Question: How to connect Beanstalk to DocumentDB

"Hello, I created an Elastic Beanstalk application (node) that needs to connect to DocumentDB.I also created the DocumentDB cluster, following this guide:https://docs.aws.amazon.com/documentdb/latest/developerguide/connect-ec2.htmlmy problem is that I am not sure I should connect the Security Group to a EC2 instance, what happen if I decide to recreate the beanstalk environment? Should I maybe connect the Security Group to the Load Balancer? What's the best approach for this use case?thanksMFollowComment"

Answer: "0The best approach for this use case would be to connect the DocumentDB Security Group to the Elastic Beanstalk environment's Security Group. This way, the connection between the DocumentDB cluster and the Elastic Beanstalk application is established through the Security Group.If you decide to recreate the Beanstalk environment, the connection to the DocumentDB cluster will still be established, as the Security Group will remain unchanged. This is because the Security Group is not tied to a specific EC2 instance or Load Balancer, but rather to the environment as a whole.To set this up, you can add the DocumentDB Security Group as an inbound rule to the Elastic Beanstalk environment's Security Group. This will allow the Elastic Beanstalk application to communicate with the DocumentDB cluster.In summary, connecting the DocumentDB Security Group to the Elastic Beanstalk environment's Security Group is the best approach for this use case as it ensures a stable connection between the DocumentDB cluster and the Elastic Beanstalk application, even if the environment is recreated.CommentShareDivyam Chauhananswered 4 months ago0I am not sure what you mean by Beanstalk environment's Security Group. If a select my environment and I click on Configuration and then Security, I can only see Service Role and Virtual Machine Permissions.Or do you mean to add the DocumentDB Security Group to EC2 security groups in Configuration -> Instances? Btw I already tried this with no luck.thanksMCommentSharerePost-User-3116220answered 4 months ago0After twicking a little bit with the configuration I managed to make these 2 security groups:a security group (DocumentDBSecGroup) to allow inbouns connections on 27017 from EC2SecurityGroup, and outbound to everywhere. I attached this one to my DocumentDB Cluster.a security group (EC2SecurityGroup) to allow inbound connections on 27017 from DocumentDBSecGroup,. as well as inbound on 80 and 443, and outbound to everywhere. I attached this one to my EC2 instances from Beanstalk.I am still not able to connect to DocumentDB, am I missing anything?thanksMCommentSharerePost-User-3116220answered 4 months ago"


Question: Please add retry configuration in the create-deployment command

"Dear AWS,We need to create greengrass deployments and are using following cli command https://awscli.amazonaws.com/v2/documentation/api/latest/reference/greengrassv2/create-deployment.html. It looks like this option is missing from the command, could you please add it if it's indeed missing or advise on how to add it?Thank you in advance.With best regardsFollowComment"

Answer: "1Hi. Retry configuration is a relatively recent addition to AWS IoT jobs. It's available for CreateJob but not yet available for CreateOTAUpdate nor CreateDeployment. Unfortunately, I can't give you a timeline on when this will be delivered.CommentShareEXPERTGreg_Banswered a year ago"


Question: Why VPC with a "public subnet only and AWS Site-to-Site VPN access" cannot be configured?

Why VPC with a "public subnet only and AWS Site-to-Site VPN access" cannot be configured? As per Doc (https://docs.aws.amazon.com/vpc/latest/userguide/vpc-scenarios-intro.html) there are only four types except for only public sub and VPN.FollowComment

Answer: "2Accepted AnswerHello,Private subnet only with AWS Site-to-Site VPN is the case when you want to restrict the VPN network in the private, there is no Internet gateway enabled over the Internet. However, there is no limitation to public subnet only with AWS Site-to-Site VPN, you can configure it if you want. For details see below AWS Doc.https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario4.htmlCommentSharejcvipanswered 10 months agoEXPERTBrettski-AWSreviewed 10 months ago"


Question: Copy / Paste Issue Between Multiple Monitors on Linux Client

"Hello, I am using Amazon workspaces on a Linux client. The Linux flavor is Ubuntu.The Amazon workspaces are Windows 10.My issue is that I cannot copy / past anything across multiple monitors. I can copy and paste between the physical machine and the amazon workspaces, but I cannot copy any info from my first monitor to my secondary monitor. I checked to be sure copy and paste was working fine on my Linux machine and it is working just fine. I have been googling solutions but have not had much luck.Anything helps. Thanks!FollowCommentrePost-User-7218344 23 days agoI've got the same issue.  Ubuntu 20.04.6 here and the 4.5.0.2006 client.  Amazon... anything?Share"


Question: Cross-region encrypted snapshots of encrypted RDS instances   - data transfer cost?

"As Amazon RDS now supports copying encrypted snapshots of encrypted DB instances across regions, what is the cost?  Will the customer be charged just for the diff, or for the entire snapshot?FollowComment"

Answer: 0Accepted AnswerA snapshot copied to another region is a full copy (similar to EBS). Customers are charged for the data transfer used to copy the snapshot data across regions and storage used to store the copied snapshot in the destination region.CommentShareAWS-User-1234922answered 6 years ago


Question: Migrate LaunchConfiguration to LaunchTemplate

"I have a CloudFormation template that creates an AutoScaling Group (AWS::AutoScaling::AutoScalingGroup) using a LaunchConfiguration (AWS::AutoScaling::LaunchConfiguration). I'm trying to convert it to use a LaunchTemplate (AWS::EC2::LaunchTemplate). I've updated the cloudformation template, creating a new launchTemplate resource. I created a CloudFormation Change set and I see that the LaunchConfiguration will be deleted, a LaunchTemplate will be created and the AutoScaleGroup will be updated.  I used the same parameters as the existing CloudFormationTemplate. The error occurs when I attempt to Execute the changeset.You must use a valid fully-formed launch template. The parameter groupName cannot be used with the parameter subnetI'm supplying the Security Group ID via a parameter SecurityGroups:          - !Ref InstanceSecurityGroupIf I switch to using the group name, I get a different error regarding defaultVPCsLooking at a partial execution, I see that the Security GroupID is listed in the LaunchTemplate under the "Security Groups" and not the "Security Group IDs", which is where I would expect it.How can I update my CloudFormation template to use a LaunchTemplate?FollowComment"

Answer: "1The property to set in the CloudFormation template is SecurityGroupIDs and not SecurityGroupsCommentShareTomOgnibeneanswered 2 months agoShahad_C 2 months agoAdditionally, you don't need to include the Subnet in the launch template.  The ASG will ignore it in favor of the subnets specified on the ASG itselfShare"


Question: How to increase S3 storage for account displays 100% usage in storage lens

"I use S3 to store video records from Twilio Services using the I AM accountAfter storing some objects it stopped receiving any new objects and displays in Storage Lens that it uses 100% of its storage (258.2 MB) (271 objects)Here is the policy for I AM account{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "UploadUserDenyEverything",            "Effect": "Deny",            "NotAction": "*",            "Resource": "*"        },        {            "Sid": "UploadUserAllowPutObject",            "Effect": "Allow",            "Action": [                "s3:PutObject"            ],            "Resource": [                "arn:aws:s3:::bucketname/folder/*"            ],            "Condition": {                "StringEquals": {                    "s3:x-amz-acl": [                        "public-read"                    ]                }            }        }    ]}I got this error in twilio error logAccess denied to external S3 bucket configured in recording settings: Access denied to external S3 bucket configured in recording settings. Review your account's recording settings. The media will not be uploaded until the configuration has been fixed.Any help would be appreciated.FollowComment"

Answer: 1HelloThe total volume of data and number of objects you can store are unlimited. Can you please provide details of where in Storage lens are you seeing 100%?The error indicates access deny error which points to something in permissions. What is the process through which files are uploaded to S3 bucket? You can try uploading through CLI with the same IAM role to troubleshoot.CommentSharerePostfanclubanswered a year agorePost-User-1576855 a year agoThank you for your answerI Tried using CLI and get access denied then I edited the permissions and it works right nowShare


Question: How to use external libraries in AWS Glue Python Shell

"I am trying to use external libraries like openpyxl, added the wheel for it in S3 and referenced in the Job details, but it seems that it is not working. Tried adding a parameter with the version needed too. But nothing is working. Can you please suggest any other way of doing the same or any other service through which I can run my python jobs(Contains code for fetching data from different dbs, transformation and creating reports with aggregated values)FollowComment"

Answer: "1Hi,to successfully add an external library to a Glue Python Shell job you should follow the documentation at this link.UPDATEas described i the link above, when using python 3.9 the best option to install external libraries is:--additional-python-modules s3://aws-glue-native-spark/tests/j4.2/fbprophet-0.6-py3-none-any.whl,scikit-learn==0.21.3For previous version the following is still correctconsidering you have already downloaded the wheel file  and uploaded it to Amazon S3, then if you are creating your job via command line you need to add the parameter:--default-arguments '{"--extra-py-files" : ["s3://MyBucket/python/library/openpyxl-3.0.9-py2.py3-none-any.whl"]}if you are creating/editing the Python shell in the console:for the new Glue Studio Job Editor : look under Job Details , Advanced properties.for the legacy Job Editor - look under the Security configuration, script libraries, and job parameters (optional) sectionOnce you locate the text box under Python library path paste the full S3 URI for your wheel file.I tested it with your library and it works in my environment.Processing ./glue-python-libs-cr2dddvq/openpyxl-3.0.9-py2.py3-none-any.whlCollecting et-xmlfile  Downloading et_xmlfile-1.1.0-py3-none-any.whl (4.7 kB)Installing collected packages: et-xmlfile, openpyxlSuccessfully installed et-xmlfile-1.1.0 openpyxl-3.0.9hope this helps,CommentShareEXPERTFabrizio@AWSanswered a year agowookjae a year agoI did the same thing but my problem was not solved. I have edited the Python shell in the console. In new version user interface of Jobs, not legacy version jobs, I found the Python library path in the library section in the Job details tab.Share0Thank you for your question. Without some context its hard to say what is the reason, but in general i was able to make it work as based on this articlehttps://aws.amazon.com/premiumsupport/knowledge-center/glue-version2-external-python-libraries/CommentShareAlex_Tanswered a year agoAWS-User-0885813 a year agoThe article shared does not work either, right now I am importing just one library - openpyxl.Gives "No module named openpyxl" error. Have passed the wheel file downloaded from internet and added, also tried passing the key value job parameter (key:--additional-python-modules, value: openpyxl==3.0.9)ShareFabrizio@AWS EXPERTa year agoHi, the answer is actually incorrect, the link provided works for AWS Glue Spark JObs , not for Glue Pyhon Shell as requested in the question.it also  could be improved by mentioning that it is possible to understand if an error is happening during the import of the external library by checking in the Cloudwatch logs for the job.If no error are presents the logs under the job run will show the package installed.Share"


Question: ec2 server restarted itself

"ec2 server running with low cpu utilization and suddenly restarted itself , and after ec2 restart systemctl can not start some services tooFollowComment"

Answer: "01)In your AWS Ec2 console, In the navigation pane, choose Instances.Select the instance and choose Instance state, Reboot instance.Alternatively, select the instance and choose Actions, Manage instance state. In the screen that opens, choose Reboot, and then Change state.Choose Reboot when prompted for confirmation.The instance remains in the "running" state.2)The other problem might be from kernel (sudo yum update kernel or if i miss out any additional commands you can look in google .I dont remmeber now ) end, you might need to reboot . Also check the system logs are located at /var/log/messages or /var/log/syslog depending on your OS distribution.3)Also check your reboot history to determine if a user or an application inside the server initiated the reboot:grep reboot /home/*/.bash_historygrep reboot /root/.bash_historyhistory | grep -i reboothistory | grep -i initlast reboot4)The other area in cloudtrial- Event histroy -Select Event name from the filter dropdown list, and then enter RebootInstances.create an Amazon CloudWatch alarm that automatically recovers instances experiencing underlying hardware issues resulting in reboot.Hope this helps.CommentSharerePost-User-3162014answered 8 months ago"


Question: Elastic IP Addresses disappeared (EC2 Instances)

"Hi, So I've had a few Elastic IP addresses for years and associate them with specific EC2 Instances, as required, in a specific Region. They have now disappeared & I do not release them (100% positive).  I tried allocating a new IP address to test, but the Scope of this new public IP address is VPC only (I cannot edit/change).Any thoughts?FollowComment"

Answer: "0Unfortunately, I don't think there's much assistance we can give you here as we don't have visibility into your account. The best suggestion I have is to contact our support team.CommentShareEXPERTBrettski-AWSanswered 6 months ago"


Question: Maintain CloudWatch settings with CloudFormation for cross-account views

"For enabling account switching the part of data sharing provide a CloudFormation template like described here:https://repost.aws/questions/QUmLk1Q-VrSTW6ok3Scj8o6A/enabling-cross-account-functionality-in-cloudwatch-without-aws-consoleUnfortunately, I can't find anything like this for cross-account views.I like to manage the custom account selector with CloudFormation.FollowComment"


Question: Amazon Prometheus is reporting wrong data

"Hi,I am using the Prometheus Python client library to instrument my application and send metrics to AMP with the help of AWS Distro Otel (ADOT) collector in between. I am creating a custom timestamp for my metric which is a few minutes older than the current time.For example, let's say the current time is 12:00:00 and I had to report a metric value 100 that occurred at 11:50:00. I am creating a metric with value 100 and custom timestamp 11:50:00.000 (milliseconds precision) and sending it to AMP using ADOT in between.However, on the AMP side, I can see the metric value 100 being reported from 11:50:00 to 11:55:00. That is the value 100 is being reported up to +5 minutes from the timestamp that I had intended it to be actually reported.I believe the AMP should not be filling such wrong values on its own.This has turned to be a major blocker for us and any immediate help or support on this would be really appreciated.FollowComment"


Question: Regions.getCurrentRegion() for AWS SDK 2.0

From this link: https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/migration-client-region.htmlRegions.getCurrentRegion() is still not supported for AWS SDK 2.0. So what is the alternative that we could do in order to get the region of our cluster.FollowComment

Answer: "1Regions.getCurrentRegion() does not have an equivalent in v2.You could use the DefaultAwsRegionProviderChain class that looks for the region in this order:Check the aws.region system property for the region.Check the AWS_REGION environment variable for the region.Check the {user.home}/.aws/credentials and {user.home}/.aws/config files for the region.If running in EC2, check the EC2 metadata service for the region.var regionProvider = DefaultAwsRegionProviderChain.builder().build();var region = regionProvider.getRegion();CommentShareDmitry Balabanovanswered a year ago"


Question: SSL Error: Hostname/IP does not match certificate's altnames

"I have a ReactJs front-end app deployed in Netlify and  Rails back-end app deployed on AWS using Elastic Beanstalk. When I test my app with Postman making requests to my API via HTTP, I get results back, but fetching to it via HTTPS gives me the following error:"SSL Error: Hostname/IP does not match certificate's altnames"I acquired a domain from GoDaddy, and added the certificate to the AWS load balancer by adding a listener on PORT 443. Even after that, I can't seem to fetch from any source who's URL starts with https.If anyone could briefly meet over a zoom call and shed some light on this issue, I would highly appreciate it. This is my only obstacle before having a fully functional full-stack application.Please feel free to contact me through linkedIn at: https://www.linkedin.com/in/albertogonzalez1091/Thank you!Alberto GonzalezFollowCommentlarryjkl 13 days agoAre you able to post the URL of the site here?Share"


Question: "Creating a EMR Cluster, Failing!"

"Have not been able to create a simple EMR cluster all day! Keep getting:2023-04-11 20:35:59,668 INFO i-0ef1cde5b1311d42c: new instance started2023-04-11 20:35:59,684 ERROR i-0ef1cde5b1311d42c: failed to start. bootstrap action 1 failed with non-zero exit code.2023-04-11 20:38:03,861 INFO i-0f4dc67b1f1531f2e: new instance started2023-04-11 20:38:06,023 INFO i-0f4dc67b1f1531f2e: all bootstrap actions complete and instance ready2023-04-11 20:38:07,153 INFO i-0e6c8c961472af934: new instance started2023-04-11 20:38:09,360 INFO i-0e6c8c961472af934: all bootstrap actions complete and instance readyFailed even when I created a new AWS account. Any help appreciated!FollowComment"

Answer: "0Accepted AnswerHi,have you reviewed this troubleshooting guide? https://repost.aws/knowledge-center/emr-cluster-bootstrap-failedHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago0Thank you @alatech! I will try it and give you an update!CommentShareyli12313answered 2 months ago"


Question: Query HTTP Request Headers When Using Function URLs?

"Can I query HTTP request headers in a Lambda function when configured to use Function URL? If so, can you provide a Python snippet to do so?  Thanks!FollowComment"

Answer: "1Accepted AnswerThe HTTP request headers are available within the event object. For example, the following code should return the requesting browser's user agent:import jsondef lambda_handler(event, context):    return {        'statusCode': 200,        'body': json.dumps(event["headers"]["user-agent"])    }CommentShareEdanswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: is there any function like this in AWS Cloudfront CDN ?

"Hello. Thanks for kind reading in advance.I am currently using BunnyCDN but the image render is not working at all(just white paper..) when the traffic increases. I am wondering why it happens ;(To replace the CDN conveniently, I am looking for CDN provider like thisIf I store the jpg files to S3 storage, can I get the unique url address link for each jpg files? I mean , if I store 100 number of jpg files , then there should be 100 unique url per each files. So that I can embed that link to my app admin panelThe important thing is, the url address should be same across the region. Suppose the file name is AAA . The url of this AAA file should be same across the region like Asia, USA, Europe region . And if the user click the url, will be cached from the nearest region automatically.May I ask, does the Cloudfront CDN has the above function?ThanksFollowCommenttedtrent 4 months agoCloudFront supports the use case you just described.You will get a unique globally available URL for your distribution that you can alias from within the CDN with your own domain name.Below is a lab that will walk you through an example configuration.https://www.wellarchitectedlabs.com/security/100_labs/100_cloudfront_with_s3_bucket_origin/Share"

Answer: "0Hi,Yes, each S3 key name uniquely identifies the Object and its URL location.If you attempt to upload an object with the same name, in the same bucket location, it will be overridden, meaning you ll always have unique keys / paths, even in CloudFront.https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.htmlCommentShareEXPERTalatechanswered 4 months ago"


Question: What is the discrepancy on pricing for my ec2 instance?

"On my bill, I see $0.672 per On Demand Linux with SQL Std m6i.xlarge Instance Hour but here https://aws.amazon.com/ec2/pricing/on-demand/ I see it'sm6i.xlarge$0.192416 GiBEBS OnlyUp to 12500 MegabitFollowComment"

Answer: 1You have launched an instance with Microsoft SQL Standard on it. The difference is the Microsoft licence cost.CommentShareSiTheAWSGuyanswered a year ago


Question: Does the Redshift ODBC macOS X driver version 1.4.53 support the M1 MacBook Architecture?

An architectural mismatch has often led to issue like -When trying to connect through a dotnet application it fails with the following error message: "ERROR [01000] [unixODBC][Driver Manager]Can't open lib '/opt/amazon/redshift/lib/libamazonredshiftodbc.dylib' : file not found"FollowComment


Question: EC2 - Instances

HiHopefully you can help.Got an email regarding the instance and we have stopped and started  the instance which  you have confirmed will migrate the instance to a new host.Is everything good now? Do we need to do anything else. I did speak to a colleague a few months back and he mentioned the id will be deleted at some point in the coming months and that we need to put our websites onto a new instance?Is this the case? If so how do we do this please?FollowComment

Answer: "0Accepted AnswerStopping and starting the instance is the correct action. That will have solved your issue. Here's a blog related to exactly that should you have further questions. That being said, I'd edit this question to remove you instance ID and AWS Account ID.CommentShareAWSJoeanswered a year agoAWS-User-5776122 a year agoThanks so much AWSJoe. I have edited my question now....Share"


Question: Amazon GameLift Anywhere (Compute type "Managed EC2" works / Compute type "Anywhere" does not work)

"I was able to successfully start my game via Gamelift using the compute type "Managed EC2" and the corresponding build upload from my game (Windows 2012 R2).Now I have tried it with Compute type "Anywhere" and followed this step by step guide: https://latam-es-resources.awscloud.com/aws-news-blog/introducing-amazon-gamelift-anywhere-run-your-game-servers-on-your-own-infrastructureWhen I start my game server here on my hardware (laptop), the startup hangs when executing "Init SDK" and does not continue.Btw: If I run GameLiftLocal on the laptop and then start the game server, the game server starts without problems.I do not understand what is missing here.Do I need to install anything else on the target hardware (laptop) for "Anywhere Fleet" or create any prerequisites?I use a Windows 10 Pro laptop for "Anywhere Fleet".FollowComment"

Answer: "0Hi Nexus0847,Amazon GameLift released a new major version of their SDK, SDK 5.0, which is required to use Amazon GameLift Anywhere (release notes). If you have upgraded to SDK 5.0 and are still having issues, I'd recommend creating a support ticket so the Amazon GameLift team can help take a closer look.RegardsCommentShareJackson_AWSanswered 2 months ago"


Question: Bug: Same AL2 version but different AMIs causes NGINX to fail healthchecks

"I have dug down a lot to make sure this is a bug and post it here.I run several workloads on Elastic Beanstalk. The newest app I have deployed on Elastic Beanstalk seems to fail the default 80 port healthchecks. After digging down, I found out that it doesn't detect index.php files.I run two workloads with the same "PHP 7.4 running on 64bit Amazon Linux 2/3.1.0" version. The older one, that works, has AMI set to ami-0d9f444fde94d8329, but it seems like a newly deployed application has the AMI set to ami-0ebd56d21ef13ef53 that makes NGINX return 404 for PHP applications.This is not related to healthchecks in the app, as if I SSH into both instances, calling curl http://127.0.0.1 works for the older app, but for newer app it doesn't.I have tried to change some of the NGINX config files to figure out what is all about, and i realised that in the ~ .php location block check, somehow refuses to read index.php files. If I create an index.html, curl-ing works again. If i let index.php as the only index, it throws 404 and refuses to serve it.FollowComment"

Answer: "0After more digging, I found out that http://127.0.0.1 gets 404, while the DNS name i pointed to the AWS EB endpoint via CNAME work. I am now going insane.CommentSharerennokkianswered 2 years ago0Finally, after many configuration attempts and checks, I found out that the CNAME that points to my EB Environment DNS is solving correctly the application, but internally, 127.0.0.1:80 is not solving, even tho the listen 80 default_server directive is set and not overwritten by any of my own configuration.CommentSharerennokkianswered 2 years ago0It's an issue with my Laravel app's kernel handler. APP_URL enforces DNS solving at the Kernel level within the routing system: https://github.com/laravel/framework/issues/35522Edited by: rennokki on Dec 7, 2020 6:00 AMCommentSharerennokkianswered 2 years ago"


Question: Can't connect to MySQL db from Lightsail instance. MY-010055 warning in logs.

"Hello,I have a Lightsail instance with a LAMP stack and a web app. It works fine when connecting to localhost MariaDB (using mysqli_connect() in PHP).I have a problem connecting to a dedicated database which is in the same region and zone as the instance. It seems to work for a while then the site breaks with "Cannot connect to MySQL". I am able to connect with a command line: mysql -u -p -h xxx  so it isn't an issue with password or endpoint.I have tried to enable public access just in case but still no luck.I went to the log and I can see this: "[Warning] [MY-010055] [Server] IP address 'x.x.x.x' could not be resolved: Name or service not known" where x.x.x.x is my instance private ip.I don't have a DNS zone in Lightsail, I use Cloudflare DNS to resolve to my instance static public IPv4.I want to move my data layer to a dedicated Lightsail database (as opposed to localhost) because I want to scale my application and have several instances pull from  a unique source.Does anyone have an idea what could be the issue?FollowComment"

Answer: "0Check this stackoverflow link... https://serverfault.com/questions/393862/mysql-warning-ip-address-could-not-be-resolvedCommentShareDavid Ganswered a year agojeffbond a year agoAnd that was me thinking Lightsail was going to be easy. Isn't a change in my.cnf going to alter the MySQL server that is on my instance (ie:localhost)? It is the external Lightsail database that I am having an issue with, there's no my.cnf that I can edit.I have noticed a difference between localhost and the dedicated instance:localhost:Server version: 10.6.4-MariaDB Source distributionMariaDB promptdedicated instance:Server version: 8.0.27 Source distributionMySQL promptMaybe I should restart the mysql service and stop the mariadb service when I am switching to the dedicated db instance.Share"


Question: using athena to read glue database

"Data layer is not my thing and I need some guidance.I create a glue crawler to extract compressed JSON files and store them in an aws S3 bucket.  I recently learned that I can use Athena to directly connect to the glue database. When I do select * from table-name It starts to load but then errors with long string of stuffHIVE_METASTORE_ERROR: Error: : expected at the position 407 of 'struct<http:struct<status_code:int,url_details:struct<path:string,queryString:struct<prefix:string,versioning:string,logging:string,encoding-type:string,nodes:string,policy:string,acl:string,policyStatus:string,replication:string,notification:string,tagging:string,website:string,encryption:string,size:string,limit:string,hash:string,accelerate:string,publicAccessBlock:string,code:string,protocol:string,G%EF%BF%BD%EF%BF%BD%EF%BF%BD,%EF%BF%BD%EF%BF%BD%EF%BF%BD`~%EF%BF%BD%00%EF%BF%BD%EF%BF%BD{%EF%BF%BD%D5%96%EF%BF%BDw%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%3C:string,cors:string,object- etc etc etc.I can load one small table but the others fail.FollowCommentGonzalo Herreros 3 months agojson tables are often problematic and not always compatible between different tools. That part where it starts G%EF% doesn't look right, look at the table definition, are you sure the json is valid and not using strange characters for the property names?Share"


Question: Cognito sends verification code even after changing verification message to link in the console

"I am working on a workflow for my Cognito user pool to allow users to change their email. So far I have it working to where the email change is pushed to Cognito using AdminUpdateUserAttributes and a verification email is sent to the user at the new email.public async Task AdminUpdateUserEmail (            string username,            string userPoolId,            string email){    AdminUpdateUserAttributesRequest adminUpdateUserAttributesRequest = new AdminUpdateUserAttributesRequest    {        Username = username,        UserPoolId = userPoolId,        UserAttributes = new List<AttributeType>        {            new AttributeType()            {                Name = "email",                Value = email            }        }    };    AdminUpdateUserAttributesResponse adminUpdateUserAttributesResponse = adminAmazonCognitoIdentityProviderClient        .AdminUpdateUserAttributesAsync(adminUpdateUserAttributesRequest)        .Result;}Initially we were sending a Code, but we are now wanting to test sending a link instead to see if it will make the workflow a bit easier. Ideally, sending the link will make it so the email verification will be handled by Cognito rather than by us using VerifyUserAttribute.In order to change to using a link instead of a code, I went into my User Pool's Messaging tab and changed the Verification Message template to use Link instead of Code.Even after making this change, however, I still receive a code when I try to change the email for an account.Based on all the documentation I've seen, this seems to be an uncomplicated change and I've only seen one report of this issue when I was trying to find solutions online which wound up being tied to a third party so it wasn't really very helpful.Am I missing a step or doing something wrong here? If there is anything else you need to help answer my question, let me know.FollowComment"

Answer: "0I've encountered the same issue, were you able to fix this?CommentShareDiogoanswered 6 months agoglago 6 months agoI have not, so far nothing is working for me.Share"


Question: Problem with Amazon EBS CSI Driver Node Driver Registrar after moving to EKS 1.25

"I installed aws-ebs-csi-drivereksctl get addon --name aws-ebs-csi-driver --cluster <cluster-name>NAMEVERSIONSTATUSISSUESIAMROLEUPDATE AVAILABLEaws-ebs-csi-driverv1.16.0-eksbuild.1ACTIVE0arn:aws:iam::<numbers>:role/AmazonEKS_EBS_CSI_DriverRoleWhen I look at the objects it created, the container node-driver-registrar under the pod ebs-csi-node keeps on crashing.I'am unable to get the logs because I was having another issue below when running kubectl logs command.Internal error occurred: Authorization error (user=kube-apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)FollowComment"

Answer: 0It seems to be that the permissions are setup incorrectly. Could you try adding this ClusterRoleBinding Resource and test it once.kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:  name: kubelet-api-adminsubjects:- kind: User  name: kubelet-api  apiGroup: rbac.authorization.k8s.ioroleRef:  kind: ClusterRole  name: system:kubelet-api-admin  apiGroup: rbac.authorization.k8s.ioCommentShareKumudhan Cherarajananswered 2 months ago


Question: Private Managed Blockchain CA expiration date

"I'm are using Hyperledger Fabric on AWS Managed Blockchain and I would like to know what is the expiration date of the certificate authority's certificates, if they expire at all. I created the Fabric network according to the Managed Blockchain documentation.FollowComment"

Answer: 0AMB is managing these certificates for you. When they expire (after 3 years) the service will automatically renew them.CommentShareJCanswered a year ago


Question: How do I check my current SageMaker service quotas?

"How do I check my current service quotas for Amazon SageMaker?In the case of Amazon EC2, service quotas can be checked here: https://console.aws.amazon.com/servicequotas/home/services/ec2/quotasFor SageMaker, the default quotas are listed here: https://docs.aws.amazon.com/general/latest/gr/sagemaker.html but there isn't a link to where one can find the current region-specific quotas for an account, which could have changed after a request for a service quota increase.FollowComment"

Answer: "1Accepted AnswerAmazon SageMaker has now been integrated with Service Quotas. You should be able to find current SageMaker quotas for your account in the Service Quotas console. You can also request for a quota increase right from the Service Quotas console itself. https://docs.aws.amazon.com/sagemaker/latest/dg/regions-quotas.html#regions-quotas-quotasCommentShareGlenn_Danswered a year ago1Unfortunately, AWS Sagemaker is not supported for direct visibility into the service quotas. We have an existing feature request for SageMaker Integration with the Service Quotas page as below. However, I currently done have an ETA for the same as it would depend on feasibility and further integration.Having said that, the below documentations provides the default values as you mentioned:[+] https://docs.aws.amazon.com/general/latest/gr/sagemaker.htmlI would suggest  to contact the AWS Support when ever you wish to get to get insights on current quotas currently.CommentShareSUPPORT ENGINEERNirmal_Kariaanswered a year ago"


Question: Cloudformation exports exists after stack is deleted

"We where deleting a stack and one of the exports in the stack was still in use, but instead of failing the deletion, the stack completed the deletion and the exports still exists when i look in the exports list, even after we cleaned up the imports so there is no other stack using the exports.So now we have an export that is not associated with a stack and we can't redeploy the stack template because the exports exist, we don't want to change the export name as that would screw our naming convention.Anyone know how we can fix this?FollowComment"

Answer: "0The CloudFormation docs indicate "You can't delete a stack if another stack references one of its outputs."I would recommend raising a support ticket via the Support console for further guidance.CommentShareRoBanswered a year agoAWS-User-1827871 a year agoYep, i was a little surprised when a team member showed it to me but non the less, the problem i have is it's on a developer account and we don't have support on that account, can it rely be true that we have to change it to a developer subscription and back just to get AWS to fix a problem on their own side of the fence, or do we have some other way we can get flag the bug to them? just in case you might knowShare"


Question: How to deploy to single instance Elastic Beanstalk worker environment using CodePipeline?

"I use CodePipeline's AWS Elastic Beanstalk action provider to deploy my application to my load-balanced Elastic Beanstalk webserver environment. I now want to do the same for my single instance worker environment. However, using this action provider results in the following error:Deployment completed, but with errors: Failed to deploy application. Service:AmazonCloudFormation, Message:Template format error: Unresolved resource dependencies AWSEBV2LoadBalancer, AWSEBV2LoadBalancerTargetGroup in the Resources block of the templateTo my understanding, the Elastic Beanstalk action provider uses a CloudFormation template under the hood which apparently assumes my environment uses a load-balancer, which I am not. Is there any way to change this directly? Or should I manually create a CloudFormation template that omits these resources? Are there any examples on how to write such a template, or can I find the template that the Elastic Beanstalk action provider uses somewhere?Thanks in advance.FollowComment"

Answer: "0With the AWS Elastic Beanstalk Compose Environments API, you can create and update groups of Elastic Beanstalk environments within a single application. When you create a group of environments with the Compose Environments API, Elastic Beanstalk creates dependent environments only after their dependencies are up and running.~/application|-- webapp|   `-- env.yaml`-- worker    `-- env.yamlWith each directory containing an environment definition file env.yaml with the source code for each.Detailed docs at Creating and updating groups of Elastic Beanstalk environmentsCommentShareRoBanswered a year agoTheThompson a year agoThanks for responding. I think this answer isn't what I am looking for. I am looking to deploy the same app to both the webserver and worker environment using CodePipeline. I doubt your answer would allow this, or do I understand it incorrectly?Shareab a year agoYa, I'm not sure this is answering the question. Don't understand why this is so difficult in beanstalk. Web tier with a load balancer, worker tier with no load balancer. How do you deploy the same code to both environments via eb cli?Share"


Question: ASA VTI to VPC Transit Gateway dual active tunnels (non BGP)

"Following the tutorial here: https://docs.aws.amazon.com/vpc/latest/adminguide/cisco-asa-vti-no-bgp.html, I have dual tunnels to AWS, terminating at a Transit Gateway.As both tunnels are active, I see traffic leaving on tunnel 1 and returning on tunnel 2. This results in the error 'Deny TCP (no connection)' on the ASA tunnel 2 interface. Traffic does not pass successfully to the client on the inside of the ASA.Is there some config missing from the guide that allows this to work, or can the transit gateway be configured to use only one tunnel at a time?Disabling one of the tunnels allows traffic to pass to the client on the inside of the ASA.Thanks, John.Edited by: johnnsmith on Feb 19, 2020 7:36 AMFollowComment"

Answer: "0Accepted AnswerPat Kerpan from Cohesive Networks here.Happy to have someone more TGW knowledgeable to tell different than this - I would encourage them to join in.That said, our experience is that there is currently no specific way to know which of your two VTI routed tunnels is considered the primary and which is the secondary WITHOUT looking at traffic like you have done.Since the traffic is "coming back" over tunnel 2 - then tunnel 2 is actually your primary.   The answer is to change your static routes metrics in the ASA config so your current tunnel 2 is the primary and tunnel 1 is the secondary.OR more potentially troublesome - and may not be within your organization's policies - allow asymmetric routing such that the ASA will allow traffic to go "up" one tunnel and come back "down" the other.I would recommend trying to change your static routes.CommentSharecohesivenetworksteamanswered 3 years ago0Hi Pat,Thanks for taking the time to help me out. This was indeed the issue. Swapping the metric on the routes has solved the problem.I've since realised that this ASA supports BGP. Am I correct in thinking I can use this to allow the devices to agree upon the primary route for traffic (rather than me manually adjusting the metric)?Thanks again,John.CommentSharejohnnsmithanswered 3 years ago0Pat Kerpan from Cohesive Networks here.Not officially a Cisco person....but we test our security controllers (VNS3) against ASA(-X)'s in our lab.Short answer - yes.With BGP configs you have to configure "ASN" distance on the ASA side - where you configure the number of hops to the primary vs. the secondary.(To our experience don't use BGP over VTI on ASA until 9.8+ software revision, but that is highly anecdotal on our part)CommentSharecohesivenetworksteamanswered 3 years ago0Thanks again, Pat. We're using version 9.12 and we're up and running with BGP.All the best,John.CommentSharejohnnsmithanswered 3 years ago"


Question: Get the call transcript using the AWS connect streams java script library.

"I'm using AWS connect-streams.min.js library in my application.But, could not figure out how to get the voice transcript from a call. Faced "Widget Error: NOTFOUND Voice transcript widget".Thanks in advance for the help. Any help would be appreciated.FollowComment"

Answer: "0I will need a little bit more information about your use case to be able to answer accurately.In any case, connect-streams-js is not the right library for call transcripts.If you need the transcript in real time you need to use the Contact Lens streams API (https://docs.aws.amazon.com/connect/latest/adminguide/contact-analysis-segment-streams.html). For post call you can retrieve the transcript from the Contact Lens output file stored in the S3 bucket configured for your instance (https://docs.aws.amazon.com/connect/latest/adminguide/contact-lens-example-output-files.html).CommentShareMagdaanswered 3 months ago"


Question: How to copy an encrypted ami as an unencrypted ami?

I was wondering if there is a way to do this. I have tried to create an unencrypted copy of the encrypted ami without checking in the encrypt option but it still shows encrypted. Please advise.FollowComment

Answer: "2Accepted AnswerHi,according to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html#ami-copy-encryption, is not possible to copy an encrypted ami to an unencrypted one.Hope it helps and if does, please accept the answer so that community benefits for clarity, thanks!CommentShareEXPERTalatechanswered 3 months agoEXPERTkentradreviewed 3 months ago"


Question: AWS S3 access control

How do I disable access or display of a directory (folder) for a specified IAM user?FollowComment

Answer: "0I would use S3 Access Points to achieve this. You can read the full documentation here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.htmlEach access point has distinct permissions and network controls that S3 applies for any request that is made through that access point. Each access point enforces a customized access point policy that works in conjunction with the bucket policy that is attached to the underlying bucket.An example of an access point policy to grant access to a Prefix (folder) is here:/{"Version": "2012-10-17","Statement": [{"Sid": "Statement1","Principal": {"AWS": "arn:aws:iam::123456789012:root"},"Effect": "Allow","Action": ["s3:*"],"Resource": ["arn:aws:s3:us-west-2:123456789012:accesspoint/tester"],"Condition": {"StringEquals": {"s3:prefix": ["asdf"]}}}]}CommentShareMarc Schurichtanswered a year ago"


Question: Automatizar envio dos dados para o backup na AWS

"Hello!So... our company started utilizing AWS cloud backup. All configuration was done with a partner. This partner installed their own software to manage the backup by sending the data to the AWS platform.Now, the company's manager wants to withdraw this software (according to him for reasons of values) and use some tool from AWS itself to manage this backup.Does anyone have material or information that can help us with this issue?Strong hug !!!FollowComment"

Answer: "0My understanding is that your customer is using a third party backup package that is using AWS as the target for storage.  Is that correct?  Are the cost drivers the actual backup software or the AWS storage?  If it's the price for AWS storage that is the issue and the third party package is using S3 we can use intelligent tiering to help with the cost.  If the reason is the third party package price, where are the source servers - on-premise, AWS, or another cloud provider?  For on-premise servers to be backed up to the cloud we can use Storage Gateway.  These are just a few options.  Let me know if I can help further.https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/on-premises-to-aws.htmlCommentShareMarc Fontenotanswered a month agorePost-User-5383508 a month agoFirst of all thank you very much for the answer!My understanding is that your customer is using a third party backup package that is using AWS as the target for storage. Is that correct? EXACTLY!!!That's it... The reason is the third-party package price.At the moment only the data stored on the local server is being sent to the cloud.For now, the company is no interest in having a cloud server.Share"


Question: S2S VPN host address within CIDR range of VPC (10.0.0.0/16)

"Hello,Since last few days I was unsuccessfully trying to setup a S2S VPN connection from AWS VPC subnet (10.0.10.0/24) to the on-prem host which address (10.0.50.1/32) is covered by the VPC CIDR (10.0.0.0/16). I've tried to use Virtual Private Gateway and Transit Gateway but there's a problem with VPC routing table which cannot contain any route that is equal or more specific than it's CIDR blocks.Any ideas about how to achieve this or whether it is possible at all without using NAT?Thanks in advanceFollowComment"

Answer: "1Accepted AnswerIt is highly recommended to not use overlapping CIDRs, if at all possible I would suggest to ReIP your VPC. AWS VGW or TGW does not natively support NATing which means you would need to deploy a 3rd party firewall on an EC2 instance.Few things to note about VPC routing - You can propagate VGW VPN routes automatically into the VPC route table, VGW advertises full VPC CIDR (not a subset) towards on-premises (CGW) ; If your VPN is configured on TGW it doesn't support route propagation to VPC (unlike VGW) you need to configure Static routes in VPC pointing towards TGW, in TGW scenario you can advertise subset of your VPC CIDR towards on-premises CGW because the VPN encryption domain is decided by the TGW route table in this case.In any case I would suggest avoiding overlapping CIDRs.CommentShareEXPERTTushar_Janswered 9 months agoEXPERTToni_Sreviewed 9 months agoPaVliK 9 months agoThanks for a detailed explanation. Regarding the VGW VPN, a propagated network address needs to be outside of the VPC CIDR to be installed in VPC routing table as local route is most preferred when propagated routes are more specific?ShareTushar_J EXPERT9 months agoNot possible with VGW, there is a solution for TGW https://github.com/aws-samples/aws-transit-gateway-overlapping-cidrs but then again it is highly recommended to Re-IP your VPC space and just avoid overlapping IP spaces, it will save you complex troubleshooting, managing and maintaining NATs.Share"


Question: WordPress site went offline after clearing server cache

After running the following code "sync; echo 1 > /proc/sys/vm/drop_caches" and ". My wordpress site hosted on EC2 AWS went down and error 521 appears. Does anyone know how to solve it?FollowComment

Answer: "0Without knowing more let me take a stab at this . . .Have you tried reloading the instance? Yes I'm seriously asking.A 521 error indicated a server side error.  When you dropped the cache the CPU load probably went way up.  In the future, I  would be hesitant to clear the cache if I am trying to save memory.  Linux tries to use all of the memory and the cache will use as much as it can, but this is low priority usage of memory.  The cache gets swapped out if another more important process needs the RAM.If this is a busy site you may want to snapshot the image and resize to a larger instance type.CommentSharetedtrentanswered 4 months ago"


Question: Using custom license in Azure Data Exchange

"Hey community members,Is there a way for a data provider to enable subscribers to use a vendor provided license instead of the AWS Data Exchange subscription when subscribing to the individual products offers?My use case here is I want to distribute the data through multiple platforms and not just AWS Data Exchange. So ideally, I would want subscribers to use the license which could be generated by the customers/subscribers through my license portal and use this to allow/enable them to subscribe to the product offerings in AWS Data Exchange. This way I can then publish my data to some other platform say Azure Data Factory and the customer/subscriber would be able to use the same license to access the data there as well without having to create separate subscriptions on individual platforms.Is this possible to do? Or is there any workaround for this?Thank you in advance!FollowComment"

Answer: 1Providers are able to create custom offers for existing licensees using the Bring Your Own Subscription (BYOS) model.CommentSharejchananswered 10 months ago


Question: Receiving Warning: spark.executor.instances less than spark.dynamicAllocation.minExecutors

"We are receiving a warning while running our Glue job:23/04/10 06:39:21 WARN Utils: spark.executor.instances less than spark.dynamicAllocation.minExecutors is invalid, ignoring its setting, please update your configs.23/04/10 06:39:22 WARN Utils: spark.executor.instances less than spark.dynamicAllocation.minExecutors is invalid, ignoring its setting, please update your configs.23/04/10 06:39:22 WARN ExecutorAllocationManager: Dynamic allocation without a shuffle service is an experimental feature.We are using Glue 3.0, Worker G.2X and have:number_of_workers = 20max_capacity      = 20And --enable-auto-scaling is 'true'.Job is not throwing an error, but would like to understand this better and clear the warning if possible.  Thank you.FollowComment"

Answer: "0Hello,Thanks for reaching out.These two warnings about Apache Spark are merely informational messages:WARN Utils: spark.executor.instances less than spark.dynamicAllocation.minExecutors is invalid, ignoring its setting, please update your configs.The spark.executor.instances and spark.dynamicAllocation.minExecutors parameters are related to the allocation of executors for Spark applications:If dynamicAllocation (Auto-Scaling) is enabled in a Glue job then the value of spark.executor.instances is set to 'None'.The spark.dynamicAllocation.minExecutors is the lower bound for the number of executors. If Auto-Scaling is enabled in a Glue job, it’s defaulted to 1.The function that logs the warning can be found in the spark config file [1], which essentially logs the warning message when the value of spark.dynamicAllocation.minExecutors > spark.executor.instances. It tries to get the set value of spark.executor.instances, else sets it to 0.Therefore, when the job is run with Auto-Scaling enabled, the default value of 0 for spark.executor.instances is used, and the warning is logged since the default value of spark.dynamicAllocation.minExecutors is greater than 0.To clear this warning, you can consider setting the Log Level to ‘ERROR’ by following the instructions provided in [2].WARN ExecutorAllocationManager: Dynamic allocation without a shuffle service is an experimental feature.This warning is logged from the code snippet provided in [3] when the value of spark.shuffle.service.enabled is set to 'False'.In order to clear this warning, you can set spark.shuffle.service.enabled to ‘true’ or you can follow instructions in [2] to change the log level.Hope this information was helpful.References:[1] https://github.com/apache/spark/blob/v3.1.1/core/src/main/scala/org/apache/spark/util/Utils.scala#L2592-L2595[2] https://repost.aws/knowledge-center/glue-reduce-cloudwatch-logs#:~:text=Set%20the%20logging%20level%20using%20Spark%20context%20method%20setLogLevel[3] https://github.com/apache/spark/blob/v3.1.1/core/src/main/scala/org/apache/spark/ExecutorAllocationManager.scala#L205-L216CommentShareSUPPORT ENGINEERChaitanya_Tanswered 2 months ago"


Question: IP Geolocalization issue

"we are trying to restrict a cloudfront CDN to Spain, but on of our internet lines, located in Spain is getting a forbiden response.I have checked the info in http://whois.arin.net/rest/net/NET-----1 and it is updated and correct.Where is the IP location database Amazon use for the Geolicalization ? And how to force the update of that database ?RegardsFollowComment"

Answer:
"0Hi there!
From the case notes, l understand you have set the geolocation to Spain but however it is currently blocking ip addresses inside Spain.Please note, CloudFront uses Maxmind GeoIP database to determine the location of the viewers [1].To confirm the location of the IP address refer to document [2]. With that said CloudFront blocks requests according to what is in the Maxmind database at that moment. You can refer to the link here [3] to submit a request to Maxmind to correct the GeoIP data if you believe there is an error to the database.As a suggestion you can also use third party Geolocation service to control distribution of your content at the country level for all files that you’re distributing with a given web distribution. You can refer to the link here [4]I hope the above information is helpful.Hope you have a great day ahead, take care and stay safe!References:[1] https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GeoRestriction.html[2] https://www.maxmind.com/en/geoip2-precision-demo?ip_address=109.159.129.251[3] https://www.maxmind.com/en/geoip-data-correction-request[4]https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html#georestrictions-geolocation-serviceCommentShareAntonioanswered a year ago"


Question: ACM certificate won't validate for newly registered domain in Route53

"I registered a new domain with AWS in route53 3 days ago, I then created an ACM certificate for the domain, with the same name and used the "Create record in Route 53" functionality, 3 days later my certificate is still in "Validation pending" state even though the validation record exists.Worth noting I can access the CNAME validation record with nslookup, is this just a case of waiting for propagation or something, I expected 3 days or ~60hours to be long enough.FollowComment"

Answer: "0Hi,I understand that you have followed all the register domain procedure [1] and you specified all the values needed when registering a domain [2] but your certificate is still in "Validation pending" state even though the validation record exists. Some domain registrars don't populate the contact information in WHOIS ("Who is") data. Your ACM certificate issue or renewal can be affected if:Your domain registrar doesn't include contact email addresses in WHOIS data.You use custom emails addresses in WHOIS for certificate validation.The WHOIS lookup for email validation is performed on the apex domain and searches for email addresses in the domain registrant, technical contact, and administrative contact fields. Verify your listed email addresses using a WHOIS query [3]. For additional information, on Enabling or disabling privacy protection for contact information for a domain [4].To troubleshoot your problem ,you can choose from the following two options that are available depending on your preference and the effort required for maintaining or switching. You can't convert an ACM certificate's validation method from email to DNS or from DNS to email. To switch validation methods, request a new ACM certificate to replace the previous one.Use EmailTo check your certificate for your domain to verify the email addresses.Open the ACM console, and then choose List certificates.Choose the certificate that you want to renew.In Domains, note the Registered owners field. Usually the registered owners include [7]If the five system email addresses aren't listed, confirm that the domain has at least one valid MX record using the following commands:Linux and macOS: $dig mx example.comWindows: $nslookup -q=mx example.comFollow the instructions for resending the validation email using the AWS Management Console or the AWS CLI [5]For more information, see  Troubleshoot email validation problems [6]Use DNSTo switch to DNS validation, recreate the ACM certificate, and then select DNS for validation. DNS validation has several advantages over email validation, especially if Amazon Route 53 is the DNS provider for your domain.DNS requires that you create one CNAME record per domain name used only for requesting an ACM certificate. Email validation sends up to eight email messages per domain name.You can request additional ACM certificates for your fully qualified domain name (FQDN) if the DNS record is in use.ACM automatically renews certificates that you validated using DNS. ACM renews each certificate before expiration if the certificate and DNS record are both in use.ACM can add the CNAME record for you if you use Route 53 to manage your public DNS records.Automation using the DNS validation process is less complex than using the email validation process.You can switch to DNS validation at no additional cost.References:[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-register.html#domain-register-procedure[2] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-register-values-specify.html[3] https://whois.gandi.net/en[4] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-privacy-protection.html[5] https://docs.aws.amazon.com/acm/latest/userguide/email-validation.html#gs-acm-resend[6] https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-email-validation.html[7] https://docs.aws.amazon.com/acm/latest/userguide/setup-email.html#setup-email-mxI hope the below Information is helpful. Feel free to reach out at anytime.CommentSharePhindianswered a year ago"


Question: How to add multiple domain SSL in single ALB which already exist one needs to add from ACM second.

"How to add multiple domain SSL in single ALB which already exist one SSL with domain , then i have to add another domain from ACMFollowComment"

Answer: "0Hello,Take a look at the below Knowledge center article:https://aws.amazon.com/premiumsupport/knowledge-center/acm-add-domain-certificates-elb/CommentShareEXPERTTushar_Janswered 8 months ago"


Question: Can devices send MQTT messages to Greengrass core on different port?

"Hi,I work in a convoluted corporate network environment where, for the time being, I have had to set up my Greengrass Core in a AWS VPC to test out IoT functionality.  I have a KepServerEX environment on the internal network that I have set up as a thing in IoT and configured to send data to the Greengrass Core but traffic will not flow between device and core unless I can send it over port 443.  Is there a way to configure the Core device to listen for MQTT messages on a port other than 8883?  I have already configured it to talk to AWS IoT over 443 but I don't see similar configuration options for talking with devices.Thanks for any help you can provide!  If someone knows of a way to get AWS IoT to expose its core services inside of a VPC, that would be even better!FollowComment"

Answer: "0Hi MoPositive,You can read about the proxy options available in Greengrass at:https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-core.html#alpn-network-proxyThanks,KR-AWSCommentShareKR-AWSanswered 4 years ago0I'm not asking about communication between core and AWS IoT, I'm asking about communication between devices and core.CommentShareMoPositiveanswered 4 years ago0Hi MoPositive,That's currently not supported. I submitted a feature request.Thanks,KR-AWSCommentShareKR-AWSanswered 4 years ago"


Question: GameLift fleet spins/hangs after creation

"Steps to reproduce:Open gamelift dashboard in us-west-1Click "create fleet"Populate the fleet creation fieldsClick initialize fleetExpected:The UI loads briefly then shows provisioning details such as logs.  The fleet should be visible in the list of fleets, perhaps in a provisioning state.Actual:The fleet creation UI closes and is replaced with the amazon loading icon (two arrows that form a circle, spinning).  This has persisted for over an hour.I've tried different fleet details such as spot vs on-demand to no avail.  There are no errors/logs present to suggest a failure.Any ideas?   Thanks!FollowComment"

Answer: "1Hi,It turns out to be a race condition on the page. The team has already pushed a fix, and we'll send an update when the fix is deployed in the us-west-1 region.A temporary workaround to this issue is to try creating the fleet again; however, after inputting all the values, waiting for 1 minute before hitting the "initializing fleet" button. This will prevent the race condition. Alternatively, you may use the aws CLI to create a fleet in the us-west-1 region if you continue to see the same issue.Sorry for any inconvenience, and thanks again for letting us know!CommentShareJamesM_AWSanswered a year agoEXPERTToni_Sreviewed a year ago0Hi,Thanks for reporting this, I was able to reproduce this on my end. Will reach out to the GameLift team to get this addressed as soon as possible.Thanks!CommentShareJamesM_AWSanswered a year ago0Hi,Gamelift team has addressed this issue.Thanks,CommentShareAWS-User-2402300answered a year ago"


Question: Inconsistent monthly number of GET requests

"Dear AWS community, may I seek some advice on the monthly number of GET requests to S3, please?In my recent AWS monthly bills, I have observed a fluctuation pattern in the number of GET requests stated. Every other month (i.e., May, July, Sep, Nov 2022), the number of monthly GET requests stated in the bills went above 140,000/month, while in other months (i.e., Jun, Aug, Oct, Dec 2022), the number of GET requests stated in the monthly bills remained low below 2,500/month. There is an oscillation pattern in the monthly number of GET requests in this case (see the chart below for reference).I have contacted the AWS support team for bills clarification, unfortunately, they mentioned the bill department has limited technical info on this, and hence advised us to try re:Post. I would appreciate any advice on how I may find out what had caused this monthly fluctuation, please? Or any possible causes that you may suggest?Thank you very much!FollowComment"

Answer: "1Hello,If you'd like, feel free to review our doc on understanding your AWS billing and usage reports for Amazon S3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/aws-usage-report-understand.html. For additional ways to receive assistance, feel free to check out these options: https://aws.amazon.com/premiumsupport/knowledge-center/get-aws-help/. For help with pricing information, you may also connect with our Sales team: https://aws.amazon.com/contact-us/sales-support/.Thank you,Lex D.CommentShareEXPERTAWS Support - Lexanswered 5 months agorePost-User-8974965 5 months agoThank you Lex! I have taken your suggestions and browsed through the resources you recommended. I found out from the AWS usage report that the large number of GET requests in alternate month (i.e., May, July, Sep, Nov 2022 for my case) was caused by the HeadObject operation, and this operation took place within an hour on a single day in those months, would you know what are the possible causes for such HeadObject operation every other month, please? Thank you!Share"


Question: Latency increases as I add more and more data into AWS RDS postgres table.

we have our data in AWS RDS postgres db. We have a table with around 100-200 rows and we loaded up 200M rows in 3 hours timeframe. That table is indexed as well. And now we want to insert more data into the table and we see that adding 20M rows is taking 5 hours.Our instance size is db.r6g.xlarge. And we have two AZ. I want to know the reason for slower performance in query operation and what is the best way to import that huge data into postgres table.FollowComment

Answer: "0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following link:[+] https://support.console.aws.amazon.com/support/home?#/case/createFurther, you can go through following AWS blogs and knowledge-articles to troubleshoot performance issues :[+] https://aws.amazon.com/premiumsupport/knowledge-center/rds-aurora-postgresql-performance-issues/[+] https://aws.amazon.com/blogs/database/optimizing-and-tuning-queries-in-amazon-rds-postgresql-based-on-native-and-external-tools/[+] https://aws.amazon.com/premiumsupport/knowledge-center/rds-aurora-postgresql-query-blocked/[+] https://aws.amazon.com/premiumsupport/knowledge-center/rds-write-latency-spikes/CommentShareSUPPORT ENGINEERTapas_Danswered 3 months ago"


Question: Configuring Solution : Filtering multiple event types in Amazon Personalize

"When configuring a solution, how do we specify that we want to include multiple event types during training?In our dataset, we have three event types "STARTED", "PARTIALLYWATCHED", "COMPLETED". We only want to include  "PARTIALLYWATCHED" and "COMPLETED" during training.In the console, we tried giving it in the following ways:PARTIALLYWATCHED,COMPLETEDPARTIALLYWATCHED|COMPLETEDBut the solution version failed and we got the following error:**"Dataset has fewer than 1000 interactions after filtering by event type: PARTIAL|COMPLETED".**However, in our interactions dataset, we have around 7000 interactions with event types "PARTIALLYWATCHED" and "COMPLETED".How do we specify that we want to include multiple event types during training when creating a solution?FollowComment"

Answer: "1Currently you can only create a solution that trains on interactions for all event types (i.e., do not specify an event type) or train on interactions for a single event type. You cannot specify more than one event type when creating a solution. To support the use case you described, you would have to create an interactions dataset that only includes interactions for PARTIALLYWATCHED and COMPLETED event types and then create a solution that trains on all event types.CommentShareJames_Janswered a year agoAnusha G a year agoOkay, got it. Thanks.Share"


Question: How can we shorten failover time DX and VPN?

"A customer has decided to use DirectConnect(DX) and VPN.So if DX failed, they want to fail over to VPN.But it takes about 20~30 seconds.What configuration does it effect to this long fail over time?AWS VPN Configuration is belowconfig vpn ipsec phase1-interfaceedit "transit-KR.P***"set interface "Loopbk"set local-gw 182.###.###.###set keylife 28800set proposal aes128-sha1set dhgrp 2set remote-gw 15.###.###.###set psksecret .set dpd-retryinterval 1set dpd enable set comments "aws-transit-****"nextedit "transit-KR.****"set interface "Loopbk"set local-gw 182.###.###.###set keylife 28800set proposal aes128-sha1set dhgrp 2set remote-gw 52.###.###.###set psksecret xset dpd-retryinterval 1set dpd enableset comments "aws-transit-***"nextendconfig vpn ipsec phase2-interfaceedit "transit-KR.####"set phase1name "transit-KR.####"set proposal aes128-sha1set dhgrp 2set keylifeseconds 3600nextedit "transit-KR.****"set phase1name "transit-KR.****"set proposal aes128-sha1set dhgrp 2set keylifeseconds 3600nextendconfig system interfaceedit "transit-KR.####"set ip 169.###.###.### 255.255.255.255set allowaccess pingset tcp-mss 1387set remote-ip 169.###.###.###set description "aws-transit-****"nextedit "transit-KR****"set ip 169.###.###.### 255.255.255.255set allowaccess pingset tcp-mss 1387set remote-ip 169.###.###.###set description "aws-transit-****"nextendconfig router bgpconfig neighboredit "169.###.###.###"set remote-as 64514set route-map-in aws-transitgwset route-map-out non-transitnextedit "169.###.###.###"set remote-as 64514set route-map-in aws-transitgwset route-map-out non-transitnextendend*****-FW-1 $ get router info bgp nei 169.###.###.### routesBGP table version is 6042, local router ID is 182.###.###.###Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,              S StaleOrigin codes: i - IGP, e - EGP, ? - incomplete   Network          Next Hop            Metric LocPrf Weight Path*  10.80.64.0/18    169.###.###.###         100             0 64514 e*> 10.80.120.0/24   169.###.###.###         100             0 64514 eTotal number of prefixes 2DX bgp configuration is belowinterface g3/7.30description AWS_DX_vpc_testlogging event subif-link-status no ip redirectsencapsulation dot1Q 30ip address 172.16.1.57 255.255.255.252bfd interval 100 min_rx 100 multiplier 3ip as-path access-list 92 permit ^64513$ip prefix-list ***-OUT-IPLIST seq 10 permit 10.56.0.0/13 le 32ip prefix-list ***-OUT-IPLIST seq 20 permit 10.64.0.0/13 le 32ip prefix-list ***-OUT-IPLIST seq 30 permit 10.28.0.0/14 le 32ip prefix-list ***-OUT-IPLIST seq 40 permit 172.16.128.0/23 le 32ip prefix-list ***-IN-IPLIST seq 10 permit 10.80.0.0/12 le 32route-map AWS-KR-IN permit 10 match ip address prefix-list ***-IN-IPLIST match as-path 92 set local-preference 100 set community 9710:1493route-map ***-OUT permit 10 match ip address prefix-list ***-OUT-IPLIST match as-path 1 set community nonerouter bgp 64710 neighbor 172.16.1.58 remote-as 64513 neighbor 172.16.1.58 password ********** neighbor 172.16.1.58 description AWS dx-transitgw test neighbor 172.16.1.58 soft-reconfiguration inbound neighbor 172.16.1.58 route-map ***-IN in neighbor 172.16.1.58 route-map ***-OUT out neighbor 172.16.1.58 fall-over bfdVPN config is downloaded from AWS VPN Config.FollowComment"

Answer: "0Accepted AnswerThe failover times that you are seeing are within acceptable range. BFD will not provide sub-millisecond failover between VPN and DX connection. BFD will provide quick failover between DX connections.AWS VPN doesn't implement BFDs. Best practice is to have BGP based VPN connections. Internally, it will take few seconds for routes to converge and failover from DX to VPN and vice-versa.CommentSharejkapsanswered 3 years ago"


Question: CMK key rotation

Is there a way of manually rotating CMKs. I know KMS does it automatically every year but due to compliance reasons we require it done earlier. I saw a blog once that talked about it but I can’t find it nowFollowCommentDominic_M a year agohttps://aws.amazon.com/premiumsupport/knowledge-center/rotate-keys-customer-managed-kms/Share

Answer: "2Accepted AnswerHello, please review this knowledge centre article on rotating CMKs and this guide on KMS key rotation.When you begin using the new KMS key, be sure to keep the original KMS key enabled so that AWS KMS can decrypt data that the original KMS key encryptedCommentShareKashanswered a year agorePost-User-9123442 a year agoThats the one. thanksShare"


Question: Data routing to VPC Endpoint from different AZ

"I have 3 subnets in 3 different AZ. I have VPC endpoint connected to our partner's VPC Endpoint Service.This endpoint connected to each of 3 subnets.To send data to the endpoint I'm using general DNS name which resolves in 3 Internal IP addresses.In the meanwhile, I've spotted big amount of paid Cross-AZ traffic. From flow logs it is clear that it is traffic from my instances (or fargate tasks) to this VPC Endpoint.My question is: **Is it possible to force using VPC Endpoint ENI from the same AZ as origin? ** Or the only way is to use different DNS names in different AZ?FollowComment"

Answer: "7Yes, you can choose which endpoint to use but (as you say) it is up to the DNS entry that you use. Your client machine (EC2 instance or on premises) will resolve multiple IPs if given the "generic" endpoint name; or a single IP if given the AZ-specific name. Note that using an AZ-specific name isn't desirable if there is some failure within that AZ that is causing the endpoint not to respond.For those reading along, you can find the names for your endpoints in the console or by running aws ec2 describe-vpc-endpoints - you'll see the endpoint DNS name (something like vpce-xxxxxxxx.ec2.region.vpce.amazonaws.com) and you'll also so the AZ-specific names (such as vpce-xxxxxxxx-region-1a.ec2.region.vpce.amazonaws.com).CommentShareEXPERTBrettski-AWSanswered a year agoSmotrov a year agoTank you for your response! The benefit of cross-zone routing are clear. However, in our case 50-100TB/month it generates pretty significant cost for Cross-AZ traffic. Single AZ or isolated AZ does not have this costs at all.Share0If you prefer not to change the DNS, you can also mange it with specific routes per subnet to point to ENI/IP in the RoutingTable(s), but as suggested here before, if something happen to the endpoint, your AZ is down (at least what's dependent on that route).Also, regardless, make sure you validate with your partner what's the AZ ID (not its name - as those are random per account)CommentShareAWS-ProServeanswered a year agoSmotrov a year agoInteresting idea with routing table...How does this routing table record could look like?Share"


Question: Add a custom attribute in a pre-signup lambda function

"I have a User Pool that has a custom attribute "custom:userId". When using the User Migration Lambda it is easy to edit the event.response.userAttributes to include the custom attribute. However, federated identities don't trigger the migration lambda, so I have set up a pre-signup lambda function. This does not have userAttributes in the response section of the event. I have tried adding "custom:userId" in the event.request.userAttributes but this does not reflect in the user. How do I add a custom field to the user in the pre-signup lambda?FollowComment"


Question: Quicksight Multiple Entries for Singular TimeStamp

"The data I am working with has several data entries at each time stamp. Each data point contains a field for sensor name as well as a field for value. So the field for sensor name is automatically linked with the value. With this type of data I am trying to look at multiple sensors at a specific time. I have tried creating calculated fields, but the issue is that they analyze the data by row and not timestamp. So when the calculated field gets to the first data point and tries to look at other calculated fields, it receives a null value as those fields are not specific to a time stamp, but to a sensor and not applicable to the first sensor. Any ideas on how I can look at data with multiple entries with the same timestamp in quicksight? Is it even possible?FollowComment"


Question: Server process started correctly but did not call InitSDK() or ProcessReady() within 5 minutes.

"I managed to successfully upload one server, and create a fleet for it. However, when I repeated the process to create a second server. The fleet gets stuck on activating before returning error. I get: "Server process started correctly but did not call InitSDK() or ProcessReady() within 5 minutes, launchPath(/local/game/TemplateAWS/Binaries/Linux/TemplateAWSServer), arguments(null), instanceId(i-0f4c8dcb19893e9..." In the events log. If it helps, the reason the first server kept returning error was because I didn't have my project and my engine in different partitions to cross-compile for Linux. And, the path I used for my fleet path, IS correct, as it is exactly the same as the previous path. No idea how to find out what's wrong.FollowComment"