN_PROGRESS.04-17-2022 05:54:55 PM [AppRunner] Deployment started.example #2 - 10 min when image not found04-17-2022 05:35:41 PM [AppRunner] Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository.04-17-2022 05:25:47 PM [AppRunner] Starting to pull your application image.example #3 - 10 min when image not found04-17-2022 06:46:24 PM [AppRunner] Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository.04-17-2022 06:36:31 PM [AppRunner] Starting to pull your application image.but 404 error should be detected immediately and fail much  faster. because no need to retry 404 many times for 10 min, right?additionally the error message Failed to pull your application image. Be sure you configure your service with a valid access role to your ECR repository is very confusing. it doesn't show image name and doesn't provide the actual cause. 404 is not related to access errors like 401 or 403, correct?can App Runner actions performance and error message be improved?FollowCommentrePost-User-8095604 a year agoI'm seeing long deploy times, as well. Roughly 5-10 minutes each for successful deploys.Share"


Question: AWS IoT for ESP32

"Hi, Wanted to know current avaiable solution for AWS, BLE and WiFi using ESP32. Can the available e.g. be directly used and modified?For development support what is available? if not free then what are plan prices.FollowComment"

Answer: "0Depending on your arch type, you can find compatible guides here. Take a look at the partner device catalog where you can choose the kind of ESP32 device you want to work with and take a look at the guides on their individual guide pages.For clarity: The partner devices are created by the partners which are third party vendors. AWS provides support for AWS IoT Core and FreeRTOS and other cloud offerings. The devices themselves are offered and priced by companies that build them.Hope that helps.CommentSharePronoy_Canswered a year agoAWS-User-5915743 a year agoHi, was looking for support from code development perspective of ESP32 for application of AWS-WiFi and BLE controlled devices. For such support wanted to know if its free, where to get support and if paid what are prices.Share"


Question: "No packages marked for update" -> Yet ALAS-2017-901 bulletin exists

"Seeing an issue w/ 2017.07 AMI missing this package.  Any idea where to locate it??Advisory: https://alas.aws.amazon.com/ALAS-2017-901.htmlkernel-4.9.51-10.52.amzn1.x86_64[ec2-user@ip-172-31-xxx-xxx ~]$ rpm -qa | grep -i kernelkernel-tools-4.9.43-17.39.amzn1.x86_64kernel-4.9.38-16.35.amzn1.x86_64kernel-4.9.43-17.39.amzn1.x86_64[ec2-user@ip-172-31-xxx-xxx ~]$ sudo yum updateLoaded plugins: priorities, update-motd, upgrade-helperamzn-main              | 2.1 kB  00:00:00amzn-updates          | 2.3 kB  00:00:00No packages marked for updateFollowComment"

Answer: 0anyone from AWS browsing these threads?CommentSharespideranswered 6 years ago0The root cause is the /etc/yum.conf file.  you need to manually update "releasever=2017.03" with "releasever=latest"& yum update.  I was able to obtain a newer version of the kernel but it is still behind and vulnerable...Remote package installed : kernel-4.9.51-10.52.amzn1Should be                : kernel-4.9.58-18.51.amzn1CommentSharespideanswered 6 years ago


Question: AWS service for business events published by microservices

Is there an AWS service where microservices can log events(with flexible schema) like json documents but these can be queried. I want to publish events for business analysis and debugging.FollowComment

Answer: "0Hi kuldeepiitg,a typical approach is to centralize logs in special AWS account, and one way is outlined here: https://docs.aws.amazon.com/whitepapers/latest/microservices-on-aws/distributed-monitoring.html#centralizing-logs and https://docs.aws.amazon.com/solutions/latest/centralized-logging-on-aws/overview.html.Depending on your workload, microservices (serverless or container based) have capability to have S3 and CloudWatch as target destination, often with streaming capabilities such as Kinesis Data Firehose. From there, to high performant search engines such as CloudWatch Insights, AWS OpenSearch/Kibana and/or Athena.Hope it clarifiesCommentShareEXPERTalatechanswered 3 months ago"


Question: Issue: Date and Time on AWS server hosting my WordPress website is off by 8 days in the future.

AWS is hosting our WordPress website and roughly a month ago the pages that use a calendar/time (date & time) are now off by eight (8) days in the future.  These are primarily Event pages the now drop off 8 days early (before the event date.)  My research as determined it is not a Word Press issue but that the date and time on the server that is hosting the site is off by 8 days and a few hours.  Is this setting on the server something I have control access to?  If so how?  If not how do I go about getting AWS support to look into the issue?FollowComment

Answer: "0What you are looking for is a time synchronization service.  That will allow you to use NTP to sync the time on your EC2 instances every couple of hours or so.  AWS now provides one to all user for free.  See here. https://aws.amazon.com/blogs/aws/keeping-time-with-amazon-time-sync-service/. There is documentation for setting up an NTP client for Amazon Linux and WIndows in the article.  If you use Ubuntu, check here https://ubuntu.com/server/docs/network-ntpBestCraigCommentShareCraig Simonanswered 24 days ago"


Question: Customizing the Docker Run Command on Elastic Beanstalk

"I'm running a single container setup on Elastic Beanstalk using the Amazon Linux 2 Docker platform.The container is running a third-party image that is fully functional only when its hostname matches an issued license file.With the previous iteration of Docker platform on Amazon Linux, it was possible (though never officially supported) to override the docker run command by using an ebextension to patch the /opt/elasticbeanstalk/hooks/appdeploy/pre/04run.sh script to inject -h MY_HOST. This does not seem to work on Amazon Linux 2.Is there any officially supported way to set the hostname of a container running on Elastic Beanstalk using the Amazon Linux 2 Docker platform? Thanks for any help you can provide.FollowComment"


Question: Read permission error after MQTT Moquette Broker restarts with active client connection (Windows)


Question: How Long ill LightSail be down

Does anyone know how long LightSail will be downFollowComment

Answer: 0Please take a look at duplicate question here: https://repost.aws/questions/QUCYbnscvGQWKzImlmolkJSQ/lightsail-downCommentShareGiorgio@AWSanswered a year ago


Question: Amplify Next.JS Hosting Env Var Accessible during getInitialProps

"I am hosting a NextJs 13 App on Amplify. In my custom _app.tsx file, I have a getInitialProps function that references an env-var not prefixed with NEXT_PUBLIC_. This means that the variable will not be accessible outside the Node runtime. However, the initial load of getInitialProps runs on the server, so this shouldn't be a problem.However, when trying to access the variable, it is undefined. Other env-vars that are prefixed with NEXT_PUBLIC_ are, which means the process is not running on Node.The app works as expected when run locally, which leads me to think this is an issue with how Amplify hosts the app.FollowComment"


Question: How to enable Logical Replication for existing Aurora PG 13 Cluster?

"We are considering enabling logical (streaming) replication on our existing Aurora PG 13 cluster for CDC?We want to keep our aurora read replicas as is, but I haven't found good resource that explains how to achieve both, OR what is the implication for existing read replicas.Our current understanding is that we might have to stand up 2x current nodes in our cluster which would be way too expensive for us.FollowComment"

Answer: "2You can enable logical replication by setting the parameter rds.logical_replication parameter in Cluster Parameter group. There will not be any impact on the existing Aurora replicas/reader instances in the cluster. Additionally, you do not need to add new instances in the cluster just because the logical replication is enabled.Refer - https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html#Aurora.Replication.AuroraPostgreSQLCommentShareprasanth_awsanswered a year agoEXPERTJohn_Freviewed a year agoAWS-User-4365303 a year agoThanks for confirming!Share2Thank you for reaching out. Since you mentioned CDC, I will also recommend you to review this document since it provides guidance on the enabling Logical replication for CDC.[Using a PostgreSQL database as an AWS DMS source  - Enabling change data capture (CDC) using logical replication  - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.SecurityCommentShareSUPPORT ENGINEERArnab_Sanswered a year agoAWS-User-4365303 a year agoThanks @arnab, the intention is to run CDC indefinitely (i.e we are not just migrating DB), does DMS still solve the problem cleanly and cost effectively?Share"


Question: Issues Communicating to Cognito from App Mesh

"Hey everyone,I currently have an App Mesh setup that consists of three ECS Fargate services and also a virtual service/node in order to connect to Elasticache. This is all working properly. The final piece which we are having trouble with is communication from one of our services to Cognito.We saw from some forum posts that App Mesh will only flawlessly communicate with AWS services which have url's that end in amazon.com. Accessing Cognito user pools unfortunately has url's which end in amazoncognito.com and for some reason that's not currently supported by App Mesh.From advice found online it was reccomended to setup a virtual service/node for each cognito user pool url that our service needs to communicate with, similiar to what we did in order to communicate with Elasticache. We setup a virtual service and named it the exact DNS name of the cognito user pool url ([userPoolName].auth.us-east-1.amazoncognito.com). The virtual node is listening via TCP protocol on port 443. We also created a backend referencing this new virtual service in the source virtual service which we can call auth service.After applying these changes and testing we are seeing the following error from our auth service. After doing so and attempting to communicate Cognito we receive that following error: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.IO.IOException: Unable to read data from the transport connection: Connection reset by peer. ---> System.Net.Sockets.SocketException (104): Connection reset by peer --- End of inner exception stack trace A note that our auth service is handling the TLS negotiation.Anyone have any ideas on how I can get this working properly?Thanks so much.FollowComment"


Question: [IoT Core] Duplicate messages from topic forwarding rule

"Hi,I have created a topic forwarding rule in AWS IoT Core using this rule.SELECT * from 'data/device01' WHERE temperature > 35This rule forwards messages to the topic 'data/alarms'. I used QoS 0.I observed duplicate messages like this from the subscription of 'data/alarms'data/alarmsAugust 05, 2020, 14:36:01 (UTC+0900)ExportHide{  "device": "device02",  "temperature": 35.02,  "brightness": 12,  "humidity": 87,  "time": "2020.08.05 07:36:01"}data/alarmsAugust 05, 2020, 14:36:01 (UTC+0900)ExportHide{  "device": "device02",  "temperature": 35.02,  "brightness": 12,  "humidity": 87,  "time": "2020.08.05 07:36:01"}Interesting part is where sometimes there are duplicates and sometimes not.Question: Is this expected behavior of IoT Core?Thanks,FollowComment"

Answer: "0Accepted AnswerThe AWS IoT Core message broker defines MQTT Quality of Service level zero like so:In AWS IoT Core, subscribing to a topic with QoS level 0 means that amessage is delivered zero or more times. A message might be deliveredmore than once. Messages delivered more than once might be sent with adifferent packet ID.https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.htmlCommentShareSounavoanswered 3 years ago"


Question: What is the relationship between the Client VPN Network Association and Client CIDR Block?

"Let's say my Client VPN CIDR Block is 10.0.0.0/22 and my Client VPN Network Association is 10.100.0.0/27 for a VPC at 10.100.0.0/16.The Client VPN CIDR Block (10.0.0.0/22) has 1,024 addresses.The Client VPN Network Association has 32 addresses.Will this cause an issue?Is this a requirement?Client VPN CIDR Block <= Client VPN Network AssociationI don't understand how the two relate to each other.FollowComment"

Answer: "1Accepted AnswerHello,Think of the Client CIDR Block as the Pool of IPs that are handed out to every client that connects to the CVPN. ClientVPN actually does a Source NAT when you connect to the destination.For example, if you expect to support 8,000 VPN connections to your Client VPN endpoint, specify a minimum client CIDR range size of /18 (16,384 IP addresses), and associate at least 2 subnets with the Client VPN endpoint.If you’re unsure what the number of expected VPN connections is for your Client VPN endpoint, we recommend that you specify a size /16 CIDR block or larger.On the other hand note that you can associate the client VPN endpoint to multiple subnets. The requirement is that each of the subnets needs to belong to the same VPC but different Availability ZonesCommentShareEXPERTTushar_Janswered 8 months agoEXPERTToni_Sreviewed 8 months ago0@Tushar_J Thanks for the response. So given these parameters:Private Subnet: 10.100.1.0/24Client CIDR Block: 10.0.0.0/22Client Network Association: 10.100.0.0/27Test VPN Address: 10.0.0.6Test Private Network: 10.100.2.0/24I'm trying to ping an EC2 instance on my Test Private Network from my Test VPN Address. Here's where I still don't understand:Test Private Network ACL Allow: [Client CIDR Block] - will not allow accessTest Private Network ACL Allow: [Client Network Association CIDR Block] - will allow accessI'm guessing there is some type of Private IP NAT going on at the Client Network Association?But I'm confused as to why the NACL works for my Client Network Association CIDR Block and not my Client CIDR block.Thanks,JoeCommentSharerePost-User-4132807answered 8 months agoTushar_J EXPERT8 months agoHi Joe, yes that is correct. When traffic from the end user device reaches the Client VPN endpoint, the source IP address of the packets is translated to the Client VPN endpoint network interface's IP address using source NAT. As a result, the target resources have visibility into all the traffic that's sourced with the Client VPN endpoint network interface's IP address.Share"


Question: occasionally losing event/stream from kinesis to lambda

I am relatively new to AWS. I am working on a system that uses a single Kinesis stream to trigger 2 lambdas. In most cases this is working but occasionally I encounter cases (a few daily) where one or the other lambda fails to process one of the events even though it is clear it has been processed in the other lambda. What might be the cause of this and how would I go about troubleshooting/fixing it?FollowComment

Answer: "0Is the second lambda that was not able to process the message from KDS getting the message or not getting at all? Are you able to tell from the Lambda logs?If the lambda got the message but encountered a failure, then what are your settings for Retry Attempts and have you configured "Split Batch on Error" and "On Failure Destination". Please refer to this - https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.htmlIf the lambda doesn't get the message at all, is it possible that the 2MB/second/shard limit has been exceeded? Have you configured the lambdas as Enhanced Fanout consumers.Another thing to check will be do the lambdas have enough concurrency available in the account to handle the number of shards on the Kinesis Streams and in case you have configured "Concurrent Batches Per Shard" lambda will need even higher concurrency.CommentShareEXPERTIndranil Banerjee AWSanswered 8 months ago"


Question: Move S3 buckets to different account

I need to move 100 S3 bucket from AWS prod account to AWS QA account . How to transfer entire bucket from one account to other AWS account?FollowComment

Answer: 0Accepted AnswerThere is no way to move entire buckets to other account so that moving all objects in their bucket is alternative way. Here is the detail for moving S3 objects to other account.CommentShareAWS-User-2481746answered 6 years ago


Question: Sagemaker Studio notebook instances restricted to 64 megabytes not allow to train Pytorch multiprocess

Sagemaker Studio notebook instances restricted to 64 megabytes not allow to train Pytorch multiprocess with the default dataloaders. How can I add more capacity to /dev/shm or what kernel can I use to train with Pytorch multiprocess?uname -aLinux tensorflow-2-3-gpu--ml-g4dn-xlarge-33edf42bcb5531c041d8b56553ba 4.14.231-173.361.amzn2.x86_64 #1 SMP Mon Apr 26 20:57:08 UTC 2021 x86_64 x86_64 x86_64 GNU/Linuxdf -h | grep -E 'shm|File'Filesystem Size Used Avail Use% Mounted onshm 64M 0 64M 0% /dev/shmFollowCommentNathaniel Ng a year agoAre you using PyTorch with the SageMaker Python SDK (as described here: https://sagemaker.readthedocs.io/en/stable/frameworks/pytorch/using_pytorch.html) or are you bringing your own code to the SageMaker environment (as described here: https://sagemaker.readthedocs.io/en/stable/frameworks/pytorch/using_pytorch.html#bring-your-own-model)?Share

Answer: "0This is being tracked in the GitHub issue linked below.https://github.com/aws/sagemaker-python-sdk/issues/937A possible workaround is to use a regular Notebook Instance instead of a Studio Notebook Instance. On a regular Notebook Instance of the same size (ml.g4dn.xlarge), /dev/shm is 7.7Gdf -h | grep -E 'shm|File'Filesystem      Size  Used Avail Use% Mounted ontmpfs           7.7G     0  7.7G   0% /dev/shmCommentShareSUPPORT ENGINEERPeter_Xanswered a year ago"


Question: Why isn't ITEM included in the Summary section in Textract Expense Analysis API? and it can't capture ITEM most of the time too.

"For Expense Analysis API such as invoice and receipts, I have tested the API in the past few days, and found out it misses ITEM (items purchased/sold) on the receipts or invoice most of the times, and it is NOT included in the Summary section, everything else in the Summary are pretty accurate so far.The question, how to improve this and capture ITEM accurately? Without this key data point being accurate, this Expense Analysis API actually doesn't have too much value, just like the saying "the capacity of a barrel is determined not by the longest wooden bars, but by the shortest".Please kindly advise, thanks.FollowComment"

Answer: "0Item data are returned in LineItemGroups section:SummaryFields - Contains all other information a receipt, such as header information or the vendors nameLineItemGroups- A data set containing LineItems which store information about the lines of text, such as an item purchased and its price on a receipt.See AnalyzeExpense APIHave you reviewed Best Practices for Amazon Textract to improve results produced by Textract?You also may consider using Amazon Textract with Amazon Augmented AI for processing critical documents as described hereCommentShareIgorShanswered 2 months ago0Thanks for the follow up.Even in LineItemGroups LineItems, it fails to capture ITEM most of the time... For a consumer facing product, we can not afford to ask users to follow specific format or guild lines, this is the shortest bar in this barrel which makes this product unusable most of the time. Is there any solution to fix this issue? The goal is to capture ITEM - items purchased/sold.Appreciate your input!CommentSharerePost-User-Seattleanswered 2 months ago"


Question: Lightsail Upfront Payment

"Hello, I'm new to AWSCan i set up AWS Lightsail upfront payment like EC2 instance (I saw it on calculator pricing EC2)?Default Lightsail pricing is monthly based, is it possible to added ie 1 year payment for lightsail, or maybe there's some options to added credit balance on AWS?Thank you for the answerFollowComment"

Answer: "1AWS does currently have a new feature of Advance Pay in public preview which allows customers to pay for their usage in advance subject to certain restrictions.Please find details here :https://aws.amazon.com/about-aws/whats-new/2021/07/aws-allows-customers-pay-their-usage-in-advance/https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-advancepay.htmlCommentShareAWS-SUManswered 3 months agorePost-User-4700714 3 months agoThank you for your help, that's exactly what I mean. Maybe in future can using international bank transfer like Citibank that available in my country without incur additional bank chargeShare"


Question: What SAP products are supported for deployment using AWS Launch Wizard for SAP?

What SAP products are supported for deployment using AWS Launch Wizard for SAP?NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyone.FollowComment

Answer: "1Accepted AnswerAs at the time of writing this answer, AWS Launch Wizard for SAP supports  SAP NetWeaver on HANA ( 7.5 SPS02 and 7.5 SPS00 ), SAP BW/4HANA ( 2.0 and 2021 ), SAP S/4HANA ( 1909, 2020, and 2021 ).Please refer to the following AWS Document for more details :https://docs.aws.amazon.com/launchwizard/latest/userguide/launch-wizard-sap-versions.htmlNOTE: This answer is provided by the SAP on AWS speciality team and is accurate at the time of publish. Please check comments as the answer may have changed/services evolved.“CommentSharedemouzonanswered a year agoSunil_Y 8 months agoA recent addition the list is Solution Manager 7.2. For most up to date list, refer to the link above.Share"


Question: Codebuild local cache with a more permanent time

"I use the cache in code build to cache my maven .m2 folder. I tried using the local cache feature and the build process was noticeably faster. However, as the local cache is temporal, several times per day the build re download all my dependencies again.Is there a way to mark the local cache as to not expire?FollowComment"

Answer: "-1Hi lfec,We do not currently offer the ability to modify the local cache expiration, which is presently related to the frequency and number of builds run. However, we are always looking for ways to expand on this feature, so thank you for the feedback!CommentShareAWS-User-6139167answered 4 years ago"


Question: aws step function invoke with token functionality for invoking aws personalize batch segment job

"We want to trigger the aws personalize item attribute affinity user segment batch job from our application. We are planning to use step function to trigger the batch segment. The batch segment job is asynchronous job, the job might take more time to complete. Can we use step functions invoke with "Wait for a Callback with the Task Token" functionality to trigger batch segment job ? So that we don't need to implement the wait/sleep and awage/check loop.Or is there any other way to check the job status without being in a wait-sleep cycle ?FollowComment"

Answer: "0Accepted AnswerNot sure what exactly you are asking. If the API you are calling is synchronous, i.e., it blocks until the operation is done and when it returns, you get the answer, there is nothing special you need to do.If however, the operation is asynchronous, i.e., you get a job ID, you will need to poll for the response by getting into a look that gets the status of the job, checks for completion, and if it did not complete yet, wait a few seconds/minutes and go back.Specifically with Personalize, if you refer to the create_batch_segment_job, it is asynchrouns, you will need to call describe_batch_segment_job in a loop to get the latest status.There are a few services that have optimized integrations with Step Functions. With these services you can call the API using .sync in the resource name, and Step Functions will do the loop for you. Personalize is not one of these services.You also mentioned a token. I am not sure exactly to which token you are refering to. If you are refering to the Wait for task token integration type, you will need someone to call the completion API, and Personalize does't know how to do it.CommentShareEXPERTUrianswered 2 months agoG V Navin 2 months agoMy apologies for not being very clear. I edited the question.I was talking about "Wait for a Callback with the Task Token" - https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-tokenShare"


Question: Can you add custom Security Stadards or edit existing Standards?

"I don't see this mentioned in the documentation and I do not see any options in the console, so I thought I would double check here to ensure I am not missing anything:Can you create your own Security Standard that has a set of rules that you'd like your accounts to comply with?Can you customize existing Security Standards?  For example, before enabling the CIS Benchmark, can I disable all Level 2 controls?  Or is the only way to do this to enable the standard and then disable individual controls afterwards?Perhaps using another tool that can integrate with Security Hub, such as Prowler, is the way to go for a custom Security Standard?Thank youFollowComment"

Answer: "0Fully customizable standards are coming in the future. Today, you can disable individual controls in a standard. This can only be done after you have enabled the standard.Relevant docs:https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable-controls.htmlhttps://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-cis-to-disable.htmlCommentShareEly_Kanswered 3 years agorePost-User-9257957 9 months agoHi Ely, so are we now able to add custom Security Standards in the security hub?ShareJhoov 9 months agoHi Ely,I don't see that this was ever released and we'd still like to be able to define a custom standard.  Selecting rules from the existing standards would be perfectly acceptable for us.  We know we can enable the standards via the API and then turn off individual rules, but we then have to monitor for new rules and add them to the script or we will have new AWS accounts with rules that we do not wish to be enabled.  It would be so much easier to just select the rules we wish to have enabled and add them to a custom standard.  We wouldn't have to constantly maintain the script that way and it would simplify the entire process.  Please let us know if this is still planned.Thank you,JeffShare0Thank you, Ely.  That is great to hear about fully customizable standards coming in the future.  Also, thank you for confirming that we can only enable standards and then disable individual rules.  That is what I thought.CommentShareJhoovanswered 3 years ago"


Question: SendMessageBatch API

"Hello,I am using the java sdk and using sendMessageBatch to send messages to a FIFO queue. I am trying to understand exactly how the messages are enqueued into the FIFO queue. More specifically, I want to know if these messages all enter the queue and become visible at the same time or if there they are posted one by one behind the scenes. I have gone through as much documentation as possible and have not found the answer, the closest I have read was this:"For a FIFO queue, multiple messages within a single batch are enqueued in the order they are sent."from the documentation here: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessageBatch.htmlUnfortunately, this doesn't give me the information I am looking for and hoping someone may be able to help with this!Thank you,BrandonFollowComment"

Answer: "0Accepted AnswerYou are right, I can confirm that currently if the following conditions are met for an SQS FIFO queue:The queue has no messages available to be returned (either empty or all messages are in flight)There is a long-poll ReceiveMessage call already waiting on the queueA batch of messages is sent to the FIFO queuethen the existing long-poll ReceiveMessage call will complete immediately and return only first message of the sent batch. If there was another long-poll ReceiveMessage calls pending as well, it will return the remaining messages of the batch (but only if they had a different message group id - the rules of FIFO ordering still apply).This behavior will affect the scenario you are trying to do to minimize the number of calls to SQS. I've added a request to change this behavior to the team's backlog.CommentShareKubaanswered 4 years ago0Please provide more info about your use case, specifically why would this make a difference?The behavior of batch sends vs messages becoming visible is more closely tied to what message group ids do you assign to messages in the batch.If all messages in the batch have the same message group id, then only the first message becomes available to be received.If all messages in the batch have a different message group id, then all messages are available to be received.The above assumes the queue is empty. If there were already messages in the queue, the above behavior depends on whether you had invisible messages for those message group ids.CommentShareKubaanswered 4 years ago0Sure here are some additional details. For the FIFO queue, we are using content based deduplication but are not using a Deduplication Id.For out problem, we are trying to efficiently calculate a specific value on an account in our DB (Outside AWS).For our infrastructure, we have two lambdas (one with a regular SQS queue as a trigger) and a FIFO queue. The flow works something along these lines:An event is published from our system with a list of account Ids that need to be calculatedThis is published to the SQS Queue which triggers the first lambda (Let's call this the eventHandler)The eventHandler creates a new event for each account Id to be processed and publishes these to the FIFO queue (using sendMessageBatch in batches of up to 10)After the messages are published, the eventHandler asynchronously invokes the second lambda (Let's call this the CalculationHandler) which can pull up to 190 events from the FIFO queueThe CalculationHandler does some processing (making API calls into our system), gets a final value, and updates the accountThe CalculationHandler will then poll the FIFO queue and if no messages exist, it will finishAs a side note, we have concurrency set to be larger than 1 so multiple lambdas can be invoked at once.The reason the FIFO queue is important here is because if 3 events come in for the same account and they are all sitting in the FIFO queue, we only need to do the calculation once (this is why we use content based-deduplication). Deduplication will not work because of the 5 minute wait after the account has been processed to avoid duplicates being published.I am attempting to get an idea on the number of API calls the CalculationHandler does back into our system given certain metrics. However, what I have noticed in some scenarios is that 9 events get published (set to be 5 seconds apart), these get published to the FIFO queue in 9 separate batches (I configured the size of the accounts to be under 10 so that each event would be published in one batch), but the CalculationHandler pulls messages from the queue 16 times (the numbers add up to the same number of accounts published but the size of the messages pulled are smaller than the messages published). This leads me to believe that when calling sendMessageBatch, not all messages become available in the queue at the same time leading to more messages being pulled than initially being published and resulting in higher API calls to our system.I was hoping to get clarification on whether sendMessageBatch would make all messages visible at the same time or if there could be a delay in some messages?Back to your point, in this use case there should be no messages in the same batch that have the same message group id. Any messages with the same message group Id that would already be sitting in the queue would have the same content and should be removed through content-based deduplication.CommentSharebrandon11answered 4 years ago"


Question: EC2 Image Builder not working in the private subnet

"I have retrying to use EC2 Image Builder in a private subnet and image is failing to create with this error.I already created a VPC endpoint for image builder for my private subnet. What else can we done?Resource handler returned message: "Error occurred during operation 'SSM execution "id" failed for image "xxxx arn" with status = 'Failed' in state = 'BUILDING' and failure message = 'failed to download the EC2 Image Builder Component "xxx arn". Error - operation error imagebuilder: GetComponent, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failedFollowComment"

Answer: "0Hi, I happened to see someone in our organisation contact AWS support about this very thing a few days ago.  In summary, the outcome is that outbound internet access is required so your subnet needs NAT Gateway access for example.  Here's part of the response from Support:I reviewed ... and was able to obtain the entire error which is broken down below:"reason": "SSM execution 'xxx' failed for image arn: 'arn:aws:imagebuilder:xxx' with status = 'Failed' in state = 'BUILDING' and failure message = 'failed to download the EC2 Image Builder Component 'arn:aws:imagebuilder:xxx:component/aws-cli-version-2-linux/1.0.3/1'. Error - operation error imagebuilder: GetComponent, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Get "https://imagebuilder.ap-southeast-2.amazonaws.com/GetComponent?componentBuildVersionArn=arn%3Aaws%3Aimagebuilder%3Axxx%3Acomponent%2Faws-cli-version-2-linux%2F1.0.3%2F1": dial tcp 52.63.252.130:443: i/o timeout'"...From the output we can see that it failed to connect to the IP 52.63.252.130 TCP port 443 (https). We can rule out a DNS issue based on the above output but not necessarily a connectivity issue.From the infrastructure configuration, I can see that the ... instance ... will fail when trying to connect to resources on the public internet.CommentShareEXPERTskinsmananswered a year ago"


Question: There is a delay for AWS Config Log to capture the configuration Changes

we have EKS clusters being deleted on 7th Feb and this change can be found on CloudTrail. How ever in the AWS config log it only appears on 9th Feb. Please help to clarify the delay.FollowComment

Answer: "0Hello,I hope you're doing well.Thank you for reaching out to us with your concern.I understand that you have few queries related to delay for AWS Config Log to capture the configuration changes.Q: we have EKS clusters being deleted on 7th Feb and this change can be found on CloudTrail. How ever in the AWS config log it only appears on 9th Feb. Please help to clarify the delay. Usually, There might be a delay in recording resources with AWS Config. AWS Config records resources only after it discovers the resources. However, You're getting more time than expected. To verify this, I have replicated the same in my lab environment, where I can be able to see the config changes as expected.  Inorder to find the actual root cause, I would like to check your config resources details. Hence, I would request you raise a support case ticket, where we can go deep dive into the resources to find out the actual root cause.Thank you! Have a wonderful day!Reference:[1] https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/TrackingChanges.html[2] https://docs.aws.amazon.com/config/latest/developerguide/view-manage-resource.html[3] https://docs.aws.amazon.com/config/latest/developerguide/faq.htmlCommentSharerePost-User-6294732answered 4 months ago"


Question: GameKit Cognito user registration through the web user portal

"Hello Everyone,We have gameKit setup for unreal Engine game and managing username passwords via gamekit.However we also want to allow game users to register through user portal.When user registers from game, in AWS cognito via gamekit, there are two user variables createdgk_user_idgk_user_hash_keyHowever above two variables are not generated when user registers via webpage.We have already configured cognito.Is there any way , we can get custom variables gk_user_id and gk_user_hash_key generated via webpage registration  ?Thank youFollowComment"

Answer: "0Hi PeterS,Thanks for asking this question.Unfortunately the Cognito Web Portal only allows you to customize the UI, but not the playload it sends. So the web portal can't create the custom attributes gk_user_id and gk_user_hash_key for the user.I would recommend creating your own web portal and have it make a POST request to a custom Lambda function that does the registration. Inside the Lambda function you would do this logic: https://github.com/aws/aws-gamekit/blob/main/aws-gamekit-identity/source/aws/gamekit/identity/gamekit_identity.cpp#L41-L100Alternatively, you could try modifying the CognitoPreSignup and CognitoPostConfirmation Lambda functions so they generate the two custom attributes if they are missing from the request (since they are missing from the web portal requests). Here's how to generate the attributes in a Lambda function.I've created an internal feature request to add support for doing website based user registration and login. To help make sure this request meets your needs, would you mind explaining your use case more? Are you only trying to do registration through the web portal? Or do you also want players to log in through the web portal (i.e. player loads game, logs in through website, then plays game)? Anything else?CommentSharekevomara-awsanswered 10 months ago"


Question: Athena query to pull EC2 instance type cost per account

"I'm looking for a way either through Cost Explorer or CUR/Athena query to pull EC2 Instance Type usage per account and its associated cost.For example; If I am using m4.2xlarge, how many accounts are using this instance type and its cost.I've close to 60 different instance type and close to 20 accounts.FollowComment"

Answer: "0Accepted AnswerHello I have some corrections to the above query.Include Spot costsHas Pricing termHas Amortized cost, in addition to the billed cost.  This is especially important if the customer bought up front or partial upfront RIs or SPsSavings plan negation should not be ommittted unless using amortized costs.You still will have to replace the same name.You should also use a where clause to restruct the timeframe .  For example to find Jan cost you would write:where line_item_useage_state_date >= date '2021-01-01' and  line_item_useage_state_date <date '2021-01-01' andSELECT  line_item_usage_account_id, (CASE WHEN (line_item_usage_type LIKE '%SpotUsage%') THEN 'Spot'    WHEN (((product_usagetype LIKE '%BoxUsage%') OR (product_usagetype LIKE '%DedicatedUsage:%')) AND ("line_item_line_item_type" LIKE 'SavingsPlanCoveredUsage')) or (line_item_line_item_type = 'SavingsPlanNegation') THEN 'SavingsPlan'    WHEN (("product_usagetype" LIKE '%BoxUsage%') AND ("line_item_line_item_type" LIKE 'DiscountedUsage')) THEN 'ReservedInstance'    WHEN ((("product_usagetype" LIKE '%BoxUsage%') OR ("product_usagetype" LIKE '%DedicatedUsage:%')) AND ("line_item_line_item_type" LIKE 'Usage')) THEN 'OnDemand'    ELSE 'Other' END) "Pricing Term"  , case when line_item_usage_type like '%BoxUsage' or line_item_usage_type like '%DedicatedUsage' then product_instance_type else split_part (line_item_usage_type, ':', 2) end InstanceType, round (sum (line_item_unblended_cost),2) BilledCost, round (sum((CASE      WHEN line_item_usage_type LIKE '%SpotUsage%' THEN line_item_unblended_cost       WHEN ((product_usagetype LIKE '%BoxUsage%') OR (product_usagetype LIKE '%DedicatedUsage:%')) AND (line_item_line_item_type LIKE 'Usage') THEN line_item_unblended_cost      WHEN ((line_item_line_item_type LIKE 'SavingsPlanCoveredUsage')) THEN TRY_CAST(savings_plan_savings_plan_effective_cost AS double)      WHEN ((line_item_line_item_type LIKE 'DiscountedUsage')) THEN reservation_effective_cost     WHEN (line_item_line_item_type = 'SavingsPlanNegation') then 0     ELSE line_item_unblended_cost END)), 2) "AmortizedCost"   FROM <your table>where line_item_operation like '%RunInstance%' and line_item_product_code = 'AmazonEC2' and (product_instance_type <> '' or  (line_item_usage_type  like '%SpotUsage%' and line_item_line_item_type = 'Usage'))  group by 1,2,3CommentShareAWS-User-7298241answered 2 years ago"


Question: can I set up DNS to route requests to an alternate subdomain with EC2?

"I have a domain with 3 instances within EC2. I would like to create a subdomain that routes traffic to a specific IP, am I able to do that with EC2 or do I need to use Route53? I'm also using the ELB service but I don't think it has any DNS features.Thanks,cFollowComment"

Answer: "0Hi there!Thank for posting your question here.You can use Route 53 to create an A record that will point to that specific instance IP and You are correct, the ELB service is not a DNS service. Route 53 is the only DNS service available in AWS and Route 53 does support the creation of ALIAS records pointing to your load balancers.I believe this answers you questions and concerns, and if not, then you are more than welcome for further engagement.CommentShareThabo-Lwazi-Mziyakoanswered 3 years ago0Thanks very much, I'll look into Route 53. Much appreciated! cCommentSharecchobbsanswered 3 years ago"


Question: Need to delete a service I cannot locate

My bill says I have a windows t2 instance I am paying for. But I cannot locate that service in order to cancel it. Also says I have a light sail service paying for. I assume these are the same. But when I goto lightsail it says I have nothingFollowComment

Answer: "0Hi ThereFirst, check How do I check for active resources that I no longer need on my AWS account? for help on locating running services that you are being billed forSpecifically for Lightsail, there may be additional resources that don't get automatically removed when you terminate the instance.  See How do I shut down my Amazon Lightsail resources?CommentShareEXPERTMatt-Banswered 2 months ago"


Question: Running FPGA machines on EKS

"Hello, we'd like to run our FPGA machines inside our EKS cluster. Does anyone know of a working AMI/ECR image combination that would allow this to happen? We've tried rolling our own in several ways with no success. Thanks in advance.FollowCommentJeremy a year agoPretty sure you need to use a device plug-in to use an FPGA adapter with Kubernetes. Looks like Intel has one, https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/fpga_plugin/README.html as does Xilinx, https://www.xilinx.com/developer/articles/using-alveo-in-a-kubernetes-environment.html and InAccel, https://docs.inaccel.com/setup/kubernetes/. Unfortunately, I don't have first hand experience with them so I can't tell you that they will work with EKS.Share"

Answer: "0If your use case is VT1 video transcoding, this documentation page provides some details: https://docs.aws.amazon.com/eks/latest/userguide/vt1.htmlCommentShareAWS-Harrisonanswered a month ago0Dear customer,Thank you so much for your question. Some of our customers had success with using our FPGA Developer AMI(AL2) with Docker. Are you using AL2? Also is there a specific ECR image that you are interested in/using?ThanksKishoreCommentShareAWS-User-7905434answered a month ago"