Question: API Gateway throttles requests

I have an API Gateway resource connecting to lambda and I see that consecutive requests to the API are throttled. I don't have caching enabled and the rate of requests is far below the throttling level.API Gateway configurationThe lambda also has been configured without an upper bound on invocations.FollowComment

Answer: "1If you are confident that the throughput is below the rate and the burst limit for a particular API resource/method combination, then you may be hitting the overall account level limits for your account - https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.htmlIn that case, you will need to open a support ticket with AWS support and apply for an increase in quotas.CommentShareEXPERTIndranil Banerjee AWSanswered 10 months agorePost-User-7471461 10 months agoHi IndranilThanks for taking the time to reply. I did have a look at this table before, but my system is still under dev and the peak load is probably 10rps on a resource/method. Also, I don't see this behaviour if I use HTTP integration. Only shows up with lambda.ShareIndranil Banerjee AWS EXPERT10 months agoIn that case lambda is the one getting throttled. But 10 RPS is too low. Can you take a look at this Support Knowledge Center article - https://aws.amazon.com/premiumsupport/knowledge-center/lambda-troubleshoot-throttling/The account level quotas for lambda functions are here - https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.htmlAre there other lambda functions running in the account that are using up the account level lambda concurrency limits?Share1API Gateway throttles requests to your API using the token bucket algorithm, where a token counts for a request. Specifically, API Gateway examines the rate and a burst of request submissions against all APIs in your account, per Region.In the token bucket algorithm, a burst can allow pre-defined overrun of those limits, but other factors can also cause limits to be overrun in some cases.When request submissions exceed the steady-state request rate and burst limits, API Gateway begins to throttle requests. Clients may receive 429 Too Many Requests error responses at this point. Upon catching such exceptions, the client can resubmit the failed requests in a way that is rate limiting.Refer to the below link for additional details:https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html -- [1]CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agorePost-User-7471461 10 months agoThanks for taking the time to reply. In my case, the API is still under development and currently, it's just me querying the API. How can I disable this throttle for specific resources using the API? Also, I don't see this behaviour when I use HTTP integration. This only shows up with lambdas.Share"


Question: How to request eligibility review for additional credit in Activate for Startup?

I want to know a way to request this review to get additional credit in Activate for StartupFollowComment

Answer: "0Hi,I suggest you reach out to https://aws.amazon.com/activate/contact-us/ FAQs to check the status of your application or connect with their support.If you also have an Account manager associated to your company, he may be able to speed up the process and get in touch with Activate earlier.Hope it helps.CommentShareEXPERTalatechanswered 4 months ago"


Question: Error when launching AWS CloudShell: "Unable to start the environment"

"I'm getting an error when trying to launch AWS CloudShell in the us-west-2 (Oregon) region.My IAM Role has Administrator Access, and I'm the only creator/user of the AWS account.I enabled AWS Organizations, but am not using any features of it right now.I am not using any permissions boundaries in IAMI am not receiving any kind of "access denied" error message. It is just a generic, useless message (see below).Any ideas on how to resolve this?Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.FollowCommentCharu Khurana a year agoDid you try changing AWS region and/or browser?Shareawmbtc a year agoI have the same problem, did you solve yours?ShareAWS-User-2148182 a year agoI have the same problem.Share"

Answer: "0Can someone please look into this? I have tried all the suggestions with no luck. The negative rating on the answers indicates that no good solution exist for this issue. I am facing this issue in ap-southeast-2.Unable to start the environment. You must verify your account before accessing CloudShell. To verify your account, contact AWS Support .The link goes to https://support.console.aws.amazon.com/support/home with no guidance as to how to "verify" my account.CommentSharerePost-User-7856348answered 8 days ago-2Hi, good question.A couple things I would start with:What region are you in?  Cloudshell only operates in the following regions: https://docs.aws.amazon.com/general/latest/gr/cloudshell.htmlAre there any other policies that could be denying CloudShell?  SCP (Organization Level), Managed Policies, Permission Boundaries?  If not, Admin Access should do the trick (Cloudshell:*).Have you restarted?  Actions -> Restart CloudShell.  This will kill any active sessions you have.CommentSharejsoncanswered a year agoAWS-User-203634 a year agoI updated my question.Share-2Hello AWS-User-203634, Has your problem been resolved? Let us know by clicking on the "Accept" button when an answer provided in the community helped you. This allows other community members to also benefit from it. Thank you for your participation.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago-3So i was able to resolve this issue with the help of AWS repost user @Maulik_Makadiya.Few things to try to create CloudShell environment:Time Synchronization: Make sure Your machine time is accurate. It means its correct based on world time. did you try from another machine to see if its working there? may be any time sync related issue?Check in different regions..check AWSCloudShellFullAccess policy to ensure it has below JSON data.{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "cloudshell:*"            ],            "Effect": "Allow",            "Resource": "*"        }    ]}Check in different browser to see if it works in different browser or not. https://docs.aws.amazon.com/cloudshell/latest/userguide/troubleshooting.htmlDid you deleted cloudshell home directory or something? Try after resetting home directory. But it can DELETE all your data exists in home directory. https://docs.aws.amazon.com/cloudshell/latest/userguide/vm-specs.html#deleting-home-directorycheck if any DENY policy created for it. remove that.It is possible your account is not 100% verified. Try this: Create a CloudFront distribution if you get the below error it confirms your account is unverified or if you can create 2 distributions and can't create the 3rd one.Your account must be verified before you can add new CloudFrontresources. To verify your account, please contact AWS Support(https://console.aws.amazon.com/support/home#/ ) and include thiserror message.Click the support linkNavigate to:Support / New case / Service limit increaseLimit type:CloudFront DistributionsIn Requests select:Limit: Web Distributions per AccountNew limit value: <TYPE_YOUR_NEW_VALUE_HERE>MY CASE: In my case, I had 2 distributions, wanted to create 3rd, but couldn't. So I have put as <TYPE_YOUR_NEW_VALUE_HERE> a number 10.Note: If nothing works choose last option as your last resort to confirm your account is verified.hope it helps.CommentShareAWS-User-3586868answered a year agoAWS-User-8770114 a year agoI had the same issue and this part fixed it (despite I don't know what/how do they "verify" an account):"It is possible your account is not 100% verified. Try this: Create a CloudFront distribution if you get the below error it confirms your account is unverified or if you can create 2 distributions and can't create the 3rd one.Your account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support (https://console.aws.amazon.com/support/home#/ ) and include this error message.Click the support link 1) Navigate to: Support / New case / Service limit increase".AWS support took a few days to fix this and I'm now able to open CloudShell.Share"


Question: Quicksight S3 Manifest Capacity Solution

We store data in S3 hourly so that means 24 files per day * 30 days a month = 720 files a month but Quicksight has a 1000 file limit per manifest file when importing data from s3. What is the best practice here? Should I create a new manifest file each month and then combine the datasets into one?Here is a link to the documentation: https://docs.aws.amazon.com/quicksight/latest/user/data-source-limits.htmlFollowComment

Answer: "0Hello ,Yes you would be correct in your understanding of how the limit works.I can confirm that as soon as you reach the limit of 1000 files within any type of S3 manifest file format you would be met with the following message: The S3 data source exceeds QuickSight’s limits. Please see data source limits for more informationTherefore the best workaround would be to use Amazon Athena , as this would allow you to have as many files in your S3 bucket as you may need  and thereafter you will still be able to upload your data to QuickSight via Athena.CommentShareSUPPORT ENGINEERTrishen_Canswered 3 months agorePost-User-9071258 3 months agoThank you but doesn't that mean I have to pay more money to store the data twice just so I can use quicksight?Share0How about using Amazon Athena?https://docs.aws.amazon.com/athena/latest/ug/what-is.htmlAmazon Athena can refer to multiple files in S3 like a database.If you read the data via Amazon Athena, you should be able to import it into QuickSight without any problems.CommentShareARBRanswered 3 months ago"


Question: Invalid environment type: Codebuild curated windows container

"Hello,Creating/Updating AWS CodeBuild project using WINDOWS_CONTAINER works well until yesterday via CLI but It's not working anymore from today with this exception.An error occurred (InvalidInputException) when calling the UpdateProject operation: Invalid environment typeOriginal command was (nothing has changed from yesterday)aws codebuild update-project --cli-input-json {"name": "build_test_naoko", "description": "build test naoko", "source": {"type": "GITHUB", "location": "...", "gitCloneDepth": 0, "buildspec": "buildspec.yml", "auth": {"type": "OAUTH", "resource": "..."}, "insecureSsl": true, "sourceIdentifier": "master"}, "artifacts": {"encryptionDisabled": true, "location": "hbsmith-codebuild-artifacts-us-east-1-20190423", "overrideArtifactName": true, "packaging": "ZIP", "path": "naoko", "type": "S3"}, "cache": {"type": "NO_CACHE"}, "environment": {"type": "WINDOWS_CONTAINER", "image": "aws/codebuild/windows-base:1.0", "computeType": "BUILD_GENERAL1_LARGE", "environmentVariables": []}, "serviceRole": "arn:aws:iam::...:role/aws-codebuild-build-test-naoko-role", "timeoutInMinutes": 90, "badgeEnabled": true, "secondaryArtifacts": [{"artifactIdentifier": "lastest", "encryptionDisabled": true, "location": "hbsmith-codebuild-artifacts-us-east-1-20190423", "overrideArtifactName": true, "packaging": "ZIP", "path": "naoko", "type": "S3"}]}I updated CLI with latest version but problem still occurs. CodeBuild document still cites it supports aws/codebuild/windows-base:1.0.What cause the problem? Is it my fault or CodeBuild's fault?FollowComment"

Answer: "0Hi,it happens the same to me. I was using boto3 to create a codebuild project with the following environment:'environment': {            'type': 'WINDOWS_CONTAINER',            'computeType': 'BUILD_GENERAL1_MEDIUM',            'image': f"{REPOSITORY_URI}:{IMAGE_VERSION}",            'imagePullCredentialsType': 'SERVICE_ROLE'        }and the same error appears: An error occurred (InvalidInputException) when calling the CreateProject operation: Invalid environment type.I tried to create a dummy codebuild project by using the aws console and the problem is the same when using 'type': 'WINDOWS_CONTAINER'. ( Invalid environment type ).For Linux type codebuild projects it works correctly.CommentSharejcozaranswered 4 years ago0I'm seeing the same thing, tried multiple accounts and via Console and Cloudformation. I contacted @AWSsupport on twitter, they dont seem too interested at the moment.CommentSharedaniel37899answered 4 years ago0Amazon have fixed this!CommentSharedaniel37899answered 4 years ago0I found everything works fine now :)CommentShareHBsmithanswered 4 years ago"


Question: Route53: Cannot delete resource record set via AWS Step Functions

"Hello,I am using a step function (aws-sdk:route53:changeResourceRecordSets) to delete a Route53 record and sometimes I am getting the following error:[Tried to delete resource record set [name='xxxxxxxxx.some-domain.net.', type='A', set-identifier='i-xxxxxxxx'] but the rdata provided is invalid] (Service: Route53, Status Code: 400, Request ID: zzzzzzzzzzzzz)Even though the record is there and I can verify it from the AWS console it does not work half of the time. Sometimes I can delete it immediately after creation, but sometimes I have to try again after 1-2 hours or even a day (always via the step functions).I have no problems deleting it manually from the console.FollowComment"

Answer: "0Hi, @algert.Have you checked the following articles?This article explains that the same error message occurs when the ResourceRecord has unmatched values in the delete action.https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-route53-resource-record/?nc1=h_lsAn error occurred (InvalidChangeBatch) when calling the ChangeResourceRecordSets operation: Tried to delete resource record set [name='a.domain.com.', type='A'] but the rdata provided is invalid.You're performing the DELETE action for a resource record set, but the value for ResourceRecord doesn't match the value in the existing resource record set.Check and update the ResourceRecord value in your configuration file. Then, try to delete the resource record set again.CommentShareEXPERTiwasaanswered 4 months agoalgert 4 months agoHello iwasa, yes I have already checked. The data is valid since when I am running the same step function again after sometime with the same input, it will work.My use case is not very complex. I create a record (A record) and I try to delete it with a step function. Sometimes it does not work, but re-running the step function after some time (same input) will delete the record.Share"


Question: Does DocumentDB support client side encryption?

"I understand DocumentDB supports SSE via KMS (1 key per cluster).  However, does it support client-side encryption or the AWS encryption SDK?FollowComment"

Answer: "2You can use Transport Layer Security (TLS) to encrypt the connection between your application and an Amazon DocumentDB cluster. By default, encryption in transit is enabled for newly created Amazon DocumentDB clusters. It can optionally be disabled when the cluster is created, or at a later time. When encryption in transit is enabled, secure connections using TLS are required to connect to the cluster. For more information connecting to Amazon DocumentDB using TLS, all details can be found https://docs.aws.amazon.com/documentdb/latest/developerguide/security.encryption.ssl.htmlCommentShareAWS-User-0759610answered 2 years agoBruno_M 2 years agoi'm concerned with encryption at rest.Share1The AWS Encryption SDK is a client-side encryption library designed to make it easy for everyone to encrypt and decrypt data using industry standards and best practices. It enables you to focus on the core functionality of your application, rather than on how to best encrypt and decrypt your data.As mentioned in this link , albeit for S3,  it can be used to encrypt or decrypt data to be stored anywhere and gives an explanation on how the SDK works.https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.htmlThis answers both the questions, however, you have to be aware that the data has to be encrypted and decrypted using the Encryption SDK and the AWS Encryption SDK cannot interoperate with other libraries because each library returns encrypted data in a different format.Read the developer guide and be sure you understand the concepts and how it works.https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.htmlLooking at use cases,  you can also enable TLS as previously answered which is in the DocumentDB documentation if the concern was to encrypt data in transit and enable encryption at rest for the DocumentDB cluster.https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.htmlhttps://docs.aws.amazon.com/documentdb/latest/developerguide/security.encryption.ssl.htmlCommentShareVLSanswered 2 years agoEXPERTLuca_Ireviewed a year ago0The latest release of Amazon DocumentDB supports CSFLE.To get started with CSFLE, please refer to this blogCommentShareKTanswered 3 months ago"


Question: Is it possible to use smddp in notebook?

"I recently tried the smddp v1.4.0 on SageMaker notebook instance (not sagemaker studio), using 8-GPU instances ml.p3.16xlarge, by directly using smddp as backend in the training scripts. I launched the estimator by setting instance_type to local_gpu and ended up with smddp error. Corresponding errors are attached below, saying an initialization error.42u1m0wni0-algo-1-36bbw | Traceback (most recent call last):42u1m0wni0-algo-1-36bbw |   File "true_main_notebook.py", line 636, in <module>42u1m0wni0-algo-1-36bbw | main()42u1m0wni0-algo-1-36bbw |   File "true_main_notebook.py", line 178, in main42u1m0wni0-algo-1-36bbw | dist.init_process_group(backend=args.dist_backend)42u1m0wni0-algo-1-36bbw |   File "/opt/conda/lib/python3.8/site-packages/torch/distributed/distributed_c10d.py", line 576, in init_process_group42u1m0wni0-algo-1-36bbw | store, rank, world_size = next(rendezvous_iterator)42u1m0wni0-algo-1-36bbw |   File "/opt/conda/lib/python3.8/site-packages/torch/distributed/rendezvous.py", line 219, in _env_rendezvous_handler42u1m0wni0-algo-1-36bbw | rank = int(_get_env_or_raise("RANK"))42u1m0wni0-algo-1-36bbw |   File "/opt/conda/lib/python3.8/site-packages/torch/distributed/rendezvous.py", line 203, in _get_env_or_raise42u1m0wni0-algo-1-36bbw |     raise _env_error(env_var)42u1m0wni0-algo-1-36bbw | ValueError: Error initializing torch.distributed using env:// rendezvous: environment variable RANK expected, but not set42u1m0wni0-algo-1-36bbw | Environment variable SAGEMAKER_INSTANCE_TYPE is not set42u1m0wni0-algo-1-36bbw | Running smdistributed.dataparallel v1.4.042u1m0wni0-algo-1-36bbw | Error in atexit._run_exitfuncs:42u1m0wni0-algo-1-36bbw | Traceback (most recent call last):42u1m0wni0-algo-1-36bbw |   File "/opt/conda/lib/python3.8/site-packages/smdistributed/dataparallel/torch/torch_smddp/__init__.py", line 51, in at_exit_smddp42u1m0wni0-algo-1-36bbw | hm.shutdown()42u1m0wni0-algo-1-36bbw | RuntimeError: Was this script started with smddprun? For more info on using smddprun, run smddprun -h42u1m0wni0-algo-1-36bbw | 2022-04-03 16:07:30,005 sagemaker-training-toolkit ERROR    Reporting training FAILURE42u1m0wni0-algo-1-36bbw | 2022-04-03 16:07:30,005 sagemaker-training-toolkit ERROR    ExecuteUserScriptError:42u1m0wni0-algo-1-36bbw | ExitCode 142u1m0wni0-algo-1-36bbw | ErrorMessage "ValueError: Error initializing torch.distributed using env:// rendezvous: environment variable RANK expected, but not set42u1m0wni0-algo-1-36bbw |  Environment variable SAGEMAKER_INSTANCE_TYPE is not set Error in atexit._run_exitfuncs: Traceback (most recent call last):   File "/opt/conda/lib/python3.8/site-packages/smdistributed/dataparallel/torch/torch_smddp/__init__.py", line 51, in at_exit_smddp hm.shutdown() RuntimeError: Was this script started with smddprun? For more info on using smddprun, run smddprun -h"The original goal is to launch a single-node smddp for debugging.Does the smddp only support launched by AWS python SDK rather than the notebook? Or if something I've done is not correct?FollowCommentAnonymous a year agoDid you pass the below distribution to the estimator?dist_strategy = {"smdistributed": {"dataparallel": {"enabled": True}}}Blog - https://medium.com/@dangmz/speed-up-efficientnet-model-training-on-amazon-sagemaker-with-pytorch-and-sagemaker-distributed-dae4b048c01aSample Code - https://github.com/aws/amazon-sagemaker-examples/blob/main/training/distributed_training/pytorch/data_parallel/efficientnet/pytorch_smdataparallel_efficientnet_demo.ipynbShareyzs a year agoThanks! I forget to uncomment the distribution settings in the estimator.Share"


Question: My site no longer works after installing ssl  does it take time to propegate?

"I get this message in bitnami, website.com "resolves to a different ip address than the one detected please fix its dns endtries.  but i double checked the dns on my godaddy domains and it is corrent. Does it take time to propegate?dnFollowComment"

Answer: 0It can takes longer (24h-48h) for some DNS provider to propagate the changes. I suggest waiting longer and clear your browser cache/cookies on every retry.CommentShareEthan Ferdosianswered a year ago


Question: User: anonymous is not authorized with an explicit deny

"Hi, I have a lambda function which, called from a regional Gateway API, works fine. I call it from my devel computer and it answers correctly.But, I need this lambda to work only from my web app, which is in EC2 inside of a VPC. So I created a new private Gateway API with a com.amazonaws.us-east-1.execute-api endpoint (private DNS disabled) inside the VPC (with DNS enabled) where the EC2 instances are. The subnets for the endpoint are the same subnets for the EC2 instances.I setup the resource policy following the white list for VPC origin example. Then I implemented the API.I call the endpoint using its hostname (with curl), passing in the x-apigw-api-id header the API id, but I get:{"Message":"User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-1:**********:**/myStage/GET/myRes with an explicit deny"}I don't know if this is caused by having the DNS enabled for the VPC and not for the endpoint, or if I need to change the subnets for the endpoint, or if there's another cause.Any hint is appreciated. Thanks.P.S. I followed this tutorial: https://aws.amazon.com/es/premiumsupport/knowledge-center/api-gateway-vpc-connections/FollowComment"

Answer: "1Solved by tech support. I changed in the policy this line (sourceVpce instead of sourceVpc):"StringNotEquals": {"aws:sourceVpce": "<VPC_ENDPOINT_ID>"}to indicate that the source is a VPC endpoint, not a VPC.CommentSharemetayiianswered 4 years ago"


Question: Is It Necessary To Specify the Number of Shards When Creating an Index in an OpenSearch Serverless Collection?

"Is it necessary, or even permitted, to specify the number of shards when creating an index in an OpenSearch Serverless Collection? The documentation says that index and shard lifecycle is managed by Amazon, but it's not clear if this extends to deciding how many shards there should be.FollowComment"

Answer: "1Accepted AnswerIndex and shard management is taken care by serverless, you don't need to worry about specifying the shards/replica for an index. Even if you have those settings in your index template or index creation step, it would be ignored.CommentSharePrashant Agrawalanswered 3 months agoGraham Campbell 3 months agoExcellent, thank you for your help. 🎉Share"


Question: Cloudformation Stack Stuck in UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS

"I have a cloudformation stack stuck in UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS and I can't for the life of me figure out why or where the issue is. The stack id is: arn:aws:cloudformation:us-east-1:996768638400:stack/xxxx/e1641270-ed2b-11ea-bd1a-0e353767367bEdited by: dkobia23 on Jan 22, 2021 2:59 PMFollowComment"

Answer: 0It looks like the problem takes about an hour to resolve itself after it happens. I've been able to replicate it a few times.CommentSharedkobiaanswered 2 years ago


Question: Support for SASL OAUTHBEARER for MSK

We use SASL OAUTHBEARER for our on-prem authentication and looks like Amazon MSK currently does not support that. It would be great if anyone from Amazon MSK team let us know if the support the same is planned in near future.similar feature is avaiable on confluent.https://docs.confluent.io/platform/current/kafka/authentication_sasl/authentication_sasl_oauth.html#FollowComment

Answer: "0Hi there, thank you for providing your valuable feedback on the service. I have raised a feature request with the service team on your behalf. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What's New (1) and Blog pages (2) for any new feature announcements. However please note MSK’s integration with IAM supports standard IAM features like role-based access control, and support for external identity providers including OpenID Connect for OAuthBearer authentication (3).(1) https://aws.amazon.com/new/(2) https://aws.amazon.com/blogs/aws/(3) https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp.htmlCommentShareSUPPORT ENGINEERHarshith_Manswered a year agoEXPERTFabrizio@AWSreviewed a year ago0We tried to integrate with third party idp, but the solution is not working as expected. It would be nice if you provide oauth feature asap. Otherwise wise customers will look for alternatives.CommentShareAWS-User-3045317answered a year ago"


Question: Migrate from EC2 with MSSQL to instance without

"I need to migrate an instance with a SQL license to an instance without one to save money on the monthly bill. I've made a copy of the DB to RDS in SQLExpress, and tested with the application successfully. I now need to figure out how to migrate the data to a smaller instance without SQL. Anyone know the best way to achieve this? The basic method of changing instance type fails as it wont let me choose an instance without SQL.FollowComment"

Answer: "0"Changing your license type from License Included to BYOL will require you to import your your own Windows and SQL Server media through VM Import Export (VMIE) to create Amazon Machine Images (AMIs). You can use these AMIs to launch Windows and SQL Server instances. In addition, when switching from license included to BYOL, you will be required to activate Windows Server using either your own Key Management Service (KMS) activation or Multiple Activation Key (MAK) activation."Refer to AWS announces a new capability to switch license types for Windows Server and SQL Server applications on Amazon EC2CommentShareRoBanswered a year ago0Hi, you can use AWS Application Migration Service (AWS MGN) for this purpose. Follow the steps and you should achieve your goal. Regarding your inquiry, if you're going to use AWS MGN, you can backup your data (dump file) that resides on your server, compress the data and then you can move forward.https://docs.aws.amazon.com/es_es/mgn/latest/ug/what-is-application-migration-service.htmlCommentShareclemusgoanswered a year ago"


Question: unique identities in cognito user pool

"We are experimenting with cognito user pool. We set email or mobile number to be used as user name.We created user with email and mobile number. When we used the same email and mobile number for second user, cognito threw error.  This is expected.After the users are added to cognito with different user email and phone number,  we updated the same mobile number and email, it doesn't threw any error.  I launched the hosted UI from cognito portal and login with email and password, it picked one account and logged in.This doesn't seem to be expected output.Why the cognito doesn't throw error when duplicate phone number is updated ?When we login using email how does the cognito picked the account ?FollowCommentemattheis a year agoI'm also wondering how to ensure unique identities with federated login options. I setup a pool with email only and enabled Apple and Google sign in along with the ability to self-register. If I manually create a user in the pool and then Sign In with Apple or Google using the same e-mail, I end up with multiple users in the pool with the same verified email address.Share"

Answer: "1Hi,When email or phone is used as Alias, email and phone can be marked as verified to only one user in the user pool. If you attempt to assign the same phone/email to another user, you will be able to do so but you will not be able to mark it as verified (you will get an error if you attempt to verify the email/phone). You can force the verification to go through and this will mark the email/mobile for the other user as not-verified and will move the alias to the new user.Cognito chooses the user with verified email/mobile when you attempt to sign-in using email/mobile.CommentShareEXPERTMahmoud Matoukanswered a year agoNavin GV a year agoJust verified now, I have 2 users with same email and phone number combination and both are in verified state.Sharenewtechfellas 5 months agoI have this same problem. Surprised Cognito team did not address it even after 10 months. https://repost.aws/questions/QU6F7QTvrnTf6wSHePSkX5Pg/cognito-allows-duplicate-email-aliasShare"


Question: Compliants Italia Online

"Hello,I use from 3 years amazon SES for sending newsletter with a simple software called Sendy.co . I decide to change my software for sending in Acelle Email.I migrate my user correctly and now I have a lot of compliants email from Italia Online for address @virgilio.it or @libero.itMy account is suspended.But how is possible fix it? I really dont change anything! Just software for sending and respect privacy policy, gdpr, unsubscribe button etc!Anyone has same problem?FollowComment"

Answer: "0Hello,A complaint occurs when a recipient reports that they don't want to receive an email. They might have clicked the "Report spam" button in their email client, complained to their email provider, notified Amazon SES directly, or through some other method.  In your case, the change you've made with the software may have changed something in the message that the recipients are receiving, and this is why they are marking your messages as a SPAM.You should work with the Trust & Safety Team of AWS to identify the root cause of the issue and to fix it. They are the only ones that are capable of lifting the suspension you encountered in your sending access. For more about complaints and how SES handles them, please refer to this FAQ page.https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html#e-faq-cmThanks!MoCommentShareMoanswered 2 months ago"


Question: Sensing SNS email notifications from my domain

Hello:I'm using SNS to notify users via email. The email is sent from no-reply@sns.amazonaws.com. It's is possible to use our own domain? I was able to verify the domain in SES but I don't see a way to link SNS to that verified account.ThanksFollowComment

Answer: "0It is possible to use your own domain for the MAIL FROM.Please see this guide on how to add your domain and verify it with AWS: https://docs.aws.amazon.com/ses/latest/dg/mail-from.htmlCommentShareEXPERTChris_Ganswered a year agoAWS-User-SOS a year agoI configured MAIL FROM in SES (and it was verified) but I still get all email notifications from no-reply@sns.amazonaws.com.Just to clarify, I'm using IoT Events which sends notifications using SNS (I don't see any configuration from SNS nor IoT Events that relates to SES configuration...)Is there any thing else to have this working? My objective is to have users being notified with our own email, not AWS one...ThanksShare"


Question: Error while installing the VCpp redistributalble uisng .ebextensions

"I have a an ASP.NET Core web application which publishes to AWS using ElasticBeanstalk.  In order to configure the windows environment I am using .ebextensions, which will copy the vcpp redistributables from S3 and installs them while creating the environment.When published I am getting the error 'Error occurred during build: Command 01_instlVCx64 failed".  Below is the command in my .ebextensionsfiles:  "c:\\vcpp-redistributables\\vc_redist_x64.exe":    source: https://<bucket_name>.s3.eu-west-2.amazonaws.com/vcpp-redistributables/vc_redist_x64.exe    authentication: S3Accesscommands:  01_instlVCx64:    command: c:\\vcpp-redistributables\\vc_redist_x64.exe /q /norestartBelow is the trace back from the logs2022-03-22 15:31:35,876 [ERROR] Error encountered during build of prebuild_0_GWebApp: Command 01_instlVCx64 failedTraceback (most recent call last):  File "cfnbootstrap\construction.pyc", line 578, in run_config  File "cfnbootstrap\construction.pyc", line 146, in run_commands  File "cfnbootstrap\command_tool.pyc", line 127, in applycfnbootstrap.construction_errors.ToolError: Command 01_instlVCx64 failed2022-03-22 15:31:35,876 [ERROR] -----------------------BUILD FAILED!------------------------Could you please let me know what am I missing?****Thanks in advanceFollowComment"

Answer: "0Found the issue couple of days before. So, thought of answering my own question, so that it will be useful for others.The issue is Elastic beanstalk instance (Windows server 2019) already has VCpp redistributables installed and which is later version that I am trying to install as part of .ebextensions. So, when I tried to install, it failed.I figured it out, by enabling RDP connection on the EC2 instance that is created as part of Elastic beanstalk and run the scripts manually, which gave a detailed error message.Hope it helps someone in the future.CommentShareAWS-User-4995022answered a year ago"


Question: Error when accessing Elastic Beanstalk environment Configuration

"I deleted a subnet ('subnet-4da38573') and now I can't access Elastic Beanstalk environment Configuration anymore.Error trying to access Elastic Beanstalk environment settings:Configuration Validation Exception: Invalid option value: 'subnet-f7c6d9ab, subnet-23746644, subnet-8f9188a1, subnet-4da38573, subnet-4742e00a, subnet-42e5314c' (namespace: 'aws: ec2: vpc', OptionName: ' ELBSubnets') : Subnet 'subnet-4da38573' does not exist.This error occurs in all our environments.I checked if 'subnet-4da38573' still referenced in other services, but we couldn't find it.FollowComment"

Answer: "0Accessing the environments through "eb cli", I could remove the deleted subnet from "eb config" file.CommentShareRochaJanswered 2 years ago"


Question: High write IOPS for MySQL instance even on low activity hours

"We recently took over a wordpress project using a MySQL db instance. A few days ago, it ran out of storage causing the site to crash which we found very very strange because the db had 185GB allocated and the application isn't that big or busy to eat up all of that. We first changed the space allocated to 250 GB to allow the site to load. We then ran optimize on the tables and were able to reclaim practically all of that 250 GB and the site loaded afterwards.We then monitored the DB and noticed that the free space was going down faster than what we are expecting and at a fairly constant rate (around 2.5 GB per 24 hours). We checked what queries are running using the show processlist command but no queries were coming up. Cron also wasn't running for the wordpress application so no background tasks there so we weren't sure what's going on.We then realized that the write IOPS was around 150-200 when monitored through AWS and never went down even if that time was already a slow day which would contribute to the space going down. This was also probably what caused the space to run out before. We are not sure where to check next exactly. If it would help, the instance is a t3.large mysql community instancethank youEdited by: dogfish on Apr 26, 2020 5:14 PMEdited by: dogfish on Apr 26, 2020 5:30 PMEdited by: dogfish on Apr 26, 2020 5:37 PMFollowComment"

Answer: 0I learned very recently that i could setup general logs for the mysql instance. I think i found the issue already and it looks like it's related to the current wordpress theme. We would be replacing the theme with a different theme.ThanksCommentSharedogfishanswered 3 years ago


Question: Cloudfront custom SSL not installing for naked domain

"EDIT: I think this is an issue with google admin settings.EDIT2: It's not a google admin setting, the naked domain redirect on that dashboard only handles http requests which im already redirecting with namecheap DNS.I am using an S3 bucket to host my site, Cloudfront to distribute it, and namecheap for the domain, DNS, and SSL Certificate.Below I've attached all the settings and screenshot of SSL certificate and as far as I can tell everything is correct. Certificate shows both www and naked domain in Namecheap and imported to ACM. Imported certificate is also in US-East-1 and I've defined cloudfront behavior to redirect http to https. However naked domain doesn't appear in details of ACM nor under custom SSL certificate details in Cloudfront.And when trying to navigate via HTTPS to my naked domain (https://example.com) I get a timeout error. Navigating any other way (example.com, www.example.com, https://www.example.com, http://www.example.com, http://example.com) all work. I'm totally lost at where I went wrong or if the bug is out of my hands and I need to refactor my architecture. Thanks!FollowComment"


Question: Database migration service error DATA_STRUCTURE:SQLite general error. Code <19>

"Hello:We have 18 DMS replicate tasks with origin endpoints from SQL server databases on premises to target ec2 SQL server endpoints. Same database versions.All tasks are replicating with this red status: "Running with errors". we have 2 x r5.2xlarge replication instances.cloudwatch logs are reporting always the same error.[DATA_STRUCTURE]E:SQLite general error. Code <19>, Message<UNIQUE constraint failed: events.identifier, events.eventType, events.detailMessage>What is causing this error?We dont know if the replication is going wellFollowComment"

Answer: "0You can ignore the SQLite errors.If your task(s) are in "Running with errors" flag, it implies that the DMS task is running fine, but some of its table(s) have failed.To find that out, check the "Table Statistics" on the Task page of the DMS Console and see which table(s) are flagged as failed/error there. Then, go to the DMS task logs and search for the table name and you should see the reason why those table(s) failed.CommentShareD-Raoanswered a year agoD-Rao a year agoDid this work for you?ShareDylan_Delport a year agoAny idea why these warnings are thrown in the first place? I've got Cloudwatch Alarms monitoring a metric for any errors/warnings so would like to have a better understanding before adjusting my metric to ignore SQLite textShare"


Question: Adjusting Memory to account for vCPU count on Batch

"Occasionally, Batch will place a job on an instance that has more CPU cores than I requested. My task can take advantage of the extra threads easily, but the memory requirements go up if that happens, often leading to an OOM (out of memory) crash.Is there a way to have a core-based memory limit? Or do I need to limit my job to only use the threads I requested?Related question - if I request 16 vCPUs for a job but the container runs on an instance with 128 vCPUs, is Batch able to place other containers on the same instance? In which case, trying to use 128 threads would potentially be counterproductive anyway?FollowComment"


Question: Overriding java logging config

"-rw-r--r--  1 yarn yarn   4.8G Jul 29 04:43 hadoop-yarn-timelineserver-ip-172-31-23-227.outJul 29, 2022 4:44:14 AM com.sun.jersey.server.wadl.generators.AbstractWadlGeneratorGrammarGenerator attachTypesINFO: Couldn't find grammar element for class javax.ws.rs.core.ResponseJul 29, 2022 4:44:14 AM com.sun.jersey.server.wadl.generators.AbstractWadlGeneratorGrammarGenerator attachTypesINFO: Couldn't find grammar element for class javax.ws.rs.core.ResponseJul 29, 2022 4:44:14 AM com.sun.jersey.server.wadl.generators.AbstractWadlGeneratorGrammarGenerator attachTypesINFO: Couldn't find grammar element for class javax.ws.rs.core.ResponseJul 29, 2022 4:44:14 AM com.sun.jersey.server.wadl.generators.AbstractWadlGeneratorGrammarGenerator attachTypesINFO: Couldn't find grammar element for class javax.ws.rs.core.ResponseJul 29, 2022 4:44:14 AM com.sun.jersey.server.wadl.generators.AbstractWadlGeneratorGrammarGenerator attachTypesINFO: Couldn't find grammar element for class javax.ws.rs.core.ResponseI've just found that the .out file of YARN timeline server is abnormally big and it consumes /mnt partition.The file just has tons of useless messages for me written by AbstractWadlGeneratorGrammarGenerator class of jersey-server module.AbstractWadlGeneratorGrammarGenerator.java...import java.util.logging.Logger;...private static final Logger LOGGER = Logger.getLogger( AbstractWadlGeneratorGrammarGenerator.class.getName() );...LOGGER.info("Couldn't find grammar element for class " + parameterClass.getName());...However, AbstractWadlGeneratorGrammarGenerator writes the message by Java logger, not log4j.Can I override Java logger configuration for EMR servers, especially YARN timeline server?FollowComment"

Answer: "1Accepted AnswerThis has been an outstanding issue until YARN-9554 which is fixed in Hadoop 3.3.0. However, EMR as of now packages only 3.2.1 in the latest EMR-6.7.0. I can confirm there is work underway to backport this to 3.2.1 for EMR which should be included in the upcoming release of EMR.As a workaround you can do the following:Login to the Master node of the EMR cluster to run the below commands or bake them as a bash script to submit it as a scriptrunner - EMR Step using console / CLI / SDKAdd logging properties to JREecho 'com.sun.jersey.server.wadl.generators.level = OFF' | sudo tee -a /etc/alternatives/jre/lib/logging.properties > /dev/nullRestart the Timeline Server to apply the changessudo systemctl restart hadoop-yarn-timelineserverPlease test the same in your lower environments and reply back if you have additional questions regarding the same.CommentShareSUPPORT ENGINEERKrishnadas Manswered 10 months agorePost-User-3418860 10 months agoThanks. It works well. I will add it as EMR step.Share"


Question: What processes managed RedShift connections that would explain initializing connections being stuck for 2m when connection count is < 250.

"Hello, I'm trying to understand how RedShift manages connections.I understand that RedShift has a connection limit of 500 which we aren't close to hitting, however we've will intermittently see connections be stuck at initializing for nearly 2m before finally resolving. This is on a new Lambda with normal pg to connect.Where is connection handling processed, does it have a queue? Does Redshift need to do additional work when using temporary credentials over connecting with username/password?FollowComment"

Answer: "0The leader node manages communications with client programs, refer https://docs.aws.amazon.com/redshift/latest/dg/c_high_level_system_architecture.htmlUsing temporary credentials involves additional services, namely IAM and STS, and with Federation an IdP (AWS Directory Service, your enterprise user directory, or a web identity provider) is also involved. Referhttps://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-overview.htmlCommentShareMilindOkeanswered a year ago"


Question: The Site can’t be reached after reboot the Lightsail

"I'm using WordPress multisite setup. Which is still under development So I didn't point to a domain and didn't set up a dedicated IP. I was using dynamic IP for the website. After I reboot the server IP has changed, But the website isn't loading "This site can’t be reached" message coming.Any idea How to fix this?FollowCommentiwasa EXPERTa year agoHi.Which are you?You expect the page to disappear after changing your IP address, but you can.You are in trouble because the page cannot be displayed after changing the IP addressShare"

Answer: "0Accepted AnswerThis problem is solved by editing wp_blogs  and wp_site  tables. All I had to do is change the old IP address into a new static one.CommentShareKeshananswered a year ago0Hi, @KeshanAs I commented, you may not understand what you are requesting.If you want to make it unreachable, SSH into Lightsail and run the following command: This is because bitnami follows dynamic IP address changes by default.$ sudo / opt / bitnami / configure_app_domain --disable-automatic-configurationCommentShareEXPERTiwasaanswered a year agoKeshan a year agoYes I'm in trouble because the page cannot be displayed after changing the IP addressShareKeshan a year agoAfter I run the above command "This site can’t be reached" error turns into 404. Even after I change the site URL from the DBShare"


Question: Amazon WorkMail - You have exceeded the sending limit for this account.

"We're unable to send outgoing emails with Amazon WorkMail: You have exceeded the sending limit for this account.We haven't been able to send any emails through WorkMail, hard to believe we have reached the sending limit.I already opened a support call and we received the message from:Hello,Thank you for contacting us. We see that your current sending limit is 50,000 messages per day. You can view the current sending rate and sending quota for your account on the Sending Statistics page of the Amazon SES console, or by using the GetSendQuota API.I have confirmed that your account is active and able to send email in the US East (N. Virginia) region.Domínio: hiperservicos.com.brFollowComment"

Answer: "0Hi,I'm sorry to hear you're encountering problems with sending mails via WorkMail. I'm sorry to inform you this is in line with the WorkMail terms of service. WorkMail is a business mail and calendaring solution which means its not meant for bulk/automated mailing. You can leverage SES for bulk/automated mailing.WorkMail has very strict monitoring on bounces and complaint messages. If your organization is causing too much of either you will receive a notification in your personal health dashboard. If you think your use case is a valid one, you can use that notification to work with the team to unblock your organization.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 5 months ago"


Question: "IoT policy with multiple clients, same certificate, different client ID, immediate disconnection"

"I have a device where i have multiple clients connecting to IoT using the same credentials.  Each client is using a different client ID.In the certificate policy, I have under    {                                                                                "Effect": "Allow",                                                                                "Action": [                                                                                "iot:Publish"                                                                                ],                                                                                "Resource": [  "arn:aws:iot:ap-pt:xxxxx:topic/abc/${iot:Connection.Thing.ThingName}/*" ]                                If I try to publish for example to a topic on one of the clients, let sayabc/MY_THING_NAME/hello, IoT will immediately disconnect the client.If I have the policy    {                                                                                "Effect": "Allow",                                                                                "Action": [                                                                                "iot:Publish"                                                                                ],                                                                                "Resource": [  "arn:aws:iot:ap-pt:xxxxx:topic/abc/MY_THING_NAME/*" ]                                Then I can happily publish to abc/MY_THING_NAME/hello, the message is accepted by the broker, and no client disconnect.I don' t understand why I have to put the specific thing name in the policy rule, and the "${iot:Connection.Thing.ThingName}" does not allow this through. Am i missing something here ? I understand that the client disconnection behavior occurs when the client breaks the policy, however this is not expected here I didn't think.FollowComment"

Answer: "0Hi Majh,you are correct that the disconnect happens when the client breaks the policy. In the specific case, all clients using a clientId different from the Thing Name will break the first policy when trying to publish to abc/MY_THING_NAME/hello. This is because the ${iot:Connection.Thing.ThingName} only resolves to the Thing Name when the the clientId is the same as the Thing Name.Assuming you really need to have multiple connections using the same certificate - which should only be the case when all connections are established from the same device - then you can use a certificate policy variable instead.If you are using AWS IoT Certificates you can use a CSR to populate Subject variables when creating the certificate with CreateCertificateFromCsr.Your policy would then be:{                                                                                "Effect": "Allow",                                                                                "Action": [                                                                                "iot:Publish"                                                                                ],                                                                                "Resource": [  "arn:aws:iot:ap-pt:xxxxx:topic/abc/${iot:Certificate.Subject.CommonName}/*" ]   }                Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 6 months ago"


Question: Why SNS Sandbox is unable to verify some phone number of a specific Telecom?

"Hi, I am currently using SNS to send transactional SMS messages to several users I'm in the Sandbox test so when I add new number I don't receive the verification code for a specific mobile number of certain telecom provider in Morocco but for other provider I received the code. Any idea on why is this happening?FollowComment"


Question: Quicksight Data Transfer to RDS

"Hi,When connecting QuickSight to RDS in the same region do you need to pay for data transfer?Is it necessary to connect QuickSight to customer's VPC or does QuickSight understands that RDS is inside AWS network and uses internal connections?Thank you.FollowComment"

Answer: "0Accepted Answerif quicksight is connecting to an RDS instance in a VPC, the connection is enabled via ENI placed in VPC. This ENI will allow quicksight to access RDS within a VPC. hence no data transfer charges.if the traffic crosses AZ, then inter-AZ charges would apply.If the database is on AWS and in the same AWS Region as your QuickSight account, you can auto-discover the instance to make connecting to it easier. To do this, you must grant QuickSight permissions to access it. For more information, see : https://docs.aws.amazon.com/quicksight/latest/user/scoping-policies-for-access-to-aws-resources.htmlif the database is in a VPC, then there are different set of steps needed to connect it to quicksight, depending on whether its in default VPC or non default VPC.you can read about the steps in detail here: https://docs.aws.amazon.com/quicksight/latest/user/configure-access.html#ip-address-rangesCommentShareEXPERTVikesh_Panswered 3 years ago"


Question: AppSync use / access CloudFront Viewer Headers

"CloudFront has a number of headers regarding viewer information that we would like to access in our AppSync vtl / resolvers, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-cloudfront-headers.htmlSpecifically, we'd like to use CloudFront-Viewer-Country-RegionIn a 'normal' Cloudfront -> S3 origin for example, we would add an Origin request policy to forward the headers on.How is this possible in Appsync please?FollowComment"

Answer: "0You can access all request headers via the $context.request.headers construct.CommentShareAWS-User-4340776answered 7 months agochris5argent 7 months agoHi thanks - yes we know this, but the point is it doesn't include all the headers from cloudfront.e.g. we get cloudfront-viewer-country but not cloudfront-viewer-country-regionShare0Hey the way I found to solve it is to put Cloudfront distribution in front of the app-sync one.You can configure this new CF distribution to include the headers so they can be used in the resolvers.P.S.: AWS it would be nice to be able to to configure the header behavior of the CF you guys create for the AppSync instance so we do no need to do this :)CommentShareignaciolarranagaanswered 2 months agochris5argent 2 months agoThanks - yeah, this is what we've ended up doing by adding a kind of reverse proxy to our front end's cloudfront dist.Share"


Question: IoT Core endpoint redirecting published to another account

"We have several environments in IoT core for the shale of this questions let's call them dev and Staging. Dev environment has aaaaaaaa-ats.iot.eu-west-1.amazonaws.com endpoint and staging has bbbbbbbbb-ats.iot.eu-west-1.amazonaws.com endpoint.We have a device provisioned with JITP in dev environment which connects without any issue to dev environment as expected.Now, if we change the device endpoint to "bbbbbbb...." keeping dev certificates and we try to publish a message. The device connects to dev environment and we get the message in dev environment. Is this an expected behaviour?FollowComment"

Answer: "1Hi,To ensure that the device connects to the account which corresponds to the specified endpoint, you need to:register the certificate in both accounts. This is called  Multi Account Registration. Follow the instruction for registering a client certificate signed by an unregistered CAensure the MQTT client you use sends the SNI extensionRegards,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 5 months ago0I discussed this with one of my engineers in the pastI think It is not expected behavior for a device to be able to connect to the wrong environment (in this case, the "dev" environment) with the wrong endpoint (in this case, the "bbbbbbb...." endpoint that belongs to the "staging" environment).When a device is provisioned with Just-in-Time Provisioning (JITP) in AWS IoT Core, it receives a unique X.509 certificate and private key that is used to authenticate the device when it connects to AWS IoT Core. The device also receives an endpoint URL that it should use to connect to AWS IoT Core.If the device attempts to connect to the wrong endpoint URL, it will not be able to establish a connection with AWS IoT Core. The device should only be able to connect to the correct environment (either "dev" or "staging") using the correct endpoint URL for that environment.It is possible that there may be some issue with the device or its configuration that is causing it to connect to the wrong environment. It would be helpful to check the device logs and configuration to try to determine the cause of the issue.@seekrsiCommentShareSeanSianswered 5 months agoGavin_A 5 months agoIf the device attempts to connect to the wrong endpoint URL, it will not be able to establish a connection with AWS IoT Core.For general certificates that do not use multi-account registration or the SNI field for connection, this actually will work. IoT Core will check the certificate id (hash) and determine which account it belongs to, and then if the policy allows, establish a connection to that AWS account regardless of the endpoint FQDN used.Share"


Question: Client VPN: Any way to require password authentication without AD?

"It seems like with using the mutual authentication option for Client VPN, there is no way to add another obstacle to ingress for anyone who has the configuration file. Is this correct? I just wanted to make sure that's true before I tell the stakeholder.FollowComment"

Answer: 0You also can (and should) use a specific active directory group to allow access.CommentSharecloudbuttonanswered 4 years ago


Question: Creating Lambda functions not responding

"Hello,I am trying to creat a lambda function for Alexa Skill support for Home Assistant, but when I press Create Function, the side is loading, but nothing happends. Afte a while I am back on the same page.FollowComment"

Answer: "0Hello Ahmad,sorry for my late reply. I am logged in as "Stammbenutzer", so I should have enough rights, or?The other proposed solutions from you, I have tried out. even on a different PC.Attached I ad a screenshot. It is strange, the red X marks an error, but which?Also the last called remark: before 53year !Thanks for your supportCommentSharerePost-User-1753826answered 3 months agoAhmad Tariq 3 months agoHi there,Thank you for your response.To rule out the possibility of the issue being related to your user permissions, could you test by temporarily adding the "AWSLambda_FullAccess" permissions policy to your user (Stammbenutzer).This will give you admin permissions to interact with the AWS Lambda service in any way you like. If this resolves the issue, we will know that the issue is due to a lack of permissions, which you can go back an make then more granular if you do not wish to to have admin rights.Note: The "AWSLambda_FullAccess" is an AWS managed policy which you do not need to create, rather you can simply attach it to your user from the IAM console, as shown after step 7 on this document [1].I hope this helps!Ahmad[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.htmlShare0Hi there,I understand that you are trying to create a Lambda function, however upon clicking the "Create Function" button, you are not able to proceed to the next step.This could be due to multiple factors such as temporary networking issues, browser issues etc.There are a few steps you can take to help in pinpointing the root cause of this issue. 1. Clear the cache on your browser, and try again. 2. Test on another browser (Chrome & Firefox are recommended). 3. Test on incognito mode. 4. Ensure that you (the user), has sufficient IAM permissions to create Lambda functions in the region.Kind regards,AhmadCommentShareAhmad Tariqanswered 3 months ago"


Question: 'docker push' to ECR fails

"I am attempting to push a 12GB docker image to ECR. It works for all layers except the large one which retries and fails repeatedly..I am logged into an EC2 amazon-linux instance.  Docker version 18.06.1-ce, build e68fc7a215d7133c34aa18e3b72b4a21fd0c6136I am logging into ECR the standard way: https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.htmlaws ecr get-login --region ${REGION} --no-include-email > login.shthis generates the command to login to ECR which looks something like which my script executes and the login is successful.docker login -u AWS -p <reallylongpass> https://123123123123.dkr.ecr.us-east-1.amazonaws.comThe local docker image looks great and has been tagged properly.The image is VALID and I am able to 'docker run'/'docker exec -it <containerid> bash' and launch it just fine.'docker images' looks like:REPOSITORY                                                             TAG                 IMAGE ID            CREATED             SIZE123123123123.dkr.ecr.us-east-1.amazonaws.com/myrepo                    latest              1faee4304174        4 days ago          12.1GBmyrepo                                                                 latest              1faee4304174        4 days ago          12.1GBNext I am attempting 'docker push'. My proxies look good.docker push ${ECR_ID}.dkr.ecr.${REGION}.amazonaws.com/${IMAGE}:latestThe command pushes multiple layers successfully to the remote ECR repo. Output looks like:The push refers to repository [123123123123.dkr.ecr.us-east-1.amazonaws.com/myrepo]5cf889a10bb3: Pushedb9d2d8033662: Pusheda0eabe3f044d: Pusheded3c559e8570: Pushed7dd2c6c87cb8: Pushed879ed9fddabb: Pushed5c0964ce8332: Pushed2466533a61e0: Pushed5c13fd4091c4: Pushed424b600de233: Pushing ==>                                                ]  634.5MB/11.14GB0c62105c5e04: Pushed74ef47ea2b76: Pushing ==================================>                ]  212.8MB/307.9MB742a3cb8ef5b: Pushed9356a924d1e7: Pushing ==================================================>]  187.1MB5f70bf18a086: Pushed9b0885650d8b: Pushing =================================>                 ]  130.1MB/196.6MBNow at this point, all the layers except for the largest one (the 11.14GB) complete pretty quickly. The 11.14GB layer is much bigger and takes ~5 minutes total.When the 11.14GB layer finally reaches 100%, it will show this line and sit there for about 1 min.424b600de233: Pushing ==================================================>   11.3GBThen it will show:424b600de233: Retrying in 5 seconds424b600de233: Retrying in 4 seconds ...and restart the push again for that large layer. It will repeatedly fail./var/log/docker shows: "Upload failed, retrying: EOF". I am completely baffled as to what is going on. I enabled verbose docker logging (see link below), but this hasn't revealed anything deeper yet. I haven't exceeded any ECR limits I don't think?Please help, thank youecr limits:  https://docs.aws.amazon.com/AmazonECR/latest/userguide/service_limits.htmldocker debug mode: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-debug-mode.html/var/log/docker:time="2018-12-10T17:04:25.037918492Z" level=debug msg="UnmountDevice START(hash=3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)" storage-driver=devicemappertime="2018-12-10T17:04:25.037947493Z" level=debug msg="Unmount(/var/lib/docker/devicemapper/mnt/3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)" storage-driver=devicemappertime="2018-12-10T17:04:26.208305666Z" level=debug msg="Unmount done" storage-driver=devicemappertime="2018-12-10T17:04:26.208566225Z" level=debug msg="deactivateDevice START(3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)" storage-driver=devicemappertime="2018-12-10T17:04:26.208671326Z" level=debug msg="devicemapper: RemoveDeviceDeferred START(docker-202:1-1576181-3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)"time="2018-12-10T17:04:26.248795710Z" level=debug msg="devicemapper: RemoveDeviceDeferred END(docker-202:1-1576181-3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)"time="2018-12-10T17:04:26.248824617Z" level=debug msg="deactivateDevice END(3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)" storage-driver=devicemappertime="2018-12-10T17:04:26.248837221Z" level=debug msg="UnmountDevice END(hash=3917bed0c364c431655d753a41aa9da4e2db2d954497a3f0ed115ce52131ef95)" storage-driver=devicemappertime="2018-12-10T17:04:27.838363250Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:04:39.835637837Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:04:51.860897072Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:04:51.866517706Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:05:03.838044567Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:05:15.836698076Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:05:27.835978356Z" level=debug msg="Calling GET /v1.25/containers/json?limit=0"time="2018-12-10T17:05:35.645825351Z" level=error msg="Upload failed, retrying: EOF"AFTER MULTIPLE ATTEMPTS /var/log/docker EVENTUALLY CONTAINS:171 time="2018-12-06T17:33:40.903623164Z" level=error msg="Upload failed, retrying: EOF"  172 time="2018-12-06T17:43:01.903052850Z" level=error msg="Upload failed, retrying: EOF"  173 time="2018-12-06T17:52:18.852081979Z" level=error msg="Upload failed, retrying: EOF"  174 time="2018-12-06T18:01:42.852832787Z" level=error msg="Upload failed, retrying: EOF"  175 time="2018-12-06T18:11:17.852544006Z" level=error msg="Upload failed: EOF"  NOTE: I created a small image (<2GB) as a test and I am able to push this one with no issues..  I wonder why the larger image/layer will not push ?!?Edited by: GregF2112 on Dec 10, 2018 10:30 AMFollowComment"

Answer: "0Thanks for the reply. I thought the same thing, so I recreated by docker image, and by trimming down a .tar file which is added to the image, I was able to reduce the total size down from to 12.1GB to 9.09GB.The largest layer is now only 8.268GBea66653845d4: Pushed847e0c1e35ce: Pushing ==================================================>]  8.268GB6be84415c641: WaitingI attempted again the 'docker push' and same symptom occurs.time="2018-12-11T00:12:13.601180691Z" level=error msg="Upload failed, retrying: EOF"CommentShareGregF2112answered 4 years agomarkkc 6 months agoDid you ever find the solution to this issue?I'm pushing a load of images to ECR concurrently.  They share a 6GB base image, then each add around 1-100MB on top of it.Share0Looks like you are hitting the max layer size limit: 10G here.Maximum layer size ** 10,000 MiBAnd those are hard limits.Try break that 11.14GB layer to two layers if you can I would suggest.CommentSharestarchxanswered 4 years ago"


Question: Amazon Forecast UI unresponsive to dataset update

"Using the Amazon Forecast UI, I successfully created a forecast. But it does not allow me to update my dataset. In the dataset group dash board, I go to datasets, click on my target time series dataset name (previously uploaded), under 'dataset imports', I click 'create dataset import'. In the 'Create target time series dataset' page I go to dataset import details section and provide the the dataset import name and data location. Leave the lambda role the same and click 'start' but nothing happens. I don't get any error message. Simply nothing happens. Why?FollowComment"

Answer: "0Tried out the same steps as mentioned here to re-import, unfortunately I was not able to replicate the issue, in my test the DSI import started and the screen got updated. I would request you to open a ticket with AWS support and one of our support engineer should be able to help you.Updating data documentation - https://docs.aws.amazon.com/forecast/latest/dg/updating-data.htmlConsole use dataset import - https://docs.aws.amazon.com/forecast/latest/dg/gs-console.htmlCommentShareSUPPORT ENGINEERStewyn_Canswered a year ago"


Question: com.amazonaws.SdkClientException: Unable to execute HTTP request: Timeout waiting for connection from pool"

"I encountered this error when writing a large size Parquet file onto an S3 bucket, "com.amazonaws.SdkClientException: Unable to execute HTTP request: Timeout waiting for connection from pool"I included the following, but still the job stops.[{"Properties": {"fs.s3.maxConnections": "500",}}]When I reduce the size of the data, everything works fine.Any insights would be very much appreciated. ThanksFollowCommentiwasa EXPERTa year agoHi, Please tell me the code of the writing part and the size of the file you want to upload. Do you reproduce the problem 100%? Or do you reproduce it once in a while?Share"

Answer: "0Hi rePost-User-9456311,From my understanding, this seems like this is an issue about the parquet file size since when you reduce the size of the data everything works. I would try to perform a multipart upload with a SDK and see if that solves your issue or not.  Here are some links that should helphttps://aws.amazon.com/premiumsupport/knowledge-center/s3-large-file-uploads/https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.htmlCommentShareZion_Canswered 10 months ago"


Question: Use same CodeBuild project for multiple GitHub repositories

"I have a GitHub repository for which I have successfully created a CodeBuild project that gets run automatically on pull request events. I now have a scenario in which I want to extend that CodeBuild project to multiple GitHub repositories. I updated the repositories to have the same my_buildspec.yml file and also updated the "Sources" section of the CodeBuild project to point to the new GitHub repositories. But, the builds are only getting triggered for events on the primary source and not on the secondary source. All the GitHub repositories are using the same buildspec file with the same name and content and in the default branch.How can I ensure that the same CodeBuild project gets triggered for events on secondary source GitHub repositories? I know I can create multiple CodeBuild projects (one for each GitHub repository) but is there a way to use the same CodeBuild project for multiple GitHub repositories?FollowComment"

Answer: "0Accepted AnswerHey samkit-juvoxaThank you for your question on how to dynamically update your project using Codebuild with multiple GitHub Repositories.I have replicated your use case in my own environment using  AWS CodePipeline and configured it using two GitHub repositories as  sources  which dynamically triggered Codebuild. Below are the steps I took.Currently this feature update your Build Project using CodeBuild with multiple GitHub resources to automatically trigger CodeBuild isn't an available feature that CodeBuild provides. However Integrating your CodeBuild project into CodePipeline with fix this problem.Here you can find how CodePipeline integrates with CodeBuild to use multiple input sources  as outlined in your use case [1] .First create two separate GitHub repositories in an account with different source code in each.Then configure a CodeBuild project with a name and a buildspec that outputs the source code in a giving directory [2].Next  continue to the CodePipeline Console and create a pipeline . Configure the source page and select GitHub as the source provider, which prompted a sign in, in order to authorize application access to the account. When the account is authorized this may you chose your GitHub repository for the source location for your pipeline, along with the branch . [3]Then configure the Build section , you should chose CodeBuild and from here chose the Build Project you created in step 2.You should chose to skip the deploy stage, as this step was is necessary for the pipeline.When the build is complete, you can edit the source section of the Pipeline, to add a “new stage”. Here you will prompted to sign into GitHub. When authorized choose add source and pick the second repository you've created and save.When commits are made to either of the GitHub repositories they will automatically trigger the Pipeline which your CodeBuild project is associated to.Please feel free to reach out to me with any questions or concerns .James[1] https://docs.aws.amazon.com/codebuild/latest/userguide/sample-pipeline-multi-input-output.html[2] https://docs.aws.amazon.com/codebuild/latest/userguide/getting-started-create-build-project-console.html[3] https://console.aws.amazon.com/codesuite/codepipeline/start?region=us-east-1CommentShareaws-jamesobanswered 2 years ago"


Question: Can SCT be used to auto generate a data migration when both source and destination schemas exist yet they are different engine types?

I have a SQL Server 2016 database with several tables and 30+ million rows . Currently the Microsoft instance is on premises but it could be copied onto an EC2 instance. We are still investigating the feasibility of this. The target database is an Aurora PostgreSQL database. We already have a working target schema for PostgreSQL.What i wish to understand is whether SCT can automate the process of comparing the two (similar but not identical schemas) and generate a migration process.Even if there is a fair bit of hand holding and decision making involved - I will consider it a win.Let me know if I need to provide more details to answer the question.RegardsFollowComment

Answer: "0Accepted AnswerSCT as the name implies is schema conversion tool, What you trying to do is schema diff, SCT does not do schema comparison.  What you can do is,  use SCT to covert your Sql Server into a new schema in Aurora and then use Schema diff option of pgadminhttps://www.pgadmin.org/docs/pgadmin4/development/schema_diff.htmlCommentShareDevinder-theDBGuyanswered a year agoAWS-User-42 a year agoOk, I've reread your answer.  If I understand you correctly, the outcome would be a list of differences for the two databases but only between the two postgreSQL schema's.    Is there a process for taking this list of schema differences and then taking advantage of the data migration service to bulk migrate?Share0SCT was initially built to create the new "target schema" - via an easy push-button UI.Even so, .. .. it can ALSO help build the TRANSFORMATION-Rules of Source-database to an ALREADY-existing TARGET-database schema.To me (at least) SCT was smart enough - enabling me to define a VERY SIMPLE transformation-rule - from Oracle to Postgres (to copy over 3 tables even tho the DDL data-types were different).Even so .. Yes! You can use Schema Conversion Tool to also do MANUAL ad-hoc data transfers!  If you'd like to automate this transfer (say, midnight daily), you will need to "deploy" (from SCT of course) to AWS DMS service.NOTE: COST!! AWS DMS is a "traditional EC2-style" service (unlike the serverless Glue ElasticViews), as in .. it MUST run 24x7x365 and there is NO automated way to "shut it down" (via EC2-console or EC2-cli) when it's not in use (this is, as of Dec 2021).WARNING: It does NOT work with AWS SSO, or any other  M O D E R N  security-model that requires SESSION-KEY in addition to ACCESS-KEY and SECRET-KEY.   So, it was a failure at our Enterprise environment, where traditional IAM-Users are banned.  Clearly, everyone at the SCT-team didn't feel it important to support enterprises in their ROBUST-security efforts.  It's really sad that no one at SCT team even thought of leveraging the ~/.aws/credentials [default] credentials either.CommentSharesarmaanswered a year ago"


Question: Model type of User-Personalization recipe

What is the model family/type behind Amazon Personalize's User-Personalization recipe?FollowComment

Answer: "1The underlying technology is decribed in the paper "Temporal-contextual recommendation in real-time".However the recipe also has other additional features descibed in the documentation, such as optimizing recommendations for a business metric and native processing unstructured text data using NLP among others.CommentShareAnna_Ganswered 10 months ago"


Question: Cannot delete certificate from ACM

"I have an old certificate in ACM which was created through Terraform, and is in the "Issued" state. Unfortunately, now I cannot delete it because it is shown as "In use", even though it's not, at least not by me.I tried deleting the certificate manually from the ACM console, but the deletion page shows that it is in use by account 061510835048, which is one of AWS's internal accounts (see https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-api-with-vpclink-accounts.html)How can I unlink it? I have already tried deleting all my resources, but it seems something got stuck. I read that this can happen and normally it requires contacting the AWS customer service, but I don't have access to that. Can someone help?This is blocking me because I cannot destroy resources and get back to a clean slate.FollowComment"

Answer: "0Are you using the certificate together with a custom domain in api-gateway (or another service)?Removing the domain mapping from the API should make it possible to delete the certificateCommentShareEXPERTBen Bridtsanswered 5 months agomichelem 5 months agoYes, I am. Or I should say "was" because I deleted everything but still cannot delete the certificate. It's apparently stuck, linked to a ghost CloudFront distribution.Share"


Question: S3 Request tier 2  - why so high

"Hi,I've got a very low use website using S3 to store some media files (audio and user owned images).There are about 10 'test' users on the site each month and S3 Requests-Tier1 seem fine, very low, **but   **S3 Requests-Tier2 seems very high for a test server?Amazon Simple Storage Service Requests-Tier1 $0.005 per 1,000 PUT, COPY, POST, or LIST requests 72.000 Amazon Simple Storage Service Requests-Tier2$0.004 per 10,000 GET and all other requests 38,060,093.000 I'm confused as to what these 38,060,093.000 requests are and I'm struggling to find out.I'd greatly appreciate any advice as to how I can work out what's happening here.Please keep in mind that I'm quite new to S3 in general.###################################################################################EDIT:  I realise that the answer might be somewhere within the Storage Lens but I'm struggling to find it.###################################################################################Many thanksMFollowComment"

Answer: "0You could find this through CloudTrail logs if 'Data Events' are already enabled.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-request-identification.html#cloudtrail-identification-object-accessAlso, check this - https://docs.aws.amazon.com/AmazonS3/latest/userguide/aws-usage-report.htmlCommentShareRajesh Sanswered 10 months ago"


Question: How AWS Client VPN costs are calculated

"We are evaluating the possibility of enabling the AWS VPN, but we want to know how it works in terms of how it is charged...We understand that there are 2 basics concepts that are considered in the VPN use charge: time that VPN is enabled and time that connections through make use of the VPN.... right?We believe that this service was charged only per use, but time that should be considered to enable a VPN during a contingency could impact our RTO. That is why we need to know if it is possible to have a VPN endpoint "configured" and only "enable/turn it on" when necessary for contingency and **only ** be charged for that usage while endpoint is enabled...Thanks in advanceFollowComment"

Answer: "0In AWS Client VPN you are charged for the number of active client connections per hour and the number of subnets that are associated to Client VPN per hour.   The pricing is different per region.  SO you will pay a small monthly keeping the connection configured, but the bulk of charges would happen when you use the connection.https://aws.amazon.com/vpn/pricing/CommentSharetedtrentanswered 5 months ago"


Question: Comprehend Training Set Format

"We had a vendor help setup our training set for comprehend custom classification and we are now questions the design.We know its a csv with class in the first column and text in the second but they design it that each line of text (from textract) should be single quote wrapped and comma delimited. We are questioning should it be one long line of text wrapped in double quotes for the text column of the csv.Is this IncorrectDrama, "['Here I am today.', 'Lots of text on lines.', 'Welcome to my example.']"Is this correctDrama, "Here I am today. Lots of text on lines. Welcome to my example."FollowComment"

Answer: "0Hi,Both the example formats that you provided are correct in the sense that the second column in both of your examples are enclosed within a double quote. As long as you create a valid two-column CSV file format, i.e. label in the first column and text/documents in the second column, you should be fine. However, the fact that both of your examples contain a space after the first column (i.e., 'Drama,') can make the file invalid though. You should avoid having a space after the comma separator. As for your example:Drama, "['Here I am today.', 'Lots of text on lines.', 'Welcome to my example.']"it will be considered as four-column CSV file. Whereas if you remove the space after 'Drama,' as below,Drama,"['Here I am today.', 'Lots of text on lines.', 'Welcome to my example.']"it will be considered as a valid two-column CSV file.CommentShareNavin_Yanswered 5 months agoTroj 5 months agoThank you on that for the reply.on the second columndoes comprehend then use the ' and ,  as part of the evaluation.  Meaning it thinks the document has ' and , in the text?The reason we ask is that there was a belief that  example 1 below comprehend would treat that as a list of phrases in the 2nd column.Or it is that comprehend treats all text in the 2nd column as one long list of text.Example 1"['Here I am today.', 'Lots of text on lines.', 'Welcome to my example.']"Example 2"Here I am today. Lots of text on lines. Welcome to my example."Share"


Question: I CANNOT CONNECT TO AWS IOT USING PAHO GOLANG

"I have the following code made using golang:`package mainimport ("crypto/tls""crypto/x509""fmt""log""os""os/signal""path/filepath"MQTT "github.com/eclipse/paho.mqtt.golang")func main() {MQTT.DEBUG = log.New(os.Stdout, "", 0)MQTT.ERROR = log.New(os.Stdout, "", 0)// Get working dir pathdir, err := os.Getwd()if err != nil {panic(err)}// ArchivosKeyPath := filepath.Join(dir, "assets", "otra_prueba.private.key")CertPath := filepath.Join(dir, "assets", "otra_prueba.cert.pem")CAPath1 := filepath.Join(dir, "assets", "root-CA.crt")ClientId := "basicPubSub"Endpoint := "a2fqp5ya964aj9-ats.iot.us-east-1.amazonaws.com"// Carga de certificadostlsCert, err := tls.LoadX509KeyPair(CertPath, KeyPath)if err != nil {panic(err)}certs := x509.NewCertPool()caPem1, err := os.ReadFile(CAPath1)if err != nil {panic(err)}certs.AppendCertsFromPEM(caPem1)tlsConfig := &tls.Config{Certificates: []tls.Certificate{tlsCert},RootCAs:      certs,}// Carga de opcionesoptions := MQTT.NewClientOptions()options.AddBroker(fmt.Sprintf("tcps://%s:8883/mqtt", Endpoint))options.SetClientID(ClientId)options.SetTLSConfig(tlsConfig)// ConexionmqttClient := MQTT.NewClient(options)if token := mqttClient.Connect(); token.Wait() && token.Error() != nil {panic(token.Error())}fmt.Println("[MQTT] Connected")quit := make(chan struct{})c := make(chan os.Signal, 1)signal.Notify(c, os.Interrupt)go func() {<-cmqttClient.Disconnect(250)fmt.Println("[MQTT] Disconnected")quit <- struct{}{}}()<-quit}`//--------------------------------------------------------------------------------Output the following response:$ go1.20.2 run cmd/main.go[client]   Connect()[store]    memorystore initialized[client]   about to write new connect msg[client]   socket connected to broker[client]   Using MQTT 3.1.1 protocol[net]      connect started[net]      connect got error EOF[client]   Trying reconnect using MQTT 3.1 protocol[client]   socket connected to broker[client]   Using MQTT 3.1 protocol[net]      connect started[net]      connect got error EOF[client]   Failed to connect to a broker[store]    memorystore closedpanic: network Error : EOF// ---------------------------------------------------------------------------------I think I'm using the certificates wrong.How can I connect to the mqtt brokerFollowComment"

Answer: "1Hi Guillermo. I take it that the certificate is registered in IoT Core? Do you have an IoT policy attached to that certificate? Does that policy allow Connect?CommentShareEXPERTGreg_Banswered 2 months agoGuillermo-4331550 2 months agoI have the following policies:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["iot:Publish","iot:Receive"],"Resource": ["arn:aws:iot:[Region]:[account]:topic/sdk/test/java","arn:aws:iot:[Region]:[account]:topic/sdk/test/python","arn:aws:iot:[Region]:[account]:topic/sdk/test/js"]},{"Effect": "Allow","Action": ["iot:Subscribe"],"Resource": ["arn:aws:iot:[Region]:[account]:topicfilter/sdk/test/java","arn:aws:iot:[Region]:[account]:topicfilter/sdk/test/python","arn:aws:iot:[Region]:[account]:topicfilter/sdk/test/js"]},{"Effect": "Allow","Action": ["iot:Connect"],"Resource": ["arn:aws:iot:[Region]:[account]:client/sdk-java","arn:aws:iot:[Region]:[account]:client/basicPubSub","arn:aws:iot:[Region]:[account]:client/sdk-nodejs-*"]}]}ShareGreg_B EXPERT2 months agoI think the policy looks OK. Is it attached to the certificate?ShareGuillermo-4331550 2 months agoyes, i attached that policy to the certificateShare"


Question: Error while disabling GuardDuty from delegated admin

"Hello All,I am getting below error while am trying to disable guard duty. I have disassociated all member accounts under account tab but the error would still remain. Can anyone help with this?ErrorThe request is rejected because the current account cannot delete detector while it has invited or associated membersNaveenFollowComment"

Answer: "0Hello,I would like to inform you that basically this error occurs due to the following two reasons:-Reason 1:-  If there are still one or more than one associated members accounts which are currently not removed.In this case, you will get the same error message and so you have to remove all the associated member accounts, however, as you said you don’t have any associated members currently. Hence, we can rule out this finding.Reason 2:- If you have configured a Delegated Admin for GuardDuty from your Organisation master account.In this case, although the associated member accounts are removed but still you will get the same error message because the Organisation master account has enabled a Delegated Admin account. So, in this case, you have to login to the Organization master/root account, and then have to remove the Delegated Admin account by navigating to the GuardDuty console through the Organisation master/root account ID.You can refer to the below link, in order to know more about “Delegated Admin”:-https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.htmlI believe this might be the current scenario of your environment and thus you are getting the error as “The request is rejected because the current account cannot delete detector while it has invited or associated members”. I would request you to follow the below steps:-STEP1:- Login to your Organization master account.STEP2:- Navigate to GuardDuty console.STEP3:- Click on “Settings” and then go to “Delegated Administrator” section.Here, you will see the Delegated Admin account and then click on “Remove”Once it is removed, then go to your AWS account and try to disable the GuardDuty once again.Have a nice day!CommentShareSupport Engineeranswered 10 months ago"


Question: Improving accuracy of industry terms

"I am trying to develop streaming speech-to-text for medical use. While Amazon Transcribe Medical is good for most medical terminology, I cannot get it to recognize common dosing and rate phrases.Examples of failing phrases:1- "Administered at a rate of 5 mcg/kg/hr"2- "begin at a starting dose of 8 mg/kg"The spoken pronunciation of the dosing would be:1- "mike-per-kig-per-hour"2- "mig-per-kig"In both of these examples, the fractions are either ignored or read out as "mike pir" or "months per cake", or sometimes it just crashes with a 500 error.I have tried:1- Adding a custom vocabulary with the following relevant entries:PhraseIPASoundsLikeDisplayAsmig-per-kigmig-per-kigmg/kgmike-per-kig-per-hourmike-per-kig-per-hourmcg/kg/hr2- I tried varying the medical specialty with no improvement.3- I tried using the regular Amazon Transcribe with the custom vocabulary, as well as a 10,000 word language model with many examples of these phrases in context.4- I can get more reliable results by not verbally abbreviating the phrase. Instead of saying "mikes per kig per hour", saying "micrograms per kilogram per hour", but demanding providers to speak in this verbose manner is going to be met with annoyance and resistance to using the service.Am I using the vocabulary table wrong? Is there something else I can do to improve the accuracy of these phrases? It pains me because the accuracy is otherwise very good, but missing common dosing phrases is unfortunately a small but critical deal breaker.FollowComment"

Answer: "0Accepted AnswerI think I have found the answer to my own problem.When I changed the custom vocabulary and removed the "/", it read out the abbreviations as expected.Amazon team, please create an error for invalid characters returned from the custom vocabulary.TLDR: It is possible to create a custom vocabulary with invalid characters without an error. When you go to use the custom vocabulary, transcription will silently fail.CommentSharerePost-User-4724600answered 23 days ago"


Question: How to build a project combining code from two repositories

"Hello,I have an application whose code is split between two repositories, and I would like to use code pipeline to combine them.The first one contains the actual code and needs to be built.The second contains a .env file with parameters needed to run the build. It also needs to be deployed to Beanstalk for the application to run properly.What I tried so far:I defined a source that is triggered by commits to repo A, and outputs the artifacts to SourceArtifacts.Then I defined another source that is triggered by commits to repo B, and outputs the artifacts to SourceArtifacts2.Then I defined a Build stage that uses SourceArtifacts and SourceArtifacts2 as Input Artifacts, runs the build command and outputs to BuildOutput.Finally I defined a deploy stage that gets the code from BuildOutput and deploy to Beanstalk.My problem is that when the build runs it can't access the values in the .env file, so it fails.Also the .env file from repo B is not deployed.I was wordering if there's any specific workaround to achieve this.thanksMFollowComment"

Answer: "0Accepted AnswerYes you're right, defining a CodeCommit repo source in the console sets up the EventBridge Rule as I described anyway.What's more relevant is that you'll get only one of SourceArtifacts or SourceArtifacts2 populated depending on which repo triggered the build. So you can't rely on either and may need to clone both repos as part of your CodeBuild setup, then access the files you need from these clones.CommentShareEXPERTskinsmananswered 4 months ago0Do you want to actually trigger a build when repo B changes or just when repo A changes?  If the latter then maybe an option is to just have repo A as a source, and have a CodeBuild step where you clone repo B and access the files you need.CommentShareEXPERTskinsmananswered 4 months ago0The ideal would be to trigger a build both when one of the two changes: I need a new build when the code changes but also when a config param changes.But the important thing would be to have the build stage (Codebuilder) able "to see" both repos to actually build.CommentSharerePost-User-3116220answered 4 months ago0Ok then I would have repo A as the source for your pipeline, and create an EventBridge rule on events from repo B that triggers your pipeline when repo B changes.https://docs.aws.amazon.com/codecommit/latest/userguide/monitoring-events.htmlhttps://docs.aws.amazon.com/codeartifact/latest/ug/configure-service-events-codepipeline.htmlCommentShareEXPERTskinsmananswered 4 months ago0I think this is not necessary. To trigger the pipeline I can just define two sources, and I did it.My problem here is in the builder itself.What I am trying to do is to have Codebuilder to take the code from repoA, then the code from repoB, put them together and then run "npm run build" as defined in the buildspec file.What is happening is that Codebuilder triggers the run but can't see the values from the .ini file in repoB, so it fails.CommentSharerePost-User-3116220answered 4 months ago0OK thanks for that.I guess I am going to add the .env to the repo, I can't see any other flexible solution for my use case.thanksMCommentSharerePost-User-3116220answered 4 months ago"


Question: Accessing host metadata from ECS tasks

I know that it's possible to access metadata about ECS tasks using the ECS task metadata endpoint. Is it possible to access the host metadata from a task if the task is running on an ECS EC2 instance? How about from an ECS Fargate task?FollowComment

Answer: "0Accepted AnswerHello bwhaley,If you are running your ECS task on ECS container instances (EC2 type), you can call the EC2 IMDS endpoint (http://169.254.169.254/latest/meta-data/instance-id) to get the host metadata.However, this will not be allowed for ECS tasks running on ECS Fargate.Hope this is helpful!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 5 months agobwhaley EXPERT5 months agoThanks. Quick follow up question: can the ECS task on EC2 then assume other roles and/or use the permissions of the host?Sharebwhaley EXPERT5 months agoAnswered the follow up question myself: https://aws.amazon.com/premiumsupport/knowledge-center/ecs-container-ec2-metadata/ShareVenkat Penmetsa SUPPORT ENGINEER5 months agoGreat, thanks for the update!Share"


Question: Having issues with communications between EC2 vms on the same subnet

"I have an issue with EC2 vms not able to communicate with each other and hoping perhaps you can assist.I have 4 instances all on the same subnet and vpc.I have all traffic allowed to the subnet range of /20 on both inbound and outbound with regards to the security groupsEC2 B can be pinged by all but A, C and D can’t be pinged by B or each otherCan’t telnet to listening port on B either and FW port is opened to subnet. (All Windows OS btw)Things I’ve tried:I started with more stricter rules (sorta) but using a /16 instead of a /20 but for specific ports however forwarding of logs was not working. And I couldn’t ping anything not even EC2 B.What am I missing?FollowCommentGary Mclean a month agoDouble check they are in the correct security groups.Also have you tried turning off windows firewall.Windows server can be funny also trying to determine a private and public network interfaceShare"

Answer: "0Have you altered the NACL for the subnet?  The default should allow all traffic but if you have altered them, check that.Have you checked the OS level for firewall settings?CommentShareEXPERTiBehranswered a month agoGary Mclean a month agoThat would be a good question. They said they are all on the same subnet so nacls wouldn’t come into play here.Share0You may want to check the Routing table(s) you are using in this VPC and subnets.  If you have the original default VPC and main routing table to compare settings, look for a route target with 'local' Target and correct destination CIDR block for your subnet.  Also check each subnet for similar Route table settings for local traffic.There is a new feature in AWS Console for VPC which displays a Resource map of your VPC, might give clues to whatever is missing or misconfigured.CommentSharecyrkanswered a month agoGary Mclean a month agoThey said they are all on the same subnet. No routing neededShare"


Question: Unidentified emails being sent on SES

"Hi. I am a little concerned that when i just logged into SES console I saw that my SES account is constantly sending approx 3 emails a day, even when not being used by my team.  This has been going back months and also is showing  1.6% bounce rate and 0.9% complains in some cases on these 'unknown' emails.        Is this usual?     Is there a way I can see WHAT is being sent out exactly? (ie the content of the emails?)      Our team can go weeks at a time without sending any SES emails, yet virtually every day it's showing 3 emails being sent out.   What is going on ?        Many thanks for any help I get.FollowCommentmdibella a year agoAre you sure these message are truly originating from SES and not from a forged sender?   Do you have DMARC configured for your verified domain and any custom MAIL FROM subdomain?   If so, what are the DMARC policies (none, quarantine, reject)?   How are you processing DMARC reporting?Shareaskewd a year agoI think i may have got to the bottom of this. My web guy reminded me that one of our other websites use this SES for it's signup notifications & password reset emails.   While this doesn't explain the bounce & complaint rate (albiet very low)  it does tally with the numbers of emails being sent out.    I will see if I can dig a bit deeper for peace of mind. Thanks for the answers though, will digest those links.Share"

Answer: "0Hello,You can setup a SNS notification so that everytime there is a delivery bounce or complaint you will get a notification with all the information, the From:, To:, Subject, etc... that you can then process or just receive on a email address to later processing.Please take a look on how to enable the SES SNS notifications on your addresses/domains on the link below:http://docs.aws.amazon.com/ses/latest/DeveloperGuide/configure-sns-notifications.htmlAlso, if you are unaware and feel like your AWS Account is being misused, you pause the Sending: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ses/update-account-sending-enabled.htmlCommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year agoaskewd a year agoThat is really helpful. Thank you so muchShare0Good question!  Out of the box, SES Data events like email sends won't be tracked as CloudTrail will record AWS API Management Events.However, to get more granularity on logging in AWS SES, you can set up more monitoring such as CloudWatch: https://docs.aws.amazon.com/ses/latest/dg/event-publishing-retrieving-cloudwatch.html including event publishing and retrieving.Check out details here on what's included when you retrieve that information: https://docs.aws.amazon.com/ses/latest/dg/working-with-event-data.html which can include data including the top-level JSON object contains an eventType string, a mail object, and either a Bounce, Complaint, Delivery, Send, Reject, Open, Click, Rendering Failure, or DeliveryDelay object, depending on the type of event.CommentSharejsoncanswered a year ago"