Question: Are get request with body allowed in AWS? 403 error

"Hi,I published an API to AWS with Visual Studio, for now I am testing the methods with postman, but all get methods that require a body are returning an error that mentions cloudfront in the response, I do not know if the issue is related to cloudfront or if  is the AWS HTTP 1.1  specification implementation that does not allow get requests with body:Note:Get request with body were a requirement from our clientthis is the error:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">                  <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">          <TITLE>ERROR: The request could not be satisfied</TITLE>
403 ERROR

The request could not be satisfied.

  Bad request.

  Generated by cloudfront (CloudFront)
          <ADDRESS></ADDRESS>          RFC 7231 HTTP/1.1 specification says the following:A payload within a GET request message has no defined semantics;sending a payload body on a GET request might cause some existingimplementations to reject the request.so my questions are:are get request with body allowed in AWS?how AWS deals with get request with body?is there a way to use get methods with body on AWS?Many ThanksFollowComment"

Answer: "0CloudFront rejects a get request with body.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#RequestCustom-get-bodyAs noted in the RFC, this behavior might be different based on the implementations. With this reason, although RFC does not prohibit to use GET request with body, generally it is not encouraged to use it.CommentShareAWS-User-3921561answered 4 years ago0Thanks for your answer @jwaataws, and I just have some doubts. I was researching that there are several types of API Gateway: Edge Optimized, Regional API Gateways and Private API Gateways. the regional API Gateway does not come with an implementation of cloudfront, so my questions are:what would happen if I use regional API gateway without cloudfront?would that allow me to make get Request with body?or is it possible to have API Gateway without cloudfront configured and in that way allow get requests with body?Many ThanksEdited by: egzx73 on May 7, 2019 1:27 PMCommentShareEnriqueOGanswered 4 years ago"


Question: Does lambda memory allocation impact network bandwidth?

"Even though the CPU and Memory is < 30% utilization at 1024mb, it appears that changing the lambda to 2048mb doubles the network throughput. My runtime is single threaded node.js so it shouldn't particularly be impacted by the additional vCPU. I can't find specific details about network scaling, it's just vaguely hinted at:https://docs.aws.amazon.com/lambda/latest/operatorguide/computing-power.htmlAdding more memory proportionally increases the amount of CPU, increasing the overall computational power available. If a function is CPU-, network- or memory-bound, then changing the memory setting can dramatically improve its performance.Is there something more concrete to refer to?FollowComment"

Answer: "3Accepted AnswerYes, the network performance will increase with memory. There are no specifics as there is no definitive performance since Lambda compute is abstracted from you and it is also protocol and application specific. You should benchmark your function with various memory sized to determine where you meet your requirements.CommentShareRodney Lesteranswered 7 months agoEXPERTTushar_Jreviewed 7 months agoEXPERTBrettski-AWSreviewed 7 months agoKit - CostCenter 7 months agoWhat's surprising to me is that at 1GB memory I'm seeing 1mb/s, at 2GB I see 2mb/s, but after that it makes no meaningful difference switching it to 10GB. This seems really low, and there's no indication on what ranges AWS lambda operates in so I can't tell if this is within expected levels or not. Same code on my own machine hitting the same target gets 7mb/s down.Share0If your lambda is interacting with resources inside your VPC or with AWS services, you should VPC enable your lambda function if you haven't done so already - https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.htmlAlso make use of interface VPC endpoints for AWS services. That way the traffic goes over the AWS network and not the internet - https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 7 months agoKit - CostCenter 7 months agoThat's not an answer to anything I wrote, I was asking about network resources being affected by memory configuration like vCPU, nothing relating to VPC configuration.Share0All Lambda functions get the same type of network interface with the same bandwidth. However, the more memory you give your function, the more CPU it gets, which allows it to actually drive the network bandwidth, up to the limit that the network interface supports. This is why you will see an increase in bandwidth only until some point.CommentShareEXPERTUrianswered 7 months ago"


Question: Failed email messages Logs from Cognito

"I want to know it there any service provided by AWS Cognito related to accessing the log from failed email messages from Cognito, the ones we get requesting us for a change password after we get a user created for that emailFollowComment"

Answer: "0Access logging is not supported for the default email option in Cognito. Troubleshooting email issues in Cognito depends on which email option you have chosen, see https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html. For the default option, Amazon Cognito limits the number of emails it sends each day for your user pool. For information on service limits, see Quotas in Amazon Cognito.. For Amazon SES, see troubleshooting Amazon SES SMTP issues.CommentShareAWS-Everettanswered 3 months ago"


Question: DyanamoDB connection issue - aws-sdk for NodeJs - Inside Docker

"DDB connection is succeeded and 'listTables' API works (although with a huge delay)but when I try to fetch anything with DocumentClient using the NodeJs's 'aws-sdk', I'm seeing this error:{"message": "CRC32 integrity check failed","code": "CRC32CheckFailed","retryable": true,"time": "2022-02-02T19:53:18.508Z","statusCode": 200}note: this is occurring only when the app is running from within the docker whereas outside the docker it is working fine.Solutions Tried:As per the solution given here, tried adding '{dynamoDbCrc32: false}' like this:var AWS = require("aws-sdk");AWS.config.update({    dynamoDbCrc32: false});var dynamodb = new AWS.DynamoDB({dynamoDbCrc32: false});const dynamodbClient = new AWS.DynamoDB.DocumentClient({dynamoDbCrc32: false});but still, I'm facing the above issue.note: I'm using the latest version:"aws-sdk": "^2.1067.0"any inputs would be helpful!Solution:after I deleted and recreated the docker containers, the issue was resolved, probably adding this flag ‘{dynamoDbCrc32: false}’ worksFollowComment"

Answer: "0Accepted Answerafter I deleted and recreated the docker containers, the issue was resolved, probably adding this flag ‘{dynamoDbCrc32: false}’ works.but the execution is very slow when compared to the localhost, any inputs on that would be helpful as wellCommentShareSaruanswered a year ago0Which version of the SDK are you using? Can you first ensure you update to the latest version?CommentShareEXPERTLeeroy Hannigananswered a year agoSaru a year agohi, thanks for the reply.I'm using the latest version:"aws-sdk": "^2.1067.0"Share"


Question: Listing bucket content from instance

"Hi,I'm trying to use my S3 bucket from an instance. The command wget works  and transfers files from S3 to the EC2 instance. However, aws s3 commands produce error messages such as:aws s3 ls s3://mybucket1Could not connect to the endpoint URL: "https://s3.us-west2.amazonaws.com/mybucket1?list-type=2&prefix=&delimiter=%2F&encoding-type=url"Ports 80 and 44 are open.Thanks.FollowComment"

Answer: 0Hi. My issue is now fixed. Not sure why because all what I did was to download the CLI for my PC and play with it. Somehow that must have either update or do something because the instances can now connect/list/copy to the S3 buckets.CommentShareafodyanswered 2 years ago


Question: Upgrade to Apache 2.4.48

"Hi,Our Elastic Beanstalk is running on Apache 2.4.46. The recent release is Apache 2.4.48 which fixed several critical vulnterabilities, as described in the recent Amazon Linux 2 Security Advisory,https://alas.aws.amazon.com/AL2/ALAS-2021-1674.htmlDoes anyone know when the latest update of Elastic Beanstalk with Apache 2.4.48 will be released?Is there anyway where I can upgrade the Apache manually? How do I run "yum update httpd" on Elastic Beanstalk?Thanks in advanced!FollowComment"

Answer: 0Just found out the latest release for Elastic Beanstalk Amazon Linux 2 platform.CommentShareBulleyesanswered 2 years ago


Question: [Amazon](500310) Invalid operation error

"Hi Team,We are fetching the data from redshift db using JDBC way in java.The query used for getting the data from tables is select * from table_name limit 200;Below are the errors occurred for different tables. .I am able to see the data in resultset .But while getting next record of particular row it throwing the below errors. Could you please help us to understand the error  and resolution for it.ERROR1:[Amazon](500310) Invalid operation: Invalid input syntax for type numericDetails:error:  Invalid input syntax for type numericcode:      8001context:   value: ""query:     88634410location:  cg_util.cpp:604process:   query19_773_88634410 [pid=79398]-----------------------------------------------;at com.amazon.redshift.client.messages.inbound.ErrorResponse.toErrorException(Unknown Source)    at com.amazon.redshift.client.PGMessagingContext.handleErrorResponse(Unknown Source)      at com.amazon.redshift.client.PGMessagingContext.handleMessage(Unknown Source)      at com.amazon.jdbc.communications.InboundMessagesPipeline.getNextMessageOfClass(Unknown Source)      at com.amazon.redshift.dataengine.PGResultSet.hasMoreRows(Unknown Source)      at com.amazon.jdbc.common.SForwardResultSet.updateCursorPosition(Unknown Source)  ERROR2:For other table[Amazon](500310) Invalid operation: Divide by zero;at com.amazon.redshift.client.messages.inbound.ErrorResponse.toErrorException(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.handleErrorResponse(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.handleMessage(Unknown Source)at com.amazon.jdbc.communications.InboundMessagesPipeline.getNextMessageOfClass(Unknown Source)at com.amazon.redshift.dataengine.PGResultSet.hasMoreRows(Unknown Source)at com.amazon.jdbc.common.SForwardResultSet.updateCursorPosition(Unknown Source)at com.amazon.jdbc.common.SForwardResultSet.next(Unknown Source)ERROR3:java.sql.SQLException: [Amazon](500310) Invalid operation: operator does not exist: text ||;at com.amazon.redshift.client.messages.inbound.ErrorResponse.toErrorException(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.handleErrorResponse(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.handleMessage(Unknown Source)at com.amazon.jdbc.communications.InboundMessagesPipeline.getNextMessageOfClass(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.doMoveToNextClass(Unknown Source)at com.amazon.redshift.client.PGMessagingContext.getParameterDescription(Unknown Source)at com.amazon.redshift.client.PGClient.prepareStatement(Unknown Source)at com.amazon.redshift.dataengine.PGQueryExecutor.<init>(Unknown Source)at com.amazon.redshift.dataengine.PGDataEngine.prepare(Unknown Source)at com.amazon.jdbc.common.SPreparedStatement.<init>(Unknown Source)at com.amazon.jdbc.jdbc41.S41PreparedStatement.<init>(Unknown Source)at com.amazon.jdbc.jdbc42.S42PreparedStatement.<init>(Unknown Source)at com.amazon.redshift.core.jdbc42.PGJDBC42PreparedStatement.<init>(Unknown Source)at com.amazon.redshift.core.jdbc42.PGJDBC42ObjectFactory.createPreparedStatement(Unknown Source)at com.amazon.jdbc.common.SConnection.prepareStatement(Unknown Source)at com.amazon.jdbc.common.SConnection.prepareStatement(Unknown Source)Please share your thoughts on thisThanks,Padma YeddulaFollowComment"

Answer: "0Are you still having this issue? If so, please provide a minimal code example or script that we can use to reproduce the problem.You can send me a direct message with this if needed.CommentShareAWS-User-2965899answered 3 years ago"


Question: Uncaught exception in ZMQStream callback -- trying to run Jupyter notebook with Julia kernel in SageMaker

"I want to run a Jupyter notebook with Julia kernel in Amazon SageMaker. The Julia 1.7.1 icon shows up in the Jupyterlab launcher and accepts the kernel on launch, but then the kernel dies immediately after launch (it never works). I have posted about this herehttps://www.repost.aws/questions/QU2PXu3tbpQ7-V2OTlD_I07Q/make-julia-notebooks-work-in-sage-makerand Alex_T has made some very good suggestions, but even they get stumped at this point. Log info:[E 00:25:58.760 NotebookApp] Uncaught exception in ZMQStream callback    Traceback (most recent call last):      File "/home/ec2-user/anaconda3/envs/JupyterSystemEnv/lib/python3.7/site-packages/zmq/eventloop/zmqstream.py", line 431, in _run_callback        callback(*args, **kwargs)      File "/home/ec2-user/anaconda3/envs/JupyterSystemEnv/lib/python3.7/site-packages/notebook/services/kernels/kernelmanager.py", line 391, in record_activity        msg = session.deserialize(fed_msg_list)      File "/home/ec2-user/anaconda3/envs/JupyterSystemEnv/lib/python3.7/site-packages/jupyter_client/session.py", line 929, in deserialize        raise ValueError("Invalid Signature: %r" % signature)    ValueError: Invalid Signature: b'ec1d1093f3b6505658469b860c203f696bc39cf8fcea1672cb55802fc57592eef57b8db0b5cb603d1bcada6f41060f0819f6002a7a31f309fbaa1a701cc13f5b'There are some posts from 2018 recommending updating tornado and ipykernel, but 4 years later this should hardly apply (and I tried it, and it didn't work). Any suggestions? What could be going wrong here? Everything else seems to be in place. There is a white paper on running a Jupyter notebook with Julia kernel in SageMaker here [https://d1.awsstatic.com/whitepapers/julia-on-sagemaker.pdf?did=wp_card&trk=wp_card], but it is incomplete, as you can see in the other post.FollowComment"

Answer: "1Thanks for raising this again!So as mentioned on the other question, I tentatively believe this to be caused by this open IJulia issue... And there I see one participant commented they managed to resolve the issue by not installing Julia inside conda.Happy to share I seem to have been able to reproduce this success with the following steps... :DInstead of creating a conda env and installing Julia through it as advised by the whitepaper (which would of course be a good practice for proper environment separation, if it weren't for this issue), wget the generic Linux x86 64-bit (glibc) tarball from the Julia downloads page https://julialang.org/downloads/ (for example, https://julialang-s3.julialang.org/bin/linux/x64/1.7/julia-1.7.2-linux-x86_64.tar.gz)(Because uname -a shows us that our NBI is running in x86 64-bit Linux, and a couple of hacky checking methods I found online seemed to suggest it's a glibc setup rather than musl)Don't forget to cd SageMaker in terminal before your wget, so the file actually downloads to somewhere you can see it in JupyterLab(Verify the checksum of the downloaded file first, as good security practice and then) Untar the bundle with tar -xvf {YourFileName.tar.gz}. You should see a folder something like julia-1.7.2 containing (amongst other things) a bin subfolder with a julia executable in it.Make julia executable visible in your system PATHThere are many different ways you might want to set this up, depending what you want on persistent EBS storage vs ephemeral, whether you want to use multiple versions of julia in parallel, and whether you have preferences about where in the filesystem the application should reside.For this particular test I chose to cp -R ./julia-1.7.2 /usr/local/julia (copy Julia to a folder where I wouldn't accidentally edit it) and then sudo ln -s /usr/local/julia/bin/julia /bin/julia (create a julia symlink to the main executable inside the /bin folder, which is already on PATH).Start julia from your terminal (julia) and then install & configure IJulia as per the original instructions:using PkgPkg.add("IJulia")using IJuliajupyterlab(detached=true)# I got an error on this last command but it still seemed to work?Verify that you should now have a julia entry in your Jupyter kernels folder. I copied out the contents into my JupyterLab working folder to inspect it: cp -R ~/.local/share/jupyter/kernels/julia-1.7 ./julia-1.7-copy. It should contain a kernel.json.If all is well (and it was for me) you should now see a "Julia 1.7.2" (or similar version) kernel on your launcher and be able to launch a notebook successfully and run commands (🎉)What about productionization?So of course this installation is a bit of a hacky workaround for whatever underlying issue is causing Julia to not run properly inside conda... I'd really prefer to see a direct resolution for that problem if possible. The procedure described here won't persist between Notebook Instance stop/starts (at which time everything outside of /home/ec2-user/SageMaker EBS mount is reset), so you'd probably want to explore automating the setup with a lifecycle configuration script.I see by default that Julia packages (including IJulia) are installed to /home/ec2-user/.julia/packages/ (which is outside the SageMaker mount), so may be interesting to explore configuration options for moving .julia under the SageMaker folder for persistence. Files and folders beginning with a dot are hidden in JupyterLab file tree, which is worth remembering if you explore customizing the setup.CommentShareEXPERTAlex_Tanswered a year agovodoaldus a year agoYou are a hero, Alex_T! It worked perfectly for me, and I didn't even get an error runningjupyterlab(detached=true)Thank you!Share"


Question: Windows Instances launched using RegisterImage API are showing PlatformDetails as "Linux/UNIX" and are not booting - when the EBS volume snapshots are created using StartSnapshot() API

"Steps to reproduce:Create a Windows Instance with a single EBS volume (aka root volume)Take a snapshot of the root volume (Snap-1)Create a new EBS snapshot (Snap-2) using StartSnapshot API with the Snap-1 as parent snapshot.On Snap-2, issue CompleteSnapshot API with 0 changed blocks.Create an AMI using RegisterImage API with Snap-2 as the root volume and same block device mapping as the original instance.Any instance created using the AMI has "Linux/UNIX" in Platform Details and does not boot.It was observed that this issue occurs only if the EBS snapshot used is created using StartSnapshot API. For example, if Snap-1 was used in the RegisterImage call, any instance created using the AMI is showing platform as "windows" and is booting up properly.Question:Is there any way to create a Windows AMI (that creates bootable windows instances) using EBS snapshots created via StartSnapshot API or is there any workaround for this ?FollowComment"

Answer: "0A Windows AMI must be created from an Amazon EC2 instance. Creation of a Windows AMI from an EBS snapshot is currently not supported as it might cause issues with billing, performance, and general operation.CommentShareAWS-User-2910020answered 9 months agoKameron_B a day agoSource for the above - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html#process-creating-a-windows-ami-ebsShare"


Question: put an array of object into dynamoDB

"Hi all,I have a problem to insert an array using the DynamoDb's standard library.I have an API which receives this JSON:{    "name": "Mar/19",    "month": "3",    "year": "2019",    "credit": [        {            "name": "Income salary",            "value": "6500"        }           ],    "debit": [        {            "name": "Rent",            "value": "2500"        }           ]}And my backend runs on AWS and needs to put these informations on a dynamoDB table. The Lambda function look like:const AWS = require('aws-sdk'); const dynamodb = new AWS.DynamoDB({region: 'sa-east-1', apiVersion: '2012-08-10'}); exports.handler = (event, context, callback) => {const params = {    Item: {        "id": {            S: ""+Math.random()        },        "name": {            S: event.name        },        "month": {            N: event.month        },        "year": {            N: event.year        },               },    TableName: "billing-circle"};dynamodb.putItem(params, function(err, data){    if(err) {        console.log(err);        callback(err);    } else {        console.log(data);        callback(null, data);    }});The API has a Mapping template declared on Integration Request and looks like this:#set($inputRoot = $input.path('$')){  "name" : "$inputRoot.name",  "month" : "$inputRoot.month",  "year" : "$inputRoot.year",  "credit" : [        #foreach($elem in $inputRoot.credit)        {            "name" : "$elem.name",            "value" : "$elem.value"        }         #if($foreach.hasNext),#end    #end    ],    "debit" : [        #foreach($elemDebit in $inputRoot.debit)        {            "name" : "$elemDebit.name",            "value" : "$elemDebit.value",            "status" : "$elemDebit.status"        }         #if($foreach.hasNext),#end    #end    ]}I'm trying to call the API from Postman but I got this error:{    "errorType": "ValidationException",    "errorMessage": "Supplied AttributeValue is empty, must contain exactly one of the supported datatypes",    "trace": [        "ValidationException: Supplied AttributeValue is empty, must contain exactly one of the supported datatypes",        "    at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:51:27)",        "    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)",        "    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)",        "    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)",        "    at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",        "    at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",        "    at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",        "    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",        "    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)",        "    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)"    ]}Can anybody help me with this?FollowComment"

Answer: "0Hi Afonso,Thanks for reaching to us on the AWS Forum. I have shared your question with our developer support team and will follow up shortly with more info.CommentShareAWS-User-6425534answered 3 years ago"


Question: Assign Role For Administrative and Usage Permission KMS

"I want to enable Kubernetes secret encryption. In order to do that, I need to create KMS key first.When creating KMS key, there's page to choose what roles that will be assigned to administrative and usage permission.My question is, what roles should I choose for Administrative and Usage permission ?My assumption is this :AdministrativeRole that will manage KMS (update key policy, add/remove tags, enable/disable automatic rotate KMS key, create/delete alias, enable/disable key, delete key)Role that will setup kubernetes secret encryption.UsageRole that will manage KMS (update key policy, add/remove tags, enable/disable automatic rotate KMS key, create/delete alias, enable/disable key, delete key)Role that will setup kubernetes secret encryption.EKS role serviceAre those assignment correct ?FollowComment"

Answer: "0When creating a KMS key for encrypting Kubernetes secrets, the roles assigned to the administrative and usage permissions determine who is allowed to perform certain actions on the key.For the administrative permissions, you should choose the role that will be responsible for managing the key, such as creating, modifying, or deleting it. This role should typically be assigned to a user or group within your organisation that has the necessary privileges for managing KMS keys.For the usage permissions, you should choose the role that will be used to perform the encryption and decryption operations on the key. In the case of Kubernetes secrets, this role should be assigned to the worker nodes that run the containers in your cluster. You can do this by granting the necessary permissions to the worker node IAM role.Ref:https://archive.eksworkshop.com/beginner/191_secretshttps://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depthhttps://aws.github.io/aws-eks-best-practices/security/docs/data/CommentShareEXPERTcloudgeek7answered 4 months ago"


Question: KMS key last rotated timestamp

How to I get the KMS key last rotated time stamp using CLIFollowComment

Answer: "0Accepted AnswerI didn't think you could check the rotated timestamps in the AWS CLI.I thought I could get it with "get-key-rotation-status", but the documentation does not provide timestamp information.https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/get-key-rotation-status.htmlHow about checking CloudTrail events instead?The "RotateKey" event is recorded in CloudTrail, so you can check the time of execution from here.https://docs.aws.amazon.com/kms/latest/developerguide/ct-rotatekey.htmlWith AWS CLI, it would look like this.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-cli.html#look-up-events-by-attributesaws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKeyCommentShareEXPERTRiku_Kobayashianswered 5 days agorePost-User-6073944 4 days agoThe cloudtrail command was the right direction, but the command you provided as an example gets all RotateKey events. What should I do if I want to get it for a particular key?ShareRiku_Kobayashi EXPERT3 days agoIf the ARN of the KMS key is known, it can be narrowed down by adding "--lookup-attributes" as follows.In the following command, replace "arn:aws:kms:region:AWS Account ID:key/Key ID" with the ARN of your KMS key.aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RotateKey AttributeKey=ResourceName,AttributeValue=arn:aws:kms:region:AWS Account ID:key/Key IDShare"


Question: Unable to fetch list of snapshots associated with a single AMI using Boto3 SDK EC2.Client.describe_images

"AWS Boto3 SDK EC2.Client.describe_images returns 'BlockDeviceMappings' as a key of the list of dictionaries 'Images'. 'BlockDeviceMappings' is a list of dictionaries whose one of the keys is 'SnapshotId'. The issue is 'SnapshotId' returns a single string, instead of a list of strings, which should ideally be the case, since one AMI may have multiple snapshots associated with it. Any idea, how to get the list of all the snapshots associated with a single AMI?FollowComment"

Answer: "0The snapshot ID displayed in "BlockDeviceMappings" is the snapshot ID used to create the AMI.In other words, a single AMI cannot have multiple snapshot IDs associated with it.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-2916646 a month agoEach AMI has a block device mapping that specifies the block devices to attach to an instance when it is launched from the AMI. For an EBS-backed AMI, we can add EBS volumes and instance store volumes using a block device mapping. I am looking to fetch the list of EBS volumes based on snapshots that can be added to an AMI. Is there a way to fetch the same.Share"


Question: Greengrass v2 fleet provisioning retry in case of lack of the Internet connection.

"Hi.I have created a Greengrass fleet deployment workflow for my devices which works great - cloud resources are provisioned, claim certs are used to obtain device individual certs, and device gets connected.However in production environment the scenario will be different:An IoT device is installed by an engineer in a newly built home, with no occupiers and no internet connection.The Greengrass is ready to claim device certs and connect as soon as the device is powered up.The device then is powered up by the installing engineer, meaning the Greengrass fleet provisioning plugin will try to do its job, but there is no internet connection, so it will fail.The engineer will leave the device on, and it will be permanently on since now on.The occupiers will move in some time later and install their broadband router, the Internet is now available.At this point, from my tests, I noticed the Greengrass/provisioning plugin won't detect Internet connection and won't try to register the device/obtain certs - meaning there is no retry functionality implemented.I understand that the device can be rebooted or Greengrass service restarted to initialize new registration attempt, however - if possible I'd like to avoid occupiers fiddling with the device, and prefer the device to the retry automatically.I also understand that I can write a software that will be automatically cyclically restarting the Greengrass service if the previous registration attempt failed (probably by checking if the thingCert.crt is present) but before I'll spend my time on coding, the question is:Is it possible to configure Greengrass to retry delayed provisioning using claim certificates if previous attempt has failed?Appreciate any help.FollowCommentMichaelDombrowski-AWS EXPERTa year agoHi K676, can you please provide the exact error which is being logged? The error cause should be MqttException and I'd like to know the precise error message included with that exception.Share"

Answer: "1Accepted AnswerHello,Unfortunately, we do not support configurable provisioning retry, which is a gap in our current set up and we will address in future. In the meantime, I would recommend you go ahead with your workaround.CommentSharejunfucAWSanswered a year ago"


Question: Is it possible to connect to Azure AD from AWS Directory Service - AD Connector

"The documentation mentions about connecting to On-Premise AD, is it possible to connect AWS Directory Services - AD Connector with Azure AD? If we can, then the Windows server in the EC2 instances can be joined to the specific domain in Azure AD?Thanks,RajanFollowComment"

Answer: "0Yes, while the documentation primarily mentions connecting AWS Directory Services - AD Connector to an On-Premise AD, it is indeed possible to establish a connection between AWS Directory Services - AD Connector and Azure AD. Once a connection is established, it is feasible for Windows servers on EC2 instances to join a specific domain within Azure AD.CommentShareMauliksinhanswered 2 months agoalatech EXPERT2 months agoWould be nice to reference an official guide or tutorialShareShriram a month agodo you know how exactly? i am installing one application on AWS env and it has LDAP feature can use this method to connect my Azure AD with LDAP to this Application?ShareShriram a month agodo you know how exactly? i am installing one application on AWS env and it has LDAP feature can use this method to connect my Azure AD with LDAP to this Application?Share"


Question: Backups on S3 storage not completing / taking too long

"We have several individual web servers backing up to S3 storage (individual buckets)One of the smaller servers has 100 websites and backs up fully and quickly without any issues.The other larger servers with roughly 300 plus websites each, backing up to separate buckets - these backups seem to take very long (many days) and still show incomplete - showing only half the amount of sites backed up.What can be the issue - is it a timeout issue on our server or AWS setting or AWS plan to small or other ?FollowComment"

Answer: "0I would start with checking the transfer config, here are the docs for the CLI and boto3 (python). There will be similar docs for other SDKs as well.https://docs.aws.amazon.com/cli/latest/topic/s3-config.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3.htmlBut also make sure you are using multipart uploads on bigger files.Hope it helps!CommentShareCarl Ostrandanswered 8 months ago0Did you check your upload speed on each server?  If the one(s) taking a long time have slower upload speeds or another process is using the bandwidth, then that could be your problem.CommentSharejschwar313answered 8 months ago"


Question: CDK:  custom endpoints for Aurora cluster?

"Does CDK support the creation and management of custom endpoints in Aurora/RDS?It's simple enough to (for example) group readers together, by region, under specialized endpoints using awscli or SDK calls, but the only mention I see in CDK seems to be a read-only representation of an existing endpoint.If the answer is "no, CDK doesn't support this," then what's the guidance in this type of scenario, generally speaking?  When CFN/Terraform support features that are, at least for now, not present in CDK, should I try to handle this resource outside the IAC framework (e.g. by using SDK calls after a stack has finished executing)?Incidentally, CDK feels (even more) nascent when there isn't a tag for me to assign to this question.  :|FollowComment"

Answer: "0Unfortunately, The answer is "no. RDS does not support it. "You can not costomize endpoints for RDS(include aorora)  in CFN, terraform ...https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.htmlCommentShareShawnanswered a year ago0You can use custom resources (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources.html) to provide functionality which is not provided via Cloudformation/CDK at the moment.https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_core.CustomResource.htmlCommentShareMarcoanswered a year ago"


Question: Large number of unaccounted for SQS requests

"Hi, I just started experimenting with SQS a couple days ago - subscribing a queue to an SNS topic that receives notifications from SES, and I can't understand the enormous amount of SQS requests that I see in my billing dashboard.For example, when I send an email through SES, two notifications get sent to the SQS queue ( via the SNS topic ) - a "send", and a "delviery" notification. I have set up a lambda trigger on the receiving queue, that simply sends the message to another queue and deletes it from the original one.I would expect to see a handful of SQS requests per sent email, however it looks like each email accounts for about a thousand SQS requests in the billing dashboard. In my latest experiment, a single email resulted in exactly 2 messages in the queue, and when I checked the billing dashboard a few hours later, the "Current usage" of SQS requests had jumped from 49878 to 54809. Overall these 54000+  requests have resulted from fewer than 50 SES emails (~100 notification messages) over the last couple days.At the same time all my CloudWatch metrics for SQS do show the low numbers that I expect to see.What could possibly be making all these requests?Any pointers on resolving this mistery will be much appreciated.Edited by: rebor691 on Sep 26, 2019 7:22 PMFollowComment"

Answer: "0Accepted Answer(moving to AWS Lambda forum)According to the feature announcement, calls to SQS made by the Lambda SQS poller will be billed to your account by SQS.https://aws.amazon.com/blogs/aws/aws-lambda-adds-amazon-simple-queue-service-to-supported-event-sources/CommentShareKubaanswered 4 years ago0Hi,It sounds like you are possibly seeing a higher than expected bill with SQS because you are using the default "Short Polling" instead of "Long Polling". If you have a single thread that is polling a single queue, you will definitely want to set the timeout to 20s (long polling), so that you are NOT making continuous requests to the SQS queue to see if there is data available. The default, 'Short polling' would ONLY make sense, if you have a single thread that has to poll multiple queues (thus, checking each queue for data quickly rather than spending 20s waiting for a message to arrive on a queue before moving on to check on the next queue for a message).https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-short-and-long-polling.html#sqs-long-pollingLong polling offers the following benefits:- Eliminate empty responses by allowing Amazon SQS to wait until a message is available in a queue before sending a response. Unless the connection times out, the response to the ReceiveMessage request contains at least one of the available messages, up to the maximum number of messages specified in the ReceiveMessage action.- Eliminate false empty responses by querying all—rather than a subset of—Amazon SQS servers.- Return messages as soon as they become available.This link has directions on how to setup Long Pollinghttps://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/working-with-messages.html#setting-up-long-polling{code}Hope this helps,-randyCommentShareRandyTakeshitaanswered 4 years ago0Kuba@AWS wrote:According to the feature announcement, calls to SQS made by the Lambda SQS poller will be billed to your account by SQS.https://aws.amazon.com/blogs/aws/aws-lambda-adds-amazon-simple-queue-service-to-supported-event-sources/From the linked blog post: "... the Lambda service will begin polling the SQS queue using five parallel long-polling connections."Didn't realize a lambda trigger meant continuously long-polling the queue using at least five threads.All is accounted for now: 5 connections, 20 sec per long poll => 900 req / hour => ~54k in ~60 hours.Thanks a lot.CommentSharerebor691answered 4 years ago"


Question: QuickSight: data label of Scatter plot

"I did "Show data labels" on a scatter plot, then values of Y-axis are shown. Is it possible to change the showing data to values of "Size"?FollowComment"


Question: Sagemaker training for multiclass classification run does not store the trained model

"Hi,I have trained a multiclass classification model using auto-ml.UsedTraining image: sagemaker-xgboost:1.3-1-cpu-pyInstance type: ml.m5.12xlargeThe run succeeded to complete 2 cross validation folds before the time limit was reached.The resulting best model was not stored in the specified s3 location. The job is configured to store the model on termination.In parallel I have trained other classifications with the same auto-ml template (jupyter NB) successfully, so I don't think it is a configuration or permission issue.The main difference for this classification training is the higher number of labels, which is 1950. The allowed label limit for this algorithm is 2000.I also repeated the run for this model candidate 2 times with the same result: that the model was not stored.CloudWatch has no entries regarding problems to create or store the model.Thanks,ArthurFollowComment"

Answer: "0Accepted AnswerI solved the problem on my own:reduced the number of folds to reduce the time the algorithm needs to finish.  ( set hyperparameter _kfold: 2 )Another possibility would be to increase the time the algorithm is allowed to run to let the algorithm finish.After giving the algorithm enough time to finish, it completed and also stored the model in s3.So the problem was to store the model on termination: I suppose the default time of 120 seconds was not enough.CommentSharearthuranswered a year ago"


Question: Unable to access clipboard on S7 device.

"We are unable to access the clipboard when running auto on an Android S7 device and get the following message in logcat: "ClipboardService: Denying clipboard access to io.appium.uiautomator2.server, application is not in focus nor is it a system service for user 0"However, we are able to access the clipboard on the following AWS devices:S4 (Android 8.1)S6 (Android 9)and the following local devices not on AWS:S5e tablet (Android 11)S9 (Android 10)Android 11 emulator imageThis issue seems to be specific to AWS's S7 device. Below is an excerpt from logcat.10-06 16:31:07.958  8131  8412 I appium  : channel read: POST /wd/hub/session/8e1fdceb-781a-4d2c-bcd8-8cc9edff0fef/appium/device/get_clipboard10-06 16:31:07.958  8131  8412 I appium  : Get Clipboard command10-06 16:31:07.962  1136  2189 E ClipboardService: Denying clipboard access to io.appium.uiautomator2.server, application is not in focus nor is it a system service for user 010-06 16:31:07.963  8131  8412 I appium  : AppiumResponse: {"sessionId":"8e1fdceb-781a-4d2c-bcd8-8cc9edff0fef","value":""}FollowComment"

Answer: "0Hello,Please provide the run URLs for both scenarios:You were able to access the clipboardYou were not able to access the clipboardEdited by: JunHao-aws on Nov 18, 2021 3:03 PMCommentShareAWS-User-8182950answered 2 years ago0This was resolved after updating the Appium version to 1.18 and Node.js to LTS.CommentShareMatthewSanswered a year ago"


Question: Lambda Destinations

"HI AllI am trying to trigger a lambda(B) from an existing lambda(A) when A executes successfully. For this I created a Destination for A and set it to B, with OnSuccess.here is the code for Lambda A,  they are both in Pyhton 3.8import json#import pandasdef lambda_handler(event, context):    # TODO implement    print("Test")    return{                'statsuCode': 200,        'body': json.dumps('Hello From Lambda')    }    Lambda Bimport jsondef lambda_handler(event, context):    # TODO implement    print(event)    print("Dummy 2")    return {        'statusCode': 200,        'body': json.dumps('Hello1 from Lambda!')    }For some reason when I execute Lambda A successfully, Lambda B does not get triggered.Is there something I am missing?RegardsTanmayFollowComment"

Answer: "2Accepted AnswerDestinations will trigger only on async invocation. The TEST button on the console invokes the function synchronously. You'll need to test via the aws cli to see it in action.Here's a command to test itaws lambda invoke --function-name lambdaA --cli-binary-format raw-in-base64-out --invocation-type Event --payload '{"my": "event"}' result.jsonThis is also detailed on the blogThe other option is async invocation using Amazon S3, Amazon SNS, Amazon EventBridge etc.CommentSharePronoy_Canswered a year agoEXPERTUrireviewed a year agoRodney Lester a year agoFrom the vague use case description, Event Bridge or Step Functions would appear to meet his needs.Share1You should invoke lambda(A) asynchronously.e.g. Trigger lambda(A) by EventBridge event.https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.htmlRegards.CommentSharekabikanswered a year ago"


Question: Grouping of partitioned dataframes

"I have a large dataset (table) with >1e9 records (rows) in Glue. The tables are partitioned by column A, which is a n-letters subtring of column B. For example:A (partition key)B...abcabc123......abcabc123......abcabc456......abcabc456......abcabc456......abcabc789......abcabc789...............xyzxyz123......xyzxyz123......xyzxyz123......xyzxyz456......xyzxyz456......xyzxyz456......xyzxyz789......xyzxyz789......There are >1e6 possible different values of column B and correspondingly significantly less for column A (maybe 1e3). Now I need to group records/rows by column B and the assumption is that it could be advantageous if the table was partitioned by column A, as it would be sufficient to load dataframes from single partitions for grouping instead of running the operation on the entire table. (Partitioning by column B would lead to unreasonably large numbers partitions.) Is my assumption right? How would I tell my Glue job the link between column A and B and profit from the partitioning?Alternatively I could handle the 1e3 dataframes (one for each partition) separately in my Glue job and merge them lateron. But this looks a bit complicated to me.This question is a follow-up question to https://repost.aws/questions/QUwxdl4EwTQcKBuL8MKCU0EQ/are-partitions-advantageous-for-groupby-operations-in-glue-jobs.FollowComment"

Answer: "0Hello,Partitioning by column A could be advantageous in your use case and then groupBy column B in order to limit the number of partitions. You can create a dynamic frame and refer to partitions in it with predicate pushdown. Do you want to create multiple dynamic frames for multiple partitions and then combine them using join operator ? If you have any sample code you are using on a sample dataset, please share it with us on a support case and we can assist you by getting on a screen-share.CommentShareSUPPORT ENGINEERVishali_Nanswered a year ago"


Question: How to solve COMPONENT_BROKEN: FAILED_ROLLBACK_NOT_REQUESTED?

"I have followed Deploying a web app to an AWS IoT Greengrass Core device - Part 1 to develop a react app to the AWS IoT Greengrass. After I try to deploy it, a COMPONENT_BROKEN problem is involved.This is the screenshot of the problem, can anyone give me some suggestions to solve this problem? Thank you very much!FollowCommentMassimilianoAWS EXPERT5 months agoPlease report the issue that caused the failure in the execution of the component so that we can improve the article with additional instructions if needed.Share"

Answer: "0This error tells you that your component is failing with a non-zero exit code. This means that you must debug the failure on your end. Review your component's log file to see why it failed. Review the troubleshooting which is linked from the error in the console: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting-deployment.html#:~:text=caused%20the%20error.-,COMPONENT_BROKEN,-You%20might%20getCommentShareEXPERTMichaelDombrowski-AWSanswered 5 months ago"


Question: onchange function of JavaScript calling in lambda function

"Lambda function is using JavaScriptWe want a drop down button which list of requestsWhen ever we select a request in from the drop down it should update in the query before running the queryAfter finishing the query execution it should not reset the service name drop downexports.handler =  function myFunction(event,context) {var x = document.getElementById("mySelect").value;selectService=x}
            Select Service	<select id="mySelect"  name="selectService" onchange="myFunction()">            <option selected="${selectService==="END"?"selected":""}" value="END">END</option>             <option selected="${selectService==="START"?"selected":""}" value="START">START</option>            </select>
FollowComment"

Answer: "0The question is not clear. Can you share an architecture diagram of what exactly are you trying to do with the lambda function and also please provide some details around what is the issue you are facing with the lambda function?CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agorePost-User-2738569 9 months agoHi @IndranilI am trying to create a custom widget for log queries in cloudwatch which uses a lambda function. We are creating a dropdown in the lamda to select the service to filter the logs.We are able to get the values in dropdown. But whenever we select the service from the dropdown it is not updating in the actual query. For this we have created a onchange function but the function is not getting invoked when select the service from the dropdownShareIndranil Banerjee AWS EXPERT9 months agoThanks for the clarification. Does your lambda function return Javascript? If that is the case, then As per the documentation https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/add_custom_widget_dashboard_security.html , "For security reasons, JavaScript is not allowed in the returned HTML."There are however other means to have interactivity in the custom widget, as mentioned here - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/add_custom_widget_dashboard_interactivity.html.Share"


Question: Lambda concurrency metrics not showing in cloud-watch

"Currently, we run several lambda functions in AWS. We have recently deployed a new function that is web-facing. This function needs to serve a high volume of end users thus requiring the use of provisioned concurrency. I have configured provisioned concurrency however can not see the following metrics.ProvisionedConcurrentExecutionsProvisionedConcurrencyUtilizationUnreservedConcurrentExecutionsProvisionedConcurrencyInvocationsProvisionedConcurrencySpilloverInvocationsI can confirm I have provisioned concurrency enabled and can see concurrent invocations via the ConcurrentExecutions metric.FollowComment"

Answer: 0Provisioned Concurrency works on specific function alias. Are you actually invoking the specific alias? Or are you invoking Latest? You should point your API to the specific alias.CommentShareEXPERTUrianswered 4 months agouser-4564135734 4 months agoSo we are currently using a function URL. Then assigning provisioned concurrency to a function version. This should use our latest published version. I belive $LATEST should call the latest function version for example 10 or 20 or 30.Share


Question: Can you use AWS Snowball for local data transfers without importing the data to Amazon S3?

"We're looking at using AWS Snowball to transfer data from one physical location to another, but we don't want to import the data into Amazon S3. Is that possible?FollowComment"

Answer: "0Accepted AnswerYes, provided you're not crossing international borders, you can set up the job as a local compute and storage only job and use an AWS Snowball Edge device to move the data from one location to another. No data will be imported to Amazon S3.Note: When using an AWS Snowball Edge device for a local compute and storage job, it's a best practice to remove the data from the device before returning it to AWS. The device will also be erased following National Institute of Standards and Technology (NIST) 800-88 standards when it is returned to AWS.CommentShareMODERATORAWS-User-2697939answered 2 years ago"


Question: Effect Of Service Control Policy on Delegated Administrator Account

"Hi Everyone,I would like to know about the Effect of Service Control Policies created in AWS Master Account's organization.I have enabled Amazon GuardDuty in the Master account and added one of our member accounts as "Delegated Administrator Account" to manage GuardDuty Findings from all the member accounts.The question is what would happen to the Delegated Administrator Account (for GuardDuty) when I create and apply a Service control policy in the AWS master account's organizations?Since SCP's will take effect on all the member accounts of the master account, "Delegated Administrator Account (for GuardDuty)" is also a member account of the AWS master account.Will access get denied when making modifying the GuardDuty configuration from the Delegated admin account (for GuardDuty) as well?Ref Link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_guardduty.htmlThanks,Swapnil PawarFollowComment"

Answer: "1Accepted AnswerIf you want to exclude a specified account, you can use condition like below. Account number in this condition should be the delegated admin account number."Condition": {"StringNotEquals": {"aws:PrincipalAccount": ["0123456789012"]}}ThanksCommentShareEunsu_Shinanswered a year ago1Hi!  Good question.  Service Control Policies will apply to member accounts, but will not affect users or roles in the management account.  With your "Delegated Admin," that will count as a member account.  If the policy is attached to the "root", this will be inherited by all the member accounts.For more about SCP inheritance, check out this AWS Guide: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_auth.htmlIf you are using a deny structure, keep in mind that explicit denies will override any explicit allows.  Thus, if you have an explicit deny on GuardDuty, that will get inherited, it could block the ability of your delegated admin account to administer GuardDuty.A couple options:Conditions - You can use conditions to exclude the account to be able to manage GuardDuty.  This can be done with aws:PrincipalAccount  Principal and NotPrincipal are not supported in SCPs.Re-structure the Organization so that the delegated admin account is not affected by the broad Deny/SCP.  This could be useful if you plan on using the delegated admin account for other purposes or solely as a management or security account.Using an allowlist structure for IAM.  By using an Allowlist, you can have more granularity on child accounts/OUs.  However, this would require not having an Allow * * at the root level.  This may require a restructuring of your SCPs as well.CommentSharejsoncanswered a year agoSwwapnil a year agoThank you, jsonc for your detailed information. Appreciate it. :)Share0If you attach the SCP to all account including the Delegated Admin Account, the Delegated Admin Account will access get denied when making a change on GuardDuty because you explicitly deny the action in the policy. Delegating administrator account for GuardDuty does NOT mean that the delegated admin account will have permission of "*" action in GuardDuty regardless of SCP but just mean that the delegated admin account can collect GuardDuty findings from member account and propagate configuration to member accounts. In order for the delegated admin account to manage GuardDuty configuration in your organization, you must exclude the delegated admin account.ThanksEunsuCommentShareEunsu_Shinanswered a year ago0That's correct, Eunsu. I understand that I have to exclude that "Delegated Admin Account" when creating SCP from AWS master account in AWS organizations. I have checked the AWS documentation but I didn't find any global condition context key to add it to the condition in SCP policy in order to exclude that account.Here is the doc link:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgidLet me know If you have any idea.CommentShareSwwapnilanswered a year ago0SCPs are effective against Member Accounts (AWS Accounts) within an AWS Org, and not the Administrative/Root AWS Account (previously referred to as the 'Master Account'). So with this in-mind, if you have a flat AWS Org structure (no drill-down levels of OUs), then applying an SCP at the Root-level of the AWS Org will mean that the restrictive statements of the SCP will be applied to your AWS GuardDuty delegated admin account.Now, how to get around this? You could go down the route of adding in Condition blocks within your SCP, but you're missing out on a perfect opportunity to organise your AWS Org structure, and to really get the most out of your SCPs. You should look into crafting an OU structure within AWS Organizations which enables you to apply your SCPs to Member accounts, but not have any detrimental effect on more 'sensitive' accounts, such as the delegate admin account for AWS GuardDuty within your AWS Org.If you're looking for examples of OU structure, there's always that of the AWS Landing Zone solution, here.CommentShareCiaran Carragheranswered a year ago"


Question: EC2 Instance Restore: "You are not authorized to perform this operation"

"Hi There,We currently backup multiple Linux and Windows EC2 instances to the default vault using the Daily-35day-Retention templateSo far all backups have been successful.Our problem is with restores.  When attempting to restore an instance we receive the error "You are not authorized to perform this operation. Please consult the permissions associated with your AWS Backup role(s), and refer to the AWS Backup documentation for more details."On the restore job we are using the Default role and leaving all IAM roles, security groups, subnets and VPC identical to the original Instance.I can see from the IAM dashboard that the AWSBackupDefaultServiceRole role has both the AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForRestores permission policies assigned and sporting the same permissions as stated in the documentation.All the permissions seem to be correct, and we are not using any custom role for this so I am confused on where this is failing.FollowComment"

Answer: "2Accepted AnswerIf the instance has a role attached then the role doing the restore also needs rights to IAMPassRole.Here are the detailshttps://aws.amazon.com/premiumsupport/knowledge-center/aws-backup-encoded-authorization-failure/Or just add the following to the role that is doing the restore.{      "Version": "2012-10-17",      "Statement": \[          {              "Action": "iam:PassRole",              "Resource": "arn:aws:iam::111122223333:role/*",              "Effect": "Allow"          }      ]  }  I hope this helps someone.CommentShareScottJonesanswered 2 years ago0I have the same issue, yay. I've an instance profile connected to the instance I'm trying to restore, thought that may be the issue so added a new policy to that role to no avail.CommentShareBigAlanswered 2 years ago0Sorry to hear you have the same issue.I'm currently working around it by simply having a new role for restores.In IAM I created a new role and assigned it the same permissions as the default account and for some reason that works.IAM -> Create Role -> AWS Backup (use case) -> "AWSBackupServiceRolePolicyForBackup" and "AWSBackupServiceRolePolicyForRestores"When doing an instance restore I then select this new role at the "Restore role" partCommentShareLiamMcanswered 2 years ago0Yes (sorry, very late response from me) but I used used a PassRole policy and attached it to the default AWSBackup role and it got around the problem for me. cheers folks.CommentShareBigAlanswered 2 years ago0Thank you for the inline policy to add, this solved the issue.My previous workaround using a new Role with just AWSBackupServiceRolePolicyForBackup and  AWSBackupServiceRolePolicyForRestores policies did work, but only for my Windows Instances, not the Linux ones.For anyone new to AWS like I was:Go to IAMSelect RolesSelect AWSBackupDefaultServiceRole (or a custom role if you made one earlier)Select Add Inline PolicyOn the JSON tab replace the contents with the code in the ScottJones post above excluding the ''' linesSave and name the policy, it will now be listed in the policies list for the RoleCommentShareLiamMcanswered 2 years ago0if you are using and SCPs that enforce tagging on EC2, you will need to disable that when doing restore.  The decrypted message (thanks https://aws.amazon.com/premiumsupport/knowledge-center/aws-backup-encoded-authorization-failure/)  showed it was failing on tags that were missing.  Perhaps you can do via User Data but I just temp detached the SCP from OU, ran restore than re-attached it...CommentSharemcburn13answered 2 years ago"


Question: asp.net core web api Lambda Triggered by SQS

"For .net core console lambda function, there is a way to trigger it when message sent. but is there any ways to trigger asp.net core web api (for lambda function) when aws sqs send to a message to channelFollowComment"

Answer: 0Accepted AnswerSQS Messages are processed can be used in one of 2 ways.A running process that is Polling the Queue for messagesA Lambda that is triggered when there are messages to process.If you want to all an API call when a message arrives.   You likely need a small lambda that will call the Web API directly converting the SQS message in the queue to the format you need for the API call.There is an awesome free course provided by AWS on .NET Lambdas that really covers all the details.  It's the one with Lambda's on this page:https://aws.amazon.com/developer/language/net/badges-and-training/CommentShareRobert Loveanswered 24 days agoChao 22 days agoThanks! you solved my confused!Share


Question: OpenTelemetry with Elastic Beanstalk

"Hi allI'd like to set up AWS Open Distro for OpenTelemetry for Java with Elasic Beanstalk (https://aws-otel.github.io/docs/getting-started/java-sdk/trace-auto-instr). I've added the Java agent (using java -javaagent:path/to/aws-opentelemetry-agent.jar -jar myapp.jar). Starting the application, it logs a line like this every 15 seconds:[otel.javaagent 2022-06-08 19:21:03:940 +0000] [OkHttp http://localhost:4317/...] ERROR io.opentelemetry.exporter.internal.grpc.OkHttpGrpcExporter - Failed to export spans. The request could not be executed. Full error message: Failed to connect to localhost/127.0.0.1:4317So I guess the ADOT Collector (https://aws-otel.github.io/docs/getting-started/collector) isn't running.When I log into my instances (platform: Corretto 11 running on 64bit Amazon Linux 2/3.2.15), I can see the CloudWatch Agent under /opt/aws/amazon-cloudwatch-agent (version: 1.247350.0). It includes the Collector under /opt/aws/amazon-cloudwatch-agent/cwagent-otel-collector:$ pwd/opt/aws/amazon-cloudwatch-agent$ lsLICENSE  NOTICE  RELEASE_NOTES  THIRD-PARTY-LICENSES  bin  cwagent-otel-collector  doc  etc  logs  var$ ls cwagent-otel-collector/etc  logs  var$ ls binCWAGENT_VERSION          amazon-cloudwatch-agent-config-wizard  config-downloader  cwagent-otel-collectoramazon-cloudwatch-agent  amazon-cloudwatch-agent-ctl            config-translator  start-amazon-cloudwatch-agentI try to start the OTel Collector using sudo bin/amazon-cloudwatch-agent-ctl -a start -m ec2 -o default. It doesn't start, though. Here's the process status:$ sudo bin/amazon-cloudwatch-agent-ctl -a status{  "status": "running",  "starttime": "2022-06-09T07:12:30+0000",  "configstatus": "configured",  "cwoc_status": "stopped",  "cwoc_starttime": "",  "cwoc_configstatus": "configured",  "version": "1.247350.0"}And the log:$ tail cwagent-otel-collector/logs/cwagent-otel-collector.log2022/06/09 07:09:20 E! User aoc does not exist: no matching entries in passwd file2022/06/09 07:09:20 E! Failed to ChangeUser: no matching entries in passwd file2022/06/09 07:09:20 no matching entries in passwd fileHas anyone gotten the OTel Collector working with Elastic Beanstalk? In tips for how to configure this?-martinFollowComment"

Answer: 0Accepted AnswerI filed an issue on the Amazon Cloudwatch Agent repo on GitHub: https://github.com/aws/amazon-cloudwatch-agent/issues/483Seems the problem is fixed with the latest release of the agent.CommentShareMartin Sollianswered a year agoGurpreet Singh SUPPORT ENGINEERa year agoI see that the team had replied back to you on the github issue and when you manually installed the latest version it worked. I will suggest you to use ebextensions [1] to install the latest version of the agent so that you don't have to manually install the latest version on every instance.Reference :[1] Advanced environment customization with configuration files (<code>.ebextensions</code>) - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.htmlShare


Question: Return a custom header from lambda authorizer in API-gateway (HTTP api)

"I'm using an API-Gateway HTTP-api (not REST!) with a custom lambda authorizer. However I'd like to be able to customize the HTTP headers returned on authentication failure.This seems possible with the REST-api (https://repost.aws/questions/QUgItZ7VFcS1iQ5wKGeU4YqA/is-it-possible-to-throw-custom-error-message-from-api-gateway-lambda-authorizer), but can't get this working with the HTTP-api.Is this somehow possible?FollowComment"

Answer: "0Short answer is no, for now. I've tried too but the response integration is not even processed when the authorizer rejects with 403.CommentShareabanswered 4 months ago"


Question: Step Function error handling

"I have a state that updates DynamoDB by shifting the first word off a list of words. It returns UPDATED_OLD so that the word can be grabbed in the ResultSelector block as index 0 and passed on to the next step. If there are words in the list this works fine, but if the list is empty, there is nothing at index 0 and Step Functions throws a States.Runtime error and the execution fails. I added a Catch block but it isn't catching as expected. Can this error be caught? Thank you.FollowComment"

Answer: "0Use a Choice state to check for existence of array[0]. Something like this:{  "StartAt": "CheckArrayEmpty",  "States": {    "CheckArrayEmpty": {      "Type": "Choice",      "Choices": [        {          "Variable": "$.array[0]",          "IsPresent": true,          "Next": "NotEmpty"        }      ],      "Default": "Empty"    },    "NotEmpty": {      "Type": "Pass",      "End": true    },    "Empty": {      "Type": "Pass",      "End": true    }  }}CommentShareEXPERTUrianswered a year agojamessouth a year agoThank you for replying Uri. I came up with a work-around outside of this step function but I would still like to know about catching the error. Is this a bug in the service?Share"


Question: AWS server port 25 blocked after few hours of server creation

I am running a EC2 large.t3 instance with CentOs.My server Region is Ohio.I have installed WHM and it is working fine.When I created a server PORT 25 working fine. But after few hours port 25 gets blocked. Due to this I'm not ablw to send any email from my webmails.Here is the snippet..Just after server setup:[root@ip-172-31-43-92 ~]# telnetaspmx.l.google.com  25Trying 172.217.214.26...Connected to aspmx.l.google.com .Escape character is '^]'.220 mx.google.com  ESMTPn18si6406443jao.103 - gsmtpquit221 2.0.0 closing connectionn18si6406443jao.103 - gsmtpConnection closed by foreign host.[root@ip-172-31-43-92 ~]#`After few hours and restart:[root@ip-172-31-43-92 home]# telnetaspmx.l.google.com  25Trying 172.217.212.26...FollowComment

Answer: "0Accepted AnswerAmazon EC2 throttles traffic on port 25 of all EC2 instances by default, but you can request for this throttle to be removed.This may help you from the AWS website:Remove The Port 25 Throttle From Your EC2 InstanceCommentShareharshmanvaranswered 4 years ago"


Question: Verifying domain _amazonses. "Pending SES domain ownership verification"

"I am using Amazon DNS from my LightSail setup to host my DNS, I tried to configure my domain name for WorkMail today and I was able to quickly validate all the DNS changes with the exception of the TXT record for _amazonses.(domain).com, is the only one still pending.Do I really have to wait up to 72 hours to make sure the validation goes through and finally setup my mailbox? Could be a possible error on the Amazon or my side an that's why I am not able to validate this TXT record?. Everything seems setup as need it.FollowComment"

Answer: 0Apparently it just took more time than expected to validate this TXT record.All the DNS changes are validated now.CommentShareSosadinhoanswered 4 years ago


Question: Use instance (NVMe) storage in SageMaker Studio notebooks

"I'm exploring and pre-processing some raw data in SageMaker Studio which is split across many (20k+++) small files, and running into slow speed because SMStudio's main user storage is backed by EFS rather than an EBS volume as used on SageMaker Notebook Instances (NBIs). Navigating and manipulating this dataset is slower in Studio because of the extra metadata introduced by the communication being at filesystem level, rather than just a block storage device.I know there's a little ephemeral block storage available to notebooks under /tmp which can help with these issues (as used here, in fact), but thought it would be more scalable to make use of the proper NVMe instance storage available with ml.m5d.* instances in Studio to work with bigger datasets.Only trouble is, I'm not sure how to use these instance storage volume(s) from notebooks? When I run !df -aTh, the NVMe device only seems to be mounted on some very specific points as shown below:Filesystem        Type      Size  Used Avail Use% Mounted on[...]127.0.0.1:/200015 nfs4      8.0E   57G  8.0E   1% /root/dev/nvme0n1p1    xfs       124G   14G  111G  11% /opt/.sagemakerinternal/dev/nvme0n1p1    xfs       124G   14G  111G  11% /etc/resolv.conf/dev/nvme0n1p1    xfs       124G   14G  111G  11% /etc/hostname/dev/nvme0n1p1    xfs       124G   14G  111G  11% /etc/hosts/dev/nvme0n1p1    xfs       124G   14G  111G  11% /var/log/studio/dev/nvme0n1p1    xfs       124G   14G  111G  11% /var/log/apps/dev/nvme0n1p1    xfs       124G   14G  111G  11% /opt/ml/metadata/resource-metadata.json[...]Should I be creating a new mount somehow to access the storage? Any particular best-practices to follow?FollowComment"


Question: Eventbridge to Slack API Destination

"I have setup a Slack API Destination in Eventbridge. I've test the api destination with custom pattern using simple message, it works. But when I add additional rule to use AWS Pre-defined event pattern for Elastic Beanstalk resource status change, the notification never arrived in the slack channel.I updated the rule with below configuration as instructed in documentation. But still not workingInclude a header parameter that defines the content type as “application/json;charset=utf-8”.Use an input transformer to map the input event to the expected output for the Slack API, namely ensure that the payload sent to the Slack API has “channel” and “text” key/value pairs.FollowComment"

Answer: "0Hi, Good question!A couple of follow-ups.Have you checked that there are actual resource status changes?  What filters are you using for Status and Severity?  This is to validate that there are valid events that should be sending notifications.  For more information: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.eventbridge.htmlHave you validated that the OAuth Token is setup: https://api.slack.com/authentication/oauth-v2It looks like you've seen this page, but https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-api-destination-partners.html has links to Slack documentation for help as well.CommentSharejsoncanswered a year agoAWS-User-3610377 a year agoI finally figured out why. It is not the OAuth token. It is in the header parameter I need to put content-type: application/json;charset=utf-8Share"


Question: Send Data from local .Net application to AWS MSK?

I know I can send data from different VPCs but Is there any chance that could send data from local machine to AWS MSK?  Is there any tutorial that I can learn from it?FollowComment

Answer: 1Accepted AnswerHi.You can enable public access to the cluster after creating the MSK cluster.Then you can connect to the MSK broker node from the client application via the public internet without connecting the local and VPC using a VPN.You must meet some conditions to activate.Public subnetSecure authentication and encryption are introducedSee below for details.https://docs.aws.amazon.com/msk/latest/developerguide/public-access.htmlCommentShareEXPERTiwasaanswered a year ago


Question: Unable to find ARN of customer profile

"Hi,I am trying to create a new case using connect cases against a customer profile through connect-cases-sdk from a Lambda function. For the same, It is expecting profile ARN against whom I want to register case as one of the params but ARNs of customer profile is not specified anywhere with in the customer profiles console.  I tried building ARN using the standard syntax but receiving following error.I referred several connect documents but they haven't mentioned where I can find the ARN of the customer profile. Kindly help me with this. Thanks in advance!"errorType":"ValidationException","errorMessage":"The provided customer_id value 'arn:aws:connect:us-east-1:2XXXXXXX79:instance/4XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXb1/customer-profile/bXXXXXXXXXXXXXX' is not valid. Failed to extract domainName or profile ID from 'arn:aws:connect:us-east-1:2XXXXXXX79:instance/4XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXb1/customer-profile/bXXXXXXXXXXXXXX'."```FollowComment"

Answer: "0the ARN for a customer profile is constructed like this:customer_id - You must provide the full customer profile ARN in this format:arn:aws:profile:your AWS Region:your AWS account ID:domains/profiles domain name/profiles/profile IDhttps://docs.aws.amazon.com/cases/latest/APIReference/API_CreateCase.htmlhere is an example from my instance that I got working using cli:aws connectcases create-case --domain-id 12345678-abcd-1234-abcd-b58746ddc44a --fields id=title,value={stringValue=title=test01052023} id=customer_id,value={stringValue=arn:aws:profile:us-east-1:123456789086:domains/choi3/profiles/123456789012345678901234567890c5} --template-id 12345678-853c-abcd-866b-d1ae84cf1973To get the profile id, you use:  search profiles APIhttps://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_SearchProfiles.htmlCommentShareClarenceChoianswered 6 days ago"


Question: WorkDocs Drive does not Show the Thumbnails on Windows

"It is very important that I can see the thumbnails on Windows to facilitate my work. It is much easier to find and pick a file that I need to work on, especially for the image edition.Please, is there a way to activate that?Thanks.FollowComment"


Question: "API call from lambda function to AWS.SSM.putParameter() returns success, but leaves SSM.parameters unchanged"

"Hello all,AWS and node.js noob here. I am trying to save a code captured from URL parameters to my parameters store in the System Manager service, and later return a hashed value from various strings. My code returns the hash and I don't have any errors in the console, but when I test it with URL/?code=1234&challenge_code=5678, nothing changes in my parameter store. I already have an object named ebayUserCode in there of type string.exports.handler = async (event) => {    const crypto = require('crypto');    const AWS = require('aws-sdk')    let verificationToken = "FIXME";    let endpoint = "FIXME";    let code = "code";    let challengeCode = "challenge_code";        if (event.queryStringParameters && event.queryStringParameters.code) {        console.log("Received name: " + event.queryStringParameters.code);        code = event.queryStringParameters.code;        var ssm = new AWS.SSM();        var params = {            Name: 'ebayUserCode', /* required */            Value: code, /* required */            Overwrite: true            };        ssm.putParameter(params, function(err, data) {            if (err) console.log(err, err.stack); // an error occurred            else     console.log(data);           // successful response        });    }    if (event.queryStringParameters && event.queryStringParameters.challengeCode) {        console.log("Received name: " + event.queryStringParameters.challengeCode);        challengeCode = event.queryStringParameters.challengeCode;    }        const hash = crypto.createHash('sha256');    hash.update(challengeCode);    hash.update(verificationToken);    hash.update(endpoint);    const responseHash = hash.digest('hex');    console.log(new Buffer.from(responseHash).toString());        const response = {        statusCode: 200,        body: responseHash,    };    return response;};What am I doing wrong? Any help would be greatly appreciated.Thanks in advance!FollowComment"

Answer: "0Accepted AnswerEnded up just rewriting my lambda function in Python, and invoking the SecretManager API. It is working excellently now, and SecretManager has turned out to be much better for my application. It seems I still have a lot to explore when it comes to AWS!CommentSharelevitiku5answered 10 months ago0Given how your function is written, you probably want to change ssm.putParameter(params, function (err, data) {}) to await ssm.putParameter(params).promise(). The way it is right now, the call to putParameter is not really guaranteed to happen before the rest of your function executes, so that could be part of your problem. If you want to avoid await for some reason, you'll have to move the second half of your function into the callback of putParameters where you currently have console.log(data).CommentShareFarskianswered 10 months agolevitiku5 10 months agoChanged to this:    var ssm = new AWS.SSM();    var params = {        Name: 'ebayUserCode', /* required */        Value: code, /* required */        Overwrite: true        };    await ssm.putParameter(params).promise();Also tried this:    ssm.putParameter(params, function(err, data) {        if (err) console.log(err, err.stack); // an error occurred        else {            console.log(data);           // successful response                if (event.queryStringParameters && event.queryStringParameters.challengeCode) {    console.log("Received name: " + event.queryStringParameters.challengeCode);    challengeCode = event.queryStringParameters.challengeCode;}const hash = crypto.createHash('sha256');hash.update(challengeCode);hash.update(verificationToken);hash.update(endpoint);const responseHash = hash.digest('hex');console.log(new Buffer.from(responseHash).toString());const response = {    statusCode: 200,    body: responseHash,};return response;        }    });Still no change to my parameter in ssm. The actual call was copied verbatim from the API documentation here: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SSM.html#putParameter-propertySorry about the formatting!Share"


Question: "The job run failed. For help, post the error message on the AWS Glue forum or contact AWS support with the job run ID: jr_c543734f36402f421890d90db0419cc3c45816a3a767480d3dc19b6de68fac22"

"The job run failed. For help, post the error message on the AWS Glue forum or contact AWS support with the job run ID: jr_c543734f36402f421890d90db0419cc3c45816a3a767480d3dc19b6de68fac22FollowComment"

Answer: "0Hi,sorry for the long time to respond, I hope that by now you have solved the issue.Please note, that has mentioned in the error, to be able to help on re:Post we will need you to provide us more information, like the full error log once redacted of all sensitive information.The job id , is useful if you have a support plan and can open a support case , in which case the support engineer may be able to locate the job error logs by the job id.If you still need support please add the additional information that could help us provide some guidance.CommentShareEXPERTFabrizio@AWSanswered a year ago"


Question: Can I use aws glue crawlers to create master data in delta lake tables?

"I am setting up a new data lake and have been tasked with creating the master data tables in the data bricks delta lake component. I'm trying to do this in a use-case agnostic way (or as agnostic as possible), and need to automate the process where possible. I have researched aws glue crawlers, and it seems it is a good way to automatically create a schema and catalog for the data.However, I'm not sure how to proceed. I'm assuming that creating the master data means identifying common fields in all the data sources and creating a schema for all the data using a single crawler, and then dividing this schema into facts and dimensions. After that I could use spark jobs on data bricks to extract what I need from the raw data and to populate the master data, while checking for duplicates and doing whatever other transformations that need to be done.This plan seems like it requires a lot of manual labor though, and it's not use case agnostic in any way. Does anyone know how it could be automated further?Any help would be much appreciated.FollowComment"

Answer: "0Hello,1) Glue crawler can crawl the Data Source and create the tables as per the schema identified from the files of the Data sets.2) Glue crawler does not validate the common columns in different data sets. [1] how glue crawler works : https://docs.aws.amazon.com/glue/latest/dg/add-crawler.htmlCommentShareHarsha_Tanswered a year ago"


Question: React aws-sdk invokeWithResponseStream

"Hello, I'm trying to invoke a lambda with ResponseStream using this code, but I get the error following the code:runStreamLambda(param) {        try {            const lambda = new AWS.Lambda();            const params = {                Payload: JSON.stringify({ param }),                FunctionName: 'streamResponse'            };            return lambda.invokeWithResponseStream(params).promise();        } catch (error) {            throw error;        }    }ERRORCan't find variable: payloadThe interesting part is that if I do this, I get the response just fine:runStreamLambda(param) {        try {            const lambda = new AWS.Lambda();            const params = {                Payload: JSON.stringify({ param }),                FunctionName: 'streamAnswerQuery'            };            return lambda.invoke(params).promise(); // invoke instead of invokeWithResponseStream        } catch (error) {            throw error;        }    }And if I call the streaming lambda in other ways, it works fine as well (for example calling the Lambda Function URL directly.FollowComment"

Answer: 1Accepted AnswerThis is a difference between API URI requests andlanguage-specific AWS SDKsyou are using AWS SDK for Javascript but the invokeWithResponseStreammethod is for WS API URi request.https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeWithResponseStream.htmlCommentShareEXPERTsdtslmnanswered 10 days ago


Question: INSTALL_PARSE_FAILED_NO_CERTIFICATES: Scanning Failed.: No signature found in package of version 2 or newer for package

We keep getting this error when attempting to test an APK using Device farm.INSTALL_PARSE_FAILED_NO_CERTIFICATES: Scanning Failed.: No signature found in package of version 2 or newer for packageI have verified JAVA_HOME is set correctly.ARN Number: arn:aws:devicefarm:us-west-2:493117667654:run:1d7e24d1-6e47-4755-8479-df5807e27cf7/1b27c8f1-70c7-4f82-8128-376ed0255547FollowComment

Answer: "0Thanks for reaching out. For AWS Device Farm, we do require that your APK be signed by a V2 or higher signature version when testing on Android OS 11 or higher. For more information, please see the Android documentation here https://developer.android.com/about/versions/11/behavior-changes-11#minimum-signature-schemeIf you are still seeing this issue after signing your app via the V2 signature scheme, then it may be the case that you're using a tool like DexGuard which obfuscates certain APK metadata. Apps which have their Android Manifest file obfuscated in any way are incompatible with Device Farm's app resigning procedure. Thus, in order to test on Device Farm, you will need to skip the resigning process for your app. This can be done using private devices as described here: https://docs.aws.amazon.com/devicefarm/latest/developerguide/skip-app-re-signing-on-private-devices.htmlCommentSharesimsjon at AWSanswered 10 months ago"


Question: Is it possible to clone an email domain into another region?

"I started using Amazon SES a long time ago when it was only available in us-east-1. My servers are in Europe, so all my mails are unnecessarily routed via USA. I'd prefer to move it into a EU region, but it looks like I can only add it there as a new identity which starts from scratch in terms of reputation / sandboxing etc..Is there a way to clone my domain into another region,  automatically carrying over the reputation and sending status of the original identity?FollowComment"

Answer: "0Hello,SES regions are mutually exclusive and cloning the resources/metrics of one region to another region is not possible.You will have to follow the set up of the new region from scratch to use it for sending.Thanks.CommentShareSUPPORT ENGINEERRuhisar_Tanswered a year ago0Hello,You can Copy Amazon SES email and domain identities from one AWS Region to another using an AWS SDK:https://docs.aws.amazon.com/ses/latest/dg/example_ses_Scenario_ReplicateIdentities_section.htmlCommentSharevtjeananswered 2 months ago"


Question: How to set up blank work docs folder

Wanted to see if there's a way to create set up multiple folders at once - currently in Work Docs i see the option to upload folders but to do that I can't have it be blank - needs to have a file in it.FollowComment

Answer: "0If not possible from UI, automate it! ;-). My suggestion is to do it programmatically.Check out the createFolder method: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/WorkDocs.html#createFolder-propertyCommentShareEXPERTalatechanswered 4 months ago"


Question: Password Change in RDP

Please I have tried changing my windows rdp password after i was prompted to change the password using ctrl+alt+del key. but my problem is that the default password is too long to memorize and there is no copy and paste option. Please is there any easy way or video on how to change vps password in my aws dashboard account?ThanksFollowComment

Answer: 0You can change the password using a command line which might allow you to copy/pasteSee https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-windows-passwords.htmlCommentShareEXPERTMatt-Banswered 8 months ago


Question: IP address for AWS hosting account required to input A value in GoDaddy DNS zone.

"Hello, I have a website that is being hosted by AWS, directly linked with Github, so we are not using Amazon Route 53. The domain is from GoDaddy. I need to input the 'A' value (which is an IP address from the hosting account) Does anyone know what is the IP address for AWS?FollowCommentHarshavardhan_G SUPPORT ENGINEERa month agoWhat service within AWS are you using to host your website? Is it an EC2 instance, an S3 bucket, etc?ShareGovind Kumar a month agoIf you are hosting your website on a standalone EC2 instance, you can attach an elastic IP to it and map the A record residing on GoDaddy to the EIP.If you are using an Application Load Balancer on top of your EC2/Lambda/ECS resource, it returns the CNAME by default. Although you can get the IP address of the ALB using nslookup, it will change over time. The best solution is to use a Network Load Balancer on top of your Application Load Balancer. In this case, your Application Load Balancer would be a Target Group sitting behind the NLB Target Group, and your ALB would have the EC2 instance as a Target Group.Another workaround is to host your application in AWS Lightsail and attach an elastic IP to it.Share"

Answer: "3If you are hosting your website on a standalone EC2 instance, you can attach an elastic IP to it and map the A record residing on GoDaddy to the EIP.If you are using an Application Load Balancer on top of your EC2/Lambda/ECS resource, it returns the CNAME by default. Although you can get the IP address of the ALB using nslookup, it will change over time. The best solution is to use a Network Load Balancer on top of your Application Load Balancer. In this case, your Application Load Balancer would be a Target Group sitting behind the NLB Target Group, and your ALB would have the EC2 instance as a Target Group.Another workaround is to host your application in AWS Lightsail and attach an elastic IP to it.Please don't forget to accept the answer if i was able to answer your query in order to close this thread and help other community members.CommentShareGovind Kumaranswered a month ago"


Question: Opensearch failing connect timeout and no status in service dashboard

"I went to bed last night and everything was ok, woke up this morning and tried to start working and All my calls to Opensearch where timing out:opensearchpy.exceptions.ConnectionTimeout: ConnectionTimeout caused by - ReadTimeout(HTTPSConnectionPool(host='search-XXXXXXXX-jt5tcucdjcsa-xedweehyupm7z3zn5q6tqrt57q.us-east-2.es.amazonaws.com', port=443): Read timed out. (read timeout=10))e65029b2-6ce0-4b34-a137-a6f598bfe877 ERROR ConnectionTimeout: ConnectionTimeout caused by - ReadTimeout(HTTPSConnectionPool(host='search-XXXXXXXXXX-jt5tcucdjcsa-xedweehyupm7z3zn5q6tqrt57q.us-east-2.es.amazonaws.com', port=443): Read timed out. (read timeout=10))Checked the service health dashboard and no errors listed there.Went to the Opensearch Dashboard in the AWS UI and The cluster Health field was empty as was Searchable Doucments, total Free Space, and minimum free space. Clicking on Cluster Health gives a 404 Source View in the summary and no other useful information. There is no useful button anywhere like reboot cluster. I am at a complete loss of what to do.Luckily this is a development environment, but if this is happening here, what's to keep this from happening in a production enviornment?Anyone have any ideas?BTW as an aside, why can't we post screenshots on this support site?As a second aside the tag for Opensearch doesn't exist you have to use elasticsearchFollowComment"


Question: Amplify push failed

"Trying to push project to Amplify console using "Amplify push" getting this error..Can you please help me on this issue. If it is because of exposed API key, can you please guide me how to rotate my API key.Thank you!FollowComment"


Question: Does the file gateway cache need to be at least as large as the largest file being uploaded?

"From the FAQs: "writes could fail if there is no free cache space to store data locally pending upload to S3." This seems to suggest that the file needs to sit in that cache space before it can be uploaded into S3, which makes me think that the cache needs to be at least the size of the largest potential file (I guess in my customer's case, 5TB).My customer cares less about the performance benefits of the cache (because they are using file gw for backups that they don't plan to access) and more about the limitations that it introduces for file uploads. The documentation says that the "cache disk size must be tuned to the size of the active working set." Basically the only active working set for my customer will be the files that need to be uploaded. They are not anticipating a need for continuous retrieval.So my question is- does the file gateway cache need to be at least as large as the largest file being uploaded? Or larger potentially? Any suggestions on how to choose the size of the cache?FollowComment"

Answer: 0Accepted AnswerWe cache parts of files so the cache can be smaller that the size of the largest file you are reading/writing/updating.CommentSharePaul_Ranswered 4 years ago


Question: GameLiftLocal Crashes when commands are given to it

"We are in the process of testing GameLift for our game. We have created an Amazon Linux 2 VM under Virtual Box and have a working sample server form Github working and also have GameLiftLocal running on the machine.We run Gamelift running the following command:[ec2-user@vm_gamelift3 GameLiftLocal-1.0.5]$ java -jar GameLiftLocal.jar This seems to result in a successful startup:05:22:54,823  INFO || - [SocketIOServer] main - Session store / pubsub factory used: MemoryStoreFactory (local session store only)05:22:59,344  WARN || - [ServerBootstrap] main - Unknown channel option 'SO_LINGER' for channel '[id: 0x88185e57]'05:22:59,353  INFO || - [SDKConnection] main - GameLift SDK server (communicates with your game server) has started on http://localhost:5757 05:22:59,390  INFO || - [SocketIOServer] nioEventLoopGroup-2-1 - SocketIO server started at port: 575705:22:59,450  INFO || - [SdkWebSocketServer] WebSocketSelector-13 - WebSocket Server started on address localhost/127.0.0.1:575905:22:59,655  INFO || - [StandAloneServer] main - GameLift Client server (listens for GameLift client APIs) has started on http://localhost:8080 05:22:59,705  INFO || - [StandAloneServer] main - GameLift server sdk http listener has started on http://localhost:5758 We also get a good connection when starting up the game server sample locally. However, when we attempt to issue the local server a command, it always comes back with an exception[ec2-user@vm_gamelift3 ~]$ aws gamelift create-game-session --endpoint-url http://127.0.0.1:5758  --maximum-player-session-count 2   --fleet-id fleet-123An error occurred (NullPointerException) when calling the CreateGameSession operation (reached max retries: 4): The server does not completely crash, but does give a warning and a call stack of the exception that was caught05:25:31,497  WARN || - [GameLiftSdkHttpHandler] GameLiftSdkHttpHandler-thread-0 - Caught exceptionjava.lang.NullPointerExceptionat com.amazon.gamelift.handlers.GameLiftSdkHttpHandler.validateHeaders(GameLiftSdkHttpHandler.java:84)at com.amazon.gamelift.handlers.GameLiftSdkHttpHandler.handle(GameLiftSdkHttpHandler.java:55)at com.sun.net.httpserver.Filter$Chain.doFilter(Filter.java:79)at sun.net.httpserver.AuthFilter.doFilter(AuthFilter.java:83)at com.sun.net.httpserver.Filter$Chain.doFilter(Filter.java:82)at sun.net.httpserver.ServerImpl$Exchange$LinkHandler.handle(ServerImpl.java:700)at com.sun.net.httpserver.Filter$Chain.doFilter(Filter.java:79)at sun.net.httpserver.ServerImpl$Exchange.run(ServerImpl.java:672)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748)05:25:31,554  WARN || - [GameLiftSdkHttpHandler] GameLiftSdkHttpHandler-thread-0 - Caught exception nullThis exception also occurs when we just try to describe the sessions, so it seems to be any command you issue the jar on that socket. How do I resolve this so that I can get to actually testing my code?Thank you!DavidFollowComment"

Answer: "1Hi David,May I confirm which documentation or guide which you have followed as you tried to test this? I would recommend double checking the guide here -> https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-testing-local.html and following the exact steps for now.One thing that stands out to me is that you have run Gamelift local as java -jar GameLiftLocal.jar. Based on the doc this means that the default port 8080 will be used.  However, in the AWS CLI commands the endpoint URL is --endpoint-url http://127.0.0.1:5758. My understanding is that we must make the AWS CLI requests to the port or default port 8080 specified when starting Gamelift localCan you please try changing the port to the default port 8080 instead? Please let us know how this goes.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago0Yes, I had switched the ports when calling to GameLiftLocal.jar. It should have been:AWS gamelift create-game-session --endpoint-url http://172.16.0.39:8080 --maximum-player-session-count 2 --fleet-id fleet-123CommentShareDavid Holtkampanswered a year ago"


Question: Regex in Athena Match null data whithout raise any error

"First, I debug my regular expression online through Regex101, and successfully get the data I want. this is my debug url.My Text STRING:{"date":"2022-08-01T01:02:46.121911Z","log":"{\"log\":\"2022-08-01 01:02:46.121 [MyScheduler_Worker-9] INFO u001b[0;39m o.jeecg.modules.quartz.service.XpushRemoteService:38u001b[0;39m - push to xPush ,entity = {\"body\":{\"fileName\":\"ExamMonitor0801.xls\",\"attachment\":\"xpush/prod/dingNotifier/BI/d6bd7cd53b1248c4ba55110fda2c3370/0801 all exam monitor.xlsx\",\"userIds\":[\"193960304827593088\",\"28095501311142182\",\"21480733271214119\",\"01454058034930401224\"]},\"appId\":\"OTHERS\",\"topic\":\"BI_MONITOR_REPORT\"}rn\",\"stream\":\"stdout\",\"time\":\"2022-08-01T01:02:46.12183064Z\"}"}My REGULAR EXPRESSION\{\"date\":\"([^ ]*)\",\"log\":\"\{\\\"log\\\":\\\"(.+)(?=\\\",\\\"stream)But When I use this regular expression to create a table in athena.it finally get null data.FollowComment"


Question: CodeDeploy create-deployment using cli

"Hi, I am using aws cli v2 to create deployment for coddeploy as part of CI/CD pipeline.I am following the syntax provided here,https://awscli.amazonaws.com/v2/documentation/api/latest/reference/deploy/create-deployment.htmlUsing script I am trying to create deployment as shown below. I am using revision type "AppSpecContent" and providing content as string (Inside it's JSON)aws deploy create-deployment --application-name test-cd-ecs --deployment-group-name test-cd-ecs-dg --revision revisionType=AppSpecContent,appSpecContent={content="{  "version": "0",  "Resources": [    {      "TargetService": {        "Type": "AWS::ECS::Service",        "Properties": {          "TaskDefinition": "arn:aws:ecs:us-west-2:XXXXXXXXX:task-definition/test-cd-ecs-td:10",          "LoadBalancerInfo": {            "ContainerName": "test-cd-ecs-container",            "ContainerPort": "8080"          }        }      }    }  ]}"}When I run the above command, I get this errorError parsing parameter '--revision': Expected: '=', received: '0' for input:revisionType=AppSpecContent,appSpecContent={content={  version: 0,           ^  Resources: [    {      TargetService: {        Type: AWS::ECS::Service,        Properties: {          TaskDefinition: arn:aws:ecs:us-west-2:XXXXXXXXX:task-definition/test-cd-ecs-td:10,          LoadBalancerInfo: {            ContainerName: test-cd-ecs-container,            ContainerPort: 7001          }        }      }    }  ]}}Any idea what's wrong in the syntax. I removed the whole JSON and tried with some dummy then also I get error.Thanks for help.FollowComment"