Question: NLB Across Zones and Subnets

I have a VPC with a public subnet in zone us-east-1a and a private subnet in zone us-east-1b. There is an EKS cluster that spans both zones. I've deployed an Nginx ingress controller to distribute requests across my backend services that reside in the private subnet (zone us-east-1b). When the NLB gets deployed it creates a node and listener in both zone us-east-1a and us-east-1b. We are seeing intermittent connectivity issues when connecting to the service via the internet. I believe the issue is that when the connection is made the to the DNS record of the NLB in zone us-east-1b the connection is dropping because it's a private subnet and the routing table points to a NAT gateway.Is it possible to deploy a single NLB in a public subnet and have a listener in a different zone/different private subnet? I want to route traffic from the internet > the NLB in my public subnet > the services in my private subnet that is in a different zone than the public subnet.FollowComment

Answer: "1Deploying an NLB and having a listener are (pretty much) the same thing. If your application is deployed in two AZs then your NLB should as well. Whether you choose to enable cross-zone load balancing or not is up to you - there is extra cost if you do for traffic that goes to NLB in one AZ and then is sent to the other AZ to be processed by your EKS cluster.There's no issue with having the NLB listener in a public subnet and EKS in a private subnet - in fact, that's strongly recommended.Note that NLB modifies the DNS records depending on health checks. Each NLB node IP address will appear in DNS if it has at least one healthy target it can send traffic to. If it hasn't got any healthy targets it is removed from DNS - noting that there is always a lag with DNS propagation. If you have a situation where targets are becoming unhealthy on a regular basis this might be the cause of your issue.CommentShareEXPERTBrettski-AWSanswered a month ago"


Question: Does AWS throttle mail traffic for external smtp servers

"I have a customer who is aware that AWS throttles mail traffic, but was unclear if this also applies if you use an external smtp server? Would the  Request to Remove Email Sending Limitations still be applicable ?Customer has configured smtp to be used outside  of AWS services and so far it is working in test, but would like to know if there would be throttle implications of doing this in production.FollowComment"

Answer: "0Accepted Answeris the relay server an EC2? or you using third party email service like sendgrid, O365 etc?if ec2, then be default ec2 server have smtp limit and you need to submit a case to remove this limitation.https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/CommentShareEXPERTVaibhav_Sanswered 2 years ago"


Question: Recovering a File Gateway

"The aws best practices doc for  https://docs.aws.amazon.com/storagegateway/latest/userguide/recover-data-from-gateway.html says to just activate a new gateway. There are other recovery steps for volumes or tapes but in the case of a File Gateway, the steps are to activate a new gateway and recreate the shares.To recreate the shares, some record of the configuration would need to be available. Is there a simple way to periodicallt collect all share configurations from a gate way? Preferable a method that could be automated.FollowComment"

Answer: "0Accepted AnswerHello,You can get this information from your existing file gateways by using the AWS CLI or any of the available AWS SDKs and wrapping the commands up in a script whos output you then capture in a text file.  I'll show the steps I used to do this manually using the CLI ( https://docs.aws.amazon.com/cli/latest/reference/storagegateway/index.html ):Set up credentials for CLI access and preferred region."aws storagegateway list-gateways" - This will give you the list of all your gateways activated in a given region.  Your output will be similar to this:{"Gateways": [{"GatewayId": "sgw-xxxxxxxx","GatewayARN": "arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:gateway/sgw-xxxxxxxx","GatewayType": "FILE_S3","GatewayOperationalState": "ACTIVE","GatewayName": "IADtest","Ec2InstanceId": "i-xxxxxxxxxxxxxxxxx","Ec2InstanceRegion": "us-east-1"}]}"aws storagegateway list-file-shares --gateway-arn arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:gateway/sgw-xxxxxxxx" - using the gateway arn from the previous step, you'll get a list of shares:{"FileShareInfoList": [{"FileShareType": "SMB","FileShareARN": "arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:share/share-xxxxxxxx","FileShareId": "share-xxxxxxxx","FileShareStatus": "AVAILABLE","GatewayARN": "arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:gateway/sgw-xxxxxxxx"}],"Marker": null}"aws storagegateway describe-smb-file-shares --file-share-arn-list arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:share/share-xxxxxxxx" - For each file share, you'll run this command including the FileShareARN from the previous step:{"SMBFileShareInfoList": [{"FileShareARN": "arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:share/share-xxxxxxxx","FileShareId": "share-xxxxxxxx","FileShareStatus": "AVAILABLE","GatewayARN": "arn:aws:storagegateway:us-east-1:XXXXXXXXXXXX:gateway/sgw-xxxxxxxx","KMSEncrypted": false,"Path": "/iad-test-data","Role": "arn:aws:iam::XXXXXXXXXXXX:role/service-role/StorageGatewayBucketAccessRole27bcd82d-37f6-4f2f-94bd-xxxxxxxxxx","LocationARN": "arn:aws:s3:::iad-test-data","DefaultStorageClass": "S3_ONEZONE_IA","ObjectACL": "bucket-owner-full-control","ReadOnly": false,"GuessMIMETypeEnabled": true,"RequesterPays": false,"SMBACLEnabled": false,"AccessBasedEnumeration": false,"AdminUserList": [],"ValidUserList": [],"InvalidUserList": [],"AuditDestinationARN": "arn:aws:logs:us-east-1:XXXXXXXXXXXX:log-group:/aws/storagegateway/share-xxxxxxxx:*",            "Authentication": "GuestAccess","CaseSensitivity": "ClientSpecified","Tags": [],"FileShareName": "iad-test-data","NotificationPolicy": "{}"}]}If you have a lot of gateways and/or file shares, you can see that you would want to wrap up these commands in a script.  Please feel free to ask any further questions you may have.CommentShareMike-HAWSanswered 2 years ago0Perfect, thanks Mike!CommentSharevengleanswered 2 years ago"


Question: Route53 / DNS /

"semantal.comid 12136opcode QUERYrcode SERVFAILflags QR RD RA;QUESTIONsemantal.com. IN A;ANSWER;AUTHORITY;ADDITIONALI transferred the domain to AWS. It worked for a few weeks, but when my original registra removed it from my list on their admin side, I havent been able to access the domain. Could be coincidence. I think its a DNS issueI getDNS_PROBE_FINISHED_NXDOMAINhttps://www.semantal.comI even resorted to removing the hostedzone and starting again.any help would be appreciatedEdited by: jCross on Aug 9, 2019 11:32 AMEdited by: jCross on Aug 10, 2019 2:31 AMFollowComment"

Answer: 0All good. Dns settings were not the same on domain and hostedzone.CommentSharejCrossanswered 4 years ago


Question: EC2 Key Pair Issue

"Hi AWS,I have created an EC2 instance and its key pair using terraform code. The terraform code for the same is:resource "aws_instance" "test_ec2_instance_production" {  ami                    = var.ami_id  instance_type          = var.instance_type  subnet_id              = aws_subnet.public_subnet.0.id  vpc_security_group_ids = [aws_security_group.test_security.id]  tags = {    Name = "${var.default_tags.project_name}-${var.default_tags.environment}-ec2-instance"  }  key_name                    = var.generated_key_name  associate_public_ip_address = true  monitoring                  = true}// Create key-pair for EC2 instanceresource "tls_private_key" "prod_key" {  algorithm = "RSA"  rsa_bits  = 4096}resource "aws_key_pair" "generated_key" {  key_name   = var.generated_key_name  public_key = tls_private_key.prod_key.public_key_openssh  provisioner "local-exec" {    command = <<-EOT      echo '${tls_private_key.prod_key.private_key_pem}' > test-prod-keypair.pem      chmod 400 test-prod-keypair.pem    EOT  }}I have generated the keys using the command ssh-keygen -t rsa -m PEM.Now I am trying to provide the private key in the SSH server configuration setting of Jenkins and I am getting this error: jenkins.plugins.publish_over.BapPublisherException: Failed to connect and initialize SSH connection Message [Auth fail]Also I am not able to login into the EC2 using SSH connection command as the key is broken and getting this error:ec2-user@ec2-x-xxx-xx-xxx.us-east-2.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic)Now the issue is this is a production environment and the key is broken. Is there any way to replace the key with a new one without terminating the instance as long way down I need to have a proper RSA key which I can add in the Jenkins SSH remote host to build my pipeline. Also you know Jenkins don't accept Open SSH key format.Also I need to know the steps to generate the rsa key and to copy the key file into the .pem file which we are going to use for ssh connection with EC2. Please help!FollowComment"

Answer: "0There are a few suggestions on how to fix this in this other re:Post article - does that help you in this situation?CommentShareEXPERTBrettski-AWSanswered 2 months agoArjun Goel 2 months ago@Brettski-AWS, my only concern is if I make any changes in the tf code provided above based on the steps mentioned in the article provided will it terminate/stop the instance as I want to replace the key pair while the instance will be in a running state as it's production and I don't want any downtime. Having said that I am still able to connect to the instance using EC2 serial console however that's only the temporary solution unless the automation pipeline is not in place because once I am going to do the build on EC2 using Jenkins I need to have the private key for the key pair.Please guide.ShareBrettski-AWS EXPERT2 months agoIf you can fix it with the Serial Console then that's a good way to go. Otherwise, this type of thing is an excellent reason to have a test environment - not trying to be condescending (I've been there too); but the first (and probably second and third) version of code doesn't always work right...Share"


Question: Does GameLift Managed Servers SDK Support Unreal Engine 5?

"I noticed on the Getting Started page, the GameLift Managed Servers SDK says it is compatible with Unreal 4.26.But on the tutorial video that posted on 2021, the description of GameLift Managed Servers SDK says same as today.Doesnt AWS updated it? Or any suggestion that how i suppose to use it with newer versions?FollowComment"

Answer: 1It is possible to get the latest version (5.0.0.0) of the GameLift SDK working as a plugin for UE5 (tested with 5.1) on Windows.Please check out this repo I created for said plugin: https://github.com/NoxxGames/AwsGameLift-5.0-for-UE5-5.1. The repocontains more info.CommentShareNoxxProjectsanswered 2 months ago


Question: Option to pay bill + saving plan in Brazil

"Hi, I'm in Brazil and the only option to pay my bills here is with a credit card. I need to buy a savings plan, but I don't have enough credit to cover my bill + savings plan. Is there some sort of direct transfer?Regards.FollowComment"

Answer: "1Payment options for Brazil are covered here:https://aws.amazon.com/legal/aws-sbl/#BQAlso, Savings Plans have a no-upfront option, so you can spread the payments over the life of the plan:https://aws.amazon.com/savingsplans/faq/CommentShareGeno_AWSanswered a year ago0Thanks for help, but with no-upfront means less discount. I'm looking for a direct transfer (TED here in Brazil) just once to pay the saving plan.CommentSharejefaokptaanswered a year ago"


Question: AWS and both broad data models and industry specific data models

"Hello,Where can I find more details on AWS' approach around data models?  This would include industry-specific data models AWS is fully invested in.FollowComment"

Answer: "0I'm not sure that a question that can be easily answered.If you're asking how AWS manages data because you want to build out large-scale data modelling/processing yourself I'd suggest starting with our Analytics Blog. If you need more specific advice, please reach out to your local AWS Solutions Architect who can connect you with the right people to guide you.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: Error when importing data from S3 to RDS PostgreSQL

"Hello,we are trying aws_s3.table_import_from_s3() extension to load data into RDS PostgreSQL (v13.7) directly from an S3 bucket. To speed up the process, we are opening multiple (=30) connections to RDS (r6g.8xlarge instance type) and run the imports in parallel, for hundreds of CSV files (8 GB each) stored in our S3 bucket. This has generally worked quite well for a couple of weeks during our trial period. Unfortunately, yesterday we faced an error. From PostgreSQL logs:2023-05-08 13:12:53 UTC:10.0.1.115(27341):postgres@foodb:[12800]:LOG:  Unable to complete the COPY from s3. CURL error code 18 with message transfer closed with 6681718036 bytes remaining to read.Which then naturally leads to the following error:2023-05-08 13:12:53 UTC:10.0.1.115(27341):postgres@foodb:[12800]:STATEMENT:SELECT aws_s3.table_import_from_s3('mytable','col1,col2,col3,col4,col5','(format csv, header true, escape '''')','my-bucket','my-prefix/my-file.csv', 'us-east-1')2023-05-08 13:12:53 UTC:10.0.1.115(27341):postgres@foodb:[12800]:ERROR:  missing data for column "col2"Curl error code 18 indicates a transfer closed with outstanding read data remaining. This error occurs when the remote server or website closes the connection before all the data has been transferred to the client.What could be the underlying issue? Is it performance / throttling related? Is there anything I can do to make sure this doesn't happen again?EDIT 2023-05-17: Since then, I've had multiple queries running aws_s3.table_import_from_s3() hang for hours, even days, without really progressing. I can see in pg_stat_activity the queries are listed as "active", but they are just stuck. They even cannot be terminated using pg_terminate_backend() or pg_cancel_backend().I reduced the parallel sessions to half (15) and tried with objects of smaller size (~500MB), neither of these helped.Are there any recommended best practices regarding the use of aws_s3 extension? Unfortunately it doesn't seem very reliable to me...FollowComment"


Question: Route 53 Domain Registration

"hello , I am new to AWS and I am trying to register a domain with ".click" but somehow I am keep on receiving an email from AWS that they can't register my domain. Can you please tell me what I am doing wrong?FollowComment"

Answer: 0You can contact AWS Support about domain registration issues (Reference : https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-contact-support.html)Also please check process listed in here https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-register.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago


Question: FSx Windows File System

Can we create life Cycle Rule for FSx Windows File System? any docsFollowComment

Answer: 2Accepted AnswerThere are not tiers in FSx storage classes like in EFS or S3. There are SSD and HDD options for file systems but it is one type per file system.CommentShareEXPERTRob_Hanswered a year ago


Question: Unable to perform OpenSearch text queries from Gremlin using AWS Lambda written in Javascript

"I am syncing my AWS Neptune nodes in an AWS OpenSearch cluster as per the documentation https://docs.aws.amazon.com/neptune/latest/userguide/full-text-search.html. The name of the OpenSearch index is amazon_neptune. The OpenSearch index type is _doc. Following is the index configuration{  "settings": {    "number_of_shards": 1,    "number_of_replicas": 1,    "analysis": {      "normalizer": {        "useLowercase": {          "type": "custom",          "filter": "lowercase"        }      }    }  },  "mappings": {    "properties": {      "document_type" : {        "type" : "text",        "fields" : {          "keyword" : {            "type" : "keyword",            "ignore_above" : 256          }        }      },      "entity_id" : {        "type" : "text",        "fields" : {          "keyword" : {            "type" : "keyword",            "ignore_above" : 256          }        }      },      "entity_type" : {        "type" : "text",        "fields" : {          "keyword" : {            "type" : "keyword",            "ignore_above" : 256          }        }      },      "predicates": {        "properties": {          "content": {            "type": "text",            "fields": {              "keyword": {                "type": "keyword",                "ignore_above" : 1000,                "normalizer": "useLowercase"              }            }          },          "visibilityType": { "type": "keyword" },          "status": { "type": "keyword" },          "type": { "type": "keyword" },          "firstName": {            "type": "text",            "fields": {              "keyword": {                "type": "keyword",                "normalizer": "useLowercase"              }            }          },          "lastName": {            "type": "text",            "fields": {              "keyword": {                "type": "keyword",                "normalizer": "useLowercase",                "ignore_above" : 1000              }            }          }        }      }    }  }}Using the npm gremlin package, I'm trying to query my documents. Following is the code:'use strict';const gremlin = require('gremlin');exports.handler = async (event, context) => {  try {    const DriverRemoteConnection = gremlin.driver.DriverRemoteConnection;    const Graph = gremlin.structure.Graph;    const dc = new DriverRemoteConnection(<neptune_endpoint>,{});    const graph = new Graph();    const dbClient = graph.traversal().withRemote(dc);    const res = await dbClient      .withSideEffect("Neptune#fts.endpoint",<https_opensearch_endpoint>)      .withSideEffect('Neptune#fts.queryType', 'term')      .V().has("visibilityType","Neptune#fts PUBLIC")      .toList();    console.log('res:', res);  } catch(err) {    console.error('Failed to query', err);  }}But I'm getting the following errorFailed to query ResponseError: Server error: {"detailedMessage":"method [POST], host [<https_opensearch_endpoint>], URI [/amazon_neptune/_search?typed_keys=true&ignore_unavailable=false&expand_wildcards=open&allow_no_indices=true&ignore_throttled=true&search_type=query_then_fetch&batched_reduce_size=512&ccs_minimize_roundtrips=true], status line [HTTP/1.1 403 Forbidden]\n{\"Message\":\"User: anonymous is not authorized to perform: es:ESHttpPost\"}","requestId":"23a9e7d7-7dde-465b-bf29-9c59cff12e86","code":"BadRequestException"} (500)I have given the following permission to my lambdaType: AWS::IAM::PolicyProperties:  PolicyName: <Policy_Name>  Roles:    - 'Ref': <lambda_role>  PolicyDocument:    Version: '2012-10-17'    Statement:      - Effect: Allow        Action:          - es:ESHttpGet          - es:ESHttpPost          - es:ESHttpPut          - es:ESHttpDelete        Resource: <opensearch_cluster_arn>My OpenSearch cluster as well as Neptune cluster are located inside the same VPC. My lambda is hosted inside the same VPC as well.Please help me in understanding why I'm getting the 403 error when I've given the proper reading permissions to my lambda.Any help would be highly appreciated.FollowCommentTaylor-AWS a year agoHow have you configured security on your OpenSearch cluster?  Are you using Fine-Grained Access Control or Domain-Level Access Control?Sharekanhaiagarwal a year agoSorry, I was looking for your comment under the threads of my earlier comments. Under Fine-grained access control, Enabled value is false.Following is the AccessPolicy that I have configured in my OpenSearch cluster{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "*"      },      "Action": "es:*",      "Resource": "arn:aws:es:<region>:<account_number>:domain/<domain_name>/*"    }  ]}Sharekanhaiagarwal a year agoAs I mentioned in our other comments thread, following is the definition of the dbClientFollowing is the definition of the dbClientconst gremlin = require('gremlin');const DriverRemoteConnection = gremlin.driver.DriverRemoteConnection;const Graph = gremlin.structure.Graph;const dc = new DriverRemoteConnection(`wss://<neptune_endpoint>:8182/gremlin`,{});const graph = new Graph();const dbClient = graph.traversal().withRemote(dc);Share"

Answer: "1Accepted AnswerI looked at your document in https://pastebin.com/qjT05w3p and I think the  document_type field is not correctly set. If you change the value of document_type as "vertex", it should work as expected. Let us know if that doesn't work for you.CommentShareawsprashuanswered a year agokanhaiagarwal a year agoYou're a life saver @awsprashu. I am getting the response now. Just one small follow up. My gremlin knowledge is a bit low. I'm getting only this as a response - [{"id":<vertex_id>,"label":"POST"}]. The output contains the id and label of the vertex and not it's properties. What's the syntax for getting the vertex id as well as the vertex properties if not using OpenCypher? Following is my queryawait dbClient.withSideEffect('Neptune#fts.endpoint',<os_endpoint>).withSideEffect('Neptune#fts.queryType', 'match').V().has("content","Neptune#fts post").toList();Share1Neptune IAM + OpenSearch Domain-Level AccessIf using IAM Auth on Neptune with Domain-Level Access Control on OpenSearch, be sure to include the IAM role used to authenticate against Neptune in the Access Policy for your OpenSearch cluster.  For example, if using the following IAM role to authenticate with Neptune:   arn:aws:iam::0123456789012:role/myNeptuneRoleBut sure to then include the same role in the Domain Access Policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::0123456789012:role/myNeptuneRole"      },      "Action": "es:*",      "Resource": "arn:aws:es:us-east-2:0123456789012:domain/neptune-fts-pg/*"    }  ]}Neptune No-IAM + OpenSearch Domain-Level AccessIf not using IAM Auth on Neptune with Domain-Level Access Control on OpenSearch, then you'll need an open Access Policy in OpenSearch to allow the FTS requests to succeed:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "*"      },      "Action": "es:*",      "Resource": "arn:aws:es:us-east-2:0123456789012:domain/neptune-fts-pg/*"    }  ]}CommentShareTaylor-AWSanswered a year agoEXPERTFabrizio@AWSreviewed a year agokanhaiagarwal a year agoThanks for the solution Taylor. My query is not throwing the 403 error now. But my query is not giving back the required results.I have tried different types of queriesconst res = await dbClient      .withSideEffect("Neptune#fts.endpoint",<opensearch_vpc_endpoint>)      .V().has("content","Neptune#fts com~").values('content')      .toList();const res = await dbClient      .withSideEffect("Neptune#fts.endpoint",<opensearch_vpc_endpoint>)      .withSideEffect('Neptune#fts.queryType', 'term')      .V().has('status','Neptune#fts ACTIVE')      .toList();In all the cases, the value of res is []. I don't know what I'm doing wrong.I tried the same term query, i.e, { query: { term: { 'predicates.status.value': 'ACTIVE' } } } on the Opensearch cluster, and it returned the document that I was looking for.ShareTaylor-AWS a year agoIs data replicating to your OpenSearch cluster?  Are you using the polling framework explained here (https://docs.aws.amazon.com/neptune/latest/userguide/full-text-search-cfn-create.html) that uses Neptune Streams?  Can you please check your OS cluster directly to see if it has data?  You can access it by just using curl "https://<os_cluster_endpoint>/amazon_neptune/_search?q=<search_query>" ?  That would validate that the data is in OS and the query is working from that end.Sharekanhaiagarwal a year agoYes, the data is going to the OS cluster. But I'm not using the Neptune streams to replicate the data. I'm using a combination of FIFO SNS and SQS to trigger another lambda to write the data to OS clusterI did query the inside the cluster using the npm elasticsearch package using the API const res = await esClient.search({ index: 'amazon_neptune', body: { query: { term: { 'predicates.status.value': 'ACTIVE' } } } });. This is giving me back the required document in the response.I feel there is something wrong with my gremlin query. The name of my index is "amazon_neptune"ShareTaylor-AWS a year agoLooking at your index settings, you appear to be missing a few things.  Here is a copy of the index settings that get auto-generated from the Neptune Streams poller.  This index applies to the movie dataset that we use in our workshops, but you can use this as a template to copy for your own purposes.  https://pastebin.com/akVRPd8uSharekanhaiagarwal a year agoI created the index mapping according to the pastebin link. My new index mapping - https://pastebin.com/6BQTWd6i.My document inside the index - https://pastebin.com/qjT05w3pI tried the OpenSearch query { query: { match: { 'predicates.status.value': 'ACTIVE' } } } from the npm elasticsearch client which gives me back the above document.But when I write this lineconst res = await dbClient      .withSideEffect('Neptune#fts.endpoint',<os_endpoint>)      .withSideEffect('Neptune#fts.queryType', 'match')      .V().has("status","Neptune#fts ACTIVE").toList();res is []ShareShow 3 more comments"


Question: Aurora RDS: determine replication lag

"Since SHOW SLAVE STATUS doesn't work: What is an API-based way to determine the current replica lag, i.e., the "seconds behind master" value? MySQL 5.7.FollowComment"

Answer: "0You can use AuroraReplicaLag, AuroraReplicaLagMaximum, and AuroraReplicaLagMinimum to determine replication lag. Setting up CloudWatch alarm is easy way to monitor Aurora replication lag, or use CloudWatch API to get metrics data.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMySQL.Monitoring.Metrics.html#Aurora.AuroraMySQL.Monitoring.Metrics.clustersCommentShareYUTAKA_Hanswered 8 months agoHenningSchulzrinne 8 months agoThank you. I should have specified the use case: determining whether an SQL INSERT has reached all replicas, i.e., this query will need to be performed frequently and with low overhead. SHOW SLAVE STATUS worked very well for that in the past. I'm afraid that CloudWatch takes too long to update to make it useful for determining synchronization.ShareYUTAKA_H 8 months agoThank you for your confirmation. select Replica_lag_in_msec from mysql.ro_replica_status where Session_id != "MASTER_SESSION_ID";, and select REPLICA_LAG_IN_MILLISECONDS from information_schema.REPLICA_HOST_STATUS where SESSION_ID != "MASTER_SESSION_ID"; shows replication lag by using query. You will be able to get latest replication lag on each Readers.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.html#AuroraMySQL.Replication.MonitoringShare0I do not think that you will have an AWS API or AWS CLI call for any database command. "SHOW SLAVE STATUS" is a MySQL Command, hence you do not have a ready-to-use AWS API or AWS CLI call for this.You would have to build a custom solution for this.CommentShareD-Raoanswered 8 months agoHenningSchulzrinne 8 months agoThe problem is, as you probably know, that SHOW SLAVE STATUS does not work for RDS Aurora. Do you have a suggestion for a "custom solution" for this?Share"


Question: efa_installer.sh fail on Testing EFA device in the last few days

"Today I follow efa get started doc https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa-start.html#efa-start-enable to install EFA software on Amazon Linux 2,  it failed on the last step "Testing EFA device" with below error:$ sudo ./efa_installer.sh -y= Starting Amazon Elastic Fabric Adapter Installation Script == EFA Installer Version: 1.17.2 =............== Testing EFA device ==Starting server...Starting client...Error: fi_pingpong test timed out.==============================================================================An EFA device has been detected but a ping test has failed. Please consult theEFA documentation to verify your configuration.==============================================================================================================================EFA installation complete.Please logout/login to complete the installation.Libfabric was installed in /opt/amazon/efaOpen MPI was installed in /opt/amazon/openmpi===================================================Log from dmesg:[   47.835056] efa 0000:00:06.0 rdmap0s6: Unregister ib device[   47.966388] Elastic Fabric Adapter (EFA) v1.16.0g[   48.080918] efa 0000:00:06.0: Setup irq:27 name:efa-mgmnt@pci:0000:00:06.0[   48.085540] efa 0000:00:06.0 efa_0: IB device registered[   50.633468] efa 0000:00:06.0 rdmap0s6: Failed to process command DEREG_MR (opcode 8) comp_status 7 err -22[   50.637880] efa 0000:00:06.0 rdmap0s6: Failed to de-register mr(lkey-4) [-22][   50.647230] efa 0000:00:06.0 rdmap0s6: Failed to process command DEREG_MR (opcode 8) comp_status 7 err -22[   50.651981] efa 0000:00:06.0 rdmap0s6: Failed to de-register mr(lkey-3) [-22]However, it  does work just a few days ago(last week) when I did the same testing.    Is there any  update for the EFA in the last few days?FollowComment"

Answer: "0Hello, thank you for your post. Please refer to the documentation on EFA limitations. I suspect that there may be a problem with the Security Group configuration for the instance on which you ran the EFA installer.The EFA must be a member of a security group that allows all inbound and outbound traffic to and from the security group itself.Please consider opening a support case so that a support engineer can assist you with reviewing the configuration of the EC2 instance and troubleshoot the EFA pingpong test.CommentShareSUPPORT ENGINEERAWS_SamManswered a year agorePost-User-1783894 6 months agoI have a same issue like that:efa_test.sh with below error:Starting server...Starting client...Error: fi_pingpong test timed out.dmesg:[  803.733432] efa 0000:00:06.0 rdmap0s6: Failed to process command DEREG_MR (opcode 8) comp_status 7 err -22[  803.737575] efa 0000:00:06.0 rdmap0s6: Failed to de-register mr(lkey-0) [-22][  892.965223] efa 0000:00:06.0 rdmap0s6: Failed to process command DEREG_MR (opcode 8) comp_status 7 err -22[  892.969332] efa 0000:00:06.0 rdmap0s6: Failed to de-register mr(lkey-0) [-22]my security group had allowed all inbound and outbound traffic to and fromso what's the problem?Share"


Question: AWS us-west-2 server connecting to db have become slow

We got a mail from AWS that they will change the underlying hardware for one of our server and that did happen. However after that we are seeing a latency to connect to db from the server. Even for command line sql client we can see a difference between when the sql prompt comes back. The other server returns quickly but this server which has been migrated to new server shows a visible lag. In fact the server that is showing issue is in same availability zone as the rds.This is in west 2.Anyone else is seeing that? Also what are the ways to debug and find the root cause. Nothing has changed from our side for at least 2 months and the only new event is the change of underlying hardware.FollowComment


Question: Update eks сluster from 1.25 to 1.26

"Hello team, could you please help me.I try update eks сluster from 1.25 to 1.26, I update cluster using consol aws -successfully.Then I use the console to try to update k8s on the nodes and fail.I get error -> NodeCreationFailureCouldn't proceed with upgrade process as new nodes are not joining node group prod_eks_nodes_groupdetails:I click buttonEKS->Clusters->mycluster->Node group: mygroup-> New AMI release version is available for this node group. --- Update nowAfter that, three new nodes are created, for about 25 minutes they exist and then they go into satus termite.Nodes do not connect to the clusterI can connect to the new node and use telnet i can ping the cluster DNS nameI checked the limits and restrictionsI tested upgraded the stage cluster to version 1.26 and had no problemsIn April, I updated this production cluster from version 1.24 to version 1.25, the updates went through normally and have not made any changes to its work in rights and permissions.I would like to try turning on EKS->Clusters->mycluster->Manage logging, and run the update again, would it help?Will it help to understand the cause?Could you tell me please how can I find the problemFollowComment"


Question: Amazon Connect Lex Lambda Timeout

"For Amazon Connect chat sessions, I am having issue with Lex Lambda on Get User Input block. It always goes to ERROR if the lex execution time takes over 8000 milli seconds. Here are my test results:12648 - ERROR7499 - OK9553 - ERROR9218 - ERROR7936 - OK7446 - OK8656 - ERRORThe Error happens even though lambda is providing valid fulfillment response after 8000 milliseconds. I do have language setting in Contact Flow correctly as some re:Post answers referred to.I understand such limitation for voice calls. But for Text/Chat it doesn't make sense to have such hard time out. The setting x-amz-lex:text:start-timeout-ms doesn't work for these situations, not sure what it is for.Anyone knows how to change this time out?Thanks!FollowComment"

Answer: "0Accepted AnswerHi,I would suggest to read on options that me and another re-poster described here: https://repost.aws/questions/QUXz5ungWZQdGfoT956JT2bA/is-there-a-way-to-increase-aws-connect-module-invoke-aws-lambda-function-timeoutIn summary:as it is not possible to extend the timeout of 8 seconds for invoking lambda functions associated with AW Connect, as also this guide shows in a screenshot: https://docs.aws.amazon.com/connect/latest/adminguide/invoke-lambda-function-block.html, you could try to decrease lambda execution with mechanisms such as Snapstart (if Java based) or Provisioned concurrency.For processing which may take more than 8 seconds, you can do your work asynchronously. For more details see the blog at https://aws.amazon.com/blogs/contact-center/use-asynchronous-lambda-functions-with-amazon-connect/Hope it helps ;)CommentShareEXPERTalatechanswered a month agoTalkFirst a month agoThank you!Share"


Question: Elasticbeanstalk command line deploy has suddenly become VERY slow

"I have been using eb deploy to deploy my Node app on elastic beanstalk for 1 year+. It normally takes a few minutes. Suddenly, a few days ago, it became VERY slow (~20 minutes). And running the command with --verbose shows it's spending all of this time packaging the zip file.To be clear:eb deploy                                                Alert: The platform version that your environment is using isn't recommended. There's a recommended version in the same platform branch.Creating application version archive "app-4c72-4566829_232321".(WAIT ~20 minutes - normally this was VERY fast. Perhaps instantaneous. When I run with --verbose, I can see it slowly crawling my directory tree and adding files.  I have some files in .ebignore but even crawling normal files is very slow like a second or two per file)This part seems normal / fast:Upload Complete.2023-03-24 20:26:20    INFO    Environment update is starting.2023-03-24 20:26:26    INFO    Deploying new version to instance(s).2023-03-24 20:27:15    INFO    Instance deployment completed successfully.2023-03-24 20:27:20    INFO    New application version was deployed to running EC2 instances.2023-03-24 20:27:20    INFO    Environment update completed successfully.One thing I noticed is I am running Node.js 16 running on 64bit Amazon Linux 2/5.6.0 and it looks like there is a new platform version (5.7) available. Could the release of this new version have caused this?FollowComment"

Answer: "0Accepted AnswerI wrote in to AWS support. They suggested I run eb --debug --verbose. I ran it and some some errors around unknown branches, so I just re-ran eb init (I had to delete my local codecommit branch). That fixed it!CommentShareJeremyanswered 2 months ago"


Question: Why are my X-Ray sampling rules being ignored for my Node.js app running in EC2?

"I have a Node.js app running in EC2 and have successfully launched the X-Ray collector using user data. The X-Ray service is getting the traces from the application (instrumented using the javascript xray-sdk), but I see no trend information in the sampling rules I have set up in the AWS console (including the default rule).My code to initialize the sdk is pretty simple:const AWS = AWSXRay.captureAWS(require('aws-sdk'));AWS.config.update({ region: process.env.DEFAULT_AWS_REGION || 'us-west-2' });...app.use(AWSXRay.express.closeSegment());...app.use(AWSXRay.express.closeSegment());I have also added code to use the AWS sdk to query for and log the sampling rules to see if they are visible to the app, and they are. I have not called AWSXRay.middleware.disableCentralizedSampling(), so I don't know why the sampling rules are not being used.Is there some other configuration I need to set up to allow the rules to be used?FollowComment"

Answer: "0Tested in my test environment and it is working fine for nodejs application on EC2 with xray Daemon. Below is steps performed:Installed nodejs on EC2 Amazon Linux.# yum groupinstall 'Development Tools'# curl -sL https://rpm.nodesource.com/setup_16.x | sudo -E bash - # yum install -y nodejs Installed xray deamon2# wget https://s3.us-west-2.amazonaws.com/aws-xray-assets.us-west-2/xray-daemon/aws-xray-daemon-3.x.rpm# yum install aws-xray-daemon-3.x.rpmAdded needed permission for xray to instance IAM role 3AWSXrayReadOnlyAccessAWSXRayDaemonWriteAccess   <<read permissions to get sampling rulesAWSXrayFullAccessDeployed the sameple application4 5# wget https://github.com/aws-samples/aws-xray-sdk-node-sample/archive/refs/heads/master.zip# unzip master.zip# cd aws-xray-sdk-node-sample-master/# npm install aws-xray-sdk# npm install aws-xray-sdk --save# npm install express# node --inspect index.jsGenerate multiple requests (in my case modified port to 80 instead of 3000)# curl -v http://<INSTANCE_IP>/http-request/Checked on EC2 instance xray data been successfully sent.$ tail  -f  /var/log/xray/xray.log[Info] Successfully sent batch of 1 segments (0.003 seconds)[Info] Successfully sent batch of 1 segments (0.005 seconds)[Info] Successfully sent batch of 2 segments (0.005 seconds)[Info] Successfully sent batch of 1 segments (0.121 seconds)[Info] Successfully sent batch of 1 segments (0.015 seconds) Monitor Sampling rules (AWS X-Ray> Sampling), you can see data in Trend graphPlease try on your above in your test environment.CommentSharerePost-User-9997545answered 5 months ago0Centralized sampling rules are stored in X-Ray service. X-Ray sdk in user application has to take time to poll it and this poll action is lazy initialization, triggered by the first segment. So, the first segment generated in user application will fall back to a local rule (1/sec + 5%), which means the first segment is always sampled.X-Ray centralized sampling has some limits, it does not work well in such cases:Instrumented application's life is short. Centralized sampling rules is not ready to take effect.If user's fleet scale is large, poll centralized sampling rules and sync up status with X-Ray service would take more time.The alternative solution is using local sampling rules.CommentShareAWS-User-8048242answered 5 months ago"


Question: AWS IAM Identity Center - EventBridge Rules

"Hi all,as a Security Requirement we need to setup a notification system using SNS to notify our Security Team when someone access an AWS Account using a specific SSO PermissionSet "for example : AdministratorAccess " as shown in the image below :I'm trying to setup a simple EventBridge Rule based on the IAM Identity Center Federate Event on Cloudtrail with an SNS topic as a target but I can't get it working.CloudTrail Event :{    "eventVersion": "1.08",    "userIdentity": {        "type": "Unknown",        "principalId": "xxxx-43ce-996a-0530772c083a",        "accountId": "xxxxxxxxxxx",        "userName": "userName"    },    "eventTime": "2023-03-23T00:07:29Z",    "eventSource": "sso.amazonaws.com",    "eventName": "Federate",    "awsRegion": "us-east-1",    "sourceIPAddress": "1.1.1.1",    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0",    "requestParameters": null,    "responseElements": null,    "requestID": "c99b-48ea-a9e4-fc2194bc0f27",    "eventID": "415e-b57e-99764a0f0fdf",    "readOnly": false,    "eventType": "AwsServiceEvent",    "managementEvent": true,    "recipientAccountId": "xxxxxxxxxx",    "serviceEventDetails": {        "role_name": "AWSAdministratorAccess",        "account_id": "xxxxxxxx"    },    "eventCategory": "Management"}EventBridge Event Pattern is the Following :{  "detail-type": ["AWS API Call via CloudTrail"],  "detail": {    "eventSource": ["sso.amazonaws.com"],    "eventName": ["Federate"]  }}anyone could help on how to get this working ?Thanks in advanceFollowComment"

Answer: "0Accepted AnswerI managed to get it working,the problem was related to the detail-type  in the eventBridge Rule as in this case we are not talking about a direct API Call but about an AWS Service Event.The Correct EventBridge Rule{  "source": ["aws.sso"],  "detail-type": ["AWS Service Event via CloudTrail"],  "detail": {    "eventSource": ["sso.amazonaws.com"],    "eventName": ["Federate"],    "serviceEventDetails": {      "role_name": ["AWSAdministratorAccess"]    }  }}CommentSharePeter Eskandaranswered 2 months ago0I do not see 'detail' & 'detail-type' objects defined in the sample event which you shared. Can you just try with this ?{  "eventSource": ["sso.amazonaws.com"],  "eventName": ["Federate"]}CommentShareAritro Senanswered 2 months agoPeter Eskandar 2 months agoI tried as suggested but unfortunately it didn't workShare"


Question: AWS Spot Pricing Specifics

"Hi, for my purposes I am using AWS Batch with EC2 spot to run multiple jobs created every 15 minutes with each lasting ~2-10 seconds for computation.From my understanding AWS Batch creates an instance for each job, where Spot prices a minimum of one minute's charge for each, although I am uncertain of the exact instance type chosen by the "optimal" selection's logic with best-fit.As a result of my low duration workload, I was planning to create a load-balancing system that combines jobs (Each is calculated independently and are not easily multi-processed) before submitting them to AWS Batch, choosing a specific instance type instead of the "optimal" selection to reach the 1 minute time for a given instance consistently to avoid wasted time (However I still want the work to be computed in parallel over multiple instances whenever otherwise possible).I was wondering if there were any faults in my understand of AWS Batch and Spot above, perhaps where AWS Batch packages the jobs similarly to how I was planning?FollowComment"


Question: Unable to resolve Permission Error - Python and AWS EB

"I created a Dash application that has been deployed to AWS Elastic Beanstalk. The application relies on the user uploading an Excel sheet to get the desired output.In another Dash application I created previously, there were no problems while uploading the Excel sheet. This time around, I keep getting a PermissionError(13, 'Permission Denied') message.The platform for my Dash applications are Python. Unfortunately, I haven't been able to see anyone else facing the same problem too.Just for reference, the value of the PYTHONPATH environment property is "/var/app/venv/staging-LQM1lest/bin".Moreover, I am using the EB management console and not the CLI.Any tips on how to solve the problem would be much appreciated.Thanks.FollowComment"

Answer: 0Not an expert here but the python error is usually file permission issue. eg user running process cannot access file due to file ownership or permissions. Probably need to check how the process is being run and how the permissions are set on the file being uploadedCommentShareEXPERTPeter_Ganswered a year ago


Question: CSS styling is missing after hosting with AWS in Serverless mode.

"Hello,I have hosted a Remix JS application in serverless mode with S3 and Lamda functions. Deploying it into serverless using buildspec.yml and serverless.yml. The application hosted properly but CSS styling is missing, the application is trying to load the CSS from https://{domain_name}/_static/build/_assets/app-OAMDP42D.css, but it is getting a 404 response. I checked the s3 bucket, it has the CSS under the server/_assets/app-OAMDP42D.css path. But in AWS Lamda the server folder only has index.js. Can anyone help with how to enable the CSS styling with the S3 bucket and AWS LAMDA? Thanks in advance.FollowComment"

Answer: "0Hello,Good day.If the 404 error is from S3, it looks like Lambda is referring to an object that does not exist in the bucket. To check what exactly is being sent in the request or if there are any additional characters in the object name which could be causing the issue, we would have to look into the logs for the 404 response. For this, please feel free reach out to us via creating a support case from the support centre dashboard and share the S3 request ID pair with us.You can refer here for details on collecting the request ID pair.I came across a few external articles (1,2) which discuss about keeping CSS in the S3 bucket and calling it via lambda function which may offer additional guidance.Thank you.CommentShareSUPPORT ENGINEERSamreen_Tanswered 8 months ago"


Question: Remove SES submission queue

"Hello,Our Mautic application was hacked and about 56,000 email addresses were entered.We need the SES send queue removed so that emails are no longer sent. Is it urgent.We can't find a way to do this in the AWS documentation.Please we need help.How can I stop sending these emails urgently?We do not use the Amazon SQS service. Mautic uses a verified email domain for submissions.RegardsFollowComment"

Answer: "0Amazon SES doesn't queue messages for you--it will attempt to deliver every message that was sent to its API. However, it looks like Mautic does have some queuing functionality.As a short term approach, I recommend that you disassociate Mautic from your verified domain to prevent further damage to your domain's reputation. You should also change passwords for all IAM credentials that have the ability to send through SES or that were associated with Mautic in any way, and of course change your Mautic passwords (and set up two-factor authentication for all users, if Mautic offers that feature).CommentShareEXPERTBrentAtAWSanswered 3 months ago"


Question: Restore from glacier does not seem to work...

"Hi everyone,So I manually restored a file from the glacier storage. After a while, it says restoration complete, shows me the restoration expiry as well. However, at the same time, it also shows a warning that the file is in glacier and therefore cannot be accessed. Is this supposed to happen? Or have I done anything wrong? I am still not able to view the file. I understand that a temporary copy is moved to RRS after restoration. So where can I view that file?Also, is there any way to transfer the temporary copy of the file to STANDARD storage after restoration?Thanks so much!FollowComment"

Answer: "0Hi aliengood1729,The behavior which you are observing is expected. You will be able to open the file, to view the content once the file is restored. Please note that whenever an object is restored from Glacier storage class, even after restoration, the storage class of object remains same. In restoration process, S3 creates temporary copy of the actual object (which is in Glacier) which is available for amount of restoration period you chose while initiating the restore process. So, even after restoration, the actual object still remains in the same storage class.Also you cannot move the temporary copy to a different storage class. You can download the object and then copy it to a new location in the same S3 bucket in Standard Storage class.Please feel free to reach out for further queries or concerns.Best regardsCommentShareSUPPORT ENGINEERIsha_Panswered 2 years ago0Hi.Big thanks for reaching out! Do I really need to download the files to the PC and re-upload again? That was not the case when I worked on the last Glacier Archive that I started to sync between regions a few years back, then I could copy the restored object to the same bucket as it is recovered in and using that copy I could move it to another bucket.On the page https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects.html I can read "If you want a permanent copy of the object, create a copy of it in your Amazon S3 bucket." which is what I want to do but can't find the way to do.CommentShareeljestanswered 7 months ago"


Question: Does ACM support multiple TLS certs for same domains simultaneously?

"Prior to expiration of a current TLS certificate (e.g. expires July 1st), I would like to issue a new certificate well in advance but not valid before July 1st.  In that way I could pre-release my clients so they can validate to either certificate.Is this possible?  If not, what is the recommended approach?FollowComment"

Answer: "0ACM provides managed renewal for your Amazon-issued SSL/TLS certificates. This means that ACM will either renew your certificates automatically (if you are using DNS validation), or it will send you email notices when expiration is approaching. These services are provided for both public and private ACM certificates.CommentShareRajarshi_Danswered a year agorePost-User-3274186 a year agoThank you for your response  I realize ACM provides renewal services, but your response does not answer my question.  ACM also provides a console which allows you to request new certificates.  My question is, can I request a second certificate with overlapping validation periods so I can deploy my clients well ahead of expiration of the first certificate?Share"


Question: Accessing Amazon Athena over JDBC with an IAM role

"I have an analytics application running on EC2.  The application uses the Athena JDBC connector to connect to Athena and run queries.  Can I use an IAM role attached to the EC2 instance to authorize the Athena connection, rather than embedding credentials in the JDBC connection string?FollowComment"

Answer: 0Accepted AnswerIt is indeed a best practice to use an IAM role rather than embedding credentials in the JDBC connection string.  Attach the AWSQuicksightAthenaAccess Managed Policy to the IAM role used in the EC2 instance profile.  Then specify the DefaultAWSCredentialsProviderChain in the JDBC connection string.   The JDBC connection string would look like this:jdbc:awsathena://AwsRegion=<aws-region>;S3OutputLocation=s3://<s3_bucket>/;AwsCredentialsProviderClass=com.simba.athena.amazonaws.auth.DefaultAWSCredentialsProviderChainRead more here on Using Athena with the JDBC Driver.CommentShareKunal_Ganswered 3 years ago


Question: Running error for FPGA examples

"Hello!I'm trying to run some examples provided by AWS, in specific OpenCL examples (https://github.com/aws/aws-fpga/tree/master/SDAccel/examples) and I'm getting some errors in the execution part. (I try to execute in the FPGA itself, not any type of emulation)I followed and done every step guide, but when I try to do "./helloword *.awsxclbin" I receive an error message (below).Erro 1:xclProbe found 1 FPGA slots with xocl driver runningERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffWARNING: xclOpen Handle check faileddevice[0].user_instance : 80ERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffERROR: xclOpen Handle check failedXRT build version: 2.2.0Build hash: e21b8a5b208618834760593bbb15063f7e399642Build date: 2019-09-06 20:10:43Git branch: 2019.1PID: b23UID: 3e8[Thu Oct 17 20:02:57 2019]HOST: ip-172-31-94-233.ec2.internalEXE: /home/centos/aws-fpga/SDAccel/examples/aws/helloworld_ocl_runtime/helloworld[XRT] ERROR: Device setup failedxclProbe found 1 FPGA slots with xocl driver runningERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffWARNING: xclOpen Handle check faileddevice[0].user_instance : 80ERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffERROR: xclOpen Handle check failed[XRT] ERROR: Device setup failedxclProbe found 1 FPGA slots with xocl driver runningERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffWARNING: xclOpen Handle check faileddevice[0].user_instance : 80ERROR AwsXcl: PCI kernel bar attach failed for slot# 0WARNING: AwsXcl isGood: kernel, global & mgmt bar are: ffffffff, ffffffff, ffffffffERROR: xclOpen Handle check failed[XRT] ERROR: Device setup failedError: Failed to find Xilinx platformErro 2:xclProbe found 1 FPGA slots with xocl driver runningFound PlatformPlatform Name: XilinxFound Device=xilinx_aws-vu9p-f1-04261818_dynamic_5_0INFO: Reading xclbin/host.hw.xilinx_aws-vu9p-f1-04261818_dynamic_5_0.xclbinLoading: 'xclbin/host.hw.xilinx_aws-vu9p-f1-04261818_dynamic_5_0.xclbin'XRT build version: 2.2.0Build hash: e21b8a5b208618834760593bbb15063f7e399642Build date: 2019-09-06 20:10:43Git branch: 2019.1PID: 31347UID: 0[Thu Oct 17 21:32:14 2019]HOST: ip-172-31-94-233.ec2.internalEXE: /home/centos/aws-fpga/SDAccel/examples/xilinx_2019.1/getting_started/hello_world/helloworld_ocl/helloworld[XRT] ERROR: Failed to load xclbin.src/host.cpp:78 Error calling cl::Program program(context, devices, bins, NULL, &err), error code is: -44My specific question is: I need to set up another thing to make possible run the example and another program?FollowComment"

Answer: "0Hello,For Error 1:In this case you might want to run as root as it seems like your user does not have privileges to run.For Error 2:Try running the following commands:sudo -E /bin/bashsource <AWS_FPGA_REPO_DIR>/sdaccel_runtime_setup.sh./helloword *.awsxclbinAlso check that you have permissions to load the AFI that you created.To find out the AFI it is trying to load from the awsxclbin, run the following command:cat vector_addition.hw.xilinx_aws-vu9p-f1-04261818_dynamic_5_0.awsxclbin | strings | grep AGFITo see if you have permissions to load the AFI, try loading it manually:cat *.awsxclbin | strings | grep agfi | xargs fpga-load-local-image -S0 -I This output should show something like:AFI          0       agfi-096d0d8abcdefg  loaded            0        ok               0       0x04261818AFIDEVICE    0       0x1d0f      0xf010      0000:00:1d.0If it isn't loading, that means your account does not have permissions to load the AFI. You would have to use the modify image attribute from the account credentials you used to create the AFI to allow your other accounts to load it:https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-fpga-image-attribute.htmlPlease feel free to let us know if this doesn't work.-DeepCommentShareDeep_Panswered 4 years ago"


Question: PostgreSQL Connection to RDS from external server - Connection errors but works from other sources

"I have a Lambda Python function connecting via psycopg2 to a PostgreSQL db instance running RDS.The Lambda connects absolutely fine (Lambda and RDS both in EU-West-2 region)I can also connect to the PostgreSQL via PgAdmin4 from a local development system and other developers can also access from other locations/IPs via PGAdmin with no problem.I can also connect a simple psycopg2 connect and query script from my local desktop here. Therefore I know RDS is accepting and responding to externally-sourced psycopg2 connections and queries.HOWEVER, when I upload the same simple connect script to my web server (OVH - based in France if of any relevance), running equivalent Python and psycopg2 etc., the connection fails with the standard psycopg2 error response from the Python:Error raised: connection to server at "xxxxxxxx.yyyyyyyyyy.eu-west-2.rds.amazonaws.com" (ppp.qqq.rrr.ssss), port 5432 failed: Connection refused         Is the server running on that host and accepting TCP/IP connections?I've tweaked the Security Group settings to permit anything from anywhere etc and still no joy.  PostgreSQL in the RDS seems to have listening on * which seems necessary to permit connections under certain circumstances.What is the subtlety in the differing sources that means such a connection from the OVH web server won't work; I can't find anything in the docs that seems to link to this issue and there's nothing obvious mis-configured on the server-side..Any responses gratefully received.FollowComment"

Answer: "0You said "other developers can also access from other locations/IPs via PGAdmin", so you mean e.g. from their homes not just on-prem?  So you have connected OK from various places in the internet?  It would still be worth checking the RDS subnet's NACL and route table though.  Is everything set up properly on your OVH web server to make an outbound connection like this, for example any stateless ACL config open to receive responses on ephemeral ports?CommentShareEXPERTskinsmananswered 6 months ago0Is the OVH webserver public (and allows outgoing public connections?) and the intent to connect over the internet to the RDS instance publically?Please review: How can I troubleshoot connectivity to an Amazon RDS DB instance that uses a public or private subnet of a VPC? https://aws.amazon.com/premiumsupport/knowledge-center/rds-connectivity-instance-subnet-vpc/CommentShareMichael_Wanswered 6 months ago"


Question: "CannotStartContainerError: ResourceInitializationError" on Fargate 1.4.0

I have task that works fine using Fargate 1.3.0 but fails to start if I change the Platform version to 1.4.0 with this error message:CannotStartContainerError: ResourceInitializationError: failed to create new container runtime task: OCI runtime create failed: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused "rootfs_linux.go:58:...Any hints on how to go about debugging this?FollowComment

Answer: "0Is there a way to get the entire error message?  It looks like anything helpful gets cut off in both the Console and the CLI:"reason": "CannotStartContainerError: ResourceInitializationError: failed to create new container runtime task: OCI runtime create failed: container_linux.go:349: starting container process caused \"process_linux.go:449: container init caused \"rootfs_linux.go:58:...",CommentShareTim-Eluvioanswered 3 years ago0It looks like I am running into a few issues with 1.4.0 but as far as I can tell this specific issue seems to be caused by trying to use the InitProcessEnabled LinuxParameter:"LinuxParameters": {  "Capabilities": {},  "InitProcessEnabled": true}Is this no longer supported on Fargate 1.4.0?CommentShareTim-Eluvioanswered 3 years ago"


Question: S3 Access Denied issue

quick sight is throwing permission denied issue even after providing access to that respective S3 bucket . Below are the steps I have followed and please  find the attached screenshots for reference.Created s3 buckets and placed all the tables data in parquet filesCreated a db in AWS glue and ported tables trough crawlerstables executing in athenagiven s3 and athena permissions in quick sight and tried to access these tables using athena as datasource(https://repost.aws/media/postImages/original/IMdaIIJpDgSiK1ne3ig9G-6Q)(https://repost.aws/media/postImages/original/IMKUcDGiRFQRqHzM2W-kg5aw)FollowComment

Answer: "0Please check if you have any bucket policies restricting the same.You need to allow s3:GetObject in your IAM policy or S3 bucket policy. Below is an example.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:GetObject"            ],            "Resource": [                "arn:aws:s3:::mybucket",                "arn:aws:s3:::mybucket/*"            ]        }    ]}How do I troubleshoot 403 Access Denied errors from Amazon S3? https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-403/?nc1=h_lsIf you still face issue after this, check CloudTrail for the corresponding API call from quicksight and you will be able to identify the hurdle.CommentShareSUPPORT ENGINEERRuturaj_janswered 10 months agorePost-User-5382838 10 months agothanks for the quick respond.yes it has AmazonS3fullaccess policy.Share"


Question: Is there a way to use email + secret instead of Access Key + Secret with SES SMTP Credentials?

"Hi,We recently converted our SES Sandbox to production to be used for a specific Use Case.The third party we are working with expect the credentials to have email + password instead of Access Key + Password. Please see attached screen shot.We were just wondering if there is a way to generate credenatials in such a way.If so could you please let us know?We followed creating SMTP credentials and got the Credentials associated with an IAM user.FollowComment"

Answer: 0Obtain SMTP credentials by following the instructions in the following document.https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.htmlhttps://docs.aws.amazon.com/ses/latest/dg/send-email-concepts-credentials.htmlCommentShareEXPERTRiku_Kobayashianswered 2 months ago


Question: Error in Data Glue. Trying to do the BYOD lab

"Hello I am new to working with this product and have no idea what this error message means. Would anyone be able to help me. Or direct me to where I can figure out what is going on.  TIADec 24, 2021, 11:32:42 AM Pending execution2021-12-24 16:33:07,324 Thread-4 WARN JNDI lookup class is not available because this JRE does not support JNDI. JNDI string lookups will not be available, continuing configuration. java.lang.ClassNotFoundException: org.apache.logging.log4j.core.lookup.JndiLookup at java.net.URLClassLoader.findClass(URLClassLoader.java:382) at java.lang.ClassLoader.loadClass(ClassLoader.java:418) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:352) at java.lang.ClassLoader.loadClass(ClassLoader.java:351) at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Class.java:264) at org.apache.logging.log4j.util.LoaderUtil.loadClass(LoaderUtil.java:173) at org.apache.logging.log4j.util.LoaderUtil.newInstanceOf(LoaderUtil.java:211) at org.apache.logging.log4j.util.LoaderUtil.newCheckedInstanceOf(LoaderUtil.java:232) at org.apache.logging.log4j.core.util.Loader.newCheckedInstanceOf(Loader.java:301) at org.apache.logging.log4j.core.lookup.Interpolator.<init>(Interpolator.java:95) at org.apache.logging.log4j.core.config.AbstractConfiguration.<init>(AbstractConfiguration.java:114) at org.apache.logging.log4j.core.config.DefaultConfiguration.<init>(DefaultConfiguration.java:55) at org.apache.logging.log4j.core.layout.PatternLayout$Builder.build(PatternLayout.java:430) at org.apache.logging.log4j.core.layout.PatternLayout.createDefaultLayout(PatternLayout.java:324) at org.apache.logging.log4j.core.appender.ConsoleAppender$Builder.<init>(ConsoleAppender.java:121) at org.apache.logging.log4j.core.appender.ConsoleAppender.newBuilder(ConsoleAppender.java:111) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.createBuilder(PluginBuilder.java:158) at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.build(PluginBuilder.java:119) at org.apache.logging.log4j.core.config.AbstractConfiguration.createPluginObject(AbstractConfiguration.java:813) at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:753) at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:745) at org.apache.logging.log4j.core.config.AbstractConfiguration.doConfigure(AbstractConfiguration.java:389) at org.apache.logging.log4j.core.config.AbstractConfiguration.initialize(AbstractConfiguration.java:169) at org.apache.logging.log4j.core.config.AbstractConfiguration.start(AbstractConfiguration.java:181) at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:446) at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:520) at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:536) at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:214) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:146) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:41) at org.apache.logging.log4j.LogManager.getContext(LogManager.java:194) at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:597) at org.apache.spark.metrics.sink.MetricsConfigUtils.<clinit>(MetricsConfigUtils.java:12) at org.apache.spark.metrics.sink.MetricsProxyInfo.fromConfig(MetricsProxyInfo.java:17) at org.apache.spark.metrics.sink.GlueCloudwatchSink.<init>(GlueCloudwatchSink.scala:51) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at org.apache.spark.metrics.MetricsSystem$$anonfun$registerSinks$1.apply(MetricsSystem.scala:200) at org.apache.spark.metrics.MetricsSystem$$anonfun$registerSinks$1.apply(MetricsSystem.scala:194) at scala.collection.mutable.HashMap$$anonfun$foreach$1.apply(HashMap.scala:130) at scala.collection.mutable.HashMap$$anonfun$foreach$1.apply(HashMap.scala:130) at scala.collection.mutable.HashTable$class.foreachEntry(HashTable.scala:236) at scala.collection.mutable.HashMap.foreachEntry(HashMap.scala:40) at scala.collection.mutable.HashMap.foreach(HashMap.scala:130) at org.apache.spark.metrics.MetricsSystem.registerSinks(MetricsSystem.scala:194) at org.apache.spark.metrics.MetricsSystem.start(MetricsSystem.scala:102) at org.apache.spark.SparkContext.<init>(SparkContext.scala:514) at org.apache.spark.api.java.JavaSparkContext.<init>(JavaSparkContext.scala:58) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:247) at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357) at py4j.Gateway.invoke(Gateway.java:238) at py4j.commands.ConstructorCommand.invokeConstructor(ConstructorCommand.java:80) at py4j.commands.ConstructorCommand.execute(ConstructorCommand.java:69) at py4j.GatewayConnection.run(GatewayConnection.java:238)FollowCommentTasio EXPERTa year agoHi, do you refer to this lab? https://catalog.us-east-1.prod.workshops.aws/workshops/fad47f62-3d06-430b-ad32-8588b74fe16f/en-US/ If yes, in which step did you get that error? Thanks.Share"


Question: How to released a domain mapped from one AWS Amplify to connect under second AWS Amplify

"My current website was built and managed via AWS Amplify from one AWS account (Developer) and now I wanted to attached that domain under my AWS Account with same infrastructure under AWS Amplify. But while I'm Addind a custom domain (managed under Route53) under AWS Amplify tab, and trying to save, its giving error :One or more domains requested are already associated with another Amplify appI have full access of my Domain DNS and I had update the NS too which is generated und Route53 but still I could not get released it from the previous AWS account where from hosted by Amplify as development Environment.Kindly please assist how to release that so I can go live with my domain mapped to my AWS accont and get full control of it.FollowComment"


Question: cloud-init not setting default route to NAT Gateway

"The current setup is:VPC with a public subnet 172.31.80.0/20Routing Table has 0.0.0.0/0 directing to IGWNAT in public subnet has private IP of 172.31.90.191Manually setting the NAT private IP as the default route ( using ip ro) in the EC2 allows the NAT Gateway to function as expected.The issue is that at boot time the Amazon Linux 2 service cloud-init receives 172.31.80.1 as the gateway, not the NAT.DOPTS does not seem to have a field for setting the default gateway.Question:How can I make cloud-init receive the NAT IP as the setting for the default route?In relation to this, the EC2 will also need a route for the AWS DNS at 169.something.I suspect that a solution to the question will also help resolve this, but advice is welcome.FollowComment"

Answer: 0I solved this myself. This is what I had to do.Create VPC (Virtual Private Cloud) subnet 172.31.0.0/16Create an IGW (Internet Gateway)Create a public subnet within the VPC subnet 172.31.100.0/24Create a public route table that has a route 0.0.0.0/0 pointing to the IGWAdd the public subnet to the public route table. The public subnet should now also use the public route table.Create EC2s without access from the Internet must be in a private subnet that does not have a route to the IGWCreate an EIP (Elastic IP)Create a NAT (NAT Gateway) in the private subnet and associate the EIPCreate a private route table for the private subnet and add a route of 0.0.0.0/0 pointing to the NATThe public and private subnets must both be within the VPC subnet but not overlapping.The default GW from cloud-init now works for the EC2.CommentShareRoyceTheBikeranswered 3 years ago


Question: Redshift Copy fails due to '\' present in some of the data in my csv file

"I am trying to copy csv file from S3 to Redshift table. I have few of the columns present in my csv file that contains '' in the data. Below is the sample data:columnA|columnB|columnC|columnD|columnEabc|12|xyz|test|hellolmn|123|pqr|test|byejkl|124|deg|test|hiI am using below command to copy in Redhisft, but it fails:COPY redshif_schema.redshift_table_name from 's3://bucket/folder/inputfile.csv' access_key_id '<access_id>' secret_access_key '<secret_key>' fillrecord escape delimiter as '|' IGNOREHEADER as 1 ACCEPTANYDATE emptyasnull blanksasnull maxerror 0 ;When I check raw_line in stl_load_errors table, I see below (2 back slashes):abc|12|xyz|test|helloCan someone please help with this?FollowComment"

Answer: 0Redshift is interpreting the backslash as an escape since you have specified ESCAPE in your COPY.You can try:Remove ESCAPE if it is not really needed.Specify a different escape character https://docs.aws.amazon.com/redshift/latest/dg/copy-parameters-data-conversion.html#copy-escapeUse the CSV format reader https://docs.aws.amazon.com/redshift/latest/dg/copy-parameters-data-format.html#copy-csvCommentShareAWS-User-2965899answered 3 years ago


Question: You have exceeded your monthly credit limit

before publishing the hit the following error occursYou have exceeded your monthly credit limitis anyone solved the problem. how to resolveFollowComment

Answer: "3Same, I also contact them and have been waiting for 2 days.CommentSharerePost-User-4726850answered 7 months agorePost-User-7296550 7 months agoAre you now able to post HITs? I am still waiting that my limit is reset.Share1Me too. I get the same error message and need a quick solution!CommentShareAcademicuseranswered 7 months agorePost-User-7296550 7 months agoHas your problem been solved? I am still waiting..ShareAcademicuser 7 months agoNot so far. I got a message of the support, that they try to increase my monthly spending limit and I have to wait for approval. But the survey I wanted to publish was very cheap - so I am pretty sure that my "limit" is "0" at the moment. I am a first time user and I don't understand why there is a limit at all..Share1How long did it take before you could post HITs? I contacted the support but I have been waiting for over 2 days and nothing happened.CommentSharerePost-User-7296550answered 7 months ago1I'm having the same problem.  This post is 2 months old, and nothing seems to be coming out from the support team on this.  Is MTurk dead?CommentSharerePost-User-8937021answered 6 months ago0Anyone have an answer for this ?I am first time user and I couldn't create more than one hit even though the requester account is tied to aws billing..CommentSharerePost-User-6477306answered 6 months agorePost-User-9687991 4 months agoSame. I'm new and my limit says it's 2,500 already yet I couldn't publish something for 1,008. I dropped it to 2 and that exceeded the limit too. So I'm pretty sure when you're new the limit is 0. We are forced into AWS billing and can't use pre-paid HITS or pay upfront in any way and then they don't give you a workable account. I've been waiting for 5 days and this is after being told 3 times my case is being expedited.Share0Any updates on this? I have the same problem.CommentSharefabiangroegeranswered a month ago"


Question: AWS WAF Ruleset with Multple Rules with Cloudformation

"I am trying to configure an AWS WAF WebACL using cloud formation.  I have been successful in creating a WEBACL with a single rule defined in the AWS::WAFv2::WebACL  Rules statement, but as soon as I try to define two or more rules only the last rule in the block is created.  There are no errors but I only get the final rule in the block.  Does anyone have an example of deploying a WebACL with multiple rules?The required ruleset is:IP deny rule with priority 0 and referenced IPsetIP allow rule with priority 1 and referenced IPsetGeolocation rule to restrict to GB and allowExample code block:"Rules":[                {                    "Name": "IPSetDeny",                    "Priority": 0,                    "Statement": {                      "IPSetReferenceStatement": {"ARN": { "Fn::GetAtt" : ["SampleIPSetDeny", "Arn" ]}}                    },                    "Action": {                      "Block": {}                    },                    "VisibilityConfig": {                      "SampledRequestsEnabled": true,                      "CloudWatchMetricsEnabled": true,                      "MetricName": "aws-waf-logs-dev-inf"                    },                    "Name": "IPSetAllow",                    "Priority": 1,                    "Statement": {                      "IPSetReferenceStatement": {"ARN": { "Fn::GetAtt" : ["SampleIPSetAllow", "Arn" ]}}                    },                    "Action": {                      "Allow": {}                    },                    "VisibilityConfig": {                      "SampledRequestsEnabled": true,                      "CloudWatchMetricsEnabled": true,                      "MetricName": "aws-waf-logs-dev-inf"                    },                    "Name": "restrict-country",                    "Priority": 2,                    "Statement": {                      "GeoMatchStatement": {                        "CountryCodes": [                          "GB"                        ]                      }                    },                    "Action": {                      "Allow": {}                    },                    "VisibilityConfig": {                      "SampledRequestsEnabled": true,                      "CloudWatchMetricsEnabled": true,                      "MetricName": "aws-waf-logs-dev-inf"                    }                   }                                ]FollowComment"

Answer: "0Accepted AnswerHi, @Simon CoxYour description describes only one Rule object for Rules.It is unknown how CloudFormation interprets it, but it may have been overwritten by the last block.I think you should write multiple Rules in the form of an array in Rules as follows."Rules": [    {        "Name": "IPSetDeny",        "Priority": 0,        "Statement": {            "IPSetReferenceStatement": {                "ARN": {                    "Fn::GetAtt": [                        "SampleIPSetDeny",                        "Arn"                    ]                }            }        },        "Action": {            "Block": {}        },        "VisibilityConfig": {            "SampledRequestsEnabled": true,            "CloudWatchMetricsEnabled": true,            "MetricName": "aws-waf-logs-dev-inf"        }    },    {        "Name": "IPSetAllow",        "Priority": 1,        "Statement": {            "IPSetReferenceStatement": {                "ARN": {                    "Fn::GetAtt": [                        "SampleIPSetAllow",                        "Arn"                    ]                }            }        },        "Action": {            "Allow": {}        },        "VisibilityConfig": {            "SampledRequestsEnabled": true,            "CloudWatchMetricsEnabled": true,            "MetricName": "aws-waf-logs-dev-inf"        }    },    {        "Name": "restrict-country",        "Priority": 2,        "Statement": {            "GeoMatchStatement": {                "CountryCodes": [                    "GB"                ]            }        },        "Action": {            "Allow": {}        },        "VisibilityConfig": {            "SampledRequestsEnabled": true,            "CloudWatchMetricsEnabled": true,            "MetricName": "aws-waf-logs-dev-inf"        }    }]CommentShareEXPERTiwasaanswered 9 months ago0Hi @Iwasa thanks for your comment you were quite correct.  I have used your example of an array of rules that my code is now working.CommentShareSimon Coxanswered 9 months ago"


Question: can't create lightsail for research

can' create instance of lightsail for research....and keep alert me that:FollowComment

Answer: 0This might be due to an account level issue.Please reach out to the AWS Billing and Accounts team via support console as only they can provide you more details with regard to this.CommentShareSUPPORT ENGINEERHarshavardhan_Ganswered 2 months ago


Question: Feature request: show full MySQL statements in Performance Insights

"Currently, I've noticed there is no real option to view full MySQL statements in Performance Insights.Download option gives file with the same truncated statement even though the UI shows "To view the full SQL statement, choose Download."(It also shows "If the SQL statement exceeds 4096 characters, it is truncated" - and in principal only 1024 characters are being shown)I also enlarged digest max_digest_length / performance_schema_max_digest_length / performance_schema_max_sql_text_length to 50K but alas.The only workaround is to query performance_schema directly with the SQL Digest ID shown in Performance Insights.FollowComment"

Answer:
"1As pointed by you correctly, there is no option to view full MySQL statement i.e more than 1024 characters in Performance Insights.Also, we cannot change the max_digest_length to a greater value, as it is not modifiable in Aurora MySQL. So, it is set to 1024 by default.To confirm this behaviour, I ran a quick test in my lab environment and cannot find the parameter, also I tried to modify the parameter using the set command as follows and you can see that this parameter looks to be a read only parameter and can’t be modifiedmysql> show variables like 'max_digest_length';+-------------------+-------+| Variable_name     | Value |+-------------------+-------+| max_digest_length | 1024  |+-------------------+-------+1 row in set (0.07 sec)mysql> set max_digest_length = 2048;ERROR 1238 (HY000): Variable 'max_digest_length' is a read only variableI will also like to confirm your understanding regarding these parameters, that once the MySQL engine collects the digest it is forwarded to performance schema, and it makes a copy of the digest value, using the performance_schema_max_digest_length.For more details you can refer this link:
[+] https://dev.mysql.com/doc/refman/5.7/en/performance-schema-system-variables.html#sysvar_performance_schema_max_digest_lengthFor example: With max_digest_length=1024, if you set  performance_schema_max_digest_length value to larger value say 2048 the digest you get will still be 1024 size only, as max_digest_length is 1024.Therefore, statement above 1024 bytes will be truncated when logging it into performance schema, and hence, will be shown truncated in Performance Insights.Consequently, if performance_schema_max_digest_length is less than max_digest_length, digest values stored in the Performance Schema are truncated relative to the original digest values.Furthermore, I would like to highlight one of the reasons why it not modifiable is because increasing this value over the default causes high memory consumption specially for workloads that involve large numbers of simultaneous sessions.Also, this is a known issue and the AWS RDS / Aurora Engineering team is actively working to fix this issue. And whenever this feature is released, it will be notified on one of the following public channels:[+] AWS Forums: https://forums.aws.amazon.com/forum.jspa?forumID=60[+] RDS Release Notes - https://aws.amazon.com/releasenotes/Amazon-RDS[+] RDS/DMS What's New - https://aws.amazon.com/new/CommentShareSUPPORT ENGINEERKrishna_Banswered 10 months ago0I'm using RDS for MySQL (but I assume Aurora for MySQL is no different) and I was able to change those max length parameters on a global level only in the DB param group (change requires a restart).And as I wrote, I was able to get the full query from performance_schema (events_statements_* tables, SQL_TEXT column), so I expect Performance Insights to be able to as well and to allow me to access it conveniently through its UI.CommentShareYoni Sadeanswered 10 months ago0I completely understand your expectations, and as explained above the max length parameters present in parameter group helps engine to create copy of the digest value forwarded to performance_schema, and the MySQL statements shown in Performance Insight are truncated based on the parameter max_digest_length which is set to it’s default value i.e 1024.And as pointed by you correctly for now till this feature request is implemented, as a workaround you can directly query the performance_scherma to get the full MySQL statements with the help of SQL Digest ID shown in Performance Insights.I would like to mention that this is a known feature request and our internal team is working to fix this, but for now there is no visibility on ETA that when this feature will be released.Also, I would ilke to inform you that the Internal Team and the development teams take time to integrate new functionalities and fix bugs when it comes to a service as vast as Aurora / RDS. It requires thorough testing and checks before being implemented.CommentShareSUPPORT ENGINEERKrishna_Banswered 10 months ago"


Question: AWS Activate - registration email

"I just finished the Startup School course and am eligible for AWS credits. I am trying to apply for those credits via AWS Activate. One of the fills in the application process is my email. That fills says that my company email is preferred. However when I completed the Startup School course, I used my personal email. I believe AWS will check my email with Startup School.I wonder what email I should use in my application to AWS Activate? Thanks in advanceFollowComment"

Answer: "0For clarity on this query, please reach out to our Activate support team directly via this contact form: https://aws.amazon.com/activate/contact-us/.— Rafeeq C.CommentShareEXPERTAWS Support - Rafeeqanswered a year ago"


Question: AWS IoT Core takes too long to update the connectivity information of a device

I'm using a lambda function to process the lifecycle events   : $aws/events/presence/disconnected/clientId .  I noticed there is BIG delay on IoT service updating the status of the device that triggered the event.When running:aws iot search-index --index-name "AWS_Things" --query-string "thingName:thingA"  --region us-east-1 the response returns connected : true up to 120 seconds after the disconnection event is fired. This delay is unacceptable in some scenarios. Is there a way to improve that update time? Will it be fixed in the future?Thank you.FollowComment

Answer: "1I would use AWS IoT fleet Indexing to investigate, and troubleshoot your fleet of devices, for example to get stats on how many disconnected devices you have in your device fleet. Here a 1-2 minute delay before Fleet Indexing updates the index is less relevant. If you need to act quickly on a disconnect event, you should consume the Lifecycle Event in your own backend, for example in a Lambda function. A second options to get notified when device disconnect is the MQTT Will Flag (LWT)CommentShareEXPERTJan_Banswered a year agopguartes-end a year agoHi Jan_B, thanks for the answer. On my case, I already have the setup with lambda and SQS. I want to check if the device is still disconnected 30 seconds after the lifecycle event, in that case, send a push notification to the user associated with that device. The thing is that if the fleet index has a delay of 2 minutes, it will return "connected:true" when I do the check after 30 seconds, but I really don't know the state of the device, it could be disconnected and the index does not know yet. That is why the delay is relevant to me, I can only send the notification 150 seconds after the disconnection event. I don't want to send the notification right away because it could be a device reset and I don't need a push notification in that case. Could the will flag be used instead of the fleet index for that purpouse?ShareGavin_A a year agoBased on the need to detect a a frequency less than 150 seconds, fleet indexing on connectivity isn't viable (it is a great tool for large fleets of devices in less granular timeframes). In your case, I'd look to process lifecycle event for both device CONNECT and DISCONNECT events, process via SQS/Lambda, and track the deviceId, lastState, and the event's timestamp in a persistent datastore such as DynamoDB. Then poll in a similar manner to fleet indexing and SELECT devices disconnected > 30 seconds.Sharepguartes-end a year agoThanks @Gavin_A ! That's actually a very good idea, going to give it a try!Share0A similar question is posted today; you can check my response as well; https://repost.aws/questions/QU8mQ_u5lCQeGeveBev5d1vA/sensing-the-disconnection-of-a-device-more-than-t-secondsYou can take advantage of SQS queues with delay configuration to perform your action in a Lambda function In summary, if you setup a IoT topic rule to send message to an SQS queue and set the queue's delay=30 seconds, the lambda function will be invoked after 30 seconds of the event. You can use Thing shadow to store last timestamp of online/offline event. Then you can perform the action in a lambda function that triggered by the SQS queue, after checking last online/offline value from the thing shadow.CommentShareEmir_Aanswered a year ago0The time taken to for a Disconnect event to show up is impacted by the Keep Alive time set for the MQTT connection. If the Keep Alive is set to 60 seconds as an example, and the connection is lost un-gracefully (like a power loss to the device or cable disconnected) - it can take up as much as 60 seconds (since a check for connected status is deferred till the time Keep Alive runs out for the connection) for the message to show up on the MQTT topic - $aws/events/presence/disconnected/clientId . Try reducing the keep alive for faster disconnect notifications.CommentShareAshuanswered 6 months ago"


Question: Cognito Custom authentication flow - getting user input mid-flow

"I am creating a custom authentication flow using AWS Cognito to send a MFA code via email through the cognito triggers. I am using the authenticateUser() method to do so and my code snippet is as code below, following this example:However, instead of a prompt asking the user for the OTP, is it possible to perform a setState operation when I get into the customChallenge callback that would render a UI component (textbox), get the MFA input from the user via a textbox, and then submit that info using sendCustomChallengeAnswer() without needing to exit the authenticateUser block?Thank you very muchEdit: Someone with a similar problem here: https://stackoverflow.com/questions/72783068/aws-cognito-custom-challenge-frontend-implementation-inside-vuexFollowComment"

Answer: "0Hello,I understand that you have created a custom authentication flow using AWS Cognito authenticateUser() method to send a MFA code via email through the cognito triggers. Further, you would like to perform a setState operation, where you can get to customChallenge callback to get the MFA input from the end user via a textbox, and then submit the MFA code using sendCustomChallengeAnswer() without exiting the authenticateUser block.From the query and the shared code snippet it seems that you are using "amazon-cognito-identity-js" SDK. This SDK  uses a concept called "callback" in JavaScript to handle the Async APIs like authenticateUser, however, this SDK does not support the advance concept called Async/Await in JS, due to which we cannot use this library to make a call and then get result. Then perform something else and then finally continue with the process to process MFA(which you want, where using MFA UI user can put it, then proceed ahead with processing the MFA).I would also like to add here that, the above solution has been a popular ask. More information on the same can be found in the below shared link:https://github.com/amazon-archives/amazon-cognito-identity-js/issues/88However, as this functionality is not supported directly by the "amazon-cognito-identity-js" SDK, hence, in order to implement this using this SDK you would have to write a lot of boilerplate code over the available SDK APIs to mimic the behavior.Moving ahead, the functionality required by you has been implemented using AWS Amplify library. It has added a lot of code on top of the existing functionality to provide all the features which you require. Furthermore, the possible options for you here would be to use the AWS Amplify library or write custom logic/code over the existing SDK functionalities to mimic the required behavior. Please refer the below shared links, to get more information on the AWS Amplify library implementation:https://aws.amazon.com/blogs/mobile/extending-amazon-cognito-with-email-otp-for-2fa-using-amazon-ses/https://docs.amplify.aws/lib/auth/mfa/q/platform/js/#advanced-use-casesCommentShareSUPPORT ENGINEERrePost-User-3034217answered 10 months ago"


Question: Is the actual Kendra confidence score available in the API response.

"The QueryResultItem includes a ScoreAttributes of VERY_HIGH, HIGH, MEDIUM and LOW.Is the actual confidence result available, or an indication of the threshold of these values?FollowComment"

Answer: "0Accepted AnswerScore Attribute is a relative ranking that indicates how confident Amazon Kendra is that the response matches the query. Thus, it is not an absolute figure.Confidence scores allows you to see the estimated accuracy of a search result. Amazon Kendra assigns confidence scores into four main categories: Very High, High, Medium, and Low for various document results (e.g. Factoid Answer, FAQ). With confidence scores, developers can better distinguish between returned results and set thresholds for when results should be displayed. By combining confidence scores with Amazon Kendra’s ability to intelligently search unstructured data using natural language, you can return more accurate answers and create a search experience that more closely resembles asking a human expert.References:https://aws.amazon.com/about-aws/whats-new/2020/09/amazon-kendra-launches-confidence-scores/CommentShareSUPPORT ENGINEERVarun_Sanswered a year agoAWS-User-7139660 a year agoThank you Varun_S.Share"


Question: How do I check the clock recipe that an awsxclbin was built with?

"Forgive the novice question. I am using the latest Vitis with the latest aws-fpga setup on the FPGA developer AMI v1.8.1. I compile my designs with Vitis (using a modified version of the hello_world Makefile in the Vitis examples). I did not add anything to specify a clock frequency target.My understanding is that there are two clock recipes, one at 125 MHz and the other at 250 MHz. Is this correct and is there a way to check which recipe was used for a given awsxclbin after compilation?FollowComment"

Answer: "1Hi Bhagath,The create_vitis_afi.sh script is provided to facilitate the AFI generation. If you refer to it: https://github.com/aws/aws-fpga/blob/master/Vitis/tools/create_vitis_afi.sh#L212-L214, you can see how Vitis names the clocks and connect them to the clocks provided by the shell.Please note Vitis kernel can select from either the DATA_CLK (default) or the KERNEL_CLK clock. The selection can be done using the "kernel_frequency" option during the v++ link stage. See here for more details:https://www.xilinx.com/html_docs/xilinx2020_2/vitis_doc/vitiscommandcompiler.html#qcm1528577331870__section_frk_xtr_t3bThe reason you saw different clock frequency than the ones listed in the clock recipe is because of frequency scaling. Vitis will tune down the clock frequency if the target frequency cannot be achieved with the given kernel design. For more details, please refer to https://www.xilinx.com/support/documentation/sw_manuals/xilinx2021_1/ug1393-vitis-application-acceleration.pdfBy default, these are the frequencies of the clocks provided in the F1 platform:SYSTEM = clock_main_a0=250DATA_CLK = clock_extra_b0=250KERNEL_CLK = clock_extra_c0=500I hope this helps.Thanks,ChenCommentShareAWS-zhczanswered 2 years agoriddlesingh a year agoThanks, Chen. This helps.Share0Hi,Once you run the create_vitis_afi.sh script, the manifest file is created, which contains the clock freq that vitis used to meet timing.ThanksKrisCommentShareAWS-kristopkanswered 3 years ago0Hi,When I look at the manifest file, it has 3 different frequencies listed. Can you give some more details about what they are used for?clock_main_a0=250clock_extra_b0=233clock_extra_c0=500ThanksBhagathCommentShareriddlesinghanswered 2 years ago0Hi Bhagath,It's that shell provides extra flexibility by feeding multiple frequencies to the customer design in case part of a design requires multiple clocks, for example, for performance or timing closure reasons. Please refer to the link below for details:https://github.com/aws/aws-fpga/blob/4750aacb4dac9d464b099b27e4337220cf0b0713/hdk/docs/AWS_Shell_Interface_Specification.md#clocksThanks,ChenCommentShareAWS-zhczanswered 2 years ago0Hi Chen,Thanks for the reply.But I am still not sure about where exactly in my logic is the clock_extra_c0 is being used. It says the KERNEL Frequency is 500 MHz in the Vitis analyzer when I open up the run summary file which gets generated after running an inference. Does it mean that the Kernel is executed at 500 MHz?Even though I see that clock_extra_c0=500 in the manifest file, There is no option for 500 MHz in the Clock Group C given in the documentation. How is this possible?Also, I noticed that the "clock_extra_b0=233 MHz" in the manifest file that got generated. However, there is no option of 233 MHz for clocks listed in the clock_recipies.csv file given in the documentation.ThanksBhagathCommentShareriddlesinghanswered 2 years ago0Hi Bhagath,Sorry for the slow response on this post. I want to let you know that we're still working with Xilinx in order to provide the details you're asking. We will keep you posted as soon as we hear back from Xilinx.Thanks,ChenCommentShareAWS-zhczanswered 2 years ago"


Question: S3 permissions for MediaTailor

"I am trying to setup permissions for an S3 bucket so that a particular "folder"[1] can be accessed by the MediaTailor service.I need to allow MediaTailor to be able to read all objects in the "videos" folder.I am using root account for my experiments.The objects inside "videos" have only 1 permission set - full access to owner (root account).S3 bucket has "block public access settings" turned on.I prefer not having per-object permissions since I might have thousands of objects (to be scalable to millions).Based on my understanding, if I add the following to S3 bucket policy, it should be enough to allow MediaTailor to read objects inside "videos" folder.{    "Version": "2008-10-17",    "Id": "PolicyForMediaTailor",    "Statement": [        {            "Sid": "1",            "Effect": "Allow",            "Principal": {                "Service": "mediatailor.amazonaws.com"            },            "Action": "s3:*",            "Resource": "arn:aws:s3:::mybucket/videos/*"        }    ]}However, when I try to access an object inside videos folder via MediaTailor, it results in http 403 (forbidden) error.Does anyone know what I am doing wrong?Thanks![1] I am aware that there are no "folders" in S3.FollowComment"

Answer: "0Never mind. As per MediaTailor documentation, it needs the video source to be "accessible on the public internet and have a public IP address". Looks like having a bucket policy or other kind of security is pointless.CommentShareoyenamitanswered 3 years ago"


Question: How do I successfully complete the aws list-users command promt?

"I am doing a training for AWS, and I am at the part where I begin to use the command prompt. When I enter the command aws list-users, I get an error message and then a really long list of names of services and help commands.Can someone help me?FollowComment"

Answer: 1The AWS CLI command is : aws iam list-usersReference: https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.htmlCommentShareronald_lanswered 4 months ago