Question: CloudFront returns the error " InvalidToken - The provided token is malformed or otherwise invalid"  when accessing s3 hosted files in new region ap-southeast-4 (Melbourne)

"I have been trying to set up a website of static web pages with SSL termination provided by CloudFront.I set up the origin s3 bucket in the new ap-southeast-4 (Melbourne).After all the setup when I try to access the web pages via the CloudFront distribution I get the error message:<Error>InvalidToken<Message>The provided token is malformed or otherwise invalid.</Message><Token-0>****</Token-0><RequestId>****</RequestId><HostId>****</HostId></Error>Going back to the first principles I seem to have isolated the problem to the region ap-southeast-4.Currently, in production, we have existing CloudFront distributions that host files out of ap-southeast-2 (Sydney). This is odd so I created the 2 test CloudFront distributions with the simplest stack possible. One distribution points to a test s3 bucket in ap-southeast-4 (Melb) and the other to a test bucket in ap-southeast-2 (Syd).The distribution pointing to ap-southeast-4 always returns the InvalidToken error while the distribution pointing to ap-southeast-2 works fine.Any help in fixing this problem would be appreciated.FollowCommentAmazing Ash 3 months agoDo both your buckets, Sydney and Melbourne hosted, have same Bucket Policy to allow access from the distribution?Can you compare the infra code used to deploy the Distribution and to create the Bucket? Please look closely for any differences in bucket permissions and policy, since that must allow access from the given Distribution to the bucket, for the serving to work.Happy to help further if you share the code snippets.SharePaul_L 3 months agoAre you using OAI or OAC for CloudFront to access the S3 bucket? Does the origin domain configured in CloudFront for the S3 bucket include the region? ie. <yourbucket>.ap-southeast-4.amazonaws.comSharerePost-User-6688573 3 months agoI am using OAC for CloudFront access to both s3 buckets.Checking the permissions on the two s3 buckets they are identical. Both have 'Block all public access' set to on. Also, I have double-checked the policy access JSON settings and confirmed that the strings match what the CloudFront OAC settings indicate they should be for each respective instance.As far as I can tell the two CloudFront instances are identical and everything is set up correctly. I am still getting the error for the instance that accesses the s3 bucket in ap-southeast-4.amazonaws.com.Share"


Question: I need an example on using Boto3 to send mkv videos to Kinesis Signaling Channels (WebRTC). could anyone help?

"Greetings,I already managed to use boto3 with streaming channels. However, I need so much to find an example using Boto3 to mkv videos to Kinesis Signaling Channels (WebRTC). Would anyone please help?Thanks.FollowComment"


Question: How to pass values for a "shap_baseline" if we have categorical values (string values) as features in classsagemaker.clarify.SHAPConfig method.

"using this documentation i  passing a single row as to shap_baseline parameter to implement explainability monitoring , a similar implementation of what is done in in this github repo implementation. if I am passing a single row as input to shap_baseline parameter, the schedule is failing by concatenating 2 rows. If i ignore the shap_baseline (as it is optional), the schedule is taking forever to run. Help of any kind is really appreciated.thanks for your time and effort :)FollowComment"

Answer: "0Thanks for your questionThere is some guidance and information about selecting a proper baseline from here that may help: https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-feature-attribute-shap-baselines.htmlif I am passing a single row as input to shap_baseline parameter, the schedule is failing by concatenating 2 rowsFor this, you may want to open a ticket via AWS Support in the AWS console so we can take a better look at this internally, and include your processing job details if possible (such as your analysis configurations, Job ARN, etc.)If i ignore the shap_baseline (as it is optional), the schedule is taking forever to runThere is a num_clusters parameter in the SHAPConfig which you can explicitly set to reduce the size of the baseline dataset that is generated.  A lower number (low single digits) will generally provide faster runtimeCommentSharerePost-User-5628909answered 8 months ago"


Question: How to set the inividual data source of a pipline resolver function via CLI Amplify

I am deploying my GraphQL API via Amplify. I added another function to one of the pipeline resolvers and added it to the appropriate slot.This all works. But now this function has to be assigned to another data source.How can I do that via the configuration files in the console to push the changes via Amplify?FollowComment


Question: Can we create a Table in Aurora during the infra setup using terraform IaaC code ?

"We use terraform for creating the infra in AWS. We want to create RDS Aurora Postgres instance. Terraform has support to create it. But I am stuck at table creation. There is a line of thought that the Table creation is not part of infra, but for me it looks like part of infra (dynamo db tables are created in terraform).  We used terraform local exec command as explained in this link . But the concern is that RDS instances are kept in private subnet, not able to connect directly. Doing SSH tunnelling to execute the table creation script has security issues. Would like to understand from the community how does it is handled ? what are the guidance on this issue ? or orAny leads and help on this will be super helpful.FollowComment"

Answer: "1Accepted AnswerThere are a few ways that come to mind. Since the RDS database should be in a private subnet and not publicly accessible you will need a way to tunnel to the private connection or run the create table from the private location. The first method would be to spin up a small EC2 host as a bastion that has teh SQL client on it and can connect tot he database instance. Then you could run the create table from it using Terraform.You could also consider the approach of creating a lambda function using Terraform that can do the create table for you and invoke it from Terraform. There is an example of the invoke here https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lambda_invocationand as an example even though it is not Postgres if has all the parts you can see and extrapolate to a Postgres example, https://docs.aws.amazon.com/lambda/latest/dg/services-rds-tutorial.html.To summarize create the Aurora Postgres cluster instance and database, create the lambda function in parallel, have the invoke part have a depends on the database and lambda function creation. I think this will be easier than the EC2 bastion instance route.CommentShareAWS-JRG-1317534answered a year agoNavin GV a year agoWe are planning to use Lamdba route. Thanks.Share"


Question: '403 Forbidden' error when attempting to access AWS web console only from home IP address

"Wondering if anyone has run across this issue before. I can access all resources within my account (EC2 instances, CloudFront distributions, etc.) from my home IP address, but when I try to sign into the web console itself (console.aws.amazon.com), I get a plain page stating only '403 Forbidden'. When I use a VPN to sign in, however, it works with no issues. It seems like I've somehow been placed on a deny list for the CloudFront distros that serve the web console app.FollowComment"

Answer: "0Are you the account owner/root user? Otherwise, you could check with the account admin to check if they have restricted access to a specific CIDR range.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.htmlCommentShareRajesh Sanswered 10 months agosystemtwo 10 months agoYes, I am the account owner and can become root when needed. What's strange is I'm also blocked from viewing https://repost.aws/ unless I use a VPN. I've confirmed that no IAM policies are in effect that restrict access based on IP address.Share0I am wondering if you are facing the issue on any corporate laptop, which restricts access through VPN for certain domains.You can try accessing these on your personal laptop or mobile or tablet or ipad to see if the issue persists. If the issue is on a specific device then should be some restrictions on that.CommentShareRajesh Sanswered 10 months agosystemtwo 10 months agoThat is a good thought, but I've confirmed this behavior on both personal and corporate devices. Even my personal phone receives '403 Forbidden' messages when trying to access console.aws.amazon.com or repost.aws . The 403 error for repost.aws is slightly more informative as it gives a request ID at the bottom of the page that may help in tracing why this is happening.Share"


Question: Can't delete a system-reboot event assigned by aws to an EC2 production instance

"AWS automatically assigned a reboot event to a Windows EC2 instance used in production, and scheduled it for a nice monday afternoon.I tried all the official guides to at least postpone it to midnight, but the command in the "Actions" menu is disabled.How can I proceed? :/FollowComment"

Answer: "3Accepted AnswerJust reboot the EC2 wherever you want, and the reboot event disappears afterward.So essentially, you have up until that "nice monday afternoon" to reboot it 😊 otherwise, they will do it for you.Hope it helps!CommentShareCarl Ostrandanswered 7 months agoEXPERTIndranil Banerjee AWSreviewed 7 months ago"


Question: How can I monitor the Soft bounces?

"Dear Amazon Team,  How can I monitor the soft bounces, and can Amazon SES provide the reasons why contacts have gone to soft bounces?Thanks in Advance!FollowComment"

Answer: 0It can be monitored by the methods in this document.https://repost.aws/knowledge-center/ses-understand-soft-bounceshttps://repost.aws/ja/knowledge-center/ses-bounce-notifications-snsCommentShareEXPERTRiku_Kobayashianswered a month ago


Question: CloudFront internals and DNS routing

"Hi,I am currently learning CloudFront and would like to get some more insights on its internals.Almost all materials mention that CloudFront uses edge locations around the world to give your content faster.But what does this actually mean and how it is doing that ?My understanding is that you get a CloudFront DNS for your origin. When you issue a request, the dns server responds with the IP thatis of the edge location closest to you, based internally on some IP geolocation service it uses. This part would conceptually be the same as setting up rules in Route53 to give you different IPs based on your location.Once you get your IP your request will eventually routed to the edge location IP, and then the remaining hops to reach your origin will be going through AWS routers.And on top of that you get caching plus if you set up your permissions properly, you should be hiding the IP of your actual server (let's say my origin is a ALB or EC2 instance), since the clients will always get cloudfront edge location IPs.Is my understanding correct ?FollowCommentVM 5 months agoYes, your understanding is correct. DNS routes the request to the CloudFront POP, typically the nearest CloudFront POP in terms of latency—and routes the request to that edge location.CloudFront checks its cache for the requested object. If the object is in the cache, CloudFront returns it to the user. If the object is not in the cache, then it tries to reach the origin to fetch the content. More details are in the links shared below.Origin details are never revealed via CloudFront. Additionally, you can restrict access to the origin i.e. you can make sure that users can access the content only through the specified CloudFront distribution and prevents users from accessing the content directly.Share"

Answer: "0Amazon CloudFront is AWS’ content delivery network(CDN) that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speedsYou can read more about the Amazon CloudFront key features here:https://aws.amazon.com/cloudfront/features/?whats-new-cloudfront.sort-by=item.additionalFields.postDateTime&whats-new-cloudfront.sort-order=desc#edge-locationsTo deliver your content with CloudFront you would need to create CloudFront distributions, CloudFront distribution to tell CloudFront where you want content to be delivered from, and the details about how to track and manage content delivery.Distributions are unique CloudFront.net domain name to reference objects (abc123.cloudfront.net)https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.htmlYou can read more on how  CloudFront delivers content to your users here:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowCloudFrontWorks.htmlCommentShareVManswered 5 months ago"


Question: Field level access control in schema

"The documentation suggests that its possible to restrict access at granular field level within a schema:   https://docs.aws.amazon.com/appsync/latest/devguide/security.html#using-additional-authorization-modes  with an example given astype Post @aws_api_key @aws_iam{   id: ID!   author: String   title: String   content: String   url: String   ups: Int!   downs: Int!   version: Int!   restrictedContent: String!   @aws_iam}Based on this example it should be possible to implement restrictions on the email and phone fields in a user table like belowtype Users @aws_auth(cognito_groups: ["Admin", "Everyone"]){userid: String!firstname: Stringlastname: Stringemail: AWSEmail@aws_auth(cognito_groups: ["Admin"])phone: AWSPhone@aws_auth(cognito_groups: ["Admin"])public: Booleanaccess: String}However, this doesn't actually seem to work as all fields are returned regardless of group membership. Am I reading the docs correctly or is something mis-configured?FollowComment"

Answer: "0Hi,I think your issue is that you're applying the "Admin" group both on the type and on the field. Have you set up multi auth on your API? If so, can you try changing @aws_auth usages to this:    @aws_cognito_user_pools(cognito_groups:\["Admin"])  ? It looks like you're trying to use the wrong Cognito directive to fulfill a multi auth use case. The one you're using was created before the implementation of multi auth, and it only works for top level fields.Thanks,JeffCommentShareAWS-User-4365954answered 4 years ago0Thanks!As you thought, the issue was with the auth directive. Changing to@aws_cognito_user_pools(cognito_groups: ["Admin"])works perfectlytype Users @aws_cognito_user_pools(cognito_groups: ["Everyone", "Admin"]){userid: String!firstname: Stringlastname: Stringemail: AWSEmail@aws_cognito_user_pools(cognito_groups: ["Admin"])phone: AWSPhone@aws_cognito_user_pools(cognito_groups: ["Admin"])public: Booleanaccess: String}CommentShareraz92answered 4 years ago"


Question: Is simple AD PCI compliant?

This posthttps://aws.amazon.com/blogs/security/aws-adds-12-more-services-to-its-pci-dss-compliance-program/Indicates AWS Directory Service for Microsoft and AD Connector is PCI compliant... does this include simple AD????FollowComment

Answer: "0Accepted AnswerNo, Simple AD is not PCI compliant.CommentShareJoeD_AWSanswered 4 years ago0Thanks Joe!CommentSharesim2094answered 4 years ago"


Question: Mounting On-prem NFS share to an EC2 instance

"Hi, Need urgent help please. If someone can please respond and guide asapHere is my scenario  -I have an App server hosted on a private AWS EC2 (can't be exposed to public network). This is a lift and shift of the customer's on-prem app server. So far so good.Before migrating to AWS, customer's on-prem App server had 2 types of NFS mounts where the files were dropped for the App server to accessNFS mounts from customer's  on-prem corporate network (A). There is a 200mbps direct connect from the customer's on-prem corporate network to AWS.NFS mounts from remote servers located in a partner data centre (B). There is no direct connectivity from this partner data centre to AWS. However, there is a private connectivity between this partner data centre to the customer's corporate network (A)Now post the migration, how can I ensure these 2 types of NFS shares can be mounted/accessed on to the new EC2 instance as well?Please help asapThanksRohitFollowComment"

Answer: "1Short answer: Yes, this works.Longer: If Site B can communicate with Site A; and site A can communicate with the AWS VPC; then generally Site B will be able to communicate with the VPC.This does depend on whether Site A (the routers/switches/firewalls) allow communication from Site B to AWS so that would be the thing to check. If possible, avoid overlapping IP addresses; and ensure that firewalls allow two-way communications.CommentShareEXPERTBrettski-AWSanswered a year agoRohit_AWS a year agoThanks Brettski, yeah I thought so that Site B can communicate with AWS via Site A provided all components like routers, switches etc are aligned. However, taking a step back, my first question is even more basic -  how do I mount the existing on-prem NFS shares to the EC2 instance (site A or site B). Can I do that? I am not using EFS. Thanks againShareBrettski-AWS EXPERTa year agoNFS is network agnostic. If the endpoints can communicate with each other (IP/TCP/UDP and appropriate ports) then NFS works. There's no difference (except in performance) mounting a NFS share that is on the machine next to you as compared to one across the world.Share"


Question: Issues propogating zone to Google and others?

"My issue is that my website seems to be unavailable in certain regions due to a lack of name resolution. The website is arnaudloos.com.I have both my Domain and DNS hosted by Amazon. The website is hosted in an S3 bucket. There is no www bucket.To start I've checked and my DNS NS records match my hosted zone Nameservers.ns-889.awsdns-47.netns-1111.awsdns-10.orgns-376.awsdns-47.comns-1823.awsdns-35.co.ukChecking https://dns.google.com/query?name=arnaudloos.comresults in "Comment": "DNSSEC validation failure"But if I turn off the DNSSEC toggle switch I get results"Answer":{"name": "arnaudloos.com.","type": 1,"TTL": 59,"data": "52.84.126.13"}Manually setting my workstation client DNS to 8.8.8.8 results in not being able to browse to my website.Checking an assigned nameserver I get a good response.% nslookup arnaudloos.com ns-889.awsdns-47.netServer:         ns-889.awsdns-47.netAddress:        205.251.195.121#53Name:   arnaudloos.comAddress: 52.84.126.111Name:   arnaudloos.comAddress: 52.84.126.13Name:   arnaudloos.comAddress: 52.84.126.204Name:   arnaudloos.comAddress: 52.84.126.133but not with Google% nslookup arnaudloos.com 8.8.8.8Server:         8.8.8.8Address:        8.8.8.8#53** server can't find arnaudloos.com: SERVFAILEverything is ok with OpenDNS% dig arnaudloos.com @208.67.222.222; <<>> DiG 9.11.4-3ubuntu5.1-Ubuntu <<>> arnaudloos.com @208.67.222.222;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38549;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;arnaudloos.com.                        IN      A;; ANSWER SECTION:arnaudloos.com.         60      IN      A       52.84.126.111arnaudloos.com.         60      IN      A       52.84.126.133arnaudloos.com.         60      IN      A       52.84.126.13arnaudloos.com.         60      IN      A       52.84.126.204;; Query time: 20 msec;; SERVER: 208.67.222.222#53(208.67.222.222);; WHEN: Wed Mar 06 12:50:39 EST 2019;; MSG SIZE  rcvd: 107But not Googledig arnaudloos.com @8.8.8.8; <<>> DiG 9.11.4-3ubuntu5.1-Ubuntu <<>> arnaudloos.com @8.8.8.8;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6447;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512;; QUESTION SECTION:;arnaudloos.com.                        IN      A;; Query time: 53 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Wed Mar 06 12:51:05 EST 2019;; MSG SIZE  rcvd: 43When I do a DNS propagation test I see that there are regions where there are no records for my site.When I connect to my VPN provider and get my DNS redirected to their servers I also can't reach my website.This has to be a configuration issue on my end but can someone please tell me what. Thanks.FollowComment"

Answer: "0Accepted AnswerHello ArnaudLI understand that you are facing DNS resolution issues on your domain arnaudloos.com.I have taken a look and seen that the reason for this is that your domain has got DNSSEC enabled. Amazon Route 53 supports DNSSEC for domain registration. We do not support DNSSEC for the DNS service regardless of whether you have the domain registered with Route 53 or another registrar[1] . When you resolve using Google DNS servers, they will attempt to verify DNSSEC and this fails resulting in the SERVFAIL error message.To resolve the issue and get consistent resolution on your domain, you may disable DNSSEC on the domain as outlined in our documentation[2]. Alternatively you may transfer your DNS to another provider that supports DNSSEC.[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html[2] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html#domain-configure-dnssec-deleting-keysI hope this helps.CommentShareMatthias_Zanswered 4 years ago0Thank you so much, it's fixed now.CommentShareArnaudLanswered 4 years ago"


Question: How to get the maximum number of AWS accounts in an organization?

"Hi, I would like to be able to programmaticly find the value of the account t limit in an AWS Organization and send a notification or alert lets say when reaching 90% of the max account quota.Is this account limit number exposed in any way for instance in an api?Best regards,JonasFollowComment"

Answer: "0Hi, and thank you for the answer.I can get a list of accounts with list_accounts with the following command:aws organizations list-accountsHowever to use the GetServiceQuota API I believe I need to send ServiceCode and QuotaCode like this:aws service-quotas get-service-quota --service-code dynamodb --quota-code <code>I thought I could find i.e ServiceCode with following command, but it didn't return any info for organization accounts:aws service-quotas list-servicesIt did return a long list of information of other services, though.JonasCommentShareJonasanswered 3 months agoMatt-B EXPERT3 months agoThis likely because you are at the default quota of 10.  In that case you use the list-aws-default-service-quotas command.example: aws service-quotas list-aws-default-service-quotas     --service-code organizations  --query "Quotas[?contains(QuotaCode, 'L-29A0C5DF')]"ShareJonas 3 months agoHi,We have increased the quota from 10 to 50, so I guess something should have showed up.list-aws-default-service-quotas does return quotas for service-code organizations, but list-service-quotas does not:aws service-quotas list-aws-default-service-quotas     --service-code organizations  --query "Quotas[?contains(QuotaCode, 'L-29A0C5DF')]" --region us-east-1[{"ServiceCode": "organizations","ServiceName": "AWS Organizations","QuotaArn": "arn:aws:servicequotas:::organizations/L-29A0C5DF","QuotaCode": "L-29A0C5DF","QuotaName": "Default maximum number of accounts","Value": 10.0,"Unit": "None","Adjustable": true,"GlobalQuota": true}]aws service-quotas list-service-quotas --service-code organizations --region us-east-1{"Quotas": []}Share0Hi THereYou can use the GetServiceQuota API .  You can take the "Value" output and compare it to the number of accounts in your org.  You can use the  list_accounts API to get a count.CommentShareEXPERTMatt-Banswered 3 months ago"


Question: Lightsail - Private hosted zone - subdomain Route53

I currently host domain.com in my Lightsail VPS. It is a public hosted zone.i want to create sd.domain.com as a Route 53 private zone and host another application in Lightsail. How do I go about doing this? I am fine with buying another Lightsail VPS instance.FollowComment

Answer: "0Just to be clear, your private zone would be for internal DNS resolution to your VPC, this would not be a public application, correct?CommentShareBrian Grafanswered 8 months ago0The goal is to create subdomain.domain.com and host a private application in lightsail VPS.We already have a public application hosted in lightsail VPS at domain.comCommentSharerePost-User-8628382answered 8 months ago0Ok, I haven't tried this so I'm not sure if it will work, but you would need to use Route53 for private hosted zones and have VPC peering enabled with the Route53 associated VPC. I believe it will give you a permissions error if you try to add the Lightsail VPC to the route53 association.CommentShareBrian Grafanswered 8 months ago"


Question: AWS Managed Grafana: Change grafana.ini feature toggles?

"We're trying to change some grafana feature toggles, mainly tempoSearch and tempoBackendSearch (documented on https://grafana.com/docs/tempo/latest/getting-started/tempo-in-grafana/#find-traces-using-tempo-search). Unfortunately I can not find a way to change any grafana.ini configuration settings, let alone these specific ones.Are we just out of luck & unable to activate tempo search in AWS-managed grafana?FollowComment"

Answer: "1Accepted AnswerHello,I understand that you want to change the grafana.ini to use the Tempo Search in Amazon Managed Grafana (AMG).Unfortunately AMG doesn't support editing the grafana.ini to enable temposearch feature at this time.You can influence the priority by raising the request on the public roadmap page [1].Also, according to the documentation [2], FeatureToggles in Grafana is used to enable features under development or not yet available in stable version. Please note that tempoSearch [3] is currently experimental.Hope this helps.[1] AMG roadmap: https://github.com/aws/amazon-managed-grafana-roadmap[2] FeatureToggles interface: https://grafana.com/docs/grafana/latest/packages_api/data/featuretoggles/[3] Tempo Documentation: https://grafana.com/docs/tempo/latest/getting-started/tempo-in-grafana/#tempo-searchCommentShareEXPERTJonathan_Danswered 5 months ago"


Question: I added woocommerce to my new wordpress website & all is gone HELP

"I cannot access my wordpress dashboard.  Please, help to find where in the Amazon lightsail I can deactivate plugins or see where are my plugins.  I am very new in Amazon and I don't know all the rules.  Can anybody help me here?FollowComment"

Answer: "0Hi, Alen. Thanks for using Lightsail.Normally, you can access your wordpress dashboard by visiting the /admin page relative to the root of your wordpress site. So, if your site were at www.example.com, you would go to https://www.example.com/admin. That URL should still be accessible even if the main website fails to render.If the entire site is down because of an error in your plugins you can disable all plugins using the following procedure:login to your instance via SSH (web-based or using your own SSH client).Once logged in you can disable all plugins by moving the plugins directory to a backup: mv ~/stack/wordpress/wp-content/plugins ~/stack/wordpress/wp-content/plugins.backupReboot your server to make sure all wordpress processes are running again.This will most likely disable plugins that you want/need. My suggestion would be to copy each of the plugins back into the ~/stack/wordpress/wp-content/plugins directory and test to see if they break your site.I hope this helps!CommentSharedonleyatawsanswered 7 months ago"


Question: WorkMail unable to receive email from Shopify contact form

"Hi,As the subject mentions, my WorkMail email is not receiving any messages sent from my Shopify website contact form.  The email is verified on SES and I am able to receive a test email.  I am also able to receive email from email providers like Gmail and Yahoo.Could it be that Shopify is blocked?I've set up the following in Route53 for WorkMail and Shopify compliance:MX mywebsite.com --> 10 inbound-smtp.us-west-2.amazonaws.com.MX mail.mywebsite.com --> 10 feedback-smtp.us-west-2.amazonses.comTXT mywebsite.com --> "v=spf1 include:amazonses.com ~all"TXT mail.mywebsite.com --> "v=spf1 include:amazonses.com ~all"TXT _dmarc.mywebsite.com --> "v=DMARC1;p=quarantine;pct=100;fo=1"TXT _amazonses.mywebsite.com --> "xxx" (sample value)CNAME autodiscover.mywebsite.com --> autodiscover.mail.us-west-2.awsapps.com.CNAME xxx._domainkey.mywebsite.com --> xxx.dkim.amazonses.com.CNAME yyy._domainkey.mywebsite.com --> yyy.dkim.amazonses.com.CNAME zzz._domainkey.mywebsite.com --> zzz.dkim.amazonses.com.CNAME g94._domainkey.mywebsite.com --> dkim1.xxx.email.myshopify.comCNAME g942._domainkey.mywebsite.com --> dkim2.xxx.email.myshopify.comCNAME g943._domainkey.mywebsite.com --> dkim3.xxx.email.myshopify.comCNAME mailerg94.mywebsite.com --> xxx.email.myshopify.comDomain ownership - verifiedTXT _amazonses.mywebsite.com --> "xxx" (sample value)WorkMail configuration - verifiedMX mywebsite.com --> 10 inbound-smtp.us-west-2.amazonaws.com.CNAME autodiscover.mywebsite.com --> autodiscover.mail.us-west-2.awsapps.com.Improved security - verifiedCNAME xxx._domainkey.mywebsite.com --> xxx.dkim.amazonses.com.CNAME yyy._domainkey.mywebsite.com --> yyy.dkim.amazonses.com.CNAME zzz._domainkey.mywebsite.com --> zzz.dkim.amazonses.com.TXT mywebsite.com --> "v=spf1 include:amazonses.com ~all"TXT _dmarc.mywebsite.com --> "v=DMARC1;p=quarantine;pct=100;fo=1"Improved email delivery - verifiedMX mail.mywebsite.com --> 10 feedback-smtp.us-west-2.amazonses.comTXT mail.mywebsite.com --> "v=spf1 include:amazonses.com ~all"SES CONFIGURATIONDomain verification status: verifiedDKIM: enabled, verifiedMail From domain status: verifiedEdited by: howardtan on Sep 16, 2021 4:52 PMFollowComment"

Answer: 0I was able to resolve this by adding shopify's ip address to SES IP Address Filter and select "allow".CommentShareHowardanswered 2 years ago


Question: T2 vs T3 Instance type

A customer wants to migrate their T2 instances types to the respective T3 type. Majority of their instances were launched in 2019 but some were launched in 2018 and other in 2020. They want to know what is the significant architectural difference between T2 and T3. They have some third party software running on these instances which ties the licensing with mac address and thus want to know the architectural difference between the two type as well as T2 launched in 2018 vs T2 launched in 2020 and what they have to consider when moving all of them to current T3. Beside T2 they also want to do the migration from m4 to m5 and c4 to c5 and all of the m4 and c4 were launched in 2019.I would really appreciate if someone can point me in the right direction.FollowComment

Answer: "0Accepted AnswerThe T3, M5, and C5 instances all run on the Nitro system. https://aws.amazon.com/ec2/nitro/ There are some considerations when migrating including a requirement for ENA and NVMe drivers for example. There are several modern AMIs that have these already, so it will depend on what your customer is running. See the release notes part of our documentation page for some more details. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/general-purpose-instances.html#general-purpose-instances-limitsCommentShareAWS-User-7355078answered 3 years ago"


Question: Open Search Serverless - How to estimate Search and Query OCUs?

"Hello, What would be a good way to estimate number of Search and Query OCUs required for estimating costs? For example, how many queries per second a single Search & Query OCU can handle?FollowComment"

Answer: "0Hello,Search and Indexing OCU utilization/requirement will depend on multiple factors thus, you should test it out with your actual workload to arrive at a rough estimate.You can monitor the SearchOCU and IndexingOCU account-level CloudWatch metrics to understand how your collections are scaling. You can analyze these metrics to determine your utilization and plug in those metrics in the AWS Pricing Calculator to get a rough estimate.To better understand scaling, cost and other concerns please go through the documentation available here.CommentShareSUPPORT ENGINEERHarsimran_Sanswered 22 days ago"


Question: Uploading files to s3

"How to upload file directly to s3 from web. For example uploading imagenet data from the website to the s3 after extracting the tar file of it, without downloading dataset into my system, all process should be done through cloud. Do we need to use lambda or any other way to do it. ?FollowComment"

Answer: "0Hi,answer is depends :)If you are using a Javascript framework such as React/Angular/Next, you may want to look into Amplify. There is a pretty neat component that allows you to upload seamlessly files to s3: https://ui.docs.amplify.aws/react/connected-components/storage/storagemanagerOther options involve:Expose an api via API Gateway direct integration towards S3 to do upload, as direct proxyFor large files you may need to use API Gateway with signed URLSA combination of Cloud front and Lambda@EdgeYou can find details here: https://aws.amazon.com/blogs/compute/patterns-for-building-an-api-to-upload-files-to-amazon-s3/Hope it helps ;)CommentShareEXPERTalatechanswered a month agoranurag a month agoThank you for answering.Shareranurag a month agocan it be possible with python aws sdkShare"


Question: How do I set up Amazon VPC ingress routing with a stateless network appliance?

"I want to implement a network topology where I can set an ingress route on the internet gateway to pass through a security appliance. I still want the destination subnet behind the appliance to have a direct route to the internet gateway.  I need the appliance to see only the ingress traffic (requests) and not the other direction.I did some basic testing and found that this topology doesn't work. For example, connections initiated from the subnet behind the appliance can't reach the internet. How do I configure this routing?FollowComment"

Answer: "0Accepted AnswerIf the traffic is asymmetric, that is, the return traffic doesn’t go through the same appliance or firewall, then the return traffic is dropped at the AWS edge. This happens by design. Therefore, you need a symmetric flow for VPC Ingress routing to work. A better architecture is to use the Elastic Load Balancing sandwich architecture and scale the firewall depending on the load.CommentSharejkapsanswered 3 years ago"


Question: Increase in Billing

"All my instances,services,rds snapshots are deleted still there is increase in my bill.FollowComment"

Answer: "0Go into Cost Explorer in the console and have a look what you're being charged for.  You can break things down by service and region etc.CommentShareEXPERTskinsmananswered 3 months agorePost-User-0742761 3 months agoI am new in the AWS.How Can I stop the services that results into increase in my bill.Share0Once you have identified the services that you are being charged for as suggested above, kindly go to the respective service and simply delete/terminate the resources to stop being chargedCommentSharerePost-User-8594256answered 2 months ago0Try using AWS Cost Explorer (https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) to see the details of your charges. Cost Explorer is free when you use the console with out of the box settings the only billable features are hourly & resource granularity & direct API requests.Initially Cost Explorer will group the costs by Service, making it easy to see which service is responsible for the cost. You can also switch the Group By dimension to Usage Type, which will show you the next level of detail: the specific units by which your charges are being metered.Some examples of items that you might find:EBS:SnapshotUsage - EBS Snapshots that need to be deletedElasticIP:IdleAddress - unused elastic IPsOnce you identify the specific usage, you can go into the appropriate section of the service console and remove those resources (delete EBS snapshots, release Elastic IPs, etc).CommentShareMichael_Ranswered 2 months ago"


Question: "How to trigger Lambdas from outside the GG environment, for testing purpose"

"Hello!We are developing one iot device on top of GGV2 and there are a couple of components that we have made as lambdas. We can deploy and run them run properly, but the even sources are quite limited, if I want to trigger it, I need to either:Have another component there making the calls I want. This is horrible because I need to re-deploy that component every time I want it to send different payloads to the Lambda, and it is overhead that is not helping the development of this isolated component.Trigger from IoT Core. Not ideal since I have to specify a topic and it cannot be device-specific even, because that would require each device to have its own deployment of these components.Here are the concrete questions:What is the best way manually trigger a GG lambda? Are you planning to add a feature to trigger it as one does in the AWS console > Lambda?Are you planning on adding the option to use recipe variables inside the IOT_CORE event source? would be nice.Will it possible to create local deployments for Lambda functions? It is also very handy for the iterations to go faster.I am only concerned with development/testing, as for the production it is the local topics.As a final note, we are aware of IDP. We are planning on using it but it is not handy for development to force having a device ready. In fact, we usually have GG running inside a docker container.FollowComment"

Answer: "0Accepted AnswerHi,Thank you for your questions.For question #1, unfortunately what you described are the only ways to trigger a GG lambda right now. We'll consider what you suggested in the future improvement. If your lambda function doesn't require a specific device to test, a better option to test it in AWS Lambda first before deploying it to Greengrass.For question #2, what do you mean by "recipe variables"? Are you referring to deployment configuration? You can override the event source during a deployment by updating the "pubsubTopics" field in the default configuration.For question #3, when you say "create local deployments for Lambda functions", I interpret it as updating your lambda function and deploying it to a GG device using Greengrass CLI https://docs.aws.amazon.com/greengrass/v2/developerguide/gg-cli-deployment.html . Currently Greengrass CLI only supports updating and deploying regular components. Similar to question #1, if your lambda is relatively isolated and doesn't require a specific device to test, I would recommend you to develop and test it in AWS Lambda first.CommentShareAWS-User-5965613answered 2 years ago0Hi,Thank you very much, all my questions were answered.I can't test in AWS because they have interactions with the device, indeed, including IPC.For Question #3, that is what I meant yes.Regarding #2, I did not ask it right. Yes, I was referring to the recipe variables in https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.html#recipe-variables , but what I actually am looking for is to have IOT_CORE pub/sub topics using variables like the thing name. I understand this is not supported at the moment.And the solution of having another component subscribing and then triggering the lambda is totally fine.Thank you once more!CommentShareQuantumLoveanswered 2 years ago0Hi QuantumLove,For pub/sub topics, you could also pass in a template string and interpolate with the thing name in runtime with environment variables. https://docs.aws.amazon.com/greengrass/v2/developerguide/component-environment-variables.htmlLet me know if this works for you.Thanks,HuiCommentShareAWS-User-5233880answered 2 years ago0Hi Hui,Thank you for your reply. But this cannot be done on the component recipe, right? Only if I manually subscribe with a pinned Lambda.I am using non-pinned Lambdas, which would be handy to trigger them from the cloud, using the thing name to distinguish which device I am targettingCommentShareQuantumLoveanswered 2 years ago"


Question: Lambdas are broken after a new deployment to a serverless application breaking production functionality

"We deployed a new version of a serverless (python) application yesterday. All the CloudFormation events have it looking like a successful deployment.The error is that every lambda gets the Handler 'handler' missing on module 'routes/file_name'We have not made any changes to the structure of our code, nor any changes at all from the AWS console.The changes we made are to use a newer version of Google Ads library, and also deployed from a new machine that required an updated version of serverless and node packages (plus whatever changed in their dependencies.)$node --versionv16.19.1$serverless --versionRunning "serverless" from node_modules1.30.1I triedRolling back one of the lambdas by specifying an older version int he API Gateway function that acts as a pass-through to the lambda.Deploying a previous version of our code, which I believe is exactly what was already being used by the lambdaCreating an alias of an old version of the lambda, but couldn't figure out what to do with it.I also double-checked the CloudWatch logs and verified that things were working correctly before the new deplioyment.And finally, we deployed another app with a single lamda that gets its input from an SQS queue, with the same (broken) result.This is causing a production outage of functionality that is important to our customers.FollowComment"

Answer: "0the error "Handler 'handler' missing on module 'routes/file_name'" indicates that AWS Lambda cannot find the specified handler in the given module.to resolve the "Handler 'handler' missing on module 'routes/file_name'" error, follow these steps:Check your serverless.yml file to ensure the handler is specified correctly (e.g., routes/yourFile.handler).Verify the handler functions are correctly exported in their respective files (e.g., routes/file_name.py).Inspect the generated package in the .serverless directory to ensure the file structure and required files are present.Try creating a new virtual environment, reinstall your dependencies, and redeploy your serverless application.Roll back to the previous working versions of the Serverless Framework, Node.js, or other dependencies, and redeploy.These steps should help you identify and fix the issue causing your Lambda functions to break in production.CommentShareEXPERTsedat_salmananswered 2 months ago"


Question: SSM Automation Run Command longer than default 3600 seconds

"Currently, it appears there is no way to overwrite the timeout for a run command in an SSM automation:{"name": "LongRunningCommand","action": "aws:runCommand","inputs": {"DocumentName": "AWS-RunPowerShellScript","InstanceIds": ["i-1234567890abcdef0"],"Parameters": {"commands": "Sleep(3601) ",--"timeoutSeconds": "4000"--}}}The runCommand must finish in under 3600 or it times out. Is there a workaround?FollowComment"

Answer: "1I had issues with AWS Data Pipeline RunShellScript send commands timing out after an hour (default 3600 seconds) when I upgraded the SSM agent on my Linux EC2 instance to the latest version. The solution was to change the parameters.Original:--parameters commands=["python my_script.py"]New (with 9999 second timeout):--parameters '{"workingDirectory":["path/to/my/script"],"executionTimeout":["9999"],"commands":["python my_script.py"]}'The AWS documentation around this is very poor but I managed to figure it out by creating a Run Command in the AWS Systems Manager console. Once you've input all the settings you want just scroll to the "AWS command line interface command" section at the bottom and you can copy the code from there into CLI, Data Pipeline or wherever else you want to run it. Hope this helps someone!CommentSharetobyayreanswered 5 years agoleminou 10 months agothank you so much for the answer really helped meShare0Hello,You need to change "Execution Timeout" parameters when you use Run Command utility to override the default 3600 Second value of the Execution Timeout.Below document provides a step by step guide for it:http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/tutorial_run_command.html#rc-tutorial-uiRegards,Santosh KCommentShareSantoshK-at-AWSanswered 6 years ago0Perhaps you missed my question. This is regarding an SSM Automation, not just the Run Command. I want to change the Execution Timeout in an Automation SSM Document.CommentShareForums-User-7813077answered 6 years ago0Is anyone going to respond to this question? I'm also hitting problems with the fact that this value is only configurable in the Run Command web UI, not in SSM Automation, the AWS CLI, or or in boto3.I know I'm not alone in saying that I use the console to prototype before automating. Effectively, this limitation means everyone who uses this and requires a moderate command timeout (like 90 minutes, which is my use case) will hit this blocker.When can we expect a fix?CommentSharestevielbanswered 5 years ago0Thank you tobyayre! That did the trick.It seems confusing to me that an execution timeout would be tied to a document type, as it would seem to be universal. But that appears to the case; knowing where to look I found this documentation on document specific parameters: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-doc-syntax.htmlThanks again!CommentSharestevielbanswered 5 years ago"


Question: Error running a large matrix on Amazon Braket with D-wave

"I'm running a size matrix (419x419) as QUBO in Amazon Braket to find a solution using 'braket.ocean_plugin' ('BraketSampler') and dwave.system.composites'.However, when running for about 15 minutes, the error message appears: ValueError: no embedding found. The link of an image with the complete error: LinkCould someone help me understand what is happening and how this error could be resolved?I appreciate all the help.FollowComment"

Answer: "0The embedding composite from dwave.system.composites uses a heuristic algorithm to attempt to find an embedding, which maps logical qubits in the problem to sets of physical qubits on the target processor. For the Advantage system QPUs from D-Wave, it is not possible to find an embedding for a fully connected problem (like would be created from a matrix with no zero entries) that is larger than about 120 qubits. If a larger problem is submitted, the composite will continually try to find an embedding without succeeding until it gives up.If your problem has many zeros in the matrix, then it may be possible that the embedding composite is able to find an embedding if the zeros are removed from the problem first. If there are no zeros left in the problem and the embedding is still failing, then you will need to use a hybrid method, such as qbsolv, to decompose the problem into smaller subproblems.CommentShareStephen Fanswered a year ago"


Question: Amazon CloudHSM security dubt

"Hello,Basically, as I understand it, physical HSMs are managed by a team of people who have physical key to reset the HSM itself. That is, these people, let's say there are 3 of them, have 3 keys and each of them is needed to start or reset the HSM. In the cloud, however, for example with Amazon's CloudHSM, how does this happen? Why can't Amazon take the content in our CloudHSM? This team of people doesn't exist, so they still have full control of our encryption keys. Who has the CloudHSM primary key?  Am I right? What am I missing?Thank you very muchFollowComment"

Answer: "0Main keys for HSM are established when a cluster is allocated and the customer establishes a Crypto Officer. The CloudHSM service infrastructure and no one at AWS have any access to the main key (or any keys protected by that key) because the CO credentials are known only to the customer.Cluster management and backup are managed with an additional key which allows back up and recovery of HSM main keys and configurations without exposing keys to AWS. This is detailed in:https://docs.aws.amazon.com/cloudhsm/latest/userguide/backups.htmlCommentShareTim_Wanswered a year agoAWS-User-4450801 a year agoThe CO credentials are only known to the customer, but AWS may save them somewhere before they are forwarded to the HSM. No? Is this possible?Share0When you provision a CloudHSM cluster, there are several user types:Precrypto Officer (PRECO) - Default administrator when you provision CloudHSM. Disappears once you create your first user.(Primary) Crypto Officer (PCO and CO) - First user is the PCO who can then provision other COs. PCO and COs have the same permissions. They perform user management and that's all.Crypto User (CU) - can do:Key management - create, delete, share, import & export cryptographic keysCryptographic operations - use keys for encryption, decryption, signing, verifying etc.Appliance User (AU) - can perform cloning and synchronisation operations. Cloud HSM uses the AU to synchronise the HSMs in a cluster. The AU exists on all HSMs and has limited permissions.Setup of your cluster involves a number of steps including verifying authenticity, signing the cluster CSR (Certificate Signing Request), setting up a cluster management instance and running the HSM command-line management utility on it.CommentShareEXPERTskinsmananswered a year ago"


Question: patch-baseline-operations fail with Python 3.10.6

"After upgrading to 22.04 Ubuntu and going from Python 3.8.10 to Python 3.10.6, on updating the servers, our AWS patch-baseline fails with the errorAttributeError: module 'collections' has no attribute 'Callable'Is there a way to handle the updated python version for this OS?FollowCommentrePost-User-amartinez 2 months agoFull error:/usr/bin/python3/usr/bin/apt-getReading package lists...Building dependency tree...Reading state information...python3-apt is already the newest version (2.4.0ubuntu1).0 upgraded, 0 newly installed, 0 to remove and 43 not upgraded.Using python binary: 'python3'Using Python Version: Python 3.10.604/12/2023 11:42:39 root [INFO]: Downloading payload from https://s3.dualstack.eu-west-1.amazonaws.com/aws-ssm-eu-west-1/patchbaselineoperations/linux/payloads/patch-baseline-operations-1.105.tar.gz04/12/2023 11:42:40 root [INFO]: Attempting to import entrance file os_selector04/12/2023 11:42:40 root [INFO]: Running with snapshot id = 14c414a2-3e04-404e-b091-1a459900c012 and operation = Install04/12/2023 11:42:40 root [ERROR]: Error loading entrance module.Traceback (most recent call last):File "/var/log/amazon/ssm/patch-baseline-operations/common_os_selector_methods.py", line 125, in _get_snapshot_infossm_client = client_selector.get_default_client(instance_id, region, "ssm")File "/var/log/amazon/ssm/patch-baseline-operations/patch_common/client_selector.py", line 45, in get_default_clientcreds = get_metadata_creds()File "/var/log/amazon/ssm/patch-baseline-operations/patch_common/client_selector.py", line 159, in get_metadata_credscreds = credential_resolver.load_credentials()File "/var/log/amazon/ssm/patch-baseline-operations/botocore/credentials.py", line 1948, in load_credentialscreds = provider.load()File "/var/log/amazonSharerePost-User-amartinez 2 months agoFile "/var/log/amazon/ssm/patch-baseline-operations/botocore/credentials.py", line 1009, in loadcreds = RefreshableCredentials.create_from_metadata(File "/var/log/amazon/ssm/patch-baseline-operations/botocore/credentials.py", line 382, in create_from_metadataexpiry_time=cls._expiry_datetime(metadata['expiry_time']),File "/var/log/amazon/ssm/patch-baseline-operations/botocore/credentials.py", line 533, in _expiry_datetimereturn parse(time_str)File "/var/log/amazon/ssm/patch-baseline-operations/dateutil/parser.py", line 1164, in parsereturn DEFAULTPARSER.parse(timestr, **kwargs)File "/var/log/amazon/ssm/patch-baseline-operations/dateutil/parser.py", line 583, in parseif (isinstance(tzinfos, collections.Callable) orAttributeError: module 'collections' has no attribute 'Callable'Share"

Answer: "0Accepted AnswerHi,Currently we do not have any ETA for Patch Manager support. Please refer -https://github.com/aws/amazon-ssm-agent/issues/485We would recommend to wait for official support. You can refer our public documentation for latest updates.https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-prerequisites.html#supported-osCommentShareSUPPORT ENGINEERNeha_Ranswered 2 months ago0The following document described it.https://docs.python.org/3/whatsnew/3.10.html#what-s-new-in-python-3-10Remove deprecated aliases to Collections Abstract Base Classes from the collections module. (Contributed by Victor Stinner in bpo-37324.)As you can see, it does not seem to work with Python 3.10.If this answer has led to a solution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-amartinez 2 months agoThanks - but  how can I get the patch-baseline-operations under-the-hood to work as we're dependent on AWS dependenciesShareRiku_Kobayashi EXPERT2 months agoI think the only way is to downgrade to Python 3.8.Share0Patch Manager currently doesn't support Python 3.10. Please refer following document for supported versions:https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-prerequisites.html#python-versionThe document also lists supported Operating System.CommentShareSUPPORT ENGINEERNeha_Ranswered 2 months agorePost-User-amartinez 2 months agoThanks Neha R.Do you know if there's a timeline for 22.04 support? Specific date or general - like X months out?Also is a Python downgrade an option on this unsupported OS?AlexShare"


Question: S3 Events for burst uploads

"Hi,We are planning to ingest approx 2 lakh small pdf files(approx 40 kb) in burst mode from on Premise to Cloud(S3) on daily basis through AWS Datasync.  We want to keep track of the files ingested on daily basis and keep updating the processing status as it gets processed.Can someone suggest the best way to achieve it ? We initially thought of using S3 events to call Lambda to insert record in Dynamo DB table but since it may be a burst of files coming into same S3 bucket it might have throttling issue on Dynamo DB  or may hit Lambda limits for the Account.Please let me know the best way we can implement this.Thanks in Advance.Regards,Dhaval MehtaFollowComment"

Answer: "2Accepted AnswerThere are multiple ways to achieve this. But it really depends what kind of status you want to track.For real timenotifications within a short duration, you can take advantage of Event notification from object upload and pair it with SNS/SQS/Lambda and use some sort of Database or a text/csv file to keep track of objects uploaded. This will require code.If the tracking can wait for 24+ hours, then S3 inventory is a better choice. It's very easy to configure without any code.CommentSharerePostfanclubanswered a year ago0Decouple the process by sending the S3 notification to a SQS queue.https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-enable-disable-notification-intro.htmlThen have your Lambda function poll the queue.https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.htmlCommentShareEXPERTkentradanswered a year ago0You could also look at using the S3 inventoryhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-inventory.htmlCommentShareRobin Fordanswered a year ago0I would say that even going with Lambda notification should be ok for you if the lambda is only saving to DynamoDB because it should be super fast.It's not so easy to reach the account limit. But it is possible, so you can notify SQS instead of Lambda and trigger Lambda from SQS but using batch. For standard SQS it can be maximum 10000 items in one batch, so you will call Lambda much less often.CommentShareMGanswered a year ago"


Question: [ECS] Do you need to configure security groups to communicate over localhost?

"Say I have two services (service-a and service-b) where service-a is a REPLICA service and service-b is a DAEMON service. They're on the same container instance. In order for service-a to communicate with service-b over localhost, will I need to configure a security group rule to do so?I know you don't need to do it for two containers on the same task definition, but I'm not sure for two services in the same container instance.FollowComment"

Answer: "1Accepted AnswerWhen running in bridge / host/ network modes, it works pretty much the same way as you'd expect to do if you'd run docker-compose up locally. Meaning, it is your own business to deal with network permissions (now, there can be the caveat of using proxy sidecar i.e. envoy but I honestly did not test that). I use awsvpc (and recommend to only use) network mode (although that does not apply if you use ECS Anywhere). In which case, your two containers although running on the same machine, can't talk to each other without using the associate ENI. This is very secure, just needs a little more management. Now, in both cases (awsvpc and others), I would recommend you'd not rely on the localhost "catch-all" you might get given you will have a service in DAEMON mode. I'd recommend instead to use service discovery with CloudMap: your service A and B will get registered in there. Whether you use one mode or another, the container will be registered in DNS with a SRV record (which also nicely deals with potential exposed port change). Your service A will always be able to talk to service B and makes for much more scalable option. It will future proof everything for you to expand and add more services as this is an easy, repeatable, and consistent process.Hope this helps.CommentShareJohnPrestonanswered a year agoJohnPreston a year agoIf you were interested, checkout ECS Compose-X which can take care of dealing with taking your services you might have working all good locally using docker-compose by running just a few commands. Disclaimer, I am the maintainer of that :) If your use-case allows (and the services support features you need) you might checkout AppRunner/Copilot.ShareNickHolden a year agoThanks! We're looking at implementing our services in awsvpc mode.Say we have replica-service-a and daemon-service-b. We scale up replica-service-a to take up 2 container instances. Using service discovery instead of localhost, how can we ensure that replica-service-a communicates with daemon-service-b in the same container instance?Will it require querying CloudMap and selecting the right IP address? Or is there a more automated way?ShareJohnPreston a year agoRight. So, if you want to ensure that the service A talks to service B of the same container instance,  then questions ->is there a reason for it to have to talk to the container on the same instance ?that would not work at all if you wanted to move into Fargate (and although some features you can't use in Fargate so maybe that rules it out which is fair)and to answer your question, yes, you would want to use CloudMap to then query it and do client side service discovery -> allows you to search all instances of B which will have the attributes (EC2_INSTANCE_ID).ShareJohnPreston a year agoPS: was hitting the 600 chars comment limit: see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-discovery.html for the attributes ECS sets for you in CloudMap. You see the EC2_INSTANCE_ID attribute there. Find your own (from service A) and use that in the request to find service B.Share0Update: I don't mean in my answer that localhost will be useable. localhost in container does not resolve to the host IP so it will never work regardless awsvpc or bridge mode. My answer below answers the question about security gorup.It depends on the network mode you are using for your tasks. the default is bridge mode which does not have security groups support.Having said that AWS recommends to use awsvpc for your tasks, in the awsvpc tasks get an ENI. This allows the task to have a security group which in-turn allows you to control the inbound and outbound traffic of the task.CommentSharehameedullahanswered a year agoNickHolden a year agoGot it. So in awsvpc, you'd still have to configure your security groups to communicate over localhost?ShareJohnPreston a year agoIf you have 2 containers in the same task definition (and therefore service, no). However, no, you can't use localhost to go from container A to B (or B to A) when using awsvpc mode. See my reply.Sharehameedullah a year agoNickHolden, the localhost inside container will not resolve to the host IP or other service ip. You should not be using localhost anyway even if it resolves to your desired IP, as explained by John.Share0On ECS, all Tasks (with the exception of Tasks that use Host networking mode) have separate networking namespaces. This means each task has a separate network interface with a separate IP address. They also have separate loopback interfaces that do not communicate with one another. Since they don't share a network namespace, they cannot communicate via "localhost" as most people think of it (i.e., via the lo0 interface), even if they reside on the same EC2 instance.For tasks that use Bridge networking, the EC2 instance's Elastic Network Interface provides the ingress point. Ingress to ECS tasks running with bridge network is permitted by allowing traffic into the instance itself on the proper ports via the instance ENI's Security Groups. If a Task on Instance A initiates a direct connection to another Task running on Instance A running in bridge mode, then the traffic does not leave the instance, and so a Security Group rule allowing ingress will not be needed. But if a Task running on Instance A initiates a connection to a Task running on Instance B in bridge mode, then the Security Group configuration for Instance B's ENI must permit the traffic.For tasks that use AWSVPC networking, each Task is assigned its own Elastic Network Interface with its own AWS VPC IP address. Each Task's ENI and IP address is completely separate from that of the EC2 instance itself. Task-to-task communication requires setting up the appropriate Security Groups on each interface and allowing ingress traffic as appropriate. This is true even if the traffic is destined to a Task on the same EC2 instance.CommentShareEXPERTMichael_Fanswered a year ago"


Question: Where is the heightmap in Getting Started Guide?

"In the new Getting Started Guide section 2 (Building the Environment), under Importing a Heightmap it says to download the heightmap from "some location" which links to the Image-based Lighting page. It also mentions file name FTUE_heightmap_02.r16 in step 4, which I could not find with a search of files.So where do I get the heightmap? I assume I'm not supposed to create my own, as that seems like an insane first step of a Getting Started Guide. It also would be weird to specify how big it is, maximum height, etc. if I were making it myself.Follow"

Answer: "0Accepted AnswerHello @REDACTEDUSERThe Heightmap file can be found in the following directory:..\dev\StarterGame\Textures\HeightmapsMake sure you use the FTUE heightmap, the AM heightmaps are for StarterGame and will not work for the Getting Started Guide process.Let me know if you have any other issues.Thanks!SharerePost-User-1172586answered 6 years ago0Thank you very much. I assume it is FTUE_heightmap_Test.tif as there are no other FTUE* files there.Can you pass along a recommendation to update the Getting Started Guide to reflect the actual location of the file, and the correct file name?Thanks again,RichardSharerePost-User-6639749answered 6 years ago0Sure thing @REDACTEDUSERI will pass that along to the appropriate people.Thanks!SharerePost-User-1172586answered 6 years ago0I am using 1.12. It appears that the FTUE heightmap is missing from the file. Not sure what to do now.REMOVEDUPLOADSharerePost-User-6919639answered 5 years ago0Hello People! We're sorry for the troubles on this topic. The reason you are not seeing the file for the FTUE Heightmap is because it did not get shipped with 1.12. We are working on a patch and will have that out ASAP so that we can get everyone unblocked on this issue.As a workaround you can download the 1.11 build from previous versions and pull the file from there...admittedly a lot of work arounding, but we are getting the file included very soon. Thanks for your patience and again, sorry for the mishap.SharerePost-User-1172586answered 5 years ago0I'm seeing the same issue @REDACTEDUSERSharerePost-User-9813503answered 5 years ago0Sorry for this experience folks. I've alerted the teams on this issue -- stay tuned on updates! Again, much apologies on this.SharerePost-User-5738838answered 5 years ago0You can download the missing file here:https://dvbcuh49skxb5.cloudfront.net/releases/1.12/FTUE_heightmap_Test.tif and put it in this directory: /1.12.0.0/dev/StarterGame/Textures/HeightmapsSo sorry for the inconvenience.SharerePost-User-8353690answered 5 years ago"


Question: CloudSearch scaling for query traffic

"Hi,Suppose we have a small search instance and due to the increase in query traffic, 5 replicas are deployed. As in the limits, the maximum number of replicas allowed is five.What would happen if the query traffic continues to increase further?Will our domain get scaled to a larger instance type to handle the query traffic?FollowComment"


Question: EC2 free tier policy

I have diffrent account which I opened in order to test free tier couple years ago and I closed the instance within a month.To day and I wanted to use the free tier plan and wanted to know if this is against any of Aws policies?FollowComment

Answer: "0Hi,If you create a new account with a new email (new or same card), you will be considered as new customer, eligible for EC2 free tier, e which includes:750h of t2.micro or t3.micro in regions where t2 is not available30gb of EBS storage2 millions IOs1 gb of snapshots100gb of bandwidth to the internet.This is not against policies.If you ll be using the current account, your free tier is likely expired for some services (the ones lasting 12 months), while others are free forever regardless https://aws.amazon.com/free/free-tier-faqs/.Hope it helps;)CommentShareEXPERTalatechanswered 2 months ago"


Question: Locked out of ubuntu server after installing OpenSSL

"Hi,I just got locked out of my lightsail instance after installing OpenSSL without keeping the Port 22 Open,Now I'm not able to access my instance's FTP or SSH, Is there any possible way to recover the access or allow the port without SSH.FollowComment"

Answer: "0Try this: EC2 Serial Console for Linux instancesCommentShareEXPERTkentradanswered a year agoDavid G a year agoLightsail isn't EC2. Probably won't work.Share0Please check if TCP port 22 is open in the instance's Network settings.(replace REGION & INSTANCE_NAME with appropriate values):https://lightsail.aws.amazon.com/ls/webapp/REGION/instances/INSTANCE_NAME/networkingIf the port is open but you still can't SSH in, this means sshd server or some other network configuration is in invalid state. In this case, this article may help:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-create-an-instance-root-volume-snapshotIt shows how to make a disk snapshot and attach a disk created off this snapshot to another instance for data recovery purposes.CommentSharePavel - AWSanswered a year ago"


Question: IOT rule fails with KafkaAction failed to send a message to the specified bootstrap servers. Failed to process post-handshake messages.

"Hi Team,I am using IoT Rule to send messages on my self deployed SSL enabled kafka cluster topic but my IoT rule just fails with below error:{    "ruleName": "devops_iot_redpanda_test_6",    "topic": "NEL/telemetry",    "cloudwatchTraceId": "dcd97aa2-b524-70be-130f-88c82ab0ba48",    "clientId": "N/A",    "base64OriginalPayload": "xxx",    "failures": [        {            "failedAction": "KafkaAction",            "failedResource": "iot.redpanda.topic",            "errorMessage": "KafkaAction failed to send a message to the specified bootstrap servers. Failed to process post-handshake messages. Message arrived on: NEL/telemetry, Action: kafka, topic: iot.redpanda.topic, bootstrap.servers: backbone-0.redpanda.devops.h2.theagilehub.net:31169,backbone-1.redpanda.devops.h2.theagilehub.net:31169,backbone-2.redpanda.devops.h2.theagilehub.net:31169"        }    ]}FollowComment"

Answer: "0Accepted AnswerHello,I understand that you are attempting to use an IoT rule to send messages on self-deployed Kafka cluster topic, which is SSL-enabled. However, the IoT rule is failing and you are receiving the following error message:"KafkaAction failed to send a message to the specified bootstrap servers. Failed to process post-handshake messages. Message arrived on: NEL/telemetry, Action: kafka, topic: iot.redpanda.topic, bootstrap.servers: backbone-0.redpanda.devops.h2.theagilehub.net:31169,backbone-1.redpanda.devops.h2.theagilehub.net:31169,backbone-2.redpanda.devops.h2.theagilehub.net:31169"By making some changes in the VPC network configuration might help in this scenario and If you are using a self-signed CA for Kafka cluster, and providing it to the KafkaAction in IoT Core Rule via a PKCS12 formatted truststore stored in Secrets Manager as a binary secret, create a X.509 cert and private key from the self-signed CA, generate a keystore in PKCS12 format, and store it in Secrets Manager as a binary secret. To access the binaries from Secrets Manager, use the get_secret method in your rule's configuration. Your IAM role should have a policy allowing access to these secrets. As truststore and keystore are both password protected. And also try to switch to SSL from SASL_SSL or vice versa in different region and test it.Please refer to the below link for more information on this security mechanism supported regions.https://docs.aws.amazon.com/iot/latest/developerguide/apache-kafka-rule-action.html#apache-kafka-rule-action-parametersCommentShareAws_user171999answered 22 days agoJyoti492 19 days agoThanks for ypur response.I do understand and have used that mainly .. but can you be more elaborative about the network setup which is required. Also if its a certificate issue the error should be related to SSL handshake isn't it true ?Share"


Question: im  unable to create vpc it shows errors related to region

im  unable to create vpc it shows errors related to region it shows failed to perform operation describe availibility zoneFollowComment

Answer: "0Hi, it sounds like maybe you don't have the necessary permissions.  What permissions does your user or role have?Are you trying to do this via the AWS console, CLI or API?  What exactly did you try and what's the exact error message?CommentShareEXPERTskinsmananswered 2 months ago"


Question: DMS transaction

what will happen if I insert a new data into my target table while thd DMS job running? both the new data I inserted and the migrated data from source table will be inserted into my target table safely？FollowComment

Answer: "1You should be able to insert data to target database as long as you are not breaking any referential integrity with other tables.Other things to look is if your table has auto fields like identity or sequence it might clash with the inserts coming from dms and thereby generate duplicate ids. and if it is primary key it would fail this inserts.CommentShareAWS-User-8174525-subhashanswered 6 months ago-1This would be achieved by using ongoing replication.If you are already choosing the DMS migration type as "migrate existing data and replicate ongoing changes", the data would get migrated as of start time and any changes that are in the source database CDC log would get replicated into the target database.If you are just choosing DMS migration type as "migrate existing data", you would need another replication task using DMS.Please check this link for more information: https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.Creating.htmlCommentShareAnanth Tirumanuranswered 6 months ago"


Question: How to create an API gateway with multiple stages in AWS Serverless Application Model (SAM)?

"Hi,I am using the AWS Serverless Application Model (SAM) to create an API gateway which calls a Lambda function. When I do so, I notice the API gateway is created with two stages by default called "Stage" and "Prod". Below is my template code:  GetAllOrdersFunction:Type: AWS::Serverless::FunctionProperties:  CodeUri: orders_api/  Handler: orders.get_all_orders  Runtime: python3.9  Policies:- CloudWatchPutMetricPolicy: {}- DynamoDBReadPolicy:TableName: !Ref OrdersTable  Events:GetAllOrders:  Type: Api  Properties:Path: /idMethod: GETHow can I modify my template to customize the number of stages that are created for my API gateway and the names of them? E.g. creating three stages with the names v1, v2, and v3?Thanks.FollowComment"

Answer: 0HiYou have the possibility to pas routesettings https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettingsBut SAM will merge that if original api has someFor stagenames there is a possibility to create the stages and your api independently instead of relying on sam function resourceBy the way creating your own stage will not prevent sam creating default stage and prod stagenamesResources:    Myv1Api:        Type: AWS::Serverless::Api       Properties:           StageName: v1           OpenApiVersion: 2.0   Lambdafunction:       Type: AWS::Serverless::Function       Events:            MyApiv1Event:               RestApi: !Ref Myv1APiThis way the defaults will be prevented and you create your v1 stageCommentShareOmid Eidivandianswered a year ago


Question: What is the maximum concurrent requests and connections can ALB handle?

I'm trying to search about the information but could not find the right on"What is the maximum concurrent requests and connections can ALB handle?"FollowComment

Answer: "2I dont think you can find a specific number for this question, remember it is a managed service and under the hood is not just one physical device, and it will basically scale automatically to meet varying levels of application load. The best approach always is to test and simulate.CommentShareVicky Gracianoanswered 5 months agoEXPERTkentradreviewed 5 months ago1The main reason for number of max connection handled by ALB is not document, is that, ALB is designed to scale up as and when the traffic on the load balancer will increase. If there is a gradual increase in load (i.e less than 50% increase in a 5 min window), then the ALB scales itself to higher capacity nodes and if required increase the number of node commissioned for your ALB to provide enough capacity to handle the load.If spike in traffic is expected (i.e more than 50% increase in a 5 min window) you can always request a prewarm of your load balancer.  ( usually needed if you are expecting a spike due to marketing/sale event)CommentShareMuhammadanswered 5 months ago"


Question: "AWS Glue not properly crawling s3 bucket populated by "Resource Data Sync" -- specifically, "AWS: InstanceInformation" is not made into a table"

"I set up an s3 bucket that collects inventory data from multiple AWS accounts using the Systems Manager "Resource Data Sync". I was able to set up the Data Syncs to feed into the single bucket without issue and the Glue crawler was created automatically.Now that I'm trying to query the data in Athena, I noticed there is an issue with how the Crawler is parsing the data in the bucket. The folder "AWS:InstanceInformation" is not being turned into a table. Instead, it is turning all of the "region=us-east-1/" and "test.json" sub-items into tables which are, obviously, not queryable.To illustrate further, each of the following paths is being turned into it's own table.s3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=12345679012/region=us-east-1s3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=12345679012/test.jsons3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=23456790123/region=us-east-1s3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=23456790123/test.jsons3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=34567901234/region=us-east-1s3://resource-data-sync-bucket/AWS:InstanceInformation/accountid=34567901234/test.jsonThis is ONLY happening with the "AWS:InstanceInformation" folder. All of the other folders (e.g. "AWS:DetailedInstanceInformation") are being properly turned into tables.Since all of this data was populated automatically, I'm assuming that we are dealing with a bug? Is there anything I can do to fix this?FollowComment"

Answer: "0After testing more, I've determined the issue is being caused by that "test.json" file which is being added at the time of Resource Sync creation.CommentShareAWS-User-7460517answered a year ago"


Question: AWS Data Wrangler Athena Query Failure

"I'm attempting to run an Athena query using AWS Data Wrangler which is failing with an error indicating a column cannot be resolved. However when I view the failing query in the Athena console and rerun it there, it succeeds. I have a feeling it has something to do with the formatting with table or column names but I've been unsuccessful finding a work around. When I attempt the same query using vanilla boto3, it also fails with the same error. Here is an example of the code which fails followed by the same successful query ran in the console. (with some names anonymized for security) Adding to the strangeness further, if I remove the joins, it will error indicating the first column in the select cannot be resolved but the same query runs successfully in the console.Python Codeimport awswrangler as wrquery = """SELECT     t1.description,     t1.model_number as model,     t1.p_id as p_id,     t1.created_at as createdAt,     t1.updated_at as updatedAt,     t3.description as platform,     t2.name as moduleFROM     database_with_underscores.first_table t1 LEFT JOIN    database_with_underscores.other_table t2ON    t2.id = t1.module_idLEFT JOIN    database_with_underscores.lasttable t3ON      t1.platform_id = t3.id"""df = wr.athena.read_sql_query(query, workgroup="primary", database="database_with_underscores")Python Resultawswrangler.exceptions.QueryFailed: SYNTAX_ERROR: line 19:5: Column 't2.id' cannot be resolvedAWS Athena ConsoleSELECT     t1.description,     t1.model_number as model,     t1.p_id as p_id,     t1.created_at as createdAt,     t1.updated_at as updatedAt,     t3.description as platform,     t2.name as moduleFROM     database_with_underscores.first_table t1 LEFT JOIN    database_with_underscores.other_table t2ON    t2.id = t1.module_idLEFT JOIN    database_with_underscores.lasttable t3ON      t1.platform_id = t3.idConsole ResultSuccessfulLink to a diff of the execution where you can see the Query is identical but one succeeds and the other fails https://imgur.com/a/V9QSbInFollowComment"

Answer: "0Accepted AnswerAfter much trail and error, I came to find out the true source of the issue was due to a difference in permissions between my console account and CLI account. Adding the select/describe permissions to my CLI account immediately resolved the error.The error message regarding the column not being resolved was misleading in this situation. Further interesting was this did not generate any sort of Unauthorized event in our CloudTrail.CommentShareCoryMcCanswered a year ago0Please review the column names in the respective tables. It looks like the ON condition is not same at both places. Python code is referring t2.id while console query refers t1.id and same anomaly for the module_id column.Python Code:t1 LEFT JOIN t2ON t2.id = t1.module_idAthena Console Query:t1 LEFT JOIN t2ON t1.id = t2.module_id```CommentShareawsanilanswered a year agoCoryMcC a year agoAh yes, that was a bad copy/paste. In the source code prior to me anonymizing it, they're both identical yet the same issues persists. The both are in fact t2.id = t1.module_idAlso for further clarification, when the query fails via Python, I go the console, click the failed query to load it and hit run without edits and it succeeds. I'm not actually copying/pasting anything between the two systems.Share"


Question: Connect to the database in an EC2 instance from the ECS cluster

"I have Superset deployed on AWS using the guide https://aws.amazon.com/quickstart/architecture/apache-superset/ where I chose to deploy it in an existing VPC. The Superset deployment worked out alright and I can access Superset at the provided link. When I try to connect to a database which is hosted in an EC2 instance, within the same VPC, I get the error, port 5432 is closed message on my Superset. The DB is up and running in the EC2 instance, which has been verified locally and remotely through my laptop.I was previously able to connect to a database on RDS by adding the security group of the ECS Superset to the security group of the RDS instance. The same technique did not work for the ECS (Superset) -> EC2 (DB)  connection. I also tried adding the IPv4 subnet range like 172...0/20 to the EC2 security group without success. These subnet ranges were obtained from the ECS deployment.Any help to debug this issue would be greatly appreciated.FollowComment"

Answer: 0Accepted AnswerWhat worked for me finally was using the AWS endpoint public Ipv2 DNS - ip-172...us-west-2.compute.amazonaws.com address of the EC2 instance instead of the public IP which I was trying to use before.CommentSharechintanpanswered 9 months ago0Check if MySQL DB is allowing all host IPs for given username.Use VPC Reachability Analyzer to check communication between network interfaces.Check ECS Service definition -> Security Groups -> EC2 DB Security group should be one of the value in this array.CommentShareAshish_Panswered 10 months ago


Question: Problems with OpenSearch Serverless and More Like This queries

"I found some problems in the implementation of the "more like this" queries on OpenSearch Serverless.Following this tutorial https://opensearch.org/blog/similar-document-search/but also this documentation from Elastic Search https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-mlt-query.htmlI noticed that the queries based on the sentences works, but the queries based on ID it doesn't.For example, a query like this works:GET yourindex/_search{  "query": {    "more_like_this" : {      "fields" : ["title", "description"],      "like" : "Once upon a time",      "min_term_freq" : 1,      "max_query_terms" : 12    }  }}but this query, a lot more useful and efficient, doesn't works. The results is always an empty set.GET yourindex/_search{  "query": {    "more_like_this": {      "fields": [ "title", "description" ],      "like": [        {          "_index": "imdb",          "_id": "1"        }      ],      "min_term_freq": 1,      "max_query_terms": 12    }  }}any idea?FollowComment"


Question: Understanding route table to NAT Gateway

Consider  a customer with a large account comprised of multiple subnets and route tables. The customer sees NAT Gateway usage in Cost Explorer but doesn't know what route table directs to it.What would be the easiest way to find out?FollowComment

Answer: 0Accepted AnswerAny traffic flowing to the NATGW will need a route in the subnet route table that has a NATGW id as the destination. A simple search on route table describe API calls or searching through the console will show. The CLI docs actually give an example of this: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.htmlCommentShareAWS-James-Devineanswered 3 years ago


Question: Migration from IPv4 to IPv6 protocol

"Know which services work on this IPv6 port and which only work on IPv4?And if both protocols can be activated (dual stack) to have access to services that do not have IPv6, and continue to work with IPv4.FollowComment"

Answer: "0These services listed below support IPv6:Elastic Load Balancing, AWS IoT Core, AWS Direct Connect, Amazon Route 53, Amazon CloudFront, AWS Web Application Firewall, and S3 Transfer Acceleration, EC2 instances.For a VPC IPv6 is supported, however it has to be a dual stack. There is no IPv6 only for VPC.https://aws.amazon.com/blogs/aws/aws-ipv6-update-global-support-spanning-15-regions-multiple-aws-services/+Apart from above blog, I found another way to check more information related to which services supports IPv6 is checking the link ( https://aws.amazon.com/new/ ) where new features is announced by AWS and search for IPv6.+I found some of the links which I believe will be useful to you like:https://aws.amazon.com/about-aws/whats-new/2021/01/amazon-lightsail-supports-ipv6/https://aws.amazon.com/about-aws/whats-new/2021/01/amazon-ec2-api-supports-internet-protocol-version-6/https://aws.amazon.com/about-aws/whats-new/2020/11/network-load-balancer-supports-ipv6/https://aws.amazon.com/about-aws/whats-new/2020/11/amazon-ecs-supports-ipv6-in-awsvpc-networking-mode/https://aws.amazon.com/about-aws/whats-new/2020/08/aws-site-to-site-vpn-supports-ipv6-traffic/https://aws.amazon.com/about-aws/whats-new/2020/05/amazon-virtual-private-cloud-supports-bring-own-ipv6-addresses/https://aws.amazon.com/about-aws/whats-new/2019/11/inter-region-vpc-peering-supports-ipv6-traffic/CommentShareSUPPORT ENGINEERNirmal_Kariaanswered a year ago"


Question: I am unable to send and receive mails in workmail

I have created a workmail account and enabled the users in it.But I am unable to send and receive emails for both the users.Is there anything that I need to enable anything to send and receive emails?any help is highly appreciatedFollowComment

Answer: "1Hello,I understand that you are unable to send and enable in your WorkMail.Firstly, I want to inform you that when you create a WorkMail and if all the records of your domain are validated properly there is no need of enabling anything to send and receive emails.So, I request you to please check if all the records are verified correctly or not? Please follow the document[1] if your domain records are not verified correctly.Also, Please do refer the document[2] for troubleshooting the mail routing issues.For Inbound mail issues:Check the MX record for the domain associated with your Amazon WorkMail organization. WorkMail should be the only entry and should have the lowest priority. Multiple MX records can lead to the wrong service receiving messages. Please refer document[1] from references.Check the Domain-based Message Authentication, Reporting, and Conformance (DMARC) settings for your organization in the Amazon WorkMail console. DMARC records are used to protect against common attacks, such as spoofing or phishing, that can compromise a user's account credentials. Please refer document[3] from references.Check the Amazon Simple Email Service inbound rule. If the rule contains actions other than Amazon WorkMail, those actions can fail and cause Amazon WorkMail to stop receiving mail. For more information about Amazon SES rules, Please refer document[4] from references.For Outbound mail issues:Ensure your SPF record includes Amazon SES. Check the domains page in the Amazon WorkMail console to verify. For more information about SPF, Please refer document[5] from references.Ensure Amazon WorkMail has permissions to use the domain. If not, add the domain again by following the document[6] from references.Note:For most of the times, you will be facing issues if the required domains are not validated or if the "INBOUND_MAIL" is not active or it is disabled for the WorkMail organization at SES end. You can resolve the issue by re-adding the domain[6] or by Integrate with Amazon WorkMail action[4].Also, please make sure that if you are using any third party filtering process in front of WorkMail, Please do make sure that the domain is not blocked.Please refer the below link to troubleshoot the mail routing issues.https://mxtoolbox.com/References:[1] Verifying domains - https://docs.aws.amazon.com/workmail/latest/adminguide/domain_verification.html[2] Troubleshooting mail routing issues - https://docs.aws.amazon.com/workmail/latest/adminguide/troubleshooting.html[3] Enforcing DMARC policies on incoming email - https://docs.aws.amazon.com/workmail/latest/adminguide/inbound-dmarc.html[4] Integrate with Amazon WorkMail action - https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-workmail.html[5] Authenticating Email with SPF in Amazon SES - https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-spf.html[6] Adding a domain - https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.htmlCommentSharerePost-User-1373112answered 8 days ago"


Question: CodePipeline creates a BuildArtif and SourceArti key for build artifacts by default.  Is this configurable?

Just curious why the strange naming convention (it seems to be limited to 10 characters) and if this can be updated in any configuration within CodePipeline.FollowComment

Answer: "0The artifact naming can be modified from the defaults (1). I can't be certain as to why the underlying filename in S3 is truncated in this manner however.(1) https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome-introducing-artifacts.html : Input and output artifactsCommentShareSUPPORT ENGINEERWayne_Ganswered a year agorchawdry a year agoWhile I know the S3 bucket name is configurable, the question was asking about input/output artifact paths.  The article doesn't indicate whether the paths are configurable from the defaults (s3://{bucket-name}/{pipeline-name}/BuildArtif).  It's the last part of the path I'm trying to figure out.Share"


Question: "when using athena, report: Unsupported vendor for Glue supported principal"

"when select data from athena, it reports error:HIVE_UNKNOWN_ERROR: com.amazonaws.services.lakeformation.model.InvalidInputException: Unsupported vendor for Glue supported principal: arn:aws:iam::918874966228:root (Service: AWSLakeFormation; Status Code: 400; Error Code: InvalidInputException; Request ID: 3706fc64-95b9-478d-afd8-56821c673d42; Proxy: null)but show create table doesn't report error;FollowComment"


Question: EC2 Information Required

"Dear AllI am fairly new to AWS so please bare with me :)I have two EC2 instances in 2 availability zones. I have enables ICMP in my security groups to ping each other (Private IP's). I am able to ping (Private IP's) between the two instances which are in different availability zones. Why is this possible? I am not supposed to ping them because they are on two different networks (subnets). Will I be charged for the pings across two AZ?Also, how can I setup an instance in one region and ping another instance in region? VPC Peering?Thank youFollowComment"

Answer: "0Accepted AnswerFirst off, I was mis-typed with regards to AZ data charges...it's .01/gb between azs.  your pings will do nothing to your bill..it's inconsequential.Within a VPC, there are, generally, speaking, four dimensions that determine traffic flow:On-instance firewall/proxies (e.g. iptables...Usually not relevant for most amis out of the box)NACLS (stateless firewall).  By default, these allow any traffic to flow in both directions, and many people leave it that way, as these can be hard to manage.Subnet routing:  WITHIN A VPC, ALL SUBNETS CAN ROUTE TO EACH OTHER.  Look at any subnet route table, notice the local entry. Also notice you can't change that.Security Group:  aka stateful firewall.  This is the primary mechanism by which you would control traffic into/out of EC2 that reside within the same vpc.If this isn't clear to you and you want to understand it further, you should really take a look at the AWS VPC documentation. There's a lot of great diagrams, etc that help explain the basics.CommentSharecloudbuttonanswered 3 years ago0There should be no intra-region data charges.They are pingable..because you made them pingable.  if you want to share your security group rules, it will be more clear, but perhaps they are in the same security group and you created an inbound rule for that security group, or you used the ip of the VPC (often a /16, whereas your subnets are usually smaller, say a /24).By default in routing tables for a single vpc, traffic will route among all availability zones in the vpc (see the local entry in the routing tables), and it's up to the security groups (typically) to allow specific types of traffic.Between regions, if you are using private subnets..yes, you need peering or transit gateway..or an EC2-based VPN solution.CommentSharecloudbuttonanswered 3 years ago0HeyMany thanks for the response. I am super confused, if two instance are in separate AZ's then they should not ping because each AZ is a network and since they are in different AZ's they are in different networks. I can share my security group but it wont help as I have enabled SSH and ICMP for pings and nothing more. I think I do not understand the concept of VPC correctly. I have even attached two different security groups with ICMP and SSH enabled for the two instances. So in a nutshell, I have two instances in different AZ's with two different security groups. Awaiting your positive responseCommentShareKaizanswered 3 years ago0HeyMany thanks for the response, really appreciate it. I checked the local entry and the local entry for the VPC is 172.31.0.0./16 means for the entire subnet. My machines have a private IP of 172.31.39.178 and 172.31.28.255. So they fall under the 172.31.0.0./16. Thank for the note that all subnets can route to each other in a VPC.CommentShareKaizanswered 3 years ago"


Question: EMR_DefaultRole not displayed in dropbox

"I want to create an EMR Cluster. To do that, I need to select a service role in the last step, but when I click the drop box, no role appears. When I looked at someone's tutorial, there was a default role called EMR_DefaultRole. Why can't I see this?This picture is my screen when I click the dropbox to search roles (but no roles appear)This picture is from other man's tutorial (He searched EMR_DefaultRole)FollowComment"

Answer: "0This is because you or any other IAM role /user has not created any EMR cluster before in that AWS Account.Option 1:You can run the cloudformation as found here to create v1 roles.https://github.com/aws-samples/amazon-mwaa-complex-workflow-using-step-functions/blob/main/setup/default-emr-roles.yamlOption 2You can click "Create New Role" and can create service roles as well.https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.htmlOption3Alternatively , switch to old console and you will see default roles available in "Create Cluster - Quick Options".CommentShareEXPERTDipankar_Ganswered 3 months ago"


Question: Using codewhisperer in cloud 9 pricing

"We are a company looking to purchase an AWS Cloud 9 Professional account.  So, in order to use Code Whisperer on the cloud 9 , do we need to purchase it separately?On the official documentation it is saying that Code Whisperer is also available for free with AWS Cloud9. So is this true?Official Documentation LinkFollowComment"


Question: My db.t2.micro is stuck "in progress" after storage size modification

"My PostgreSQL db running on a db.t2.micro RDS ran out of storage (Status: Storage-full) and I've lost all connection to it.I tried modifying it to increase the storage to 20GB, but it's been "in progress" for the last 11 hours with no indication that it will ever complete.I'm a bit concerned that in the "Maintenance & backups" tab, it has a section for Maintenance that it implies a "Pending modifications - Allocated storage: 20 GiB" happening in a maintenance window in 5 days time. I remember using "apply immediately".I've also noticed that "Current Region backups" shows a spinner which fails to ever load anything.The closest info I can find on my situation is this: https://aws.amazon.com/premiumsupport/knowledge-center/rds-stuck-modifying/ but I'm not sure how I can practically action the suggestions given the current state of the rds.I can't take a snapshot while the database in is this "in-progress" state.Is there a way to increase the storage in a timely manner, and in such a way that I know when it will be completed?[edit]After looking back through my logs, I have this errorpsycopg2.errors.DiskFull: could not write to file "pg_wal/xlogtemp.8331": No space left on devicewhich seems related to this article: https://aws.amazon.com/premiumsupport/knowledge-center/diskfull-error-rds-postgresql/although trying to connect to the device is an issue, at least from a client app running on my desktop.FollowComment"

Answer: "0That spinner behaviour on "Current Region backups" indicates you're missing some permission.  I'd resolve this forst so you know you're getting true up-to-date info in the console, then see how your db looks.Though it's odd you've lost connection to the db - it should be available for reads and writes when adding storage thoughyou may experience degraded performance until the process is complete. Adding storage may take several hours.CommentShareEXPERTskinsmananswered 3 months agogmcc051 3 months agoI edited the initial post stating the original diskfull error.If I try to connect via psql, I getpsql: error: connection to server at "<my db endpoint>, port 5432 failed: Connection refusedIs the server running on that host and accepting TCP/IP connections?And that despite the db being "Publicly accessible" and having inbound/outbound rules allowing 0.0.0.0/0 port 5432Shareskinsman EXPERT3 months agoIn https://aws.amazon.com/premiumsupport/knowledge-center/rds-out-of-storage/#:~:text=An%20Amazon%20RDS%20DB%20instance,storage%20of%20your%20DB%20instance. it says "An Amazon RDS DB instance in the storage-full status doesn't have enough available space to perform basic operations, such as connecting to or restarting the instance.".  It accepts only allocated storage modifications. Any modifications for other values are rejected.  You must increase allocated storage by at least 10%. An increase less of than 10% results in an error.Sharegmcc051 3 months agoUnder the maintenance tab, it's listed "Pending modifications - Allocated storage: 20 GiB", but it has been like that for about 36 hours. This was after my attempt to increase the size from 5GB to 20GB. I have no idea why "apply immediately" had no affect because from the information in the maintenance tab, it seems to imply that this modification won't happen until the 25th (a maintenance window?). Thankfully I had a backup and was able to create a new database, but for curiosity, I'll wait till the 25th to see if the modification eventuates.Sharegmcc051 3 months agoIt took 4 days, but the resize finally happened and Maintenance: in-progress has changed to available. I've since moved to a different db.Share"


Question: Enforce Encryption on SNS creation by SCP

"I would like to create an SCP to enforce encryption on SNS creation. I am creating the below policy but it failed.{"Version": "2012-10-17","Statement": [{"Sid": "Statement1","Effect": "Deny","Action": ["sns:CreateTopic"],"Resource": "*","Condition": {"StringNotEquals": {"KmsMasterKeyId": "alias/aws/sns"}}}]}FollowComment"

Answer: 0Unfortunately I do not believe that the SNS service supports the KmsMasterKeyId as a conditional:https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.htmlAs such the policy will not work as the string will always "not equal" and then fail through the Deny.CommentShareCraig_Sanswered a year ago