Question: How to configure ec2 instance for intranet only

"I have an app that I want to host on AWS ec2 instance but I only need it to be accessed on my intranet, what changes I need to make in order to keep my IP only accessible for my intranet and block outside access. I've done some research and I think I need to create some security group but what things I need to know from my intranet to configure my instance. Do you have any suggestions or maybe some steps on how to restrict the access for my intranet?FollowComment"

Answer: "2Here are the steps you can follow:Determine the IP address range of your intranet. You can check with your network administrator or use a tool like ipconfig or ifconfig to determine the IP address of your computer on the intranet. You can then use an IP address calculator to determine the range of IP addresses for your intranet.Create a new security group or modify the existing security group associated with your EC2 instance.Add an inbound rule to allow traffic only from your intranet's IP address range. For example, if your intranet's IP address range is 192.168.0.0/16, you can add an inbound rule to allow traffic from the source IP address range of 192.168.0.0/16.Test the connectivity to your EC2 instance from a computer on your intranet to ensure that the inbound rule is working correctly.You always have the option to host your Application inside a VPC, with the routes to the internal network for different subnets that you create.CommentShareGovind Kumaranswered a month ago"


Question: Pushing matchmaking updates to mobile clients in real time

We are listening to FlexMatch notifications using SNS to Lambda and writing session info to a DynamoDB table. Our game runs on iOS through Unity and our backend exposes a REST API. We currently have the client poll our API after starting matchmaking but we want to switch to some kind of a push mechanism.What is a good AWS based solution for pushing matchmaking updates to the client? Looks like AppSync has some kind of a pub-sub tech but might require adapting to a GraphQL paradigm & writing a .NET wrapper to the AppSync iOS library. Maybe APNs with silent notifications through SNS? Is APNs reliable enough for anyone's experience?FollowComment

Answer: "0Hi @REDACTEDUSERRegards,ShashankCommentSharerePost-User-7791211answered a year ago"


Question: Building Docker image from multi-architecture base

"Hi there,We have pushed a multi-architecture Docker-image to AWS ECR and using it to generate other images.This is how the image and manifests look like on AWS ECR: % docker buildx imagetools inspect xxxx.dkr.ecr.us-east-1.amazonaws.com/my-image:2.8.1-pg14Name:    xxxx.dkr.ecr.us-east-1.amazonaws.com/my-image:2.8.1-pg14MediaType: application/vnd.docker.distribution.manifest.list.v2+jsonDigest:    sha256:59370d981db57776e336a97685c9a3930cf8227cdcbe86e6a19ce5665ab5f455           Manifests:   Name:   xxxx.dkr.ecr.us-east-1.amazonaws.com/my-image:2.8.1-pg14@sha256:e32ab6eb62bdfa2f639dac598987ef4f3a1557ed6eb459bc319734a540295224  MediaType: application/vnd.docker.distribution.manifest.v2+json  Platform:  linux/arm64               Name:  xxxx.dkr.ecr.us-east-1.amazonaws.com/my-image:2.8.1-pg14@sha256:1f977546f6d8b61a8fdb7d9b78873efa34e643430b8e02a4a223a890a9d771e1  MediaType: application/vnd.docker.distribution.manifest.v2+json  Platform:  linux/amd64Then we have a very simple Dockerfile, which builds the final image for each architecture:FROM --platform=linux/arm64 xxxx.dkr.ecr.us-east-1.amazonaws.com/my-image:2.8.1-pg14COPY xxx.txt /etc/confThe image gets build but the architecture is wrong. AWS ECR seems to ignore the --platform=linux/arm64 attribute in FROM and uses linux/amd64 instead.Is this not supported on AWS ECR?ThanksFollowCommentrodmaz 6 months agoFYI: The same approach works flawlessly when the multi-architecture image is stored in Docker Hub.Share"


Question: Direct Connect Gateway pricing?

Is there any cost associated with using Direct Connect Gateway?FollowComment

Answer: 0Accepted AnswerThere are no charges for using a Direct Connect gateway. You will pay applicable egress data charges based on the source remote AWS Region and port hour charges as per AWS Direct Connect pricing.CommentShareAarthi_Ranswered 5 years ago


Question: "Check Staffing always seem to return TRUE, even if no agents connected."

"Hi,Check Staffing always returns TRUE, even if no agents connected or online.My flow does the following:set working queuecheck hours of operation (current queue)check staffing (STAFFED) (current queue) -> i've also tried ONLINEcheck queue status TimeInQueue<3min (current queue)set customer queue flowtransfer to queueSo I have a problem with step 3. It always passes to step 4... even if nobody connected. No idea why... The idea is to transfer to an external number if no agents connected or online.Anybody an idea?Edited by: verhak on Nov 27, 2019 2:22 PMFollowComment"

Answer: 0Ok.. found the problem... one of the agents got stuck... Even after I've deleted the user it was still shown up as available in the real time stats... After I cleared all my browser caches the user was finally no longer shown as available. All ok now :)CommentShareverhakanswered 4 years ago


Question: AWS CLI greengrass v2 create-deployment using JSON to import lambda not importing lambda artifact

"I am importing lambdas as components for ggv2 using the AWS CLI. The lambdas import successfully but when I deploy to greengrass v2 I get the following error:Error occurred while processing deployment. {deploymentId=********************, serviceName=DeploymentService, currentState=RUNNING}java.util.concurrent.ExecutionException: com.aws.greengrass.componentmanager.exceptions.NoAvailableComponentVersionException: No local or cloud component version satisfies the requirements. Check whether the version constraints conflict and that the component exists in your AWS account with a version that matches the version constraints. If the version constraints conflict, revise deployments to resolve the conflict. Component devmgmt.device.scheduler version constraints: thinggroup/dev-e01 requires =3.0.61. at java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)The version exists as it was imported successfully but the artifact is not transferred to the Greengrass Core. If I import the lambda from the AWS Management Console then it works as expected.Here is my CLI json input file and the command I am running. What am I missing?aws greengrassv2 create-component-version --cli-input-json file://lambda-import-worker.jsonlambda-import-worker.json file:{  "lambdaFunction": {    "lambdaArn": "arn:aws:lambda:*******:***************:function:devmgmt-worker:319",    "componentName": "devmgmt.device.scheduler",    "componentVersion": "3.0.61",    "componentPlatforms": [      {        "name": "Linux amd64",        "attributes": { "os": "All", "platform": "All" }      }    ],    "componentDependencies": {     "aws.greengrass.TokenExchangeService":{        "versionRequirement": ">=2.0.0 <3.0.0",        "dependencyType": "HARD"      },      "aws.greengrass.LambdaLauncher": {        "versionRequirement": ">=2.0.0 <3.0.0",        "dependencyType": "HARD"      },      "aws.greengrass.LambdaRuntimes": {        "versionRequirement": ">=2.0.0 <3.0.0",        "dependencyType": "SOFT"      }    },    "componentLambdaParameters": {      "maxQueueSize": 1000,      "maxInstancesCount": 100,      "maxIdleTimeInSeconds": 120,      "timeoutInSeconds": 60,      "statusTimeoutInSeconds": 60,      "pinned": true,      "inputPayloadEncodingType": "json",      "environmentVariables": {},      "execArgs": [],      "linuxProcessParams": {        "isolationMode": "NoContainer"      },      "eventSources": [        {          "topic": "device/notice",          "type": "PUB_SUB"        },        {          "topic": "$aws/things/thingnameManager/shadow/name/ops/update/accepted",          "type": "IOT_CORE"        },        {          "topic": "dev/device",          "type": "IOT_CORE"        }      ]    }  }}FollowComment"

Answer: "1Accepted AnswerI suspect this is failing because your componentPlatform section is incorrect.  Replace platform with architecture. Or, since all platforms are supported by default, omit this section entirely.    "componentPlatforms": [      {        "name": "Linux amd64",        "attributes": { "os": "*", "architecture": "*" }      }    ],I've opened a ticket to get this clarified in the documentation and will see what we can do about improving this error message in Nucleus.Thanks,-joeCommentShareJoeAtAWSanswered a year agoJAG a year agoOut of curiosity if I am running greengrass in a container that reports the platform as linux amd64, what should the attribute strings os and architecture be?ShareJoeAtAWS a year agolinux and amd64Source: https://github.com/aws-greengrass/aws-greengrass-nucleus/blob/988385b5b04ffc827aedf577ed27741aaa4b43ea/src/main/java/com/aws/greengrass/config/PlatformResolver.java#L38-L51Share"


Question: Problems while hosting Remix JS app with AWS Amplify

"I have created a Remix JS app, then built it locally, and it's working fine. Then I created a repository in CodeCommit and kept the App there, then I tried to host it with AWS Amplify. It created a pipeline and the pipeline succeeded, but when I am opening the app in the browser with the link from Amplify pipeline, it is giving following error.If anyone can help with this scenario that would be great. Thanks in advance.FollowCommentrePost-User-4223405 8 months agoI also have the same problem with AWS Amplify hosting with Remix.JSShareThomasFr 8 months agoHi, would you be able to share the full url you are using to access your app? Have you looked into the S3 bucket Amplify has generated for the static content? What Amplify does is create a S3 Bucket and put all the static assets there and put a CloudFront Distribution in front. This error shown is coming from S3 when CloudFront tries to forward the request to S3 to get the requested object.Share"

Answer: "1Hello, I understand that you would like to host your application based on RemixJs framework to Amplify. After deploying the application, you are getting "AccessDenied" when accessing the application using the branch URL generated by Amplify.Unfortunately, as of now Amplify doesn't not support hosting for RemixJs application and it's currently a feature request. Also, you may refer to the comment on this Github issue where engineer from Service team has also mentioned the same.Having said that, I am unable to comment on when this feature may get released, I request you to keep an eye on our What's New and Blog pages for any new feature announcements.In case I misunderstood the query, please feel free to reach out to us via creating a support case from the support centre dashboard.CommentShareSUPPORT ENGINEERAnkit_Vanswered 8 months ago"


Question: Is CloudEndure(CE)/AWS Elastic Disaster Recovery(AWS EDRS) supported for disaster recovery of SAP on AWS?

"Is CloudEndure(CE)/AWS Elastic Disaster Recovery(AWS EDRS) supported for disaster recovery of SAP on AWS?NOTE: This is a common question asked by AWS customers. The AWS team is posting it to provide an answer that can benefit everyoneFollowCommentSteven 7 months agoYes, you can use AWS Elastic DR to minimizes downtime and data loss with fast, reliable recovery from disasterShare"

Answer: "1Accepted AnswerYes, you can use CloudEndure(CE)/AWS Elastic Disaster Recovery(AWS EDRS) to protect your most critical databases, including Oracle, MySQL, and Microsoft SQL Server, as well as enterprise applications such as SAP.We recommend using CE/EDRS for the SAP application servers in conjunction with database replication technologies to a secondary/warm standby server to achieve a low RPO & RTO of your SAP workload. For further details please refer to the SAP Disaster Recovery Solution Using CloudEndure (https://aws.amazon.com/blogs/awsforsap/sap-disaster-recovery-solution-using-cloudendure-part-1-failover/) blog.CommentShareKhaliluddin_Sanswered a year ago"


Question: DynamoDB Atomic Counters

"Greetings!I have an application that utilizes a DynamoDB table to manage counters. When we update the value of the counter, we consume the returned value - this returned value is the old value of the counter.This counter is then used to retrieve a value in an array, it is effectively an index.I currently increment these counters with Lambda functions - it's highly likely that many Lambdas may attempt to update the value of a given counter at the same time. It's important that each Lambda function receives a different value of the counter.Utilizing DynamoDB atomic counters, can I expect that each Lambda function will receive a different value for the counter?Example:10 Lambdas attempt to update value of a counter where its current value is 0The Update Expression is "ADD count :incr" where ":incr" is 1Each Lambdas update is processedThe returned value from each update is unique per Lambda and the values are 0 - 9The final value of the counter is 10FollowComment"

Answer: "2Yes, this is exactly how atomic counters work. You can find more info hereCommentShareEXPERTUrianswered a year agoEXPERTBrettski-AWSreviewed a year agoAWS-User-6695896 a year agoFantastic, thank you for confirming!Share"


Question: Having issues saving on elasticbeanstalk

"AWS has recently changed their UI, and when i try to change EBS settings for logging and click saves, it loads for a bit and then does nothing, therefore not saving my recent changes.  is anyone experiencing this issue ?FollowComment"

Answer: "0**To troubleshoot this issue, you can try the following steps:**Ensure that you have the necessary permissions to modify EBS settings.Try using a different browser or device to see if the issue persists.Clear your browser cache and cookies and try again.Check if there are any AWS service or infrastructure issues by visiting the AWS Service Health Dashboard (https://status.aws.amazon.com/).Try accessing the EBS settings from the AWS CLI or AWS SDKs to see if the issue persists.Contact AWS support if the issue persists.AWS support can help you troubleshoot the issue and escalate it to the appropriate team for further investigation.CommentShareKanavpreet Singhanswered 3 months ago"


Question: Amazon GameLift now supports AWS Local Zones

"Hello GameLift Devs,Today, the GameLift team is excited to announce the general availability of AWS Local Zones. With this update, you can seamlessly provide gameplay experiences across 8 new AWS Local Zones in Chicago, Houston, Dallas, Kansas City, Denver, Atlanta, Los Angeles, and Phoenix.Along with the updated support for Local Zones, we are adding new instance types specifically supported in the various Local Zone Regions, including C5d and R5d instance types. Additionally we are adding support for the next generation C6a and C6i instance types. Amazon EC2 C6i instances are powered by 3rd Generation Intel Xeon Scalable processors and deliver up to 15% better price performance compared to C5 instances for a wide variety of workloads and are ideal for highly scalable multiplayer games.You can find updated pricing on the GameLift pricing page as well as in the AWS Pricing Calculator.For more information, please refer to our Release Notes and What’s New post.Mark Choi, GameLift PMFollowComment"


Question: Glue: Testing connection triggers "Task allocated capacity exceeded limit" error

"We have a Glue connection that was running successfully. Now, though, even when testing the connection we get a "Task allocated capacity exceeded limit" error. We have checked the max DPUs and concurrency quotas. They're fine. The connection is going though a VPC, but that was working a couple of days ago.No CloudWatch logs are being written, so it's impossible to know what service / quota limit is triggering the error.FollowComment"

Answer: "0I'll answer my own question :)For some reason, AWS kept resetting my DPU quota to 0 after increasing it to 1000. So I just requested more than 1000 and now it's sticking.CommentSharerePost-User-2690376answered 10 months ago"


Question: Opensearch IP-based policies not working for some IPs

"I deployed an opensearch domain for testing purposes on a public VPC.Configured an IP based access policy to allow access to the domain for me and another co-worker. Both of our IPs should be allowed to access the domain.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "*"      },      "Action": "es:*",      "Resource": "arn:aws:es:us-east-1:564646946125:domain/test-domain/*",      "Condition": {        "IpAddress": {          "aws:SourceIp": [            "x.x.x.x/32",            "y.y.y.y/32",          ]        }      }    }  ]}I can successfully access the domain by clicking its endpoint.However, my co-worker gets an error.{"message":"Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization header requires 'SignedHeaders' parameter. Authorization header requires existence of either a 'X-Amz-Date' or a 'Date' header. Authorization=Basic NGRtMW46UDQkJHcwcmQ="}FollowComment"

Answer: "0It looks like your co-worker is getting an authorization error, which means their request is not being allowed by the IP-based access policy. One thing you can check is whether your co-worker's IP address is correct and within the CIDR range specified in the policy.If the IP address is correct, you can try removing the "AWS" principal from the policy and specify the "Condition" block with the "IpAddress" field only. Here's an example:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "es:*",      "Resource": "arn:aws:es:us-east-1:564646946125:domain/test-domain/*",      "Condition": {        "IpAddress": {          "aws:SourceIp": [            "x.x.x.x/32",            "y.y.y.y/32"          ]        }      }    }  ]}Make sure to replace the IP addresses with the correct ones for you and your co-worker. Also, make sure that both of you are using the correct AWS access keys when making requests to the OpenSearch domain.CommentSharehashanswered a month ago"


Question: Master and Slave Instances Architecture

"Hi Dears,I have a qustion on how to build master EC2 that can communicate with other EC2s based on need and send tasks to them based on a certian code/ group of tasks.  Where Master EC2 will take data from RDS db and send data with task to each EC2 based on scudualing and aknowledgamet from each one.I appriclate your help dears!ThanksBasemFollowComment"

Answer: "2Accepted AnswerI would probably put the tasks on SQS, then have the "Slaves" (worker nodes) pull the messages from SQS.If tasks contain a lot of data, save it to S3, and have the SQS message include a path (key) to the object so that the worker can find it.This will be more robust (retry etc.), you can scale your EC2s based on SQS queue length, and you won't have to deal with service discovery (CloudMap/ALB) and firewalls while staying secure.Good luck!//CarlCommentShareCarl Ostrandanswered 10 months ago1Do you want to think of using AWS Batch or serverless compute (StepFunction or a series of Lambda functions) for such use-case?https://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.htmlhttps://aws.amazon.com/step-functions/An example serverless batch processing architecture (may or may not be suitable for your use-case, but just an fyi) -https://aws.amazon.com/blogs/compute/creating-aws-serverless-batch-processing-architectures/CommentShareRajesh Sanswered 10 months ago"


Question: System was unable to deliver your mail

"Good afternoonWhat is this about please?I've been sending successfully since we took out this account on 27 December 2018 nothing's changed as far as I know.............................................Unfortunately, the system was unable to deliver your mail.The error given was:2019-01-10 14:45:09 : <Sending Email> Local address contains control or whitespaceYou may need to contact your e-mail administrator to solve this problem...................................................BestAndyFollowComment"

Answer: "0Hi Andy,I'm sorry to hear you're experiencing problems sending mails. I will ask the service team to take a look, in the meantime can you take a look at the recipients of your email and check if there are any white spaces in any of the email addresses?Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago0Good afternoon Robin,Thank you for asking.This refers to the messages I'm sending to not the one I'm sending from?The email in question was sent two email addresses and copied into two more.To be sure, before I posted this message, I checked the records locally as best I could.Two of the addresses were not in the contacts list so I added them, checked them for spaces, and added them back to the sending, plus I checked the ones that were in the contact list already again to no good effect.BestAndyCommentShareDTbusynessanswered 4 years ago0Good afternoon Robin,I just had another go and the message now been sent.I wonder if the interface had not been updated with your servers but for safety sake I stripped out the contents of the message into a text pad file and then pasted it back taking out any of the HTML-ish contentsSo I've marked this query as dealt withCommentShareDTbusynessanswered 4 years ago0Hi Andy,Good to hear you where able to send your message.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 4 years ago"


Question: Long codes for SMS on Amazon SNS no longer supported

"I keep getting alerts from AWS:We are contacting you because your AWS account contains one or more long codes for SMS workloads on Amazon SNS which are no longer supported for sending SMS text messages to the United StatesBut I only have one phone number in Amazon Pinpoint, which is assigned to a 10DLC campaign, so I think that should be safe. Messages are still being sent OK.Am I missing something?FollowComment"

Answer: "0Starting August 31, 2023, US telecom providers plan to decommission sending SMS text messages using long codes. So, if you don't have any long codes and are using only a 10DLC number to send SMS, then it should be good. Please do make sure you don't have any long codes in other regions as well.  If you still continue to receive PHD notifications, please open a support case https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareAWS-Sarathanswered 2 days agojordi a day agoI'm here because I can't open a support case, even if it seems like this is a bug on AWS's side.Share"


Question: PHP listSuppressedDestinations > Uncaught InvalidArgumentException: Operation not found:

"Hi i'm trying to the the account Suppressed list with the api. But run into this error:PHP Fatal error:  Uncaught InvalidArgumentException: Operation not found: ListSuppressedDestinations in ..../web/sdk/vendor/aws/aws-sdk-php/src/AwsClient.php:261Stack trace:#0 ..../web/sdk/vendor/aws/aws-sdk-php/src/AwsClientTrait.php(86): Aws\AwsClient->getCommand('ListSuppressedD...', Array)#1 ..../test.php(18): Aws\AwsClient->__call('listSuppressedD...', Array)#2 {main}thrown in .../web/sdk/vendor/aws/aws-sdk-php/src/AwsClient.php on line 261Fatal error: Uncaught InvalidArgumentException: Operation not found: ListSuppressedDestinations in ..../web/sdk/vendor/aws/aws-sdk-php/src/AwsClient.php:261Stack trace:#0 ..../web/sdk/vendor/aws/aws-sdk-php/src/AwsClientTrait.php(86): Aws\AwsClient->getCommand('ListSuppressedD...', Array)#1 ..../test.php(18): Aws\AwsClient->__call('listSuppressedD...', Array)#2 {main}thrown in ...../web/sdk/vendor/aws/aws-sdk-php/src/AwsClient.php on line 261This is the code u use:require_once($Path.'/sdk/vendor/autoload.php');use Aws\S3\S3Client;use Aws\Exception\AwsException;$aws_api = new Aws\Ses\SesClient([    'profile' => 'amazon',    'region' => 'eu-west-1',    'version' => 'latest']);print_r( $aws_api->listSuppressedDestinations([  'EndDate' => time(), 'StartDate' => 1609455600 ]));When i get 'ListIdentities' it all works fine.anyone know how to fix this?FollowComment"

Answer: "0Hello,The listSuppressedDestinations() function is only available in the SesV2Client Client for the AWS PHP SDK.Try switching Aws\Ses\SesClient to Aws\SesV2\SesV2Client and this should work fine.Relevant documentation - https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-sesv2-2019-09-27.htmlCommentShareEXPERTChris_Ganswered a year ago"


Question: New SES region Sydney emails are being marked as spam by Gmail

"New SES region AP-Southeast-2 (Sydney)All emails using this region are being marked as spam by Gmail, I previously used region US East 1 had no problems with sending to Gmail.I have valid SPF policy and DMARC setup. Gmail doesn't like ap-southeast-2.amazonses.comWarning quote:Why is this message in spam? Lots of messages from ap-southeast-2.amazonses.com were identified as spam in the past.FollowComment"

Answer: "0Issue is avoided by setting up custom MAIL FROM domain, setting up DKIM keys, and SPF record.Can now confirm gmail, outlook now accept emails from ap-southeast-2 SES if all 3 actions above are taken.CommentSharejustrightanswered 4 years ago0Issue is avoided by setting up custom MAIL FROM domain, setting up DKIM keys, and SPF record.Can now confirm gmail, outlook now accept emails from ap-southeast-2 SES if all 3 actions above are taken.CommentSharejustrightanswered 2 years ago"


Question: Timestream cross account

"Hi, I have a requirement where I need to have a single Timestream/Timeseries DB for multiple applications deployed in multiple accounts. Can I use a single Timestream instance also if one of my app sits in a region not covered by Timestream can I still feed to this centralised Timestream.FollowComment"


Question: GatewayEui exists error

"I am trying to setup a Dragino Gateway as a LoRaWAN GW in AWS. I do, however, get meet with an error saying that the GatewayEui already exists, which I don't understand.It has previously been attached to a TTN server, could that be the reason?FollowCommentrePost-User-4431592 3 months agoI also have this issue - were you able to resolve it and if so how?Share"

Answer: "1It has previously been attached to a TTN server, could that be the reason?No. However you will suffer this error if that Gateway EUI has been used by a gateway in another AWS account. Have you previously registered this gateway in another AWS account or region? If not, are you using the MAC address as the EUI or are you perhaps instead using some value that is not likely unique?CommentShareEXPERTGreg_Banswered 7 months ago"


Question: Detailed report Route 53

I am getting charged of millions of requests on Route 53. How can I get a detailed report showing the dns queries per  domain  so I can understand what is going on ?FollowComment

Answer: "0Accepted AnswerWe can view the metrics (including number of queries) for each hosted zone in CloudWatch, and I would use this in combination with Route 53 query logging to get a better idea of what is taking place within your hosted zone.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-public-viewing-query-metrics.htmlhttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.htmlFrom a cost perspective, I would drill into AWS Cost Explorer, selecting Route 53 for the service in question, and Usage Type for the dimension to better understand how queries are affecting your Route 53 pricing.CommentShareDarren Ranswered 3 months agoEXPERTTushar_Jreviewed 3 months ago"


Question: [Announcement] Xilinx 2017.4 tool support deprecated

"Beginning December 31, 2021 AWS will disable new AFI creations of designs made using Xilinx 2017.4 toolsets. We will also sunset FPGA Developer AMI v1.4.0 and calls to EC2 CreateFpgaImage: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFpgaImage.html API will show an ‘Unsupported Version’ error in the logs generate by the AFI creation calls.From time to time, we evaluate how we can provide great ongoing support to our customers. With the 2017.4 toolset going beyond the Xilinx technical support policies: https://www.xilinx.com/support.html, we are unable to provide ongoing support and fixes for 2017.4 Vivado tool issues for new customer designs and this in turn affects our ability to provide the best experience and support level for our customers.FAQQ: Does this affect Amazon FPGA Images (AFIs) already created using Xilinx 2017.4 tools?**A: This deprecation does not affect AFI's already created using Xilinx 2017.4 tools. This deprecation only affects new designs created with 2017.4 tools.Q: My Application uses multiple AFI’s, can I mix and match AFI’s made between different tool versions?**A: Yes. AFI’s are similar to bitstreams. Once created, they are placed and routed designs and thus you can mix and match AFI’s between your application.Q: Does this change or affect any AWS Shells?**A: No. The AWS Shells remain the same and do not change between different Xilinx tool versions. The interfaces and the shells remain the same.Q: What happens if I have to create AFI’s with a design that we previously created with Xilinx 2017.4 tools?A: Since the shell and it’s interfaces do not change, you can simply rebuild the design with a newer Xilinx tool. We suggest using latest tools from the supported tools list on our github: https://github.com/aws/aws-fpga/#fpga-developer-amiQ: What happens if I have issues re-creating AFI’s with new Xilinx tools?A: Please contact us either on this forum or on Github Issues and we’d be happy to help.FollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: Cannot access S3 bucket using flask+lambda

"I made a lambda function with the following code (runtime python3.7). The role of the lambda has "AmazonS3FullAccess". However, I got "botocore.exceptions.ConnectTimeoutError" at the line "ret= client.list_objects_v2(Bucket='myfiles');".What is the problem? How can flask+lambda access S3 objects?import awsgifrom flask import Flaskimport boto3;app = Flask(__name__)def lambda_handler(event,context):    return awsgi.response(app,event,context);@app.route("/",methods=["GET"])def index():  s3 = boto3.resource('s3');  client = s3.meta.client;  ret= client.list_objects_v2(Bucket='myfiles');  print(ret);  return "hello world";FollowComment"

Answer: "0Accepted AnswerIs your lambda function VPC enabled? If not, you should not have any issues connecting to S3 from your lambda function, unless there are bucket policies preventing access.If your lambda function is VPC enabled, you can create a NAT Gateway in your VPC as mentioned here - https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/Another better option is to create an interface VPC endpoint for S3 in your VPC. That way the lambda function will be able to connect to the S3 endpoint over the Amazon network without needing to go over the internet - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agonemy 10 months agoMany thanks! It is solved!Share"


Question: Cognito VerifyAuthChallenge InvalidLambdaResponseException

"I try to implement a custom authentication flow with .NET Core and C#. I used this site as a reference (Link: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-verify-auth-challenge-response.html), but so far I already realized, that the input isn't the same in .NET as in the documentation on the site, because the "challengeAnswer" is not given as a Dictionary<string, string>, but as a String object.I successfully go through the Define, Create and VerifyAuthChallenge, but the object that I return in the VerifyAuthChallengeLambda can not be handled by Cognito:Amazon.CognitoIdentityProvider.Model.InvalidLambdaResponseException: Unrecognizable lambda outputI take the input element, add "answerCorrect = true" to the response for testing, don't do any alterations on the input element, and return that object. Sadly I can't figure out what is wrong with the structure that I return, which is the following json-serialized object:{    "version": 1,    "triggerSource": "VerifyAuthChallengeResponse_Authentication",    "region": "eu-central-1",    "userPoolId": "eu-central-1_YV3aaaaaa",    "callerContext": {        "awsSdkVersion": "aws-sdk-dotnet-coreclr-3.3.12.7",        "clientId": "2490gqsa3gd3ba8tasdasdasda"    },    "request": {        "challengeAnswer": "{\"DeviceSub\":\"a123\",\"IpAddress\":\"1.1.1.1\",\"MacAddress\":\"FF:FF:FF:FF:FF:FF\",\"DeviceName\":\"Svens Test Device\",\"UserName\":\"8624237e-0be8-425e-a2cb-aaaaaaaaaaaa\"}",        "privateChallengeParameters": {            "CUSTOM_CHALLENGE": "SessionService_SendDevice"        },        "userAttributes": {            "sub": "8624237e-0be8-425e-a2cb-aaaaaaaaaaaa",            "email_verified": "true",            "cognito:user_status": "CONFIRMED",            "email": "s.mmmmmmmm@sooooooooo.de"        }    },    "response": {        "answerCorrect": true    },    "userName": "8624237e-0be8-425e-a2cb-aaaaaaaaaaaa"}Could you maybe provide the structure of the response object that Cognito expects? I'm a bit in the dark here and don't know what I should change on the returned object in order to conform to the required structure.Thanks for your help,All the Best,SvenEdited by: SolidWhiteSven on Jan 17, 2019 11:39 AMFollowComment"

Answer: "0Well, so my mistake was to not consider the custom authentication flow. I found a different documentation, which is by the way the one you should definitely use:Customizing Amazon Cognito User Pool Authentication Flowhttps://aws.amazon.com/blogs/mobile/customizing-your-user-pool-authentication-flow/I ran into 2 wrong parts in the documentation here (https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html) (the triggers sub-pages) and 1 error on my part.Wrong part 1: DefineAuthChallenge and CreateAuthChallenge inputs for the session is defined as a list of challenge results. This is all fine, but the challenge result object has the challenge metadata part wrongly displayed of being written like this: "ChallengeMetaData", when instead it should be "ChallengeMetadata", with a lower case "d" for "data" instead of an upper case one. This gave me the "Unrecognized lambda output"-error, because "ChallengeMetaData" wasn't was the backend was expecting, it was looking for "ChallengeMetadata", which wasn't present. The first time you enter the define auth challenge lambda, this error doesn't show up, because the session doesn't contain any challenge answers. The moment you verify a challenge though, this gets filled and then the uppercase d gives you troubles.Wrong part 2: As described in my question, the VerifyAuthChallenge input for the "challengeAnswer" is a string, not a Dictionary.All these wrong parts are correctly displayed on the first documentation page I linked here. So I would recommend using that instead of the other documentation.Error on my side: I didn't really check what happens after you verify a custom challenge via the VerifyAuthChallenge-trigger. In the given link, in the image above the headline 'DefineAuthChallenge: The challenges (state machine) Lambda trigger', it clearly states, that after verifying the response, the DefineAuthChallenge trigger is invoked again, which I didn't consider.I hope I could save someone the time it took for me to figure this out with this :-)CommentShareSolidWhiteSvenanswered 4 years ago"


Question: CloudFront Dynamic Origin Selection

"is there a scalable way to do dynamic origin selection in Cloudfront (based on request header / response header / cookie / domain name) other than using Lambda@Edge with viewer-request trigger?I have a partner trying to implement a globally available endpoint for a multi-tenant API supporting 10k+ tenants spread over 30+ application instances in 5 AWS regions (each tenant has a single home app instance).The routing key would be (preferably) a JWT token claim or a request header; however, application can be modified to play along by e.g. returning a customized response header, cookie or something else.The Lambda@Edge-based solution looks straightforward, however, partner is looking toward a solution that would optimize the cost.FollowComment"

Answer: "0Accepted AnswerHave you explored whether or not AWS Global Accelerator meets the requirements?From what you're describing the main objective of your customer is to accelerate their global application. Knowing that regardless of where your users are located, AWS Global Accelerator intelligently routes traffic to the closest edge location via Anycast and then to the closest regional endpoint that provides the best application performance it may be a great fit given the nature of the application and other requirements are met.In this case it's not necessary to have complexity in the form of building logic around a routing key and L@E. Moreover, the main goal you mentioned - cost efficiency - should be successfully achieved.CommentShareDmitriy_Nanswered 3 years ago"


Question: how to get details of security group

"Hi,we would like to know  is  there any way to find out  if the security group is in use or not or in short to which resource this security group is associated.we did tried to find out for example using aws ec2 describe-network-interfaces --filters Name=group-id,Values=<group-id> but this does not help us much.ThanksDilipFollowComment"

Answer: "1Hi Dilip.This Knowledge Center article goes into more depth on what commands need to be run after the aws ec2 describe-network-interfaces command.CommentSharetyler_applebaumanswered 8 months agoEXPERTBrettski-AWSreviewed 8 months ago1Hello Dilip,This will definitely show you all the resources your security group is associated withaws ec2 describe-network-interfaces --filters Name=group-id,Values=<group-id> --region <region> --output json --query 'NetworkInterfaces'CommentShareDunieski Otanoanswered 8 months ago"


Question: DetectLabels doesn't returns instances information

"Hi,I'm using detectLabels on an Id Card and it only returns Label Names and Confidence. The documentation says that it also returns Instances and Parents, with the bounding box of the label. I use the same image in the demo page and it returns all the info, but not when I call the API method.Could you help me please? I tested it with many images.RegardsFollowComment"

Answer: "0Accepted AnswerHi,Please make sure that you are using the latest version of the Rekognition SDK, for e.g. for Java this is the minimum version of the SDK that is required that has the support for the label bounding boxes and hierarchical taxonomy: https://github.com/aws/aws-sdk-java/blob/master/CHANGELOG.md#111442-2018-11-02ThanksCommentShareAWS-User-2425639answered 4 years ago0Thanks! I was using using an old version of aws-sdk-php:DCommentShareLeandroGQanswered 4 years ago"


Question: "After domain transfer, can't get name servers to work"

"I transfered an inactive domain into Route53 recently, and the transfer said it was a success. I then created a new hosted zone for it along with name server and SOA records. However, this does not seem to actually be updating, as the domain doesn't seem to have any name servers asscoaited with it.The domain is: "augmend.com" and the below settings are where I'm at. I've read through the updating name servers docs and can't figure out what I'm doing wrong. Any help is greatly appreciated. Is this simply something I need to wait a few days to propogate? Any good ways to test beforehand to make sure everything will propogate properly eventually?FollowCommentdiamond 5 months agoI've read through this page, and since the ownership is with Route53, and the previous domain registrar doesn't have my site any more (and it wasn't in use), I can't see what else to update: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlSharebwhaley EXPERT4 months agoLooks like your domain is set up successfully now. Did you do anything else, or did it just take time? Did the answers below help you?Share"

Answer: "1Accepted AnswerA domain transfer between registrars can take several days - up to seven days, according to the Route 53 docs. According to whois, the domain registrar for your domain is already Amazon:Domain Name: augmend.comRegistry Domain ID: 1701860576_DOMAIN_COM-VRSNRegistrar WHOIS Server: whois.registrar.amazon.comRegistrar URL: https://registrar.amazon.comUpdated Date: 2023-01-18T10:08:38ZHowever, querying for Start of Authority shows a non-existent domain:$ dig augmend.com soa; <<>> DiG 9.10.6 <<>> augmend.com soa;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58095;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512;; QUESTION SECTION:;augmend.com.INSOA;; AUTHORITY SECTION:com.900INSOAa.gtld-servers.net. nstld.verisign-grs.com. 1674074880 1800 900 604800 86400So it seems that the transfer probably hasn't completed yet.Update: Checking in a day later and I can see that your domain is now resolving. I'm guessing that it just took a little longer for the registrar transfer to complete.CommentShareEXPERTbwhaleyanswered 5 months agodiamond a month agoYes, apologies for not coming back to this, it just seemed to have taken longer then was expected and it resolved eventually without any special work.Share1Did you have dnssec enabled on your domain on your previous registrar ? Looks like dnssec related issueCommentShareMuhammadanswered 5 months agodiamond 5 months agoI don't recall enabling that, and the previous registrar now doesn't have by domain info so I can't check any settings there. Let me dig in there more though.Share"


Question: "In Sagemaker endpoint, pip download fails when connected through VPC"

"Pip download fails in my instance when sagemaker is connected through VPC. It is successful when VPC is not specified. I have internet gateway configured for my public subnets.I was able to pip download successfully in EC2 with same security groups and subnets. Is this any bug in sagemaker side?And also, can we log into EC2 instance that sagemaker created? It is more of like a blackbox testing without it.FollowCommentAnonymous a year agoCurrently, logging into EC2 instance that SageMaker created in not possible. What endpoint is this? Is it possible to test by creating a SageMaker notebook in that VPCShare"

Answer: "0When specifying a VPC config, ENIs are launched into your VPC which your Endpoint will use to communicate within your VPC. These ENIs have private IPs. In order to communicate with the internet you would need to make use of a NAT.SageMaker Endpoints are managed and it is currently not possible to SSH into the EC2 instance(s) backing your Endpoint.CommentShareMarcanswered a year agoAWS-User-6330249 a year agoYou mean to create a NAT gateway for all the subnets associated with the model with Elastic IPs allocated right?Share"


Question: Quicksight: join datasets using api

"Hello,I'm looking at options to programmatically create datasets by joining existing datasets. Is that possible?FollowComment"

Answer: "0Hi.yes you canYou create a new dataset with the CreateDataSet API.The creation parameter LogicalTableMap allows you to combine and JOIN existing datasets Arn.An example would be:{    "AwsAccountId": "123456789012",    "DataSetId": "hoge0425dataset1111111",    "Name": "hoge0425dataset1111111",    "PhysicalTableMap": {},    "LogicalTableMap": {        "hoge0425b": {            "Alias": "hoge0425b",            "DataTransforms": [                {                    "RenameColumnOperation": {                        "ColumnName": "key1",                        "NewColumnName": "key1[hoge0425b]"                    }                }            ],            "Source": {                "DataSetArn": "arn:aws:quicksight:ap-northeast-1:123456789012:dataset/599be6e0-c054-4d56-91cb-eb3b3a24a25d"            }        },        "hoge0425a": {            "Alias": "hoge0425a",            "Source": {                "DataSetArn": "arn:aws:quicksight:ap-northeast-1:123456789012:dataset/a1e4803a-5ea6-4191-ac14-7bf4a434e695"            }        },        "hoge0425c": {            "Alias": "Intermediate Table",            "DataTransforms": [                {                    "ProjectOperation": {                        "ProjectedColumns": [                            "key1",                            "val1",                            "key1[hoge0425b]",                            "val2"                        ]                    }                }            ],            "Source": {                "JoinInstruction": {                    "LeftOperand": "hoge0425a",                    "RightOperand": "hoge0425b",                    "Type": "LEFT",                    "OnClause": "key1 = {key1[hoge0425b]}"                }            }        }    },    "ImportMode": "SPICE",    "FieldFolders": {},    "Permissions": [        {            "Principal": "arn:aws:quicksight:ap-northeast-1:123456789012:user/default/hoge-iwasa.takahito/hoge-iwasa.takahito",            "Actions": [                "quicksight:PassDataSet",                "quicksight:CreateIngestion",                "quicksight:DeleteRefreshSchedule",                "quicksight:UpdateRefreshSchedule",                "quicksight:UpdateDataSet",                "quicksight:DeleteDataSetRefreshProperties",                "quicksight:CreateRefreshSchedule",                "quicksight:DescribeDataSetPermissions",                "quicksight:ListIngestions",                "quicksight:UpdateDataSetPermissions",                "quicksight:DescribeIngestion",                "quicksight:PutDataSetRefreshProperties",                "quicksight:DeleteDataSet",                "quicksight:DescribeDataSet",                "quicksight:CancelIngestion",                "quicksight:DescribeRefreshSchedule",                "quicksight:ListRefreshSchedules",                "quicksight:DescribeDataSetRefreshProperties"            ]        }    ],    "DataSetUsageConfiguration": {        "DisableUseAsDirectQuerySource": false,        "DisableUseAsImportedSource": false    }}Here, hoge0425a and hoge0425b are existing datasets. hoge0425c is the new combined dataset.You can also try creating a combined dataset from the console and see how the LogicalTableMap is constructed with the DesribeDataSet API.CommentShareEXPERTiwasaanswered a month agorePost-User-5935644 a month agoThanks. So if I plan on calling CreateDataSet API and pass the above LogicalTableMap value as one of the parameters, what should the PhysicalTableMap be. I noticed its blank here, but is a mandatory parameter when calling CreateDataSet.Shareiwasa EXPERTa month ago"{}" is fine because it is just joining from an existing dataset. you will succeed with it.Share"


Question: Need Command to fetch securityoptions data from secpol.msc to command prompt. we are using ec2 windows 2019 server instance

"Hi,We are working on windows Hardening OS as per CIS benchmark guidelines for AWS windows EC2 instance. Can you help us with Command to fetch securityoptions data from secpol.msc (local security policies) to command prompt.Below is the given path:run -> secpol.msc -> local polices -> security options. These data on command prompt will be use for a script that will create ansible playbook tocheck the rules.FollowComment"


Question: How to support expired password change with an IP restriction (user should be on a VPN)?

"We currently have explicit denies policies to prevent our IAM users to do any action unless they are logged into our VPN via an IP address list restriction.The issue is that in the case an user would let his / her password expire, then this user will be forced by AWS to change it at the next login attempt: in that case, the API call to AWS to effectively change the password will be performed from AWS itself on behalf of the user, which of course is not logged on our VPN and therefore does not match the IP address list restriction.The only workaround so far is to create another role lifting this VPN restriction just for this use-case, assigned to users temporarily just to give them the time to change their password. On top of bring overhead, it creates risk if the assignment back to the secure VPN-restricted role is not done.Any hint to a more elegant / better solution?ThanksFollowComment"


Question: can't transfer a file via sftp to lightsale wordpress instance

"I'm able connect to my instance on Lightsail with Wordpress installed, with FileZilla following the standard guidelines.  When I try and upload a file to /bitnami/wordpress/wp-content/ai1wm-backups it just returns the message 'could not start transfer' and doesn't upload whatever size the file is.I have changed the permissions for the folder to 755 but didn't make a difference.Any suggestions appreciated, thanks!FollowCommentdonleyataws 7 months agoIs ai1wm-backups a folder and does it already exist?One suggestion I would make is to try uploading to the bitnami home directory (e.g. scp file bitnami@<yourip>:) and then moving the file from there.Share"


Question: Create AWS::Lex::BotAlias with Lambdahook using Cloudformation is not working

I am using the below Cloudformation script to create an alias and assign lambda code hook but this is giving an error as below.if you have any working examples that will also help.Please note Lex bot creation and Version creation is working fineProperties validation failed for resource VOCBotAliasWithCFN with message: #/BotAliasLocaleSettings/0: required key [Key] not found #/BotAliasLocaleSettings/0: required key [Value] not found VOCBotAliasWithCFN:    DependsOn: VOCBotVersionWithCFN    Type: AWS::Lex::BotAlias    Properties:      BotId: !Ref VOCBot      BotAliasName: prod      BotVersion: !GetAtt VOCBotVersionWithCFN.BotVersion      SentimentAnalysisSettings:        DetectSentiment: false       BotAliasLocaleSettings:         - BotAliasLocaleSetting:            Enabled: true            CodeHookSpecification:              LambdaCodeHook:                CodeHookInterfaceVersion: 1                LambdaArn: <LambdaArn>          LocaleId: en_USFollowCommentjogold a year agoI have the exact same issue...Share

Answer: "1Accepted AnswerI got an update from AWS Support team this issue is fixed now. I have tested it in the us-east-1 region it is working for me now. Here is a working example---------VOCBotAliasWithCFN:  DependsOn: VOCBotVersionWithCFN  Type: AWS::Lex::BotAlias  Properties:    ...    ...    BotAliasLocaleSettings:        - BotAliasLocaleSetting:            Enabled: true            CodeHookSpecification:              LambdaCodeHook:                CodeHookInterfaceVersion: 1.0                LambdaArn: arn:aws:lambda:us-east-1:<Account_Id>:function:Lexfunction          LocaleId: en_US---------CommentShareSushil Kumaranswered a year ago-2Hi Sushil, thanks for your question. Please take a look at this documentation link on how you can declare the BotAliasLocaleSettings entity. I believe the error lies in the line "-BotAliasLocaleSetting:" which is why it cannot read the required "Enabled" field thus causing the error.Doc Link: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lex-botalias-botaliaslocalesettings.htmlCommentShareSaubia Khananswered a year agoSushil Kumar a year agoThanks Saubia for replying to my post.I have checked the documentation I didn't find any problem with my cloud formation script. Also error return by the cloudformation didn't provide such information it is pointing towards some key[Key] and Key[Value].If you have some working sample that will help.ShareSaubia Khan a year agoApologies for the late reply, as of now we have no pre-built templates that are using the entity you have in the script. We have several examples on github regarding Amazon Lex, check them out here: https://github.com/orgs/aws-samples/repositories?q=lex&type=all&language=&sort=Sharejogold a year agoHi Saubia, the question is about a CloudFormation error when deploying a AWS::Lex::BotAlias. With this error it's currently not possible to deploy an alias using CloudFormation.ShareSushil Kumar a year agoYes jogold, AWS recently launched Lex deployment using cloud formation https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Lex.htmlIf I am not putting any Codehook then AWS::Lex::BotAlias also working but with codehook it is giving error as mentioned in the problem description.Sharejogold a year agoSushil, getting the same error without a codehook, can you share your working CloudFormation template?ShareShow 3 more comments"


Question: IoT Events convert number to string for SNS custom payload

"In IoT Events, I have setup an Event to send a message to SNS.  I am attempting to use a custom payload where I can include the value in the message.  The value outlined in red below is what I am trying to use and it is a Number.  When I run the Analysis on my Event in the Detector GUI, it gives this warning:*Message: The payload expression "$input.CNC1Standard.vibration" isn't valid.  Specify an expression that would evaluate to a string at runtime because the payload type is JSON format.  *I have looked through the documentation and cannot find the command or an example for how to convert a Number into a String for this service.  I have tried both String and JSON for the Payload type, played around with quotes, escape characters, and similar.  Any ideas on how to perform the conversion?FollowComment"

Answer: "2Accepted AnswerHi Ryan. I haven't used it before, but I think you want the convert() function: https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-expressions.htmlCommentShareEXPERTGreg_Banswered 8 months agoRyan 8 months agoThanks Greg, that was it.  I looked all over that documentation and didn't come across that command...I think I need more coffee ;)Share"


Question: Are Custom Docker Windows Images Available In Asia Pacific Region?

"I want to use a Windows image for my CodeBuild machine but I don't get the option in the CodeBuild > Environment > Environment Type for Windows.I did read this article from 2018 that mentions the regions that are available and Asia Pacific wasn't one back then, but that was 4 years ago.https://aws.amazon.com/about-aws/whats-new/2018/05/aws-codebuild-adds-support-for-windows-builds/Are Windows images now available to use in ap-southeast-2?thanksFollowComment"

Answer: "1Accepted AnswerHi, CodeBuild does not offer Windows images in ap-southeast-2. The CodeBuild docs list the same 4 regions as in the linked post.A possible solution is using CodePipeline custom actions which enables Windows build jobs. This approach offloads the processing to EC2 and requires additional management and setup. See this blog post, it outlines the reasoning and process well.CommentShareJonathan_Manswered a year agoAWS-Ben-Iffland a year agoThanks for the info. The custom actions approach seems interesting. We have started to go down the approach of creating a CodeBuild project in a region that does allow Windows builds. Then the artifacts from that build will be reference via the CodeDeploy application in the Asia Pacific region. Not sure at this stage is CodePipeline will allow me to use CodeBuild and CodeDeploy stages from different regions.Share"


Question: Failing CIS 3.3 even when metric filter exists

"Hello,We have been failing CIS "3.3 Ensure a log metric filter and alarm exist for usage of "root" account" compliance check. We have a metric filter in place to detect and alert for this action. I am not sure what needs to happen to pass the compliance check.This is current filter pattern on the cloudtrail logs in cloudwatch:{( $.userIdentity.type = "Root" ) && ( $.userIdentity.invokedBy NOT EXISTS ) && ( $.eventType != "AwsServiceEvent" )}FollowComment"

Answer: "0Hi there,In the current release, SecurityHub is looking for an exact pattern match for the metric filter based on the CIS guidelines. The additional parentheses in the filter pattern may be causing the pattern match to fail. Can you try changing the metric filter pattern to { $.userIdentity.type = "Root"  &&  $.userIdentity.invokedBy NOT EXISTS  && $.eventType != "AwsServiceEvent" } ?AparnaCommentShareAparnaanswered 4 years ago0I made the changes and it is working now.CommentShareSecRoleanswered 4 years ago"


Question: "ruby AWS sdk, auth, and greengrass issues."

"I'm trying to follow the docs about using greengrass component based auth, and run into a confusing situation.Ive read that in a greengrass environment, as long as the automatic environment variables are set, auth is handled automatically.(specifically, AWS_CONTAINER_AUTHORIZATION_TOKEN and AWS_CONTAINER_CREDENTIALS_FULL_URI)This actually works great when I use a dummy test ruby program, to do things like  wrapper = Aws::IAM::Client.new   wrapper.get_userBut when I swap out my test program, for fluentd, using the timestream plugin athttps://github.com/StudistCorporation/fluent-plugin-timestreamit bombs out with an auth error,failed to flush the buffer. retry_times=0 next_retry_time=2023-04-12 17:54:12 +0000 chunk="5f9274b9cd65f79f9897b62d5fca25ed" error_class=Aws::Errors::EndpointDiscoveryError error="Endpoint discovery failed for the operation or discovered endpoint is not working, request will keep failing until endpoint discovery succeeds or :endpoint option is provided."This is making no sense to me. How can the same(?) ruby aws lib work in one case, but fail in the other?For what it's worth, this is using ubuntu 20.04FollowComment"

Answer: "1Accepted AnswerThe error you get is not related to the credentials, but to the Timestream client not being able to determine the endpoint to connect to. Timestream uses a cellular architecture where the endpoint is not fixed. AWS SDKs implements the  endpoint discovery pattern and apparently this is failing inside your Greengrass component. You should verify that the permissions associated to the Greengrass TES Role allow the timestream:DescribeEndpoints action.CommentShareEXPERTMassimilianoAWSanswered 2 months ago"


Question: Taking Onvue exam on personal computer

"I am an Amazon employee and signed up for an AWS certification exam through my account linked to my Amazon email. However, OnVue recommends using a personal computer to take the exam.I am unable to login to the AWS certification & training site on my personal computer to access my exam link as the login requires my Amazon key (which is only on my work computer). Am I missing something, or how can I access the exam to begin on my personal computer when the account I set up is my work email?FollowComment"

Answer: "0Oh no! You've fallen into the morass of "personal device meets corporate bureaucracy!"Given that AWS certifications will potentially outlast your employment at any given company, it's recommended that you tie your certification account to a personal address. I forget; are you able to change your OnVue email address to your personal account instead, then go through there? If not you may get to open a helpdesk ticket internally via whatever that process looks like; I can only presume it involves much wailing and gnashing of teeth.CommentShareQuinnyPiganswered 4 months ago"


Question: How to add data into aws timestream that's older than the memory store retention period?

"AWS Timestream says that :"To store late arrival data, you simply write the data into Amazon Timestream, and the service will automatically determine whether it gets written to the memory store or to the magnetic store, based on the timestamp of the data and on the configured data retention for the memory and magnetic stores."The maximum memory store time is 12 months but I'm trying to upload data from 2017 to my TimeStream and I'm getting the error message that the record timestamp is outside the time range of the memory store. I thought that it would automatically move it to the magnetic store. I have set :Memory store : 1 hourMagnetic store: 10 yearsFollowComment"

Answer: 0Hi - have you enabled Magnetic Store Writes for the table? There is a flag that must be set on the table before writes directly to the magnetic tier succeed. You can enable this flag by updating the table in the console or using the SDK to UpdateTable setting  EnableMagneticStoreWrites=true within the MagneticStoreWriteProperties: https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateTable.htmlPlease let us know if you have this flag enabled for the table and are still encountering errors. Thanks!CommentShareAudrey Lanswered a year ago


Question: Certificate issues on AIM macOS Monterey 12.1

HiI'm getting certificate issues when trying to for instance install npm packages on instances created based in the macOS Monterey 12.1 AIM. Have not not tried any of the other mac AIM'sSteps to reproduce:Create a new instance based on ami-09f94ce5cd5d474d9 (macOS Monterey 12.1)Install node brew install nodeInstall for instance react-native. npm install -g react-nativeI now got a ssl certificate error.If I disable ssl for npm I'm able to get furthernpm set strict-ssl falseBut I then run into other issues as also certificate related. I also not really see disabling ssl as a proper solution :-)We are also using Ansible then building a custom AMI. And I'm not able to install anything with ansible-galaxy - here I'm also getting certificate issues.Am I missing anything when creating the instance - is this not expected to just work out of the box?I found that if I reinstall the brew package ca-certificates everything starts to work as expected. Could there be something wrong with the brew installation on macOS Monterey 12.1 AMI (ami-09f94ce5cd5d474d9)brew reinstall ca-certificates/RenéFollowComment

Answer: "0Hi, Good questionIt appears to be an existing issue with MacOS and brew. More info at https://apple.stackexchange.com/questions/393481/homebrew-cask-download-failure-ssl-certificate-problem-certificate-has-expiredCommentShareSrianswered a year ago"


Question: [Announcement] Amazon Location Service adds Matrix Routing

"Amazon Location Service adds matrix routing to Amazon Location Routing, making it easier to quickly calculate driving time and driving distance between multiple origins and destinations. With matrix routing, you can use a single API request to reduce the latency associated with multiple routing calculations, allowing you to simplify your code. For example, an application that plans delivery routes can now use Amazon Location’s matrix routing capabilities to request the driving time and distance for all deliveries for a given period. You can reduce the number of requests and latency by making one request of up to 350 origins by 350 destination to retrieve 122,500 drive times and distances.Amazon Location Service is a fully managed service that helps developers easily and securely add maps, points of interest, geocoding, routing, tracking, and geofencing to their applications without compromising on data quality, user privacy, or cost. With Amazon Location Service, you retain control of your location data, protecting your privacy and reducing enterprise security risks. Amazon Location Service provides a consistent API across high-quality location based service data providers (Esri and HERE), all managed through one AWS console.Amazon Location Service is available in the following AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), Europe (Ireland), Europe (Stockholm), Asia Pacific (Singapore), Asia Pacific (Sydney) Region, and Asia Pacific (Tokyo).To learn more, visit to the calculate route matrix section of the Amazon Location Service developer guide.FollowCommentSrikanth_N SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answer.Share"

Answer: "0If you are looking for a practical example of how matrix routing can be used to optimize routes, check out this github rep. You can deploy in minutes: https://github.com/aws-samples/serverless-route-optimizationCommentSharenghtmanswered a year ago"


Question: Auto RDS Snapshot Missing

"Hello everyone,We are experiencing a problem with our Organizational Multiple Accounts where the automatic snapshot is randomly missing after a few days. I have contacted AWS support and they have identified it as a technical issue. They suggested that we upgrade our subscription plan as a first step. Have any of you faced the same problem, or do you have any solutions?FollowCommentgokul_G 3 months agoCan you please define "randomly missing after a few days" ? what is your backup retention setting ? by default it would be 7 days and the snapshots older than the retention will be removed automatically.  Is it like the in between days are missing ?Share"

Answer: 0thnx gokul_G for replying I am asking for an auto rds snapshot that amazon took on a daily basis but sometimes its missed I don't know why. I have many times generated support tickets thy replied to upgrade to enterprise support.CommentShareMuhammadNafeesanswered 3 months ago


Question: why www. prefix is required(must) with my domain hosted on AWS S3?

I have a domain xxxxx.co.in(brought it through goddady) hosted on AWS S3 as a static web host. Which is only working good when accessing as www.xxxxx.co.in but It is not working with xxxxx.co.in .I have brought it through goddady.FollowComment

Answer: 0Accepted AnswerAdd cname record with @ and wwwand redirect your url xxxx.co.inCommentShareharshmanvaranswered 4 years ago


Question: Instance running very slowly - not sure on best instance type

"I have an instance that is running very slowly, and users have difficulty getting ssh access, which is very slow.We suspect it is a memory issue, but not sure, as I have looked on AWS Compute Optimizer, but although every other instance is showing up this one is not (note optimizer has been applied for some months)?I am interested to understand the issue, and if it is memory, and then I would like a recommendation on which instance type/size is best for this instance - but can't get the details of what elements of the instance are struggling (i.e. memory, network, etc...)?Any suggestions on what I do next greatly appreciated.ThanksFollowCommentBrettski-AWS EXPERTa year agoIt would help a lot to know what type (family) of instance you're using.Share"

Answer: "1It can be a problem with the EC2 instance itself being overloaded or it could also be because of network band-width. Are the users connecting to this instance over the internet or from your corporate network over IPSec VPN or DirectConnect? IPSec VPN has a band-width limitation of around 1.25 Gbps. If using DirectConnect, are you using 1Gbps or 10Gbps? If you are using a transit VPC where you have your network firewall devices and you are connecting to the VCPs using VPN, then also you will be constrained to the 1.25 Gbps even if you are using 10 Gbps Direct Connect. It is possible that other applications are hogging the network band-width. For investigating if the EC2 instance itself is overloaded, you can look at the Cloudwatch metrics - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch.html.Likewise, for checking the performance of your IPSec VPN, you can look at Cloudwatch - https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-overview-vpn.htmlCommentShareEXPERTIndranil Banerjee AWSanswered a year agotruebluekiwi a year agoThanks for the info.My developers are accessing the instance via SSH (Port 22) using a client - and they are seeing delays in connecting, and activity is very slow.The primary application on this server is processing a data feed, which is connected (via a white listed Elastic IP Address), using a socket connection (w TLS protocol) on a defined port - and this is achieved via a standard IPv4 Network interface...So it is not VPN or DirectConnect (I do not think?) - but it may still be overloading?  How do I monitor/check this, please?Share0If you are positive that the network band-width is not the issue, then you need to look at the Cloudwatch metrics for the EC2 machine in question - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch.html and see if it is running high on resources. In that case, you may want to go with a more powerful box.CommentShareEXPERTIndranil Banerjee AWSanswered a year ago"


Question: DMS replication task not generate a operation column

"HI,I'm using DMS version 3.4.6 to ingest data in S3 from a table in the Aurora database. The type of task in the DMS I'm using is full-load-and-cdc and when I run the task for the first time it creates the .parquet file, but it doesn't create the Op column with the value "I".According to my understanding reading the documentation should generatehttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.Configuring.InsertOpshttps://docs.aws.amazon.com/dms/latest/APIReference/API_S3Settings.htmlI'm using ExtraConnectionAttributes from the endpoint for the S3 includeOpForFullLoad=true and cdcInsertsOnly=falseI've tried more than 10 settings and I can't get the task to generate the Op column.Has anyone gone through this, have any tips for me?FollowComment"


Question: Tuning underlying Windows OS and/or Applications for BYOL WorkSpaces

"Customer has taken their on-premise standardised operating environment (SOE) for Windows 7 based desktops and essentially built the same SOE on Windows 7 BYOL WorkSpaces by installing the same software and applications using the same configuration.My question is around how other customers tune their WorkSpaces desktops to maximize performance. My customer is running Standard WS instances and finding that the performance is sometimes "a bit lacking with high CPU loads while not performing overly taxing tasks". I am working with their service provider to dive deeper on the exact issues.In my previous experience with Virtual Desktop Infrastructure (VDI) based solutions like with Citrix Published Applications/Desktops and VMware Horizon View, there was guidance from them on how to reduce the performance (both CPU and memory) demands of the hosted desktops by reducing "unnecessary" items such as full screen window redraws when moving windows (i.e. configure it to draw the window outline instead), etc.Since WorkSpaces is providing dedicated virtual machine resources (CPU and memory is not oversubscribed) vs. all shared resources in the previous examples (Citrix, VMware Horizon View), I can understand why these tuning recommendations may not be applicable to WorkSpaces.Do customers follow this type of guidance for WorkSpaces, or is it not necessary?FollowComment"

Answer: "0Accepted AnswerWorkspace instances are indeed dedicated to users and not sessions running within a shared VM. That said, given that the instance is running on a hypervisor, there is still benefit in stopping unnecessary services to maximise the resources that the instance has to give to applications most compute resources. So, still a good practice.There are a number of different workspace bundles, ideally customers have an understanding of what their current workloads are prior to moving them to WorkSpaces, then they know they've selected the correct bundle type. It is also worth regularly reviewing the the demands of applications to ensure that the bundle selected is still providing the performance required.In order to understand detailed application performance requirements, check out Liquidware Stratusphere on the Amazon market place (https://aws.amazon.com/marketplace/pp/B01N9ESVJX?qid=1510773307509&sr=0-1&ref_=srh_res_product_title)CommentShareEXPERTAndrew_Wanswered 6 years ago"


Question: windows fsx file share for multi-az is failing

"Dear Team,I am trying to deploy the fsx file share for multi-az but it is failing with an error as belowFailure messageFile system creation failed. Amazon FSx is unable to create a file system within the specified Microsoft Active Directory.I deployed single-az and it created successfully with all the same parameters. That means all the parameters for deploying the file share is correct. Kindly advise on the issue.ThanksRioFollowComment"

Answer: "0Hi Rio,I see that you are trying to deploy the FSx file share for Multi-AZ but it is failing with error message "File system creation failed. Amazon FSx is unable to create a file system within the specified Microsoft Active Directory."There are a few potential causes for a file system creation failing, and troubleshooting steps depend on whether you are using an AWS Managed [1] or self-managed [2] Microsoft Active Directory.Since you have successfully deployed a Single-AZ file share with the same parameters, you may want to look into configuring permissions specifically for Multi-AZ. There is an Amazon Web Services video tutorial [3] and associated Knowledge Center article [4] available on configuring permissions for creating a Multi-AZ Amazon FSx for Windows file server share with a self-managed Active Directory [3].References:[1] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/unable-to-create-aws-mad.html[2] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/unable-to-create-fs-self-ad.html[3] https://www.youtube.com/watch?v=nCcAMStPsvQ[4] https://aws.amazon.com/premiumsupport/knowledge-center/fsx-multi-az-self-managed-ad/CommentShareKegan_Sanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: Launch Announcement: Amazon SageMaker Data Wrangler now supports Databricks as a data source

"Amazon SageMaker Data Wrangler reduces the time it takes to aggregate and prepare data for machine learning (ML) from weeks to minutes in Amazon SageMaker Studio, the first fully integrated development environment (IDE) for ML. With SageMaker Data Wrangler, you can simplify the process of data preparation and feature engineering, and complete each step of the data preparation workflow, including data selection, cleansing, exploration, and visualization from a single visual interface. You can import data from multiple data sources such as Amazon S3, Amazon Athena, Amazon Redshift, Snowflake. Starting today, you can now use Databricks as a data source in Amazon SageMaker Data Wrangler to easily prepare data in Databricks for machine learning. Databricks, an AWS Partner, helps organizations prepare their data for analytics, empower data science and data-driven decisions across the organization, and rapidly adopt machine learning (ML).To learn more about Databricks integration with Amazon SageMaker Data Wrangler, view our blog or AWS document. To get started with Amazon SageMaker Data Wrangler, visit our AWS documentation and pricing page.FollowComment"


Question: Collecting data from OPC-UA to SiteWise fails

"Hi, I have a Greengrass Core v2 running in a Docker container which is successfully collecting measurements from an OPC-UA server however these measurements are not being forwarded to AWS Sitewise. Investigating the local logs on the core I can see swPublisher.log contains many entries saying "Failed to publish messages because an SDK client error occurred. Retrying.  Error details: Unable to load AWS credentials from any provider in the chain".Any suggestions?Log:2021-09-27T06:20:41.022Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [INFO ] 2021-09-27 06:20:41.022 [main] Publisher - {"message":"Initialization Completed."}. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=RUNNING}2021-09-27T06:20:44.787Z [INFO] (Copier) aws.iot.SiteWiseEdgePublisher: stdout. [WARN ] 2021-09-27 06:20:44.770 [PublisherThread-0] BatchMessageUploaderTask - {"message":"Failed to publish messages because an SDK client error occurred. Retrying.  Error details: Unable to load AWS credentials from any provider in the chain: [EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)), SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey), WebIdentityTokenCredentialsProvider: You must specify a value for roleArn and roleSessionName, com.amazonaws.auth.profile.ProfileCredentialsProvider@41442f3f: profile file cannot be null, com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@6833fcdc: Failed to connect to service endpoint: ]"}. {scriptName=services.aws.iot.SiteWiseEdgePublisher.lifecycle.Startup.Script, serviceName=aws.iot.SiteWiseEdgePublisher, currentState=RUNNING}Image version:amazon/aws-iot-greengrass:2.4.0-0Edited by: johnDa on Sep 26, 2021 11:32 PMFollowComment"

Answer: "1Finally, I got data by recreating GreengrassV2TokenExchangeRole and its policy.I removed the old GreengrassV2TokenExchangeRole and its policy and recreated by Greengrass installer provision mode.Then check its policy is set as follows:https://docs.aws.amazon.com/iot-sitewise/latest/userguide/configure-gateway-ggv2.htmlCommentSharejohnDaanswered 2 years ago"


Question: What is the correct format of writing TemplateBody of CfnStackSetProps struct in go CDK v2?

"I'm going to use CDK to create a stackset resources and I want to use the TemplateBody parameters.Here is my code snippet:import ("github.com/aws/aws-cdk-go/awscdk/v2""github.com/aws/constructs-go/constructs/v10""github.com/aws/jsii-runtime-go")func NewMyStack(scope constructs.Construct, id string, props *awscdk.StackProps) awscdk.Stack {stack := awscdk.NewStack(scope, &id, props)yaml := `AWSTemplateFormatVersion: 2010-09-09Description: testResources:  eventbridgerulecentralaccount:Type: AWS::Events::RuleProperties:  Description: Forward event to EventBus  EventBusName: default  State: ENABLED  EventPattern:source:- custom.dingtalkevent.test  Targets:  - Arn: "arn:aws:xxx"Id: dingtalk-eventbus-accountRoleArn:  Fn::GetAtt:  - EventBridgeIAMrole  - Arn  EventBridgeIAMrole:Type: AWS::IAM::RoleProperties:  AssumeRolePolicyDocument:Version: '2012-10-17'Statement:- Effect: Allow  Principal:Service:  Fn::Sub: events.amazonaws.com  Action: sts:AssumeRole  Path: "/"  Policies:  - PolicyName: PutEventsDestinationBusPolicyDocument:  Version: '2012-10-17'  Statement:  - Effect: AllowAction:- events:PutEventsResource:- "arn:aws:events:xxx"`awscdk.NewCfnStackSet(stack, jsii.String("MyStackSet"), &awscdk.CfnStackSetProps{PermissionModel: jsii.String("SERVICE_MANAGED"),StackSetName:    jsii.String("MyStackSet"),AutoDeployment: &awscdk.CfnStackSet_AutoDeploymentProperty{Enabled:                      jsii.Bool(true),RetainStacksOnAccountRemoval: jsii.Bool(true),},TemplateBody: jsii.String(yaml),Capabilities: jsii.Strings("CAPABILITY_NAMED_IAM"),})return stack}I got the error "Resource handler returned message: "Template format error: YAML not well-formed. (line 2, column 1) (Service: CloudFormation, Status Code: 400" when I deploy it.I've tried to create stackset via AWS console use the yaml in TemplateBody and everything works fine. I would understand how to use the TemplateBody in Go CDK.FollowComment"

Answer: 0It looks like you are doing the right thing here.Maybe just test it out herehttps://codebeautify.org/yaml-validatorIt could be something weird around tabs and spacesIf that doesn’t get you anywhere maybe try reducing the template string down to something super simple just to ensure it is in-fact the yaml string that is causing issues. Even just do a CDK Synth to see it work so as not the deploy anything. Then maybe build it up to this final string.CommentShareEmma Moinatanswered a month ago


Question: What is a "stage" in AWS Glue?

"Hi,I see references made to "stages" in AWS Glue (e.g. https://docs.aws.amazon.com/glue/latest/dg/monitor-profile-debug-straggler.html), but I'm unclear as to what is actually meant by a "stage" and can't find an official definition anywhere.Is a stage each individual operation against a DataFrame in a PySpark script for example?Thanks in advance,FollowComment"

Answer: "1Hello,AWS Glue ETL uses Apache spark in backend to process the data in memory. Job,Stages and tasks are the terminologies used in spark distributed processing engine.Basically Spark stages are the physical unit of execution for the computation of multiple tasks. There are 2 kinds of transformations which take place:Narrow Transformations: These are transformations that do not require the process of shuffling. These actions can be executed in a single stage.Example: map() and filter()Wide Transformations: These are transformations that require shuffling across various partitions. Hence it requires different stages to be created for communication across different partitions.Example: ReduceByKeyTo get more understanding about Spark internals you can refer below documentation or other spark resources.[1][1] https://www.educba.com/spark-stages/CommentShareShubham_Panswered 10 months ago"


Question: Unidirectional TCP keep-alive for Classic Load Balancer and Network Load Balancer

"I own a fleet of IoT devices. The devices send data to the cloud on varying frequencies (it can be 1 minute or 30 minutes). The devices are old and can't be modified to send keep-alives. I'm currently using Classic Load Balancer and considering Network Load Balancer. I'm trying to mimic Classic Load Balancer's behavior for TCP flows, and prevent Network Load Balancer from closing the connection after an idle timeout of 350 seconds. Will a unidirectional keep-alive that is sent from the server be enough to keep the Network Load Balancer connection open?FollowComment"

Answer: "0Accepted AnswerFor Classic Load Balancer, TCP keep-alives will not keep the connection alive. HTTP payload is required for the connection to be alive for Classic Load Balancers.With Network Load Balancer, the TCP keep-alives can prevent the connection from reaching the idle timeout. However, the keep-alives must be enabled in both directions. If the server sends a keep-alive message, the client has to respond with a keep-alive acknowledgment. If the clients are unresponsive to keep-alives from the server, the idle timeout of 350 seconds will be reached. If either endpoint (client or server) sends traffic to the idle connection, Network load Balancer will generate a reset.The HTTP payload will also keep the connection alive in case of NLB however you will have to make sure that it is being sent before hitting the 350sec timeout.CommentShareAWS-User-7495734answered 3 years ago"


Question: API Gateway [message Not Found]

"Hi there,I have API Gateway with HTTP integration pointing to an external webservice. Currently, we can hitthe webservice directly by using its IP address to retrieve various json files. Sample requests are:http://xxx.xxx.xxx.xxx/req.jsonhttp://xxx.xxx.xxx.xxx/req2.jsonhttp://xxx.xxx.xxx.xxx/req3.jsonHowever, when we try to hit the API Gateway, we get {"message":"Not Found"}When we looked at the internal logs of the webservice, we noticed that requests from the API Gatewayaren't hitting our webservice. We don't have any restrictions on the firewall as we're using the same endpointfor other services hosted in Azure.Can you please advise what could be the problem?FollowComment"

Answer: "3Accepted AnswerHi, since you didn't create any stage, that means that you're the default stage '$default'. The route that you configured isn't correct and you need to set the route to $default and add the integration to your webservice endpoint like http://webservice_urlTo rectify this, first delete all the existing routes and then follow these steps:Go to your API Gateway and select RouteClick CreateLeave the Any method as is and type in the path $default without a leading slash.Click on Attach integration and select your webservice endpointEventually, this is how it should look like:Routes:Integrations:CommentSharemmlanswered 5 months agoEXPERTBrettski-AWSreviewed 5 months ago0Hi,{"message":"Not Found"} is technically an HTTP 404 status code. It looks like the API Gateway routing isn't set correctly, meaning that you're trying to fetch an item that doesn't exist in the requested path or you're using incorrect path in the requested URL.Can you provide some details on what the API gateway routing and stages look like?Also what's the URL path that you're using when hitting the API gateway?CommentSharemmlanswered 5 months agoJorden87 5 months agoHelloWhen we created the API Gateway we didn't specify any stage. It was left to AWS to decide which stage to be used.As for routes, we tried using the following and none of them worked./ GET/ ANY {proxy+}the URL that we're using on our clients is:https://api_gateway_url/req11.jsonIn our testing we used Postman and Curl and both are showing the same result.Share"


Question: Should I Use Angolia or OpenSearch instead of DynamoDB? If so in what case.

"Hi,my Developer propose for my Video on Demand app for the search function Angolia or Open Search. He is telling me that DynamoDB is not perfect for the Filter. Is it true? What would be the best and the cheapest way?FollowCommentMLGuy a year agoIt depends on the type of search that you need to do. If you need textual search, ElasticSearch (Open Search) is very popular and popular. If you need to search by attributes such as years, categories, and ranking, DynamoDB can still be used using various secondary indexes.Share"

Answer: "0Amazon Opensearch provides a fast search experience for your applications, websites, and data lake catalogs, allowing your users to quickly find relevant data. Amazon Elasticsearch Service delivers high-quality and personalized search results with industry-leading scalability and securityAmazon OpenSearch Service provisions all the resources for your cluster and launches it. It also automatically detects and replaces failed OpenSearch Service nodes, reducing the overhead associated with self-managed infrastructures. You can scale your cluster with a single API call or a few clicks in the console.DynamoDB is  a fully managed, serverless, key-value NoSQL database designed to run high-performance applications at any scale. DynamoDB offers built-in security, continuous backups, automated multi-Region replication, in-memory caching, and data import and export tools. You can configure an Amazon OpenSearch Domain to Search DynamoDB Data - https://docs.aws.amazon.com/cloudsearch/latest/developerguide/searching-dynamodb-data.html.Tutorial: Creating a search application with Amazon OpenSearch Servicehttps://docs.aws.amazon.com/opensearch-service/latest/developerguide/search-example.htmlA customer success story you may be interested in:[Sony Interactive Entertainment Redefines Online Multiplayer Experiences on Playstation 5 on AWS]CommentShareCHELSEA IPanswered 9 months ago"


Question: "ALB to Nginx every other request fails, doesn't even make it upstream"

"I have an ALB setup that goes to an EC2 with Nginx within a VPC. Every other request to the ALB will fail with a 504 Gateway Timeout. I've looked into the access logs and it's showing -1 for the request_processing_time, but I've confirmed that the timeouts for my Nginx instance are set correctly. Also, health checks are passing throughout. Moreover, looking at the Nginx logs, and testing via netcat on the EC2 shows that the ALB doesn't even make an attempt to talk to the EC2 on every other attempt. Searching the forums has revealed other people having this problem, yet I've not found anyone that's had some resolve, anyone out there that's successfully troubleshot this?Edited by: KingOfNuggets on Apr 8, 2020 9:27 AMOk, looks like the failing is happening on one specific Network Interface for the ELB. Security groups are the same on both of them, not sure what the issue is, will continue looking.Edited by: KingOfNuggets on Apr 8, 2020 9:41 AMFollowComment"

Answer: "0Ok, strange AF but what I did is created a new ALB, did all my settings the same. Tested and everything works now..CommentShareKingOfNuggetsanswered 3 years ago"


Question: Do the ASL intrinsic functions not work in the data flow simulator?

"I have tried examples from the docs, the ASL spec, and SO, nothing seems to give the expected result. It's either nothing or a literal string of the function call.FollowComment"

Answer: "0Accepted AnswerHi jamessouth,We are aware of the current limitations of the data flow simulator and plan to add functionality to it to bring the experience closer to that of an actual execution. The current behaviour of it not supporting intrinsic functions is expected.CommentShareAWS-User-0300771answered 2 years ago0Same here.CommentSharepspot2answered 2 years ago"


Question: CloudFormation structuring & splitting of resources between stacks

"A customer maintains one large CloudFormation template per application they deploy. They are currently running into challenges where deployed resources in the stack do not all share the same lifespan. By changing the stack, or deleting + redeploying the stack, the change in IDs has downstream impacts to other applications/components.How have other customers managed this? Do we have any relevant resources (i.e. blog post, videos, documentation, etc) that would be useful to share with our customer on this topic?FollowComment"

Answer: 0Accepted AnswerThat's a big topic with a lot of options.Exporting and Importing values is one way to share values between stacks.  The benefits and weaknesses of this process is that you can't change any values that are exported if another stack is importing them.  This helps prevents changing those resources (example: maybe a RDS endpoint string) with instances running in it. The downside is that if you want to change something upstream you can't do it without breaking those dependencies first.If you are going to break apart the stacks you can do nested stacks.  This allows you to change those dependencies into parameters and outputs and pass the values between the stacks.Another way to do this is to share values via SSM Parameter store.  This approach is more technically complex because you are having to deal with the downstream impact yourself.Based on what I'm seeing i would recommend using nested stacks and prefer splitting application layers across stacks.CommentShareKevin_Danswered 3 years ago


Question: AWS Instance Type size defaulting to a specific size during EC2 Launch programatically

"Hi All,I am trying to do the following. I am using the AWS SDK and trying to launch an EC2 VM with an instance size of 100GB. I can see the request header containing the size I chose, but while provisioning this it is returning a different size. I dont have access to the AWS console. Can someone let me know what service or policies can default the size of an AWS Ec2 VM before launching ? I am using the AWS SDK and the RunInstancesRequest and withInstanceType(InstanceType instanceType) method. Same behaviour across all locations.FollowCommentBrettski-AWS EXPERT7 months agoCould you provide the command you're running? That might be helpful. Also might be good to know which region you're operating in.Share"


Question: what is the best method to send email from multiple aws services and ec2 instances?

what is the best method to send email from multiple aws services and ec2 instances?FollowComment

Answer: "4Accepted Answerhere are three methods for sending emails from AWS services and EC2 instances1. Amazon SES (Simple Email Service): SES is a scalable email service that allows you to send transactional and marketing emails. It integrates with other AWS services, including EC2 instances, and provides features such as email tracking, bounce handling, and feedback loops. One advantage of SES is its low cost, which is based on the number of emails sent. Additionally, SES has a high deliverability rate and is known for its reliability.2. SMTP Relay: SMTP (Simple Mail Transfer Protocol) Relay is a method of sending email through a third-party provider, such as SendGrid or Mailgun, using the SMTP protocol. This method involves configuring an SMTP server on an EC2 instance or other server, and routing email through the third-party provider. SMTP Relay allows you to take advantage of the features provided by the third-party provider, such as email templates and email tracking, while still using your own domain name. An advantage of SMTP Relay is that it can be used with any email client or application that supports SMTP.3. AWS Lambda + Amazon SES: Another option for sending emails is to use AWS Lambda with Amazon SES. This involves creating a Lambda function that sends emails using SES and then triggering the function from another AWS service or EC2 instance. One advantage of this approach is its scalability, as Lambda can handle large volumes of emails without the need for dedicated infrastructure. Additionally, Lambda provides an easy way to integrate with other AWS services, and SES provides the same features as described above.CommentShareEXPERTsedat_salmananswered 2 months agoEXPERTBrettski-AWSreviewed 2 months ago"


Question: Maximum number of Elastic IPs has been reached.

I get following message when I try to allocate new Elastic IP:The maximum number of addresses has been reached.Please help me to increase the maximum.FollowComment

Answer: "0Hello,You can get more Elastic IP on request. You can then attach/reattach them for your EC2 instances.If you feel your architecture warrants additional Elastic IP addresses, complete the Amazon EC2 Elastic IP Address Request Form[1]. Describe your use case so that we can understand your need for additional addresses.Refer to Elastic IP Address Limit Section in the link below:[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html#using-instance-addressing-limitWrite back to us if you have any further queries.CommentShareAWS-User-5718909answered 4 years ago"


Question: Install-AWSToolsModule AWS.Tools.EC2 issue

"Hi,I try Install-AWSToolsModule AWS.Tools.EC2 has issue.I have rebuild OS but cant solved"PS C:\Windows\System32> Install-Module -Name AWS.Tools.InstallerPS C:\Windows\System32> Install-AWSToolsModule AWS.Tools.EC2,AWS.Tools.S3 -CleanUpConfirmAre you sure you want to perform this action?Performing the operation "Install-AWSToolsModule" on target "AWS Tools version 4.1.92.0".[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):Get-AWSToolsModuleDependenciesAndValidate: Exception calling "OpenRead" with "1" argument(s): "Could not find file'C:\Users\Ian\AppData\Local\Temp\eihkbeqr.cf4\AWS.Tools.EC2.4.1.92.0.nupkg'."PS C:\Windows\System32> Install-AWSToolsModule AWS.Tools.EC2,AWS.Tools.S3ConfirmAre you sure you want to perform this action?Performing the operation "Install-AWSToolsModule" on target "AWS Tools version 4.1.92.0".[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): AGet-AWSToolsModuleDependenciesAndValidate: Exception calling "OpenRead" with "1" argument(s): "Could not find file'C:\Users\Ian\AppData\Local\Temp\de4ooqxp.evb\AWS.Tools.EC2.4.1.92.0.nupkg'."PS C:\Windows\System32> Install-AWSToolsModule AWS.Tools.EC2,AWS.Tools.S3 -ForceGet-AWSToolsModuleDependenciesAndValidate: Exception calling "OpenRead" with "1" argument(s): "Could not find file'C:\Users\Ian\AppData\Local\Temp\yetrrcal.skx\AWS.Tools.EC2.4.1.92.0.nupkg'."PS C:\Windows\System32> Install-AWSToolsModule AWS.Tools.S3 -ForceGet-AWSToolsModuleDependenciesAndValidate: Exception calling "OpenRead" with "1" argument(s): "Could not find file'C:\Users\Ian\AppData\Local\Temp\zcwvmega.5ek\AWS.Tools.EC2.4.1.92.0.nupkg'."PS C:\Windows\System32>"FollowComment"

Answer: "1Hello,Thank you for reaching out! I found a similar scenario where the code base for the Install-AWSToolsModule and Get-AWSToolsModuleDependenciesAndValidate modules, which seems related to the fo following line:    try {        $zipArchive = [ZipFile]::OpenRead($Path)The error returned is stating that the module can't locate the required nupkg file which is downloaded from the PS gallery. Other potential errors (firewall settings, proxy configuration, internet connectivity) would not return this error message, so we can discard AntiVirus/Security Software, etc... for now.This could be due to the default version of the TLS protocol that the version of Powershell is configured for TLS1.1. In order to confirm this, please run the following commands in Powershell:PS C:\> [Net.ServicePointManager]::SecurityProtocolIf the output is either 'Tls11' or 'Tls10' then run:PS C:\> [enum]::GetNames([Net.SecurityProtocolType])If the output has 'Tls12', the following command will set the default security protocol type to TLS1.2, and should resolve the issue:PS C:\> [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Now, please try to reinstall the Tools. The reason this occurs is that when the Install-AWSToolsModule is ran to install a specific service, it pulls the needed files from the following sites:https://www.powershellgallery.com/api/v2/package/AWS.Tools.S3/4.1.10https://psg-prod-eastus.azureedge.netFurther reading on this one can be found at Microsoft" "As of April 2020, the PowerShell Gallery no longer supports Transport Layer Security (TLS) versions 1.0 and 1.1. If you are not using TLS 1.2 or higher, you will receive an error when trying to access the PowerShell Gallery." (2-3)If for any reason this does not resolve the issue, You can try upgrading to PowerShell version 7.1 and give this another go (4).If the issue persists, then perhaps this is something else at the OS level, please run the EC2Rescue utility (5) and review the data at the Event Viewer or other relevant logs.Have a nice day!References(1) Prerequisites for Setting up the AWS Tools for PowerShell(2) Network access to the PowerShell Gallery(3) PowerShell Gallery TLS Support(4) Installing PowerShell on Windows(5) Use EC2Rescue for Windows Server GUI - Collect data from an active instanceCommentShareSUPPORT ENGINEERJosueAWSanswered a year ago"