Question: ECS service discovery: Can I use short for inter-service communication?

"I have a bunch of services running in a ECS cluster. For that I created a private namespace called 'ns-foo'. But for service A to talk to service B, I have to say http://a.ns-foo instead of simply saying http://a.This is a bit strange.Am I doing something wrong? In a conventional docker environment, be it docker-compose of k8s, this is the norm.Thanks,FollowComment"

Answer: "0The shortnames for service to service communication is something that really only works - in my exp - on a single host or at least in an environment where docker will have control over DNS on all hosts etc. In ECS + bridge networking mode you can set extra hosts and links, but then again that's not going to scale too well IMHO.Now, where I certainly see the value in local dev with docker-compose to have links / aliases to make it easy to have service A and B talk to each other, in a highly distributed environment, I much prefer to rely on a proper service discovery.When I have services that need to discover each other, I use AWS Cloudmap + ECS (some might use Consul) and let these two deal with DNS registration between each other. Now, yes that means you need FQDN, and maybe with a VPC DHCP Option setting the search domain you can get away with short names, but I have to admit that FQDN is nice.But then also, one thing that a service discovery service does that DNS won't do, is provide client side discovery: instead of relying on DNS to find targets, and this can help achieve costs reductions too for traffic, have your client try first to do "list me all the instances / tasks for service A". To that query you can add "AND subnet == $(same_as_mine)". It will return a list of nodes, if empty, make the same request, without the condition, and so on. Active service discovery means extra steps to write in the code but I find it well worth it.And then another thing you could use is a mesh which itself will use service discovery. It is a bit more work but also well worth it to be able to define application rules at the Layer7 (or layer 4 if you do TCP) and let the services work for you.CommentShareJohnPrestonanswered 10 months ago"


Question: Error in CodeBuild: VPC_CLIENT_ERROR: Unexpected EC2 error: error while getting DHCP options for VPC

"HI,We are getting the following error in all our CodePipelines in the provisioning phase of CodeBuild:VPC_CLIENT_ERROR: Unexpected EC2 error: error while getting DHCP options for VPCCodeBuilds are accessing VPC and private subnets.We have checked that all the settings of security group, VPC, subnets and permissions should be correct.At least to my best knowledge there has not been any changes in our settings or environment.This problem started suddenly. Pipelines have been working before.FollowComment"

Answer: 0Accepted AnswerHithe reason was obvious.One of the developers had removed DHCP option set from the VPC for unknown reason.CommentSharePexiKanswered 9 months ago


Question: Is there a way to disable a VPN connection instead of deleting it?

"So im configurating a Site-to-Site VPN, to use it only as a Backup VPN.Thas is because i have an EC2 Instance serving as a Backup Server...My idea is to have the instance Stopped until i really need it.That instance is accesible by a VPN.Is there a way to mantain de VPN configurated but in "stand-by" or "disable" status?Im going to use it in case my production Server or VPN fail.By consequence, the client just have to point to my Backup VPN.I dont want to create a new VPN in that moment, i just want to have it there...Im being clear?Best regards!Eze.FollowComment"

Answer: "1Accepted AnswerThere is no way to disable the VPN so it can be enabled later on, instead you can disable the tunnels on the on-prem side so the on-prem side can forward traffic over the primary, and enable the tunnels later when needed, but you'll still be charged for the VPN connection which is about $36 per month.Or you can have both VPNs (primary and backup) configured and both are active, and through BGP attributes you can have one act as a primary and one as secondary, for that you would need to use dynamic VPN instead of static.CommentShareMatt_Eanswered 21 days agoEXPERTRiku_Kobayashireviewed 21 days ago1As per the other answer, you can't put a VPN connection into a disabled state.Something I created a few years ago was a Lambda function that would create a VPN connection when specific conditions were met - for example, when a network link goes down. It might be useful here: https://github.com/Brettles/NetworkBreakGlassCommentShareEXPERTBrettski-AWSanswered 21 days agoEXPERTRiku_Kobayashireviewed 21 days agoMNW 20 days agoThats a nice alternative, thanks for the function, very usefull!Share"


Question: Migrate using CloudFormation template

"Is there an option to generate Elastic beanstalk, lambda functions, queue, and RDS to Cloud formation template from the existing account and import the template in the new Account?I have generated all the above resources in former2 and tried to run in new account cloud formation getting too many errors, is that the correct way, or any other way is available to make it simple?FollowComment"

Answer: "0Former2 is your best option.  It's meant to be a starting point for your CloudFormation template, to save time compared to writing from scratch, but it won't produce a perfect "black box".  It doesn't replace having a good understanding of your template and debugging it unfortunately.CommentShareEXPERTskinsmananswered 6 months agoskinsman EXPERT6 months agoInfrastructure as Code (IaC) is key.  A typical workload will have CloudFormation templates (or CDK or Terraform) that are deployed in multiple environments e.g. Dev, Test, UAT and Prod accounts, without change.  Only parameter values change so you're deploying tested and proven code to Production.  Some templates, particularly more DevOps-focused ones, will be deployed across many if not all accounts in the Organization using StackSets - again it's the same template code.Templates are often written from scratch but tools like Former2 can be used too to do some legwork if you have some existing deployed resources you want to mimic.  But then the template you've generated needs some major work, like working out what needs to change as you deploy across multiple environments, and ensuring this is driven by Parameters etc.  And addition of lots of comments - which is one reason why you should use YAML and not JSON CloudFormation templates!  :)ShareAKkavniya 6 months agoThanks for the response, then how come big companies manage this type of requirement, if they have many Environments, will they set them up one by one manually? just I want to understand how they manage.Share"


Question: ClientError: ENA must be supported with uefi boot-mode

"I am trying to run a Windows 10 Home VM in EC2. The plan is to run it in EC2 for about two days, our partner will access it through RDP and then transfer it back to VirtualBox. I prepared the image in VirtualBox, then exported .ova file, uploaded it to S3 and tried to convert it to AMI with following command as described here.$ aws ec2 import-image --description "Windows 10 VM" --platform Windows --disk-containers "file://foo/containers.json" --boot-mode uefi --license-type BYOL --architecture x86_64But I get following error after the import process reaches progress 27%:$ aws ec2 describe-import-image-tasks --import-task-ids fooID{    "ImportImageTasks": [        {            "Architecture": "x86_64",            "Description": "Windows 10 VM",            "ImportTaskId": "fooID",            "LicenseType": "BYOL",            "Platform": "Windows",            "SnapshotDetails": [                {                    "DeviceName": "/dev/sda1",                    "DiskImageSize": 8298251264.0,                    "Format": "VMDK",                    "Status": "completed",                    "Url": "s3://foo/Windows-10.ova",                    "UserBucket": {                        "S3Bucket": "foo",                        "S3Key": "Windows-10.ova"                    }                }            ],            "Status": "deleted",            "StatusMessage": "ClientError: ENA must be supported with uefi boot-mode",            "Tags": [],            "BootMode": "uefi"        }    ]}I have done these steps:Installed ENA driver (Didn't help)Installed AWS CLI (Didn't help)What should I do? I know for sure that the VM boots using UEFI in VBox. Should I convert it to BIOS boot? Is there anything I need to install or what? Google returns only this thread which is unanswered and they are talking about instance types. So I asked my own question.FollowCommentrePost-User-3196201 a year agoAs expected - the AWS CLI installation didn't help. So what next? I've edited the question.Share"

Answer: "0Accepted AnswerAs per the docs here, it's not currently supported I'm afraid -Currently, we do not support importing Windows with UEFI Secure Boot by using the import-image command.If you change the boot mode to legacy BIOS prior to importing this should work.CommentShareOwenanswered a year agorePost-User-3196201 6 months agoThat's dissabpointing. I'll try GCloud before converting it to BIOS.EDIT: GCloud is even worse. AWS gives you consistent error while Google fails with 4 different error messages which don't make sense...Share"


Question: Lua Debugging

"Did someone manage to make this work?http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-editor-debugger.htmlI followed this guide step by step, so the debugger is attached to the editor.But on Step 17 I am missing one important point:That it is actual breaking when it 'should' hit the code.Follow"

Answer: "0Accepted Answerhttps://forums.awsgametech.com/t/luaremotedebugger-does-not-breaks-on-breakpoints/1585/1This is the other thread that I did not see when I created this one.Just in case someone searches for this topic to find the original thread.SharerePost-User-5460328answered 6 years ago0I've been able to get it to debug, however it can be highly temperamental, not breaking when I want it to, unable to stop the debugger and return, etc.I have found that breaking on an actual line of code does help, not an empty line.SharerePost-User-4796539answered 6 years ago0I have a breakpoint on every line of code now. And it is clearly attached to the Editor and the editor console confirmed that it is attached.whyyounodebugging.jpgSharerePost-User-5460328answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-8353690answered 6 years ago"


Question: Global Accelerator - Cannot Upgrade to Dual Stack

"When attempting to upgrade our existing accelerator to dual stack we get the following error:Couldn't update the accelerator to DUAL_STACK because 4 endpoints don't support IPV6. Add IPV6 support or remove the endpoints, and try again. EndpointARN: arn:aws:ec2:ap-southeast-1:872820258610:instance/i-03569e27eebc8dda9 EndpointARN: arn:aws:ec2:eu-west-2:872820258610:instance/i-095c957c5134fad32 EndpointARN: arn:aws:ec2:us-east-2:872820258610:instance/i-08a2e3d77cd1d2e85 EndpointARN: arn:aws:ec2:us-west-1:872820258610:instance/i-043f544ccd6ead5eb All of the endpoints have globally routable IPv6 addresses.  We've verified that all of them can be accesses via IPv6 from hosts on the internet.What could be causing the accelerator to declare the endpoints do not support IPv6?FollowComment"

Answer: 1Accepted AnswerI think that's because GA is only available for application load balancer endpoint type.https://aws.amazon.com/about-aws/whats-new/2022/07/aws-global-accelerator-announces-ipv6-support/CommentShareMatt_Eanswered 22 days agorePost-User-2275362 21 days agoThank You!Share


Question: Amazon EC2 - (Linux Instance) - sudo yum update (curl error 28 - Timeout was reached )

"I connected to an amazon EC2 linux instance using SSH client. In order to update the VM, I mentioned the sudo yum update command but gives a curl error 28. In order to resolve the error I have done the following:Internet gateway in the subnet is open.I used the following linux commands :a.  rm -rf \var\cache\yb.  rm -rf \var\cache\yumc. Then tried to update it again using sudo yum updateI have opened the port 80, 22 and 443 in inbound and outbound rules and also custom TCP port in outbound rulesTo check if the EC2 instance has an active connection, did the following:a.  ping google.com commandb. got the following response : PING google.com (142.250.183.14) 56(84) bytes of data.client_loop: send disconnect: Connection reset (Seems like a temporary connection)Used a different mirror :a. sudo nano /etc/yum.repos.d/amazonlinux.repob. replaced the mirror list in the file with the availability zone mirror eg : https://repo.ap-south-1.amazonaws.com/c.  sudo yum clean alld. sudo yum updateI have tried all the above solutions but I keep getting the same error i.e., curl error 28. Amazon Linux 2023 repository                                                            0.0  B/s |   0  B     06:00Errors during downloading metadata for repository 'amazonlinux':Curl error (28): Timeout was reached for https://repo.ap-south-1.amazonaws.com/ [Connection timeout after 30000 ms]Curl error (28): Timeout was reached for https://repo.ap-south-1.amazonaws.com/ [Failed to connect to repo.ap-south-1.amazonaws.com port 443 after 30000 ms: Timeout was reached]Please suggest how to resolve the error.FollowComment"

Answer: 0Check to make sure no Network ACLs are blockingSet the outbound rule on the security group to wide opencurl www.google.com instead of ping.CommentShareEXPERTkentradanswered 2 months ago


Question: Google BigQuery Connector for AWS Glue / Request to update to 0.28

"The Glue Marketplace Connector "Google BigQuery Connector for AWS Glue" is currently at 0.24.2. Can you please update this connector to 0.28? The newest versions provide direct write using the GRPC streaming write, as well as more forgiving schema handling when using this method. Additionally the current 0.24.2 seems to have issues with passing credentials properly when using indirect write (via cloud storage), which is the only option.Thanks!https://github.com/GoogleCloudDataproc/spark-bigquery-connector/releasesCurrent connector is: https://709825985650.dkr.ecr.us-east-1.amazonaws.com/amazon-web-services/glue/bigquery:0.24.2-glue3.0FollowComment"

Answer: 0I managed to get this working with a custom connector using spark-bigquery-with-dependencies_2.12-0.28.0.jarfrom https://github.com/GoogleCloudDataproc/spark-bigquery-connector/releasesLooks like that's all the AWS package is anyways. It's even pulling in my AWS secret ok. Having the AWS connector updated would still be nice.CommentShareChrisanswered 4 months ago


Question: Is it possible to trigger tests in Amazon Device Farm from local machine?

"On reviewing the Device Farm, I understood we need to upload the apk file and test suite to AWS Farm and then the tests will be triggered in the devices from the device pool. Instead of manually uploading the test files and apks to farm, is there an option were the user can just trigger the tests from his local. And it will start running in AWS farm and after execution the results will be shared to user?FollowComment"

Answer: "0Hi,I work for the Device Farm team.Device Farm can be used to trigger tests from your local machine using AWS CLI or AWS SDK.An example using the the AWS SDK for Python can be found here https://docs.aws.amazon.com/devicefarm/latest/developerguide/api-ref.htmlAn example using the AWS CLI can be found here in a 2 part blog series which can be compressed in a simple shell/bash script : https://aws.amazon.com/blogs/mobile/get-started-with-the-aws-device-farm-cli-and-calabash-part-1-creating-a-device-farm-run-for-android-calabash-test-scripts/Hope this helps.CommentShareNikhil_Danswered a year ago"


Question: Amplify export infrastructures does not work with CDK V2

"According to Amplify documentation and this official blog post, it is possible to export infrastructures from Amplify then import into CDK. However, I try with CDK V2 and it does not work.  I got error when installing npm i @aws-amplify/cdk-exported-backend@latest.  CDK V2 Construct is not compatible with the Construct in  aws-amplify/cdk-exported-backend, I think. So how to export Amplify infrastructure to CDK V2? Thank you!Here is my package.json of CDK{  "name": "amplify-export-cdk",  "version": "0.1.0",  "bin": {    "amplify-export-cdk": "bin/amplify-export-cdk.js"  },  "scripts": {    "build": "tsc",    "watch": "tsc -w",    "test": "jest",    "cdk": "cdk"  },  "devDependencies": {    "@types/jest": "^26.0.10",    "@types/node": "10.17.27",    "jest": "^26.4.2",    "ts-jest": "^26.2.0",    "aws-cdk": "2.18.0",    "ts-node": "^9.0.0",    "typescript": "~3.9.7"  },  "dependencies": {    "aws-cdk-lib": "2.18.0",    "constructs": "^10.0.0",    "source-map-support": "^0.5.16"  }}Here is errors when installingnpm ERR! code ERESOLVEnpm ERR! ERESOLVE unable to resolve dependency treenpm ERR! npm ERR! While resolving: amplify-export-cdk@0.1.0npm ERR! Found: constructs@10.0.108npm ERR! node_modules/constructsnpm ERR!   constructs@"^10.0.0" from the root projectnpm ERR! npm ERR! Could not resolve dependency:npm ERR! peer constructs@"^3.2.27" from @aws-amplify/cdk-exported-backend@0.0.5npm ERR! node_modules/@aws-amplify/cdk-exported-backendnpm ERR!   @aws-amplify/cdk-exported-backend@"0.0.5" from the root projectnpm ERR! npm ERR! Fix the upstream dependency conflict, or retrynpm ERR! this command with --force, or --legacy-peer-depsnpm ERR! to accept an incorrect (and potentially broken) dependency resolution.FollowComment"


Question: Problem with EBS disk resizing not completing

I am resizing an EBS volume. It is stuck at 70%. I don't know if it's OK to mention the volume ID but can if requested.FollowComment

Answer: "0How long has it been since the volume was resized? Also, what state is the resize operation in currently?I was able to find a knowledge article that may help:https://aws.amazon.com/premiumsupport/knowledge-center/ebs-volume-stuck-optimizing-on-modification/#:~:text=If%20you%20must%20modify%20the,is%20in%20the%20Optimizing%20state.CommentSharemilesvscottanswered a year agoimarsman_xmlteam a year agoIt was last resized over a year ago. It eventually resolved the next morning and I allocated the space on the volume.Share"


Question: is there a tool that can generate a cloud formation script to recreate a current VPC and it's associated configurations

"I've got a VPC in an account atm, seems I need to move/recreate my VPC, all my subnets, routes, basic security groups etc.wonder if there is a tool that can create the cloud formation scriptknow there is a vanilla cloud formation yaml file, which you can configure... hoping there is a tool that can create the file based on a current VPC.FollowComment"

Answer: "1Accepted AnswerSee: Former2CommentShareEXPERTkentradanswered a year agogeorgel a year agoi see Former2 under answer, but I don't see any answer...Shareskinsman EXPERTa year agoSorry georgel if I'm not understanding your comment, but kentrad's answer is exactly right.  Former2 is an awesome tool that does just what you want.Sharegeorgel a year agoMy apology, did not understand the answer, will have a look at the tool: Former2.GShare"


Question: Unable to delete certificate - in use by an unknown account

"I'm trying to change a certificate to use DNS instead of e-mail for verification, and it looks like you can't modify an existing certificate so I have created a new one.This worked fine and now I am trying to delete the old certificate but I cannot as it says it's in use:Certificate is in useThe certificate *.example.com (b1f0c003-3a03-41da-98e1-11de39b50cc2)is in use (associated with other AWS resources) and cannot be deleted. Disassociate the certificate from each resource in the list and try again.Associated resources    arn:aws:cloudfront::392220576650:distribution/E2236MAM7WJSZZ    arn:aws:cloudfront::392220576650:distribution/E3MB90ZRMYH1SApparently this account ID belongs to Amazon and I have heard this can come from API Gateway, however I have nothing set up in API Gateway.  Hunting around I did have an old CloudFormation template active from some experimentation with the Serverless Framework application, however after removing that template and giving it a few hours, I still cannot delete the certificate!Is there any way I can find out what exactly is using the certificate so I can figure out how to remove it?  Or is there any way I can just delete the certificate anyway and see what breaks?FollowComment"

Answer: "0With a bit of help, I was finally able to work this one out.It turns out that there's a limitation in the AWS web interface, and you can have some elements of API Gateway active but inaccessible via the web interface.  I was told I needed to go to "Custom Domains" but all I could see was the "Getting Started" page.In the end I had to resort to using the CLI, and blindly hunting around until I hit upon the region where the resources were.aws --region us-east-1 apigateway get-domain-namesaws --region us-east-1 apigateway delete-domain-name --domain-name example.comAfter a few hours this resulted in the AWS-owned CloudFront resources being released and I could at last remove the old certificate!  Phew!CommentShareMalvineous2answered 4 years ago"


Question: Amazon Linux 2023 - cloud-init mounts

"I'm attempting to create a file system and mount it using cloud-init on Amazon Linux 2023.I've used this technique before with a Ubuntu image but it's not working for Amazon Linux 2023.cloudconfig snippet:fs_setup:  - label: data01    filesystem: ext4    device: /dev/nvme1n1    partition: automounts: - [ LABEL=data01, /app, "auto", "defaults,nofail", "0", "0" ]error in cloud-init.log2023-04-13 12:44:57,216 - cc_mounts.py[DEBUG]: mounts configuration is [['LABEL=data01', '/app', 'auto', 'defaults,nofail', '0', '0']]2023-04-13 12:44:57,216 - util.py[DEBUG]: Reading from /etc/fstab (quiet=False)2023-04-13 12:44:57,216 - util.py[DEBUG]: Read 217 bytes from /etc/fstab2023-04-13 12:44:57,216 - cc_mounts.py[DEBUG]: Attempting to determine the real name of LABEL=data012023-04-13 12:44:57,216 - cc_mounts.py[DEBUG]: changed LABEL=data01 => None2023-04-13 12:44:57,216 - cc_mounts.py[DEBUG]: Ignoring nonexistent named mount LABEL=data01If I manually add the fstab line after boot, /app mounts as expected with mount -aLABEL=data01    /app   auto    defaults,nofail     0       0FollowComment"

Answer: "1Hello,Amazon Linux 2023 uses the following cloud-init version by default:$ rpm-q cloud-initcloud-init-22.2.2-1.amzn2023.1.7.noarchLooking over the version's documentation,https://cloudinit.readthedocs.io/en/22.2.2/topics/modules.html#mountsit states:When specifying the fs_spec, if the device name starts with one of xvd, sd, hd, or vd, the leading /dev may be omitted.Any mounts that do not appear to either an attached block device or network resource will be skipped with a log like “Ignoring nonexistent mount …”.This indicates that cloud-init is most likely not going to see/use labels. I was able to test and confirm this by running multiple variations of the configuration snippet you provided, each variation resulted in the same "Ignoring nonexistent mount …" error. When using the device name/path as mentioned within the guide though:fs_setup:  - label: data01    filesystem: ext4    device: /dev/nvme1n1    partition: automounts: - [ /dev/nvme1n1, /app, "auto", "defaults,nofail", "0", "0" ]This mounted with no issues. If you would still like to mount a freshly formatted volume (within cloud-init) using the label, you will need to use a different method to mount the volume, such as running a follow up command within the runcmd module (as seen below):#cloud-config fs_setup:  - label: data01    filesystem: ext4    device: /dev/nvme1n1    partition: autoruncmd: - [ mount, -L, data01, /app ]Should you require further assistance regarding your specific situation/use-case, please feel free to create an AWS Support case to get in touch with an engineer to assist you further.https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlCommentShareSUPPORT ENGINEERJuan_Panswered a month ago"


Question: Sporadic no response from dynamodb request

"Hi dynamodb experts ;-)I have an infrequent issue:Sometimes (one of thousands or more of requests) a dynamodb call (no matter which table or what kind of request, get, query, put, del, etc...) is not responding (in time).I call dynamodb from my lambda functions and track it like this (I track the calls with iopipe):  const ddb = new AWS.DynamoDB.DocumentClient({ region: settings.region });  const params = {    TableName: 'my-table-for-user-projects',    Key: {      projectId: projectId,      userId: userId    }  };  settings.track('database').start();  ddb.get(params, (err, ret) => {    settings.track('database').end();    if (err) return callback(err);    callback(null, ret.Item);  });in iopipe I see "NO TRACE END DETECTED" for my custom metric and also for the dynamodb call, i.e:REQUEST HEADERSAuthorizationAWS4-HMAC-SHA256 Credential=ASIAG3Y/20190222/eu-west-1/dynamodb/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-target, Signature=ca368c**********************************************bb6ac670Content-Length160Content-Typeapplication/x-amz-json-1.0Hostdynamodb.eu-west-1.amazonaws.comUser-Agentaws-sdk-nodejs/2.406.0 linux/v8.10.0 exec-env/AWS_Lambda_nodejs8.10 callbackX-Amz-Content-Sha256132956**************************************220b3d9fX-Amz-Date20190222T145758ZX-Amz-TargetDynamoDB_20120810.GetItemx-amz-security-tokenFQoGZXIvY*************************************************xsfm9zKPPyv+MFNo Response HeadersHas there been any internal changes to dynamodb? Or any known network issues? Not resolving the correct dns name or similar?Maybe other useful hints: Have these timeouts since 1-2 weeks and I switched the dynamodb plan to on-demand since last month. And also important: seems there are no big workload peaks when the timeouts are triggered (no special dynamodb capacity increase and no throttled request).I hope anyone can help, because my customers starts to notice it. :-(Have a nice day.FollowComment"

Answer: "0Hi adrai,I am not sure if this is the case for your but we have encountered a similar problem recently. Basically, we were experiencing an unexpected delay (100ms to 300ms, depending on the memory allocated for the corresponding Lambda) for some dynamodb calls we made in our Python function and this was happening randomly.In our case since we had a bigger timeout value set in our Lambda, functions didn't timeout. However, we were using Thundra to monitor our Lambda function and it has an AWS SDK integration shows the individual dynamodb call's duration. We saw in the Thundra console that some random dynamodb calls experience an extra latency.We eventually found out the reason was the connection timeout value that AWS SDK uses while making API calls. It was set to the 60s by default for Python AWS SDK. Basically, whenever there is a gap between two dynamodb calls greater than the 60s, AWS SDK creates a new connection and that was causing unexpected latency I have mentioned above. As long as the time between two dynamodb calls does not exceed the 60s, AWS SDK uses the same connection, so there is no extra latency for creating a new connection. Also, note that this is not something related to cold-start. Even if your Lambda is warm, once the connection that AWS SDK uses to make API calls is timed out; same latency is occurring again.I don't know if this was the exact issue you faced with, but maybe that gives you a clue about one of the possible causes. Also, I suggest you have a look at Thundra (https://www.thundra.io). It helps a lot to deal with that kind of problems.CommentSharehamitbanswered 4 years ago0Thanks for your reply.I see the same stuff you mentioned for thundra also in iopipe...See screenshot here: https://twitter.com/adrirai/status/1099224045365669888My setup with lambda + dynamodb is like for more than 2 years now... and the timeouts just appeared a couple of weeks ago... (but as said, really just very rare. Perhaps some dynamodb nodes react differently?)CommentShareadraianswered 4 years ago0Changing the default http timeout in the aws-sdk seems to solve my problem.AWS.config.update({httpOptions: {timeout: 5000}}); // default is 120000 => 2 mins// orconst ddb = new AWS.DynamoDB.DocumentClient({ region: settings.region, httpOptions: { timeout: 5000 } }); // default is 120000 => 2 minsCommentShareadraianswered 4 years ago"


Question: Route53 not resolving custom domain for CloudFront

"I have set up an S3 bucket to serve a website via https using CloudFront.  Within that bucket, I have a folder for each environment and a set of version folders within the production folder:my-bucket|-dev|-prod  |-v1.0  |-v1.0.1...etc.My initial (development) attempt worked fine using https://dev.mydomain.org, but when I decided to change the alternate domain name in the CloudFront distribution to the production name (i.e. https://mydomain.org and https://www.mydomain.org) and updated the Origin path, it stopped working.I am using Route53 to manage DNS and I haven't deleted the hosted zone.  As far as I can tell, all the name server entries match like they're supposed to (makes sense, given I haven't touched the zone).  I HAVE removed and recreated AAAA alias records that point to my CloudFront distribution with the two alternate domain names.  Several times.  No dice.  I have also removed the alternate domain names from the distribution and re-added them.  (I re-created the Route53 AAAA records after changing the distribution.)I can dig my domain without error.  The Route53 test also comes back fine (for what it's worth).  However, if I try to ping or curl, I get 'unknown host' errors.  Visiting https://mydomain.org in a browser similarly returns a DNS_PROBE_FINISHED_NXDOMAIN response.In case it's relevant, I have this function attached to my distribution to re-route https://www.mydomain.org requests to https://mydomain.org:function handler(event) {  var request = event.request;  var headers = request.headers;  var host = request.headers.host.value;  if (host.startsWith('www')) {    var response = {      statusCode: 301,      statusDescription: 'Moved Permanently',      headers: {        location: {          value: 'https://' + host.replace('www.', ''),        },      },    };    return response;  }  return request;}However, unlinking the function doesn't resolve the issue.  (I have tested the function in the AWS console and it seems fine.)CloudFront itself seems to be OK.  If I hit the CloudFront domain (e.g. d3abcdefghi123.cloudfront.net), I can see the site in all its glory.I have created a TLS/SSL certificate through ACM that covers both the apex and wildcard.  I don't think there's a problem there.Something just refuses to resolve my custom domain to the CloudFront distribution.  I know DNS changes can be slow - maybe I'm just too impatient?  I don't want to create a new CloudFront distribution if I can help it - surely it's possible to update the Origin path and alternate domains?  Given the site works fine through the default CloudFront domain, I don't think I need to invalidate it either.I'm out of ideas at this point, so suggestions would be most welcome.Regards,FlicFollowComment"

Answer: "1Accepted AnswerSo there were a couple of things I did to resolve this.  First, I flushed the DNS cache on my Macbook Pro with the following command in a terminal session:sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponderFor good measure, I cleared the web cache on all my browsers and restarted the laptop as well.  The big clue that pointed me in this direction was the site working on another computer that hadn't previously been used to view it.  This suggested it was an issue with the laptop itself.  Make sure to give the DNS cache some time to clear (a few minutes should be more than sufficient).Another thing I had overlooked was creating A record aliases to the CloudFront distribution - I had only created AAAA records (which are recommended by Amazon).  In my case, it was tricky to diagnose the problem because I hotspot off a mobile phone.  Most of the time I'm allocated an IPv6 address so the site looked fine.  However, it would randomly stop responding to browser requests - I suspect on those occasions the PC was allocated an IPv4 address and was looking for an A record instead of an AAAA.  Why do I think this?  I asked friends to check out my site and they DIDN'T see it first go - so DNS caching on their machines was not the issue.Moral of the story:  create BOTH A and AAAA alias records.  IPv4 is going to be around for a long while yet and you simply can't predict what type of record your audience will request.  If you're stuck getting bad responses and dig doesn't report errors, flush BOTH the web and DNS caches as well.Hope someone else finds this useful.Cheers,FlicCommentShareFlicanswered a year ago"


Question: Timeouts using  aws-iot-device-sdk-python

"Hey,we are using IoT Core Shadows with ROS and Python (that's why we use the SDK v1 and not v2) and we get timeouts while trying to send shadow updates fairly frequently. Sometimes when starting everything, sometimes only after the process ran for some time.It doesn't seem to be our connection (everything else runs without problems), what would be a good starting point in debugging this?I haven't found anything related in the cloudwatch logs.The IoT device and the server are in mid europeFollowComment"

Answer: "3By chance are you using the aws-iot-device-sdk-python library? And then also sending the shadow update message in the same thread that receives a IoT topic (including receiving other shadow updates)? For reasons I have never fully understood, sending a IoT message in the callback thread (after receiving a message on a subscription) will throw a publish timeout error. If this is the case there are a couple of things you can do to try and resolve the problem.Spin up a worker thread to publish your shadow changes.Migrate your code to the newer [aws-iot-device-sdk-python-v2 library] (https://github.com/aws/aws-iot-device-sdk-python-v2).A couple of further general suggestions to try and help narrow down the causes.Since publishing to IoT Shadows are really just publishing messages to special IoT topics, test whether or not you can consistently publish to a non-shadow topic. This will tell you if it's a problem with the shadow service or a general problem with IoT publishing.Make sure you are publishing with QoS 1, which sends back receive receipts.Set your code up such that if you get a publish timeout do a ping to your IoT endpoint. If the ping times out, this would tell you the problem is general networking versus IoT.CommentShareErikanswered a year agoWDDev a year agoYour first suggestion already did the trick, thank you very much!ShareWDDev a year agoWell, it seemingly only helped for some time, now the timeouts are backShare0Accepted AnswerThere was an update to the sdk in december 2021 which fixed the issue for me.Currently (Jan. 2022) you need to install it manually from github to use it.CommentShareWDDevanswered a year ago"


Question: ULID in MQTT message

"Hi,I am working with mqtt client. And I am using CPP implementation for that. I want to use ULID in one of my request message. I am not getting how to do it.Can you please help me in that?FollowCommentGavin_A 6 months agoCan you describe how you wish to use the ULID in a request message, and if this is with MQTT 3.11 or MQTT 5 client connection?Share"

Answer: "0Depending how you wish to process the payload, the ULID can be added as an additional key/value to the message (assuming JSON). For instance, the message payload could like this:{  "MyData": {    "foo": 1,    "bar": 2,  },  "ULID": "01GMB8RKEBSHA1081ZGTTRBD6B"}And the you can programmatically process the ULID by a subscriber, or inline via the Rules Engine if passing off to Lambda for instance.AWS IoT Core does not have any features to introspect data, like for putting it into a CloudWatch Log entry. You would need to understand the message payload and use the ULID within your business logic.Please let me know if you have any follow-ups!CommentShareGavin_Aanswered 6 months agohariom 6 months agoHi Gavin_A,Thanks for your reply. I want to know if AWS provides any API for ULID generation?. If yes can you please tell me the API name.  If no, how can I generate the ULID for C++ implementation?Regards,HariomShareGavin_A 5 months agoULID generation is non-vendor standard. Web search for ulid generation c++ example is probably a good starting point. AWS doesn't have any services that generate ULID or UUIDs.Share0Hi Gavin_A,I want to use ULID as one of the element in the MQTT message.I am using MQTT 3.11 for client connection.CommentShareHarianswered 6 months ago"


Question: Request a public certificate

"I am trying to get a free SSL/TLS certificate, I followed the process duly and made sure my domain is valid.However, I'm still not getting any validation mail.FollowComment"

Answer: "1You maybe use AWS Certificate Manager to get SSL/TLS certificate.There are two kinds of domain validation methods such as DNS and e-mail validation in AWS Certificate Manager.and it is more convenient to use the DNS validation method to maintain ACM certificates If you can access your DNS service such as Amazon Route53 because it needs less periodical human work to extend the certificates once required records are added.If you still need to use the e-mail validation method, you should check the pre-defined eight administrative e-mails addresses below:administrator@your_domain_namehostmaster@your_domain_namepostmaster@your_domain_namewebmaster@your_domain_nameadmin@your_domain_name"Domain registrant" email address in the WHOIS database for your domain"Technical contact" email address in the WHOIS database for your domain"Administrative contact" email address in the WHOIS database for your domain"your_domain_name" means your domain name such as "sub1.sub2.domain-name.com" except if you request an ACM certificate for a domain name that begins with www or a wild-card asterisk (*), ACM removes the leading www or asterisk and sends the email to the administrative addresses.You should also understand if you use AWS CLI or API directly, a validation email will be sent to "@sub1.sub2.domain-name.com" but if you use AWS Management Console to request an AWS certificate, it will check MX records on behalf of you and this means that it will find MX record for subdomains recursive manner.For example, if you requested an AWS certificate for the domain "sub1.sub2.domain-name.com" and if there is an MX record in sub2.domain-name.com only, AWS Certificate will check "sub1.sub2.domain-name.com" and then "sub2.domain-name.com" to find MX record, and finally it will send a validation e-mail to "@sub2.domain-name.com" which is the e-mail address with the domain that is the first sub domain which has MX record. If there is no MX record for all sub-domains, it will send the e-mail to the original domain address "*@sub1.sub2.domain-name.com"I recommend reading this document below for more details.https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-email-validation.html#troubleshooting-no-mailCommentShareJunhwan Ananswered 6 months ago0Where is your domain hosted? Is it on Route 53 or some other 3rd party website?Have you tried manual domain validation? wherein you have to create the CNAME record in your DNS management and that would take sometime to validate.CommentShareSujeet Kumaranswered 6 months ago"


Question: How to disable ufw ?

"Please help meI use Lightsail and set the firewall  using Lightsail/ Manage/ Networking/ Ipv4 Firewall rules.There are  SSH TCT 22,   HTTP TCP 80,  MySQL TCP 3306   etc.When I failed open a web site on that Lightsail,  I connected the instance using Puttyand  runsudo ufw allow 'Apache Full'    and  sudo ufw enable.Since then, I cannot access the instance in anyway.   Nothing works !How can I login to my instance ?   Please HelpFollowComment"

Answer: "0Hi there,Since you cannot connect to your Lightsail instance via ssh or through the browser-based ssh client after enabling ufw. You can recover your instance by taking a snapshot of it if you did not create a backup on launch and create a new instance from it. When you launch the new instance via console add the following script as a launch script to disable ufw:sudo service ufw stopYou can also use AWS CLI to launch the new instance from a snapshot by running the following command:aws lightsail create-instances-from-snapshot --region <snapshot-region> --instance-snapshot-name <snapshot-name> --instance-names <new-instance-name> --availability-zone <preferred-AZ> --user-data 'sudo service ufw stop' --bundle-id <value>Alternately, you can export your Lightsail snapshot to Amazon EC2 for further troubleshooting by following the steps here and here.  Additionally, here is a video tutorial  on how to export Lightsail instance to Amazon EC2 instance.Hope this helpsCommentShareCebianswered a year ago"


Question: aws cli apigateway put-integration Invalid Method identifier specified

HelloI run the following example  from the documentationAWS CLI apigateway put-integrationaws apigateway put-integration --rest-api-id 1234123412 --resource-id a1b2c3 --http-method GET --type AWS --integration-http-method POST --uri 'arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:123412341234:function:function_name/invocations'But got the following error :An error occurred (NotFoundException) when calling the PutIntegration operation: Invalid Method identifier specifiedOf course I took good --rest-api-id value and --resource-id value.Does the issue may comes from the URI ?Please advise ?FollowComment


Question: SES email not reaching hotmail users

"I'm using SES for a tiny charity that I am a member of. We have a "members@..." address for members, and an "info@..." address for external queries. I use a lambda to forward emails to these two addresses on my domain (which is on route 53) to a list of people. Since the start, our members on hotmail only get these emails in the spam folder. I don't have hotmail (and I don't even think you can get one these days), so I can't verify that they've done everything to allow-list the email. But lately, the emails aren't even getting to hotmail. They are bouncing with the following:..."action":"failed","status":"5.6.0","diagnosticCode":"smtp;550 5.6.0 CAT.InvalidContent.Exception: DataSourceOperationException, proxyAddress: prefix not supported - ; cannot handle content of message with InternalId ...Does this sound familiar to anyone? Anything I can do?I have Easy DKIM turned on, and tried adding a custom FROM. I'm using Gmail and the emails arrive fine with all checks seemingly passing. We have members in several email domains, but Hotmail is the only one where I have this issue.The latest thing I tried was to send a test email (using the send test email button in the console) to a hotmail user and it went through to their inbox, which suggests there might be something wrong with the lambda (for hotmail users only). The lambda rewrites the subject line, adding a [SVP Members] or [SVP Info] to the front of the subject line, for the members or info addresses.FollowComment"

Answer: "0Hi,Actually, in one of my projects I have developed somehow the same logic. I configured SES for sending emails and have used Lambda for sending emails via SES. I have developed the SES configuration in Terraform. I have already checked this solution for sending to Yahoo, Gmail, Hotmail, and some company email addresses.terraform {  required_providers {    aws = {      source  = "hashicorp/aws"      version = "~> 4.20.1"    }  }  backend "s3" {    bucket         = "my-bucket-name"    key    = "ses/terraform.tfstate"    region = "my-region"  }}provider "aws" {  region = "my-region"}variable "domainname" {  type    = string  default = "my-domain-name.com"}data "aws_route53_zone" "default" {  name         = var.domainname  private_zone = false}resource "aws_ses_domain_identity" "domain" {  domain = var.domainname}#----------------------------------------------------#         Domain Verification Record#----------------------------------------------------resource "aws_route53_record" "example_amazonses_verification_record" {  zone_id = data.aws_route53_zone.default.zone_id  name    = "_amazonses.${aws_ses_domain_identity.domain.id}"  type    = "TXT"  ttl     = "300"  records = [aws_ses_domain_identity.domain.verification_token]}resource "aws_ses_domain_identity_verification" "example_verification" {  domain = aws_ses_domain_identity.domain.id  depends_on = [aws_route53_record.example_amazonses_verification_record]}#----------------------------------------------------#         DKIM Record Set#----------------------------------------------------resource "aws_ses_domain_dkim" "example" {  domain = aws_ses_domain_identity.domain.domain}resource "aws_route53_record" "example_amazonses_dkim_record" {  count   = 3  zone_id = data.aws_route53_zone.default.zone_id  name    = "${element(aws_ses_domain_dkim.example.dkim_tokens, count.index)}._domainkey"  type    = "CNAME"  ttl     = "300"  records = ["${element(aws_ses_domain_dkim.example.dkim_tokens, count.index)}.dkim.amazonses.com"]}CommentShareParisa Moosavinezhadanswered a month ago"


Question: GameLift Plug-in for Unity now available

"Hello GameLift devs,Today, the GameLift team is excited to announce the general availability of the GameLift Plug-in for Unity. With this update, you can use native Unity user interfaces and workflows to access GameLift APIs and deploy AWS CloudFormation templates for common gaming scenarios.The GameLift Plug-in for Unity provides everything you need to access GameLift APIs. After downloading and installing the plugin package into your Unity development environment, you can use the native plugin UI to configure their plugin settings, perform local testing of builds of their game server, and import and run a sample Unity game. The GameLift Unity plugin also includes five pre-built CloudFormation sample scenarios that you can customize for their game, making it easier to integrate GameLift with AWS. The five deployment scenarios include:Auth Only - this scenario create a game backend service that performs player authentication.Single-Region Fleet - this scenario creates a game backend service with a single GameLift fleet.Multi-Region Fleets with Queue and Custom Matchmaker - in this scenario, GameLift queues are used in conjunction with a customer matchmaker. The custom matchmaker forms matches by taking the oldest players in the waiting pool. When there are enough players for a match, the AWS Lambda handler starts a queue placement.SPOT Fleets with Queue and Custom Matchmaker - this scenario is the same as Multi-Region Fleets with Queue and Custom Matchmaker except it configures three fleets. Two of the fleets are SPOT fleets containing nuanced instance types.FlexMatch - this scenario uses GameLift FlexMatch, a customizable matchmaking service for multiplayer games.You can deploy these five scenarios from the GameLift Plug-in for Unity.Get stated now by visiting our GitHub page: https://github.com/aws/amazon-gamelift-plugin-unity.For more information, please refer to our Release Notes and What’s New post.Mark Choi, GameLift PMFollowComment"

Answer: "0🙌Please let us know if you have any questions when using the plug-in, or you could create GitHub issues to report any bugs/feature requests!CommentSharerePost-User-7108006answered 2 years ago0@REDACTEDUSERCommentSharerePost-User-6168330answered 2 years ago0@REDACTEDUSERCommentSharerePost-User-1729650answered 2 years ago"


Question: SageMaker Autopilot training jobs stopped without any logs

"I'm trying to use SageMaker Autopilot. I'm creating new jobs via the CreateAutoMLJob API.The processing jobs succeed, but the training jobs just stop pretty much instantly after they start. Here's an example of the history of one of the training jobs :Status    Start time            End time            DescriptionStarting4/3/2023, 7:03:42 PM4/3/2023, 7:04:53 PMPreparing the instances for trainingDownloading4/3/2023, 7:04:53 PM4/3/2023, 7:04:53 PMDownloading input dataStopping4/3/2023, 7:04:53 PM4/3/2023, 7:04:53 PMStopping the training jobStopped    4/3/2023, 7:04:53 PM4/3/2023, 7:04:53 PMTraining job stoppedThere are no logs available, and there are no errors in the console. When I click the View logs button that redirects me to CloudWatch, the Log Group does not exist.FollowComment"

Answer: "0Hello,Thank you for using SageMaker AutoPilot.With the provided details, it is difficult to understand what could be the reason for the training job to stopped without any error message. Additionally, I do see multiple secondary status missing in the screenshot that is attached to your question. To better understand the issue, logs are required.  Can you please confirm that the IAM role used is having correct permission to push the logs to CloudWatch, once that is confirm then please retry the AutoML job and see if the job is populating the logs to CloudWatch metrics. If still the logs are not populated and the training is stopping without any log information, then please reach out to Support Engineer team with all the details so that they can investigate the issue with the help of the internal tools and  help you mitigate the issue.To open a support case with AWS using the link:https://console.aws.amazon.com/support/home?#/case/createCommentShareSUPPORT ENGINEERKartik_Ranswered 2 months ago"


Question: AWS SDK SQS get number of messages in a dead letter queue

"Hello community,I somehow can't find the right information. I have following simple task to solve:create a lambda that checks if a dead letter queue has messages and if it has, read how many.Before I did that I had an alarm set on an SQS metric. I chose the 'ApproximateNumberOfMessagesVisible' metric since 'NumberOfMessagesSent' (which was my first choice) does not work for DLQueues. I have read this article: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html.The NumberOfMessagesSent and NumberOfMessagesReceived for a dead-letter queue don't matchIf you send a message to a dead-letter queue manually, it is captured by the NumberOfMessagesSent metric. However, if a message is sent to a dead-letter queue as a result of a failed processing attempt, it isn't captured by this metric. Thus, it is possible for the values of NumberOfMessagesSent and NumberOfMessagesReceived to be different.That is nice to know, but I was missing the information: which metric shall I use if NumberOfMessagesSent won't work? I was being pragmatic here so I created an error, a message was sent to the DLQ as a result of a failed processing attempt. Now I looked at the queue in the AWS console under the monitoring-tab and I checked which metric spiked. It was ApproximateNumberOfMessagesVisible, which sounded suitable, so I used it.Now I wanted to get alerted more often so I chose to build a lambda function that checks how many messages are in the DLQueue. I use Javascript / Typescript so I found this:https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html.Code looked something like this:const params = {        QueueUrl: url,        AttributeNames: ['ApproximateNumberOfMessagesVisible']    }const resp = SQS.getQueueAttributes(params).promise()It was kind of a bummer that the attribute I wanted was not in there, or better: it was not valid.Valid Values: All | Policy | VisibilityTimeout | MaximumMessageSize | MessageRetentionPeriod | ApproximateNumberOfMessages | ApproximateNumberOfMessagesNotVisible | CreatedTimestamp | LastModifiedTimestamp | QueueArn | ApproximateNumberOfMessagesDelayed | DelaySeconds | ReceiveMessageWaitTimeSeconds | RedrivePolicy | FifoQueue | ContentBasedDeduplication | ...My first attempt was to use CloudWatch metrics. So I tried this:https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/cloudwatch-examples-getting-metrics.htmlvar params = {  Dimensions: [    {      Name: 'LogGroupName', /* required */    },  ],  MetricName: 'IncomingLogEvents',  Namespace: 'AWS/Logs'};cw.listMetrics(params, function(err, data) {  if (err) {    console.log("Error", err);  } else {    console.log("Metrics", JSON.stringify(data.Metrics));  }});but I could not get this working since I did not know what to add to Dimensions / Name to make this working.Please note that I am not working very long with AWS (only 6 months). Maybe I am on a total wrong track.Summarized: I want to achieve that my lambda gets the number of messages in a DLQ.I hope someone can help meCheersAleksFollowComment"

Answer: "0You can use ApproximateNumberOfMessages to find out how many messages are in the queue.CommentShareEXPERTUrianswered a year agoAWS-User-6873432 a year agoThank you for your answer I will try that, and post my reply if it works as expected.Share"


Question: Not able to use IOT Rule to publish message to IOT Events thru MQTT Client

"Not able to use IOT Rule to publish message to IOT Events  given in example template : AAWS_IoTEvents_HelloWorld_VoltageInputhow to define an IoT Events action in an AWS IoT rule using IOTCORE ConsoleWould message payload in MQTT Client would be like this:{"powerwallId": "100009", "voltage": 30}FollowCommentozy cozy 3 months agoTry subscribe to topic '#' which means able to subscribe all topic. You have to subscribe first in order to listen, then you can pass any json content.Share"

Answer: "0Hi, you can use IoT Events as a destination for your rule action. You have to create an IoT Events Input (if not done) and an IAM Role that will allow you to send those events. The policy whould be something in the lines of this:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "iotevents:BatchPutMessage","Resource": ["arn:aws:iotevents:{region}:{account}:input/{input_name}"]}]}Hope this helps!CommentShareJordi Portaanswered 3 months ago"


Question: Bug in sending email from a specific verified identities from SES

"Hi,We are using SES, (currently using region N. Virginia) from last 5 years. Everything is working fine. We are using domains and email ids as verified identities, and we are able to send email from those identities. However we are facing issue with two specific verified identities (emails), from which we are not able to send email. We get success response from ses api, however none of the recipient receives email.Please find the details and responses from SES APIsAPI response for identity: alumni.admin@spjimr.org{ ["data":"Aws\Result":private]=> array(2) { ["MessageId"]=> string(60) "0100017de1d3165c-f0145929-826d-408a-ba91-ae3e3bd4e515-000000" ["@metadata"]=> array(4) { ["statusCode"]=> int(200) ["effectiveUri"]=> string(37) "https://email.us-east-1.amazonaws.com " ["headers"]=> array(5) { ["date"]=> string(29) "Wed, 22 Dec 2021 11:07:27 GMT" ["content-type"]=> string(8) "text/xml" ["content-length"]=> string(3) "326" ["connection"]=> string(10) "keep-alive" ["x-amzn-requestid"]=> string(36) "2002009e-3849-448c-a7d4-bf2e2641fc08" } ["transferStats"]=> array(1) { ["http"]=> array(1) { [0]=> array(0) { } } } } } ["monitoringEvents":"Aws\Result":private]=> array(0) { } }API response for identity: alumnioffice@spjain.org{ ["data":"Aws\Result":private]=> array(2) { ["MessageId"]=> string(60) "0100017de1dfb9c9-3baf69ef-a7c1-4978-9415-1cb2e6450adb-000000" ["@metadata"]=> array(4) { ["statusCode"]=> int(200) ["effectiveUri"]=> string(37) "https://email.us-east-1.amazonaws.com " ["headers"]=> array(5) { ["date"]=> string(29) "Wed, 22 Dec 2021 11:21:15 GMT" ["content-type"]=> string(8) "text/xml" ["content-length"]=> string(3) "326" ["connection"]=> string(10) "keep-alive" ["x-amzn-requestid"]=> string(36) "8fb5e332-43b3-43bb-b935-57876ace13f3" } ["transferStats"]=> array(1) { ["http"]=> array(1) { [0]=> array(0) { } } } } } ["monitoringEvents":"Aws\Result":private]=> array(0) { } }Please help us resolve this bug. As This seems to be a SES's internal bug or issue, however AWS doesn't provide even basic technical support, which is very bad for a company like amazon.FollowComment"

Answer: "0Are you getting any telemetry from notifications on the feedback topics?CommentSharemdibellaanswered a year ago0Hello and thank you for contacting AWS re:Post!I reviewed your information and have some feedback for you.  I used the message IDs provided in your post to confirm the messages were soft bounces due to DMARC authentication failures.  SES is returning the error provided by the receiving mail transfer agent (MTA); the error is not originating from SES but being passed back through SES.  The email used to send the message is showing verified, but custom MAIL FROM  address is showing a pending status.550-5.7.26 Unauthenticated email from spjimr.org is not accepted due to domain's DMARC policy. Please contact the administrator of spjimr.org domain if this was a legitimate mail. Please visit https://support.google.com/mail/answer/2451690 to learn about the DMARC initiative.Please also visit the AWS documentation link for details on complying with DMARC using SES (1) and  this AWS documentation for setting up custom MAIL FROM domain (2),  which includes instructions for both verified domains and verified email addresses.  Looks like you are trying to use a custom MAIL FROM using a verified email address.Thank you!-- Resources --https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-dmarc.htmlSetting up a custom MAIL FROM domain - Configuring the MAIL FROM domain - https://docs.aws.amazon.com/ses/latest/DeveloperGuide/mail-from.html#mail-from-setCommentShareSUPPORT ENGINEERRon_Hanswered a year ago"


Question: where is our IP?

"Hello,I have a client that is asking for our IP and wants to clear our IP address  through their security, so they can send us a link to stream.  Where do I find our IP?FollowCommentalatech EXPERT4 months agoWhat are you exposing to your customer, is an api or something else?Share"

Answer: "0First, you need to know if you have a static IP or a dynamic IP from your ISP.  If you have dynamic, it will change.  Static won't.  Here's a website from Amazon that will tell you your current public IP address.https://checkip.amazonaws.comCommentSharejschwar313answered 4 months agoAnanth Tirumanur 4 months agoThis seems to provide the current IP of the machine you open this IP in.Share0To stream data into AWS, you need to have the IP address of the target AWS resource. Here's a general overview of the steps to obtain the IP address:Identify the AWS resource that you want to stream data into, such as an Amazon S3 bucket or Amazon Kinesis stream.Determine the endpoint for the AWS resource. An endpoint is a URL that represents the entry point for accessing a specific AWS resource. For example, the endpoint for an S3 bucket might look like s3.us-west-2.amazonaws.com (Reference)  and Kinesis endpoint might look like kinesis.us-west-1.amazonaws.com (Reference).Obtain the IP address for the endpoint. You can do this by using the command line utility nslookup and specifying the endpoint as the argument:nslookup <endpoint>The output of the nslookup command will include the IP address for the endpoint.Here is an exampe output:Server:192.168.0.1Address:192.168.0.1#53Non-authoritative answer:Name:kinesis.us-west-1.amazonaws.comAddress: 13.52.146.193Use the IP address to stream data into the AWS resource. The specific method for streaming data will depend on the AWS resource you're targeting and the programming language or tool you're using to stream the data.Keep in mind that AWS resources may have multiple IP addresses, and the IP addresses can change over time, so it's important to dynamically obtain the IP address when you stream data into AWS.If this helps, please upvote and accept answer to help everyone on this forum. Let me know if you need anything else.CommentShareAnanth Tirumanuranswered 4 months ago"


Question: Glue Start-Blueprint-Run running into timeout issues with increased number of jobs

"Describe the bugUsing AWS-CLI (Version: aws-cli/2.8.6 Python/3.9.11 Windows/10 exe/AMD64 prompt/off), starting a Glue Blueprint Run works fine when the number of objects generated inside the workflow (Triggers/Glue Jobs) is under 30-40 objects in total. But when there's more objects being generated inside the glue workflow, the Blueprint Run seems to be timing out and gets stuck in RUNNING state.Expected BehaviorWe expect the Blueprint Run to spin up the workflow with all the number of jobs as needed. This is a sample example of the workflow where each row consists of 2 jobs with a trigger in the middle for each task, and there could be N number of tasks like this:Current BehaviorThese number of rows of tasks when under 8-10 tasks, the blueprint run is successful and doesn't time out but when it's more the Blueprint Run is stuck in RUNNING state and we never get the workflow generated.Reproduction StepsThis is the AWS CLI command we're using right now:aws glue start-blueprint-run --blueprint-name BLUEPRINT_NAME --role-arn IAMRoleARN --parameters "file://FILE_PATH.json" --region us-east-1 --profile test-naga --cli-connect-timeout 900 --cli-read-timeout 900The JSON object takes in a collection of table names and loops over them and the layout file creates the workflow as shown in the image above. It's not easy to reproduce this with the exact same example but maybe one of the samples here https://github.com/awslabs/aws-glue-blueprint-libs/tree/master/samples/crawl_s3_locations could be used but for a higher number of jobs/objects created through the Blueprint RunPossible SolutionI'm wondering if it's related to the --cli-connect-timeout and --cli-read-timeout issue as the default value is 60 seconds and it seems like the Blueprint Run tries to spin up all the resources in that time but if there are more objects to spin up and it crosses this time, the whole process times out and gets stuck in the RUNNING state without doing anything.We also tried setting these values to 0 and still the same issue. The number of objects it spins up when timing out seems to be random across each runs.CLI version used2.8.6Environment details (OS name and version, etc.)Windows 10FollowComment"


Question: Profile permalink

Is there a way to find out your own profile URL so that it can be shared with others?FollowComment

Answer: "4If you go to your dashboard there is a share button under your Avatar. Click on that and it copies your profile URL.CommentShareMauriceanswered a year agonikolay a year agoThank you!Share1Currently I do not see a way for doing that in re:Post. Please us the feedback tab on the right to enter that suggestion.CommentShareKunal_Ganswered a year agonikolay a year agoGiven there's the widely popular Stackoverflow, you know people want to link to their profiles so that they can be followed!Sharedavidgmre a year agoI'm unsure if this is your permalink, but clicking on your username worked for me: https://repost.aws/community/users/USb9tZnu6oQ-eX4I44rQpmHgShare"


Question: using locate as a value inside if else

"Hello, I'm trying to do this:ifelse(locate({Billing Value},"token") DIFFERENT(i cannot put it on the post I dont know why) 0,locate({Billing Value},"token"),"blop")but I get an error, which seems to be related to the fact of using locate as a field, but I don't understand what is going wrong.Basically what I try to do is locate the word "token" in a field, and if it is found, I want to return its position in the stringThanks a lot,TomyEdited by: tblondeau on Oct 12, 2021 3:59 AMEdited by: tblondeau on Oct 12, 2021 3:59 AMFollowComment"

Answer: "0ifelse(locate({Billing Value},"token") <> 0,toString(locate({Billing Value},"token")),"blop")this fixes it, int needs to be parsed as string for this to workCommentSharetblondeauanswered 2 years ago"


Question: Have QnABot Render rich text from Kendra

"Hello,I'm creating a QnABot that pulls data from a Kendra index.  Some of this data is in json. I would like to style this data (using markdown or similar) to make it easier to read and understand. Is there a way to hook in after the Kendra response is return and before it is displayed to the user?Thanks!FollowComment"

Answer: "0Hi. That's a great question. Unfortunately, There is no way to style the Kendra response before it is displayed to the user as of now. Please refer to the below document for the available Tuning method with Kendra.Tuning response: https://docs.aws.amazon.com/kendra/latest/dg/tuning-responses.htmlCommentShareSUPPORT ENGINEERVarun_Sanswered a year ago"


Question: Clone a WS to Another Region

"We have members that use multiple workspaces in N.Virginia (us-east-1) region. The base configuration includes Simple AD. Initially, workspaces were created in this region, yet staff can be working from other regions. This leads to performance/lag problems.I'd like to clone workspaces to other regions (both preserving the installed apps and user profile on D drive). I've followed the best practices to create an image. Image Checker did not report any problems.Then I used this image, and copied it to another region (Let's say eu-west-1). I created a new bundle with the image.So far no errors. Then, attempting to launch a new WS by using the bundle, I am prompted to create a new directory. If I create a new directory, I'm required to create a new user. (Because directories are different original user is not listed in Show All Users section).Upon launching the new WS using the settings above, indeed I see an emtpy/fresh Workspace with both installed apps lost and user profile does not retain changes in the image.Based on the info above, what could be wrong?Do I need to switch to Active Directory setup?Do we have to use external tools to make a true clone? Please kindly share your knowledge. Thank you for reading. If needed I can provide additional information.FollowComment"

Answer: "1Accepted AnswerFirst, yes you can copy the image, but images are generalized and do not include user persona data, so you must decouple the user persona from the WorkSpace in order to address both the image copy and user persona. Additonally, having disparate identities is not an acceptable user experience, so I would recommend a full Microsoft Active Directory, and not Simple AD. With full Microsoft Active Directory, you can:Maintain the unique user identity across regionsUtilize Group Policy to redirect user persona folder (e.g. Documents, Desktop, etc.) to a File ServerReplicate File Server through DFS-Replication partner across regionsCommentShareEXPERTStevieStetsanswered a year agoidumlupinar a year agosome regions may only have 1 user. In this case, what is your recommendation in terms of file server/profile redirection?Share"


Question: Enabling Cors on API gateway

"Hello,I am practicing using SAM CLI to make and deploy Lambda functions as APIs. I am running into issues enabling CORS on the API gateway associated with my lambda function. I have tried both configuring CORS in my template.yaml file and going into the API gateway console and enabling CORS manually.The lambda function is a simple hello world function that takes in 1 parameter which is a name and returns " {name} says hello world!".  I have tested the api locally using a react app to invoke the api call and everything works fine. That is not the case for when its deployed to AWS.Here is my template.yaml file:AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: >  apple-app Sample SAM Template for apple-app# More info about Globals: Globals:  Function:    Timeout: 3    MemorySize: 128Resources:  HelloWorldFunction:    Type: AWS::Serverless::Function     Properties:      CodeUri: hello_world/      Handler: app.lambda_handler      Runtime: python3.9      Architectures:        - x86_64      Events:        HelloWorld:          Type: Api           Properties:            Path: /hello            Method: get            RestApiId: !Ref AWS::ApiGateway::RestApi            Cors:              AllowMethods: "'GET, POST'"              AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"              AllowOrigin: "'*'"Outputs:  HelloWorldApi:    Description: "API Gateway endpoint URL for Prod stage for Hello World function"    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/hello/"  HelloWorldFunction:    Description: "Hello World Lambda Function ARN"    Value: !GetAtt HelloWorldFunction.Arn  HelloWorldFunctionIamRole:    Description: "Implicit IAM Role created for Hello World function"    Value: !GetAtt HelloWorldFunctionRole.ArnAm I configuring the implicit HelloWorld api correctly to enable CORS?Since my configuration with the yaml file didn't work correctly. I tried manually enabling CORS by going into the API gateway console and clicking the button  "Enable CORS and replace existing CORS headers". This is the response I get with an error:✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Method Response Headers to OPTIONS method✔ Add Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin Integration Response Header Mappings to OPTIONS method✖ Add Access-Control-Allow-Origin Method Response Header to GET method✖ Add Access-Control-Allow-Origin Integration Response Header Mapping to GET methodYour resource has been configured for CORS. If you see any errors in the resulting output above please check the error message and if necessary attempt to execute the failed step manually via the Method Editor.! The Empty Model does not exist, and retry resource creation without it.I am not sure what I'm doing wrong, so any help would be greatly appreciated.Thank you.FollowComment"

Answer: "0If you are using a Lambda custom (non-proxy) integration:When you enable CORS by using the AWS Management Console, API Gateway creates an OPTIONS method and attempts to add the Access-Control-Allow-Origin header to your existing method integration responses. This doesn’t always work, and sometimes you need to manually modify the integration response to properly enable CORS. Usually this just means manually modifying the integration response to return the Access-Control-Allow-Origin header.You may need to add OPTIONS to the AllowMethods in your template.yaml file:Cors:              AllowMethods: "'GET, POST, OPTIONS'"If you are using a Lambda proxy integration or HTTP proxy integration:Your backend is responsible for returning the Access-Control-Allow-Origin and Access-Control-Allow-Headers headers, because a proxy integration doesn't return an integration response.You will need to ensure that your Lambda function returns the relevant headers:import jsondef lambda_handler(event, context):    return {        'statusCode': 200,        'headers': {            'Access-Control-Allow-Headers': 'Content-Type',            'Access-Control-Allow-Origin': 'https://www.example.com',            'Access-Control-Allow-Methods': 'OPTIONS,POST,GET'        },        'body': json.dumps('Hello from Lambda!')    }See: https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.htmlCommentShareDenise Yeoanswered 3 months agoTyler 3 months agoThank you for responding to my question.After some investigating, I learned that the SAM CLI templates performs a proxy lambda function. So I implemented the example lambda_handler and finally got a 200 response from my react app. With that said, I tried changing up the function by adding in a event['queryStringParameters']['name'] and returned that in the body, but Im getting CORS errors again. Is there something different  I need to do with the parameters?    # Retrieve name parameter from pathParameters    name = event['queryStringParameters']['name']    # Construct response body    response_body = {'message': f'Hello, {name}!'}    # Set headers for CORS    headers = {        'Access-Control-Allow-Headers': 'Content-Type',        'Access-Control-Allow-Origin': '*',        'Access-Control-Allow-Methods': 'OPTIONS,POST,GET'    }    # Construct response    response = {        'statusCode': 200,        'headers': headers,        'body': json.dumps(response_body)    }    return responseShare"


Question: Uploading multiple large files from client's browser to S3 bucket

We have a requirement where the user would use a drag and drop file upload control to select multiple files (may be large size files like 100MB) and these files would then be uploaded to S3 via our web server.This involves sending the files to our server and then from our server we upload them to S3 bucket.Is there a way we can directly upload to S3 from the client's browser and prevent the file reaching our servers?Currently all our S3 actions are driven by a Java based webapplication. The Java based S3 client is also being initialized using the DefaultCredentialProviderFollowComment

Answer: "0Hi, there is a documented solution for that: https://aws.amazon.com/blogs/compute/uploading-to-amazon-s3-directly-from-a-web-or-mobile-application/CommentShareDidier_AWSanswered 7 days agoEXPERTkentradreviewed 7 days ago"


Question: AWS API Gateway CORS Enablement Failing

"Hello All,I have created few endpoints in the past and enabled CORS. It was all working fine. For past 2 months, I am unable to enable CORS on any endpoint. I have tried creating the endpoint on other region as well. Same exception.Are you facing similar problems? If so, can you please guide me with solution?thanks and regards,saveteha!API Gateway CORS ErrorFollowComment"

Answer: "0Hello saveteha,It's difficult to determine the root cause of the CORS error without more information about the specific error message you're receiving. You can try the following troubleshooting steps that you can follow to help resolve the issue:Double-check your CORS configuration: Ensure that your CORS configuration is correctly set up in your API Gateway. Verify that the allowed origins, methods, and headers are all correctly specified. You can do this by going to the API Gateway console, selecting the API that contains the endpoint you're trying to enable CORS for, and then selecting the "CORS" option from the "Actions" dropdown menu.Check the response headers: When making a request to your API, check the response headers to see if the CORS headers are being correctly returned. You can do this using the browser's developer tools or by using a tool like Postman. Look for the "Access-Control-Allow-Origin", "Access-Control-Allow-Methods", and "Access-Control-Allow-Headers" headers. If these headers are missing or not correctly set, then your CORS configuration may be incorrect.Check if there are any errors in your Lambda function or backend service: If your API endpoint is backed by a Lambda function or another backend service, then there may be an error in that service that is preventing the CORS headers from being correctly returned. Check the logs for your Lambda function or backend service to see if there are any errors.Check if there are any network issues: If you're unable to enable CORS on any endpoint, then there may be a network issue that is preventing the headers from being correctly returned. Check your network settings and firewall to ensure that they're not blocking the necessary traffic.I hope these troubleshooting steps help you in resolving your CORS issue.CommentShareFrank Idugboeanswered a month ago"


Question: DMS from Oracle on Unix to RDS

Has anyone used DMS to migrate an Oracle DB hosted on Unix to RDS?I am keen to understand if DMS is limited by the different file formats across the platforms. E.G big endian (unix) vs little endian (linux/windows).This particular use case will also be migrating from 10g to 11g.Any advice would be greatly appreciated.FollowComment

Answer: 1Accepted AnswerDMS is similar to oracle golden gate. it uses native driver to connect source and target database engine. we will not have big endian and little endian  limitation here.Let me know in case you need any help here.CommentShareAWS-User-3551668answered 6 years ago


Question: Lambda function to query Kendra for Lex Response

"I am trying to write a Lambda function to filter a SearchKendra intent on Lex v2. I would like to filter based on 'accountId', which I have assigned to a document in the relevant bucket by including a .metadata file in the same location.Here is my current Lambda function followed by the error that I am receiving. Any ideas what might be going on?Lambda:def lambda_handler(event, context):    kendraQuery = {    "AttributeFilter": {    "EqualsTo": {    "Key": "accountId",    "Value": {    "StringValue": "123testid"    }    }    },    "IndexId": "sample-faq-index"    }    return {        "dialogAction": {        "type": "Delegate",        "kendraQueryRequestPayload": kendraQuery        }        }Here is the error message in the Lex console when testing:Invalid Lambda Response: Received invalid response from Lambda: Can not construct instance of IntentResponse, problem: The validated object is null at [Source: {"dialogAction": {"type": "Delegate", "kendraQueryRequestPayload": {"AttributeFilter": {"equalsTo": {"key": "accountId", "value": {"stringValue": "123testid"}}}, "IndexId": "sample-faq-index"}}}; line: 1, column: 194]   FollowComment"

Answer: "0Hey, can you provide the actual Kendra query request payload that you are performing.from the request payload you provided, it looks like that this is an invalid query.if you are trying to do a queryless search, you need to make sure both attributeFilter and SortingConfiguration are providedhttps://docs.aws.amazon.com/kendra/latest/dg/browsing.htmlThanksCommentShareAWS-User-8945368answered a year agocvanpoperin a year agoThis is a lambda function for Lex to query Kendra. Can you provide an example of a lambda function for this purpose that filters documents based on an attribute filter as above? I believe the payload would be the Lex responses, which are included in the intent. They are of the format:I found a FAQ question for you: ((x-amz-lex:kendra-search-response-question_answer-question-1)) and the answer is ((x-amz-lex:kendra-search-response-question_answer-answer-1)).I found an excerpt from a helpful document: ((x-amz-lex:kendra-search-response-document-1)).I think the answer to your questions is ((x-amz-lex:kendra-search-response-answer-1)).Share0Hi,Your Lambda can provide two attributes to Lex that can be used for Kendra queries: kendraQueryFilterString, and kendraQueryRequestPayload.kendraQueryRequestPayload requires the entire Kendra query object, while kendraQueryFilterString is only the attribute filter. Looks like what you are looking for is kendraQueryFilterString.You can see more details here: https://docs.aws.amazon.com/lexv2/latest/dg/built-in-intent-kendra-search.html#kendra-search-lambdaI hope this helps!MathildaCommentShareMathildaAWSanswered a year ago"


Question: Trying to use a single Amazon API Gateway endpoint to accept both HTTP and websocket requests

My understanding is that a websocket connection is negotiated with an upgrade request on top of an HTTP API. Can an Amazon API Gateway websocket endpoint also serve HTTP requests (which don't require the client to upgrade)? I'm trying to use a single vanity URL (such as api.foo.com instead of ws.foo.com and api.foo.com).FollowComment

Answer: 1Accepted AnswerIt's not possible to combine REST (HTTP) APIs with WebSocket APIs into a single vanity URL. It's also not possible to mix both types of requests using the same custom domain name.CommentShareEXPERTUrianswered 3 years ago


Question: LoRaWAN gateway logs

"I'm trying to find logs/metrics (any event really) that triggers on gateway specific actions - ideally, at a minimum connect & disconnect.I've set the log levels to INFO, but in digging through the docs I'm starting to feel like perhaps there is no way to receive and act on gateway connect/disconnect events?  I hope I'm wrong.  Ideally we could wire up a webhook or MQTT event that fires when a gateway disconnects from AWS.Also, I'm interested in pulling payload metadata specific for the gateway so we can analyze frequency usage by the gateway and devices, but pulling it from logs seems a mess.Any recommendations?Edited by: barryjump on Aug 6, 2021 2:12 PMEdited by: barryjump on Aug 6, 2021 2:12 PMFollowComment"

Answer: "0Is there any update about this, we've been expecting a push mechanism for gateway status (online/offline and/or latest uplink) but there seems to be no news about this feature.CommentShareAdriananswered a year agoAWS-User-9404308 a year agoAdrian, you may have noticed this already, but there is a new feature that kinda does what I was asking.In IoT setting page there is a new module called LoRaWAN and Sidewalk event notifications where you can see  the$aws/iotwireless/events/connection_status/+/lorawan/wireless_gateways topic which you can act on in the broker.ShareAdrian 10 months agoAWS-User-9404308 thanks for the tip, however unless there's something to remove or work around the 250 max gateways cap (or to add the event for all gateways) this won't work for my use case where I need to monitor the connectivity status of all gateways present in the system (which could be easily above 250)ShareAWS-User-Russ 6 months agoHave you tried to use resource-level topic subscription? Like in this link, https://docs.aws.amazon.com/iot/latest/developerguide/iot-lorawan-gateway-events.html. Also if you want to bypass the 250 limit for your monitoring, you can call the API multiple times with each one under the limit, if the resource-level topic is not working for you.ShareAdrian 6 months agoA couple of weeks ago I noticed that feature (which I believe it was not available 3 months ago) and I'm using it with a simple rule to push gateways connectivity status changes to a lambda function. Thanks for the help anyway ;)Share0Hi Barry,You don't need the logs to see the gateway connect or disconnect. If you are using console, you can directly see the gateway status change (connect/disconnect). If you are using API, GetWirelessGatewayStatistics can give your the status as well. The doc link is here, https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayStatistics.html.Please let us know if you only need the logs.Hope this answers your question.CommentShareAWS-User-Russanswered 2 years ago0Thanks Russ.. I was aware of the API, but was really hoping there was a push mechanism (maybe through an event bus or MQTT?) rather than constantly needing to poll the API.  I've got the logs somewhat configured in cloudwatch, tried reseting a test gateway, but only saw logs related to the certificate being accepted on reconnect.  Not exactly a connect message, but close.  What I didn't see was a disconnect event in the logs.  If the gateway was offline for hours or minutes we wouldn't know.I'd like to fire an alert (email, text, etc) when a connect/disconnect happens.  Is that possible?CommentShareAWS-User-9404308answered 2 years ago0Hi Barry, thanks for the input. We are working on some push mechanism for this kind of events. It is coming soon. Please stay tuned. If you have other events that need to be pushed, please also let us know.CommentShareAWS-User-Russanswered 2 years ago0Hey Russ, curious if you guys are any closer to this being a reality?Was hoping the release cycle on your Lora product would be as quick as others... Really want to be able to use this in prod.CommentShareAWS-User-9404308answered 2 years ago0Hi Barry,This mechanism for gateway connect/disconnect events has not been included in the latest roll-out yet. We are aiming to put it in the 2nd stage of the notification next. There is no concrete date for this release. I will keep you posted once there is a date. It should be very soon.CommentShareAWS-User-Russanswered 2 years ago0Thanks Russ.. Do you guys have a public roadmap for LoraWAN? Also, where could I follow the release notes - interested in checking out your latest release.ThanksCommentShareAWS-User-9404308answered 2 years ago0Just checked with our PM. It seems we don't usually share roadmap publicly. You can check with our customer account team if they have any source. Regarding this notification mechanism, I will update here whenever it is to be released.CommentShareAWS-User-Russanswered 2 years ago0Hi, I was wondering if there's any update on this new feature, it'd be really useful to be able to switch to this "new" notification mechanism over our current periodic polling (for gateway status) solution.CommentShareAdriananswered a year ago"


Question: Exchange certificate on between the EC2 (for Private domain)

HelloI have two EC2 compute  connecting for api service.I need to secure for data in-transit via certificate(tls)Prepare for private domain example use test-abc.domainHow can I generate certificate(free) and exchange certificate between EC2 ?Use certbot or any service ?Please advise ?FollowComment

Answer: 0Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application. Public SSL/TLS certificates and CA created through ACM can not be exported and can be used with integrated services. https://docs.aws.amazon.com/acm/latest/userguide/acm-services.htmlCertificates generated from certificate providers can be configured to use with AWS EC2 based web servers and applications.CommentSharerePost-User-3601717answered 3 months agoDopod 2 months agoHow can I exchange certificate across multiple account running EC2Share0I plan to use for private domain example such "test-abc.domain"   on ACM not support validate domain  by DNSI create private domain on Router 53 already.CommentShareDopodanswered 2 months ago


Question: Glue Job Error (An error occurred while calling o100.pyWriteDynamicFrame. Illegal empty schema)

"Hi Dears,Hope all is doing great!I am working on a project to migrate data from Google Bigquery to Amazon S3, I just followed the project in AWS blogs ( https://aws.amazon.com/blogs/big-data/migrating-data-from-google-bigquery-to-amazon-s3-using-aws-glue-custom-connectors/) which is a great example.But when I did all the needed steps I faced this issue: error was :An error occurred while calling o100.pyWriteDynamicFrame. Illegal empty schemaCan you please guide me on how can I fix the problem?Thanks for your answer in advance!BasemFollowComment"

Answer: "0Accepted AnswerHi,the error seems to indicate that the step that initiated the write to the target got as input an empty DynamicFrame.Are you sure the table you are reading is populated?You should try to look at the logs of the job.In Glue Studio open the jobs then select the tab Runs or in the left pane select Monitoring then follow the instruction in this documentation page.Look for other errors, that may have happen before as connection time out or privilege issue that might have not interrupted the job but led to an empty input.After you read the data, do you do any processing?If there are no error and you can manage the code in PySpark, clone the job ,  open it in manual edit mode and then try to print the schema and show the content.hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agoBasem Khalaf a year agoYes, It is populatedI found the problem, I didn't define schema for input and output data sources.I set it up and the job succeededThanks for your help!Share"


Question: How to create dynamic dataframe from AWS Glue catalog in local environment?

"I I have performed some AWS Glue version 3.0 jobs testing using Docker containers as detailed here.The following code outputs two lists, one per connection, with the names of the tables in a database:import boto3db_name_s3 = "s3_connection_db"db_name_mysql = "glue_catalog_mysql_connection_db"def retrieve_tables(database_name):    session = boto3.session.Session()    glue_client = session.client("glue")    response_get_tables = glue_client.get_tables(DatabaseName=database_name)    return response_get_tabless3_tables_list = [table_dict["Name"] for table_dict in retrieve_tables(db_name_s3)["TableList"]]mysql_tables_list = [table_dict["Name"] for table_dict in retrieve_tables(db_name_mysql)["TableList"]]print(f"These are the tables from {db_name_s3} db: {s3_tables_list}\n")print(f"These are the tables from {db_name_mysql} db {mysql_tables_list}")Now, I try to create a dynamic dataframe with the from_catalog method in this way:import sysfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobfrom awsglue.dynamicframe import DynamicFramesource_activities = glueContext.create_dynamic_frame.from_catalog(database = db_name, table_name =table_name)When database="s3_connection_db", everything works fine, however, when I set database="glue_catalog_mysql_connection_db", I get the following error:Py4JJavaError: An error occurred while calling o45.getDynamicFrame.: java.lang.ClassNotFoundException: com.mysql.cj.jdbc.DriverI understand the issue is related to the fact that I am trying to fetch data from a mysql table but I am not sure how to solve this. By the way, the job runs fine on the Glue console.I would really appreciate some help, thanks!FollowComment"

Answer: "1Accepted AnswerIt looks like you're missing the MySQL driver, you can provide your own JAR files via the "Dependent jars path" parameter. Your code looks fine so I'd assume the error is right, missing drivers/libraries.CommentShareEXPERTRaphaelanswered 10 months ago"


Question: Memory requirements

"HiHopefully a quick question, but are the memory system requirements flexible?https://docs.aws.amazon.com/datasync/latest/userguide/requirements.html#hardwareI can get a VM with 16GB of ram, but 32GB isn't possible at this time.Will the data sync agent run with 16GB?Is there setting that might need to be tweaked?I'm not that concerned with the highest performance, we will likely need to cap the transfer at 100MbpsCheers,JasonFollowComment"

Answer: "0Hi Jason,Thanks for reaching out. Using 16GB of RAM will work for transferring less than 10 million files per task. However, you may run into other limits or lower performance. I've also noted this as a feature request for lower memory requirements. Please let us know if you have additional feedback, and feel free to send me a private message if you have more questions about your specific account/setup.Regards,Olga KoganAWS DataSyncCommentShareAWS-User-9583871answered 4 years ago0Hi.Thanks for the response.We have about 25 million files total, about 9TB.Each task would copy over around 6 million files, 1.8TB.Each task would copy less than 10 million, after the second task there would be more than 10 million files in the S3 bucket.With this scenario, do you think 16GB would still be workable?We are doing a full systems migration to AWS, as such we can not purchase any new hardware as much of our existing infrastructure will be freed up once the migration is done.But without the data being migrated, the servers can't be made available.Bit of a chicken and the egg problem!One other question, for the logging, is there any way to capture the list of files that were copied?Cheers,JasonCommentShareJasonRider2answered 4 years ago0Hi Jason,As I mentioned before, using 16GB of RAM will work for transferring the number of files per task you described. However, as this is not our recommended configuration, you may run into other limits or lower performance. If you run into issues, please contact support and we'll take a look. We don't currently generate a list of all transferred files. I've noted your suggestion and we'll consider it as we plan new features.Regards,Olga KoganAWS DataSyncCommentShareAWS-User-9583871answered 4 years ago0Hi Olga,Thanks again for your reply.We are going to give it a try and see how it goes.I have put in a request for more memory, maybe I'll get lucky!Thanks for noting my requests for features, both would be welcome additions.I know it is early in the product life cycle.Cheers,JasonCommentShareJasonRider2answered 4 years ago0Hi Jason,We have just released the ability to log all transferred files:https://aws.amazon.com/about-aws/whats-new/2020/04/aws-datasync-enhances-monitoring-capabilities-with-file-level-logging/Best,OlgaCommentShareAWS-User-9583871answered 3 years ago"


Question: Why WAF disassociate resource when Cloudformation change resource Cloudfront?

"Hi Community.When I change Cloudformation template with resource Cloudfront, I will see Distribution Cloudfront removed on WAF.This makes me feel very uncomfortable. I must reassociate Distribution again on WAF.Why WAF disassociate Distribution?Please help me. Thank youFollowComment"

Answer: "1Accepted AnswerWhat changes are you making to your CloudFront Distribution resource in your template? Are you attaching WAF separately to CloudFormation? If you modify a property affecting WAF, CloudFormation may overwrite it; if you modify a property which requires replacement, CloudFormation will replace your Distribution with a new one.I'd recommend you use CloudFormation to associate AWS WAF with your Distribution. You can provide it using the WebACLId property of the DistributionConfig property in your template. If you don't want to manage the whole WAF through CloudFormation, I'd recommend making a Parameter in your template to allow you to specify the WAF ACL Id, and then use that parameter when setting the value in the Distribution resource.CommentShareEXPERTJames_Sanswered a year agoAWS-User-7754781 a year agoHi James_S,WAF I don't use Cloudformation. It was created on consoles. Only Cloudfront was created by Cloudformation.Maybe I will write Cloudformation for WAF.Thank for the advice.Best regard.Share"


Question: "loalhost to aws EC2, GET request works but POST request not working"

"Hello, I created one node js app with an express server and further I dockerize it and deployed it on ECS. When I hit from localhost to that EC2 public IP then the GET request works but when I am trying a POST request from localhost to that EC2 it gives an error of "Connection Refused" and in security groups, all traffic rules is enabled. Where is the issue, can someone guide me? ThanksFollowComment"


Question: Please help me understanding cloudfront in my scenario?

"Hi Team,Wish you all Happy New Year!!I about to set my VPC [10.1.0.0/16] in AWS and have below scenario to achieve. Customer Web server is some where else and not in AWS. lets say www.exmaple.com [5.6.7.8].I am about to set one Linux EC2 instance with WAF on it and www.example.com -> CNAME -> waf.ec2.acme.com [10.1.0.10/7.8.9.10 Elastic IP]In that case anyone accessing https://www.example.com my linux EC2 being a WAF will receive the entire traffic and then  only clean traffic will be forwarded to www.example.com. Now I wanted to activate cloud front for www.example.com and have below queries.What DNS Changes do I need to make?For activating Cloudfront do I need to have my DNS pointed to route 53?Can I activate cloudfront distribution in this case?And if I activate CDN on AWS. Do I need to protect CDN mirrors as well with WAF?Can someone please help me understanding the topology ?TIABlason RFollowComment"

Answer: "0Accepted AnswerYou'll need to change the DNS for www.example.com and point it to CloudFront (once the CloudFront distribution has been created).No. But Route 53 makes it much easier to use the "apex" domain name - for example, if you wanted to send traffic to example.com to CloudFront as well.You can create the CloudFront distribution ahead of time - it has a unique name that you can test before cutting over.I'm not sure what you're asking here, but: CloudFront has WAF built in so you can use that to protect the customer website (the "origin" in CloudFront terms). You should not be sending traffic to your EC2 instance then to CloudFront and then to the customer website - that makes your EC2 instance a bottleneck and a single point of failure in the event of a DDoS or high traffic situation.CommentShareEXPERTBrettski-AWSanswered 5 months ago"


Question: GGv2 component versioning

"Hello -I'm building a component and running into issues when trying to get it deployed down to the GGv2 core device.  Specifically I see a problem in the greengrass.log where it seems to be misinterpreting my component version.In the recipe it's specified as 1.0.1-1616781067 and in the error I see a message like this:2021-03-26T17:58:27.183Z [ERROR] (pool-2-thread-19) com.aws.greengrass.componentmanager.ComponentManager: Failed to negotiate version with cloud and no local version to fall back to. {componentName=com.xx.xxxxxxx, versionRequirement={thinggroup/TestThingGroup=>=1.0.1 <1616781068.0.0}}By contrast, here's a working example:greengrass_2021_03_26_16_0.log:2021-03-26T16:50:44.261Z [INFO] (pool-2-thread-428) com.aws.greengrass.componentmanager.ComponentManager: Searching for best candidate locally on the device.. {VersionRequirements={aws.greengrass.LocalDebugConsole=>=2.0.3 <2.1.0, aws.greengrass.Cli=>=2.0.5 <2.1.0}, ComponentName=aws.greengrass.Nucleus}It may be a red herring but seems like the upper version limited is only pulling the patch portion of the version.  Has anyone else seen this?  I believe this is still legal in semantic versioning; however, the dev guide didn't really spell out if this would be permitted.Thanks!FollowComment"

Answer: "0Received confirmation from support this format isn't supported and semantic versioning (eg. v.r.m) must be used.CommentSharemgfinkanswered 2 years ago0The docs (https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.html) really need to be updated, as pre-release versioning is supported as part of the spec (https://semver.org/spec/v2.0.0-rc.2.html). This definitely complicates CI/CD deployments, as GreengrassV2 does not gracefully handle updating different components with the same version.CommentSharegstclairanswered a year ago"