Question: AWS Site-to-Site VPN

"Hello,I created an AWS Site-to-Site VPN connection between my local network and aws vpc, installed the libreswan package, after starting the ipsec service, it can't connect to tunnel 1. What could be the problem?OS: Ubuntu 18.04.6 LTS, libreswan 3.29 packageOutput:Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: DH algorithms:Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   NONE                    IKEv1:             IKEv2: IKE ESP AH  FIPS  null, dh0Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP1024                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH        dh2Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP1536                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH        dh5Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP2048                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh14Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP3072                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh15Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP4096                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh16Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP6144                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh17Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   MODP8192                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh18Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   DH19                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_256, ecp256Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   DH20                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_384, ecp384Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   DH21                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_521, ecp521Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]:   DH31                    IKEv1: IKE         IKEv2: IKE ESP AH        curve25519Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: 1 CPU cores onlineNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: starting up 1 crypto helpersNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: started thread for crypto helper 0Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: Using Linux XFRM/NETKEY IPsec interface code on 4.15.0-197-genericNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: selinux support is NOT enabled.Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: systemd watchdog for ipsec service configured with timeout of 200000000 usecsNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: watchdog: sending probes every 100 secsNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: seccomp security not supportedNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: seccomp security for crypto helper not supportedNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: added connection description "Tunnel1"Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: listening for IKE messagesNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: Kernel supports NIC esp-hw-offloadNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: adding interface ens160/ens160 (esp-hw-offload=no) 192.168.55.18:500Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: adding interface ens160/ens160 192.168.50.18:4500Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: Kernel supports NIC esp-hw-offloadNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: adding interface lo/lo (esp-hw-offload=no) 127.0.0.1:500Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: adding interface lo/lo 127.0.0.1:4500Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: Kernel supports NIC esp-hw-offloadNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: adding interface lo/lo (esp-hw-offload=no) ::1:500Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: loading secrets from "/etc/ipsec.secrets"Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: loading secrets from "/etc/ipsec.d/aws.secrets"Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: initiating v2 parent SANov 25 07:55:22 aws-vpn-p-1 pluto[4468]: "Tunnel1": constructed local IKE proposals for Tunnel1 (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_CBC_128;PRF=HMACNov 25 07:55:22 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: sent v2I1, expected v2R1Nov 25 07:55:22 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 0.5 seconds for responseNov 25 07:55:23 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 1 seconds for responseNov 25 07:55:24 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 2 seconds for responseNov 25 07:55:26 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 4 seconds for responseNov 25 07:55:30 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 8 seconds for responseNov 25 07:55:38 aws-vpn-p-1 pluto[4468]: "Tunnel1" #1: STATE_PARENT_I1: retransmission; will wait 16 seconds for responseThanks in advance.FollowComment"

Answer: "0Unfortunately there is no data in Site-to-site VPN LogsIf not, I would check the that the IP address and pre-shared key is configured correctly - if they aren't (in general) the remote end of an IPSEC tunnel won't respond.Could you please elaborate more on how I can do this?I have a public address nailed to another VM and forward is configured there via nginx on ports 500/udp and 4500/udp on the VM where ipsec is raised (libreswan package)CommentSharerePost-User-8276890answered 6 months agoBrettski-AWS EXPERT6 months agoChecking the IP address and pre-shared key is a matter of looking in your configuration files. If you are doing NAT in between your VPN termination point and AWS then I'd also look at the logs there. Not that forwarding UDP 500 and 4500 isn't enough - you also need to forward IP protocol 50 (ESP) and maybe 51 (AH). These are not TCP or UDP ports, they are IP protocols.Share0It seems to be doing the right thing but is getting no response. Are you seeing anything in the Site-to-site VPN Logs?If not, I would check the that the IP address and pre-shared key is configured correctly - if they aren't (in general) the remote end of an IPSEC tunnel won't respond.CommentShareEXPERTBrettski-AWSanswered 6 months ago0Hello,If you have any firewall upstream to the VPN appliance please make sure to allows ingress traffic for UDP:500 (and UDP:4500, if you are using NAT traversal) from AWS VPN-endpoint public IPs.CommentShareEXPERTTushar_Janswered 6 months ago"


Question: Cognito Federated Identities and user specific policies

"Hi there,My goal is to have authenticate users using my web app, then to allow them restricted access to S3 and Rekognition. They should only be able to access their own S3 bucket, and only run IndexFaces and SearchFaces on a rekognition collection they belong toRight now I use Cognitio Federated Identities. I create the user using CognitoIdentity.getOpenIdTokenForDeveloperIdentity. Then I use STS.assumeRoleWithWebIdentity to give the user access to a role that has the following policy:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:GetObject"            ],            "Resource": [                "arn:aws:s3:::xxx/users/${cognito-identity.amazonaws.com:sub}",                "arn:aws:s3:::xxx/users/${cognito-identity.amazonaws.com:sub}/*"            ]        }    ]}This allows the user to only put and get objects that belong to their bucket, but noone elses.However, I'm having a hard time figuring out how I can change this policy to also allow access to their own Rekognition Collection. Bearing in mind that sometimes more than one user belongs to the same rekognition collection.Is there some way this can be done with cognito federated identities? Or do I need another approach?Thanks for your time,JoshFollowComment"

Answer: 0Hey just putting this here in case someone else runs into this.Turns out you can pass a 'session policy' to STS.assume_role_with_web_identity which you can configure however you like dynamically. This conveniently sidesteps AWS limits on IAM roles and policies.CommentShareCircuit8answered 4 years ago


Question: Scheduled tasks are not executed

"Hi,I try to execute an ECS task every night for copying some data. My configuration is very simple:If I look at the metrics in CloudWatch, the task is successfully invoked:But when I look at the logs in CloudWatch, I only see my tests¹ (2021-12-16 at around 3PM UTC+1) and the first nightly invocation of 2021-12-17 4AM UTC+1. I don’t see the next ones (2021-12-18, 2021-12-19 and 2021-12-20). I can confirm that no data were copied these days.Why my task is not executed every night? What I am missing?1: for the tests, the task was scheduled to run minutely (cron(0 3 * * ? *))FollowComment"

Answer: "0I can assume that there are some pbs with starting container, so app logs are not written. Probably image defined in task definition is not accessibly or container can't start or smth like that. Can you try to start it manually now? Can you try to check stopped tasks in your cluster?CommentShareA-Shevchenkoanswered a year agojtremesay-sereema a year agoI can create a service using the task definition and start the task without a problem. AFAIK, we don’t have any issue to pull the image from the repository (we do multiple deployments per day through a CI/CD).And this night, the task was successfully executed, without any change to the infrastructure :shrug:Share"


Question: "Lambda function no errors, but not writing data to s3 bucket"

"Forgive me as I am a student learning the processes.I have a Lambda function and I've created all the necessary layers, configured the environment and buckets.However, I haven't received a statusCode aside from 200 during the entirety of changes and now I see that the Lambda test isn't writing the 'cleaned' data to the s3 bucket (de2023-on-youtube-cleansed-useast1-dev).Any clues on where to start looking?LAMBDA FUNCTIONimport awswrangler as wrimport pandas as pdimport urllib.parseimport os# Temporary hard-coded AWS Settings; i.e. to be set as OS variable in Lambdaos_input_s3_cleansed_layer = os.environ['s3_cleansed_layer']os_input_glue_catalog_db_name = os.environ['glue_catalog_db_name']os_input_glue_catalog_table_name = os.environ['glue_catalog_table_name']os_input_write_data_operation = os.environ['write_data_operation']def lambda_handler(event, context):    # Get the object from the event and show its content type    bucket = event['Records'][0]['s3']['bucket']['name']    key = urllib.parse.unquote_plus(event['Records'][0]['s3']['object']['key'], encoding='utf-8')    try:        # Creating DF from content        df_raw = wr.s3.read_json('s3://{}/{}'.format(bucket, key))        # Extract required columns:        df_step_1 = pd.json_normalize(df_raw['items'])        # Write to S3        wr_response = wr.s3.to_parquet(            df=df_step_1,            path=os_input_s3_cleansed_layer,            dataset=True,            database=os_input_glue_catalog_db_name,            table=os_input_glue_catalog_table_name,            mode=os_input_write_data_operation        )        return wr_response    except Exception as e:        print(e)        print('Error getting object {} from bucket {}. Make sure they exist and your bucket is in the same region as this function.'.format(key, bucket))        raise eENVIRONMENT VARIABLESglue_catalog_db_name = db_youtube_cleanedglue_catalog_table_name = cleaned_statistics_reference_datas3_cleansed_layer= s3://de2023-on-youtube-cleansed-useast1-dev/youtubewrite_data_operation = appendFollowComment"

Answer: "0Hi, May I ask you if the Lambda function IAM role has the needed permission to write/read from s3?Refer to below and add it.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.htmlCommentShareEXPERTalatechanswered 5 months ago"


Question: Discrepancy in status between dashboard and API output for assignments

"I am using list_hits() and list_assignments_for_hit() with the Boto Python API to view the status of 20 recent HITs and their assignments. I'm seeing a mismatch in the status of the assignments between what's on the MTurk dashboard and through the APIOn the web dashboard (through requester.mturk.com/batches) I'm seeing all of the Assignments listed in the "submitted" status.With the API, I'm only setting 10 of the 20 hits returned, and none of them have the "submitted" status.I've been working on a simple tool for reviewing and responding to HITs programmatically, and this was the first batch that I'd done with that tool so far. The results I see with the API match my responses, but I'm only seeing 10/20 of the HITs.What could be the reason for this discrepancy?Edited by: landdogger on Apr 22, 2020 11:19 AMFollowComment"

Answer: "0It seems like the issue was that I wasn't setting a "MaxResults" parameter, and want also not using the NextToken to receive the next collection of additional HITs I was expecting to see but wasn't.CommentSharelanddoggeranswered 3 years ago"


Question: I would like to know easy way to start from the first line of log for the code-build execution (either in code-build console or cloudwatch-log console)

"Hi,I would like to know easy way to start from the first line of log for the code-build execution (either in code-build console or cloudwatch-log console)My case, I had run the code-build, there are loads of logs (probably 100 of clicks on show previous logs, might take me to the first line of log, alternative  clicking on view entire log, takes me to cloudwatch log, still no good way to go the first line of log for this loggroup (code-build execution)ThanksAjay KasamFollowComment"

Answer: "0Hello Ajay,In CodeBuild, the build logs first show the last 1000 lines of log and you can click the "show previous logs" up to the last 10,000 lines.A quick way to view the logs starting from the beginning is to use the "--start-from-head" option of the get-log-events CLI command. This would return the earliest log events first. You may also use subscription filters to view the log events in real time, see How do I retrieve log data from CloudWatch Logs for additional information.CommentShareUgochukwu_Ianswered a year ago"


Question: "An HTTP request is sent from WooCommerce Webhooks to Amazon API Gateway, this works in 90% of the cases, but occasionally the wrong certificate is returned."

"When the HTTP request is sent from the WooCommerce webhook to the API gateway, in approx. 10% of the cases we receive the following error and the gateway rejects the webhook:cURL error 60: SSL: no alternative certificate subject name matches target host name '....execute-api.eu-west-1.amazonaws.com'We have no authoriser attached to the route.It seems completely random which ones are rejected, when we retrigger the delivery of the same webhook, it goes through. We have tried updating the cacert.pem on the Wordpress side, with no success...How can we resolve this issue?FollowCommentEmily a month agoThank you very much for your reply!Unfortunately none of these things have resolved the problem. We are not using a custom domain, have updated the libraries, updated to PHP 8, updated the CA certificates, checked the domain name...Do you have any other ideas of what may be causing this? What's really bizarre is that 95% of the requests go through, and we cannot find any pattern dictating which ones receive this error.Share"

Answer: "0If you're using a custom domain for your API Gateway, make sure it's set up properly with the right SSL certificate. In case you're using the default domain provided by Amazon API Gateway, you can ignore this step.Update both cURL and OpenSSL libraries on your WooCommerce server, as older versions might lead to SSL-related problems. Don't forget to restart the web server after updating to apply the changes.Double-check the domain name in your WooCommerce webhook configuration, especially if you're using a custom domain for your API Gateway. A small typo or misconfiguration can result in SSL certificate validation errors.CommentShareEXPERTsedat_salmananswered 2 months agoEmily a month agoThank you very much for your reply!Unfortunately none of these things have resolved the problem. We are not using a custom domain, have updated the libraries, updated to PHP 8, updated the CA certificates, checked the domain name...Do you have any other ideas of what may be causing this? What's really bizarre is that 95% of the requests go through, and we cannot find any pattern dictating which ones receive this error.Share"


Question: Debugging Initial Container Deployment at Amazon Lightsail

"I want to deploy my container for the first time but failed. Tried to look at details, but it seems that the logs are not helping at all, not describing what causes it to fail.For detailed information, here is what I am working on.Image information:node:16.13.1-alpineNestJS applicationPushed to Docker Hub repositoryRun it on my local machine, and the deployment is successful.Tried to deploy with several configuration, including scale up resource, in Amazon Lightsail but still failed.FollowComment"

Answer: "0Hello Customer,You can look at this document which can help you to troubleshoot your Containers deployment failures. Additionally, to better assist you, we would like to share more details regarding the failures or share the error output so we can better understand the problem you are facing.Document : https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-container-services-deployments#creating-deployment-failuresHope it Helps!CommentShareHanzla_Yanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: AWS CodeBuild update on AL2x86_64 Standard 3.0 Deprecation - Do I need to make any changes to my account?

"I received the following email in my team's AWS accounts. I do not see any build projects in CodeBuild. Does this affect all recipients of the email? How can I tell if my AWS account is affected and that actions need to be taken?AWS CodeBuild notified customers on March 2, 2023 that the Amazon Linux 2 standard 3.0 image [1] will be deprecated on March 30, 2023. We have since revised the decision and extended the deprecation date for the image to April 30, 2023. You may continue using the image for your builds after April 30, 2023, but you could see increased build latency. However, this image will not get any further updates. We recommend you to update your Build Projects to use the latest build images in order to get the latest language runtimes and tools. For a list of Docker images provided by CodeBuild, please refer to the CodeBuild documentation [2].FollowComment"

Answer: "0The above email notification suggests that the Amazon Linux 2 standard 3.0 image for AWS Codebuild is deprecating soon. Please note that generally, this email is rolled out only for the AWS accounts which may have this image provisioned as part of a Codebuild project.To check further if a particular account is affected, you could navigate to the AWS Health Dashboard [1] where you can view the overall status of AWS services, and you can sign in to view personalized communications about your particular AWS account or organization.Additionally, you could also view your build project's details using the 'batch-get-projects' AWS CLI command [2] where you would be able to observe the image used by a particular project. That being said, if you might be unaware about the images used by Codebuild, you could create a custom shell script by referring to documentation [3] which can enumerate the projects in the current region for the current account, and print the image used by each project.REFERENCES:[1] https://aws.amazon.com/premiumsupport/technology/aws-health-dashboard/[2] https://docs.aws.amazon.com/cli/latest/reference/codebuild/batch-get-projects.html[3] https://docs.aws.amazon.com/codebuild/latest/userguide/view-project-details.html#view-project-details-cliCommentShareSUPPORT ENGINEERRashi_Janswered 2 months agomileta99 20 days agoWhich version should we use Amazon Linux 2 standard 4.0 image?Share"


Question: Sizing EC2 for Oracle Fusion Middleware

"I am trying to understand what size instances I would need to run the Oracle Fusion Middleware products within AWS. Currently, they sit on premise and they have massive boxes that are not overly taxed. The issue is that the way they have them configured on VMware; they have a huge heap file that is designated at startup, which makes the box look like it is using more resources than it actually is.Does anyone have insight into how this software might run in AWS and how to properly size the target EC2?FollowComment"

Answer: "0Hello,not sure what heap file refers to (VMFS? JVM? Other?), so I go for a more generic answer.You could follow two different approaches:Size your instances 1:1 to your on-prem machines (in terms of CPU, RAM and storage) and down-size later, when you have real consumption data. AWS makes changing your EC2 shape very easy and many AWS customers use this approach.You could use our Amazon EC2 instance recommendations in combination with Discovery Connector for this.Try to right-size from the beginning using load metrics from your current system. You might still want to down- or upsize your EC2 instance later, though.For load metrics, you could get the information on average CPU load, used RAM, I/O throughput, IOPS from your monitoring system or from the operating system (e.g. "sar" on Linux). Use this data to see whether your system is under-utilized (e.g., average CPU load being much smaller than provisioned CPU) and a smaller EC2 shape makes sense.See also our documentation chapter Right Size Using Performance Data.CommentShareUwe  Kanswered a year ago"


Question: S3 Storage Capacity

How do I increase the storage capacity of an S3 bucket I use to store backups of a database. I believe it has a 12GB capacity right now and I would like to double that.FollowComment

Answer: "1Hello,There is no need to increase the storage capacity of an S3 bucket, please see below:Amazon S3 FAQsQ: How much data can I store in Amazon S3?The total volume of data and number of objects you can store are unlimited. Individual Amazon S3 objects can range in size from a minimum of 0 bytes to a maximum of 5 TB. The largest object that can be uploaded in a single PUT is 5 GB. For objects larger than 100 MB, customers should consider using the Multipart Upload capability.Bucket restrictions and limitationsObjects and bucket limitationsThere is no max bucket size or limit to the number of objects that you can store in a bucket. You can store all of your objects in a single bucket, or you can organize them across several buckets. However, you can't create a bucket from within another bucket.Conclusion - you can store unlimited amount of data within your S3 bucket.Hope this helps.CommentShareEXPERTTushar_Janswered a year ago"


Question: Auto Notification when Files Uploaded to Workdocs

Can Workdocs be configured to auto-notify users when a new file has been uploaded?FollowComment

Answer: 0You could create an EventBridge Rule to trigger on specific WorkDocs API calls - see docs on the CloudTrail logging of Workdocs. For example InitiateDocumentVersionUpload UpdateDocument or CreateFolder.CommentShareEXPERTRaphaelanswered a year ago


Question: ImageMagick after execution environment update

"Is ImageMagick binary no longer included in the new execution environment or the Node.js 10.x runtime?Current working environment: Node.js 6.10Fails to work when a development alias is updated (times out at 60 seconds), but works again when the delay layer is added.The same code bundle on a new deployment using Node.js 10.x runtime displays the message:"Could not execute GraphicsMagick/ImageMagick: convert [COMMAND ARGS] this most likely means the gm/convert binaries can't be found"I'm using the NPM package gm v1.23.1. Snippet below:const gm = require('gm').subClass({ imageMagick: true })let writeStream = fs.createWriteStream(pdfFile)let convert = gm().command('convert')for(let page of pages)  convert.in(page)convert.stream('pdf', (err, stdout, stderr) => {  stdout.pipe(writeStream)})Edited by: aku-sch on Jul 1, 2019 5:07 PMFollowComment"

Answer: "0Hi,ImageMagick is no longer bundled with the Node.js 10.x runtime. There are two options to get ImageMagick working with your Node.js 10.x function:Package the dependency and include it in your uploaded ZIP fileorCreate or use a Lambda Layer that includes ImageMagickCheers,KevinCommentShareKevinL_AWSanswered 4 years ago0HiI am new to all this Node stuff, what do you mean by "Package the dependency and include it in your uploaded ZIP file"? how can I do that? I am trying to use Node 10.x for image conversions using AWS Lambda. Please help!ThanksCommentShareJuanitoPastoranswered 4 years ago0This may be of assistancehttps://github.com/serverlesspub/imagemagick-aws-lambda-2CommentShareconnorB09banswered 4 years ago0I ended up going through the process myself and it does indeed work.To save you some time here's a zip file you can use to create a Lambda Layer.https://connorb-share.s3.eu-west-2.amazonaws.com/image-magick.zipWhen you create the layer make sure you add Node.js 10.x as a supported runtime. You can then set your function to use the latest Node.js 10.x and add the layer you created. The image conversion should then work again!Edited by: connorB09b on Oct 20, 2019 5:20 AMCommentShareconnorB09banswered 4 years ago0HiMany thanks for this resource. We faced similar issue and used the zip file you provided and it worked. Can you please explain the process in creating the zip. We still have some issues with respect to image color and want to further investigate.ThanksCommentSharewrite2kcldevanswered 4 years ago0@connorB09b Thank you for posting your zip file, Connor!Unfortunately, after we uploaded it as a new Lambda layer on our aws-lambda-image, it still didn't work for us.This worked fine with NodeJS 8.10, but since we've been forced to upgrade (to either NodeJS 10.x or 12.x), it's not working even with the zip file.I am familiar with layers, and I think i followed the instructions correctly.  Can you think of anything further i need to do?The Lambda is running in us-east-1 if that makes any difference.Thanks!CommentSharejeremykmoritzanswered 3 years ago"


Question: Pinned Console Service Favorites Disappear

"I have been using Console service favorites for a long time - since they were introduced.  A couple months ago - seemingly as the Console Home UI began changing - I started losing my favorites.  I would add them back, and they'd simply disappear overnight.  This happened several times before I began trying to figure out a pattern.  I think it happens over the weekends or when I'm not active in the Console for a couple of days.I use so many services, that not having favorites pinned is really annoying and slows me down.Is anyone else having this issue?FollowComment"

Answer: "1I'm having the same nuisance. AWS shouldn't store settings in a cookie that will only last for a week. It should be saved in my account itself. So if I log in with a different browser or device I have the same favorites everywhere.CommentShareNick de Kruijkanswered a year agoahudelson a year agoI agree and have been saying this for a long time.ShareAWS-User-0472717 a year agooh, its a week long cookie ? That's explains why... this is so annoying, having to recreate these favorites every week.now, knowing is a week long cookie, I guess I can add/remove a favorite every 3-6 days and I should good  to keep them../add reminder toggle a favorite to keep the cookie aliveUpdate: I am not finding a week long cookie that match the description.I have 3, 3-days cookie that appears to store only navigation, and one in a month.I tried clearing them, but I am not loosing the favorites.maybe the local storage, but I don't know if it has an expiry.Share0Hello,It may be the case that your browser is deleting your website settings periodically, and this may be the cause of the issue.If you use a different browser and save some favorites, does the same behavior occur? If it's not deleting the favorites on this second browser, then it would give us a clue that the first browser is having issues and you just need to prevent the browser from periodically deleting website settings information.CommentShareSUPPORT ENGINEERTim_Panswered a year agoahudelson a year agoThank you for posting this.  It got me thinking back to when this started, and I believe it is directly linked to a Chrome plugin for DuckDuckGo that I installed.  It appears to have functionality that can modify any/all browsing history data.  I have disabled this plugin and will monitor it for a few weeks - hopefully that will fix me up.UPDATE:My issue was indeed the DuckDuckGo Chrome plugin.  I have not seen this issue reoccur since I disabled that plugin.Share"


Question: s3 buckets to sync to Appstream directory

"I have a on-demand AppStream which I would like to sync with a particular bucket in s3.  In the AppStream config, it has the session start which kicks off a powershell task to sync the s3 bucket at start which works fine.  However, I was trying to run this same powershell task during the session every 5 minutes.  Since the on-demand image is sys prepped, I can’t use the scheduled task generated in Image Builder to create the scheduled task.AWS support says the only recommendation they would provide is to create the scheduled task during the session start with a powershell script which creates the task.  So, I have the powershell script to create the task running at startup as system.  I think I see the powershell task being created at session start in the AppStream logs (provides task name and state).  However, there no trace of the scheduled task can be found.  This is where I am stumped.Not sure that anybody else has had the need for something similar.   Any feedback would be great!FollowComment"

Answer: "0Are you able to see the task created in the scheduled task? And what is the trigger for this scheduled task, only at startup or at startup and every 5 minutes there after. If you are running this task only at startup, it will not run because the startup phase has already passed but there is an option to add a delay which delays the task execution by specified time after startup I believe.Also as far as I remember scheduled tasks persist after sysprep but I will need to double check this. I would recommend creating a support case for investigation.CommentShareMayank_Janswered 9 months agorePost-User-9797468 9 months agoHi Mayank, thanks for your attention.  I am creating the task to run every 2 minutes.  But I am open to scrutiny on the script.  I did open a case with AWS.  They said it falls under the customer responsibility.   And I don't think AppStream will allow any different type of sysprep using the Image Builder.This is the script I have running in the Appstream config.  Again, it doesn't appear to do what I would expect and I don't see it listed in task scheduler or in Get-ScheduledTask once the AppStream image is created.$ac = New-ScheduledTaskAction -Execute '"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe' -Argument ('-File "C:\scripts\syncin1.ps1"')$tr = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2)$sa = New-ScheduledTaskSettingsSet -Hidden$pr = New-ScheduledTaskPrincipal -UserID 'NT AUTHORITY\SYSTEM' -LogonType ServiceAccount -RunLevel HighestRegister-ScheduledTask -TaskName 'SyncinTask' -Trigger $tr -Action $ac -Settings $sa -Principal $prShare0Thank you for sharing the details. I will find some time to test it.  However, syncing every 2 minutes doesn't seem to be a good idea if the files are big. It can take some time to upload/download the file between S3 and the fleet instance. If you don't configure the schedule task correctly, there may be to many tasks running in parallel which may cause performance issues. As for the case that you opened, I was not able to find it. Please ask the engineer owning the case to contact me by sharing this repost article on the case and I will work with him internally to find the solution.CommentShareMayank_Janswered 9 months agorePost-User-9797468 9 months agoHi Mayank,I am the engineer on this.  My name is Sam and I can be reached as shsamuelhageman@gmail.com.  The files were are operating with here are limited to csv files.  Each csv file is 1-2 mb.Share"


Question: Lambda and Parameter Store

"I guess this is more a suggestion than a question, but I'd love to hear the opinion of other users.Using layers we can integrate Parameter Store (or Secret Manager) with lambda, which is extremely useful since values are cached etc.However, I was thinking, wouldn't it be more efficient to simply "push" values from Parameter Store to lambda metadata (i.e. to env variables, which anyways are encrypted at rest)?In that way we could control everything centrally from Secret Manager, no need for lambda extensions : Parameter store would keep a list of "subscribed" lambda functions and propagate changes whenever they occur, information would be then retrieved locally from the lambda function, no API calls, etc.FollowComment"

Answer: "2I know it's not exactly what you're asking for but in October 2022, we announced a Lambda extension that makes it easier to use Parameter Store.Your idea is interesting but it there are edge cases that Parameter Store handles better such as having more than 4KB of storage space.CommentShareEXPERTBrettski-AWSanswered 6 months agoFAgosti 6 months agoYes, thanks, I am aware of the extension, which as I said it's pretty cool. My idea was more into changing into a push approach (P Store -> Lambda), which I feel it woudl be a bit more efficient and at the same time easier to manageShare"


Question: How to aggregate records in S3 using IOT Rules and Action?

"I'd like to aggregate prediction MQTT messages generated by the Greengrass ML Feedback Connector over a certain period into a JSON-Lines file in S3: Which may then be used as a SageMaker Ground Truth input manifest, or for other analysis.I'm not clear from the doc on the IoT Rules S3 action whether:It would be safe to have multiple (perhaps close/concurrent) messages pushing to the same S3 bucket & key via RulesMessages would be concatenated into one file (with a separator?), or overwriteThere's enough flexibility in the IoT SQL functions to control the level of aggregation nicely (Seems like day/week/month would be tough, but probably could just do something with integer-dividing the timestamp() numberIt seems like this is a use case that IoT Analytics has tools to handle, but I'm just trying to concatenate the messages together, not perform analyses/proper aggregations.FollowComment"

Answer: "0Accepted AnswerOne option would be use Firehose to batch the data:IoT Core --> Rule --> Firehose --> S3In this flow, Firehose writes the messages in batches to objects stored in S3.CommentShareAWS-User-7407086answered 3 years ago"


Question: Embedding the open search dashboard in react webapp

"We created the dashboard in open search dashboard. We clicked share and generate link as saved object and copied iFrame code. I pasted the coped code in the react app and ran from local machine i.e local host. It did not render the dashboard views, but it failed with error saying X-Frame-Options is not allowing the open search dashboard to be embedded in local host .I guess we need to set this X-Frame-Options from the server side. Since the Open search dashboard is hosted and managed by aws, I am not sure how to make the dashboard server to allow it to render it on our website hosted in our domain or in local host.Any help on this topic will be super helpful ?I posted this question in open search forum -https://forum.opensearch.org/t/embedding-the-open-search-dashboard-in-react-webapp/12237?u=gvnavin .But it seems the forum is not active much to get response and resolution.FollowComment"

Answer: 0Accepted AnswerWe check this with AWS support. It looks like the open search dashboard is embeddable when the url is not having any access control. We have cognito based authorization added on top of open search. Hence it is not working.CommentShareG V Navinanswered 3 months ago


Question: escape caracter in AWS glue

"Hi team,I have an AWS glue job that reads data from the CSV file in s3 and injects the data on a table in MySQL RDS Aurora DB.The issue is all lines in the CSV file with escaped characters are completely ignored by the glue job and they are not inserted on the table.For example on my CSV file the line containing this string is ignored by glue :"Return "1" if the number is zero; "0" if the number is non-zero.  xxxxxxxxxxxxxx."how can I configure glue to not ignore those lines that contain escaped double quotes?FollowComment"

Answer: "0Accepted AnswerI found a solution :In the AWS Glue console => Tables, choose the table and edit Edit table details.add this detail :escapeChar, enter a backslash ().CommentShareJessanswered a year agoEXPERTFabrizio@AWSreviewed a year agoFabrizio@AWS EXPERTa year agoHi, you are right, please also see the Glue Documentation Page https://docs.aws.amazon.com/athena/latest/ug/glue-best-practices.htmlShare"


Question: stdout logging from Kubernetes pods

"Hi,I ran into an issue with our logging from Kubernetes pods. We store logging in JSON format, but saw that with big JSON logs it was breaking. So I investigated the isssue.Found out that when you are sending big logs from the pods with for examplecat log/test.log > /proc/1/fd/1It will ends in multiple parts into the node log folder (/var/log/pods/pod)2023-03-24T11:53:33.107458625Z stdout P YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY 2023-03-24T11:53:33.107458625Z stdout P YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY 2023-03-24T11:53:33.107458625Z stdout P YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYThis breaks the JSON. How can we avoid that sending big log files to /proc/1/fd/1, will be splitted into multiple parts?Thank you!FollowComment"

Answer: "0I believe this is by design, files larger than 16K.  Fluent has options like (https://docs.fluentbit.io/manual/v/1.3/input/tail#docker_mode) docker mode if you are using that which tries to recombine.CommentShareRolyanswered 2 months agorePost-User-6143688 2 months agoYes, I'm using Fluent-Bit, and also has the docker mode. But I find that it stuggles to combine those again.Share"


Question: aws lex custom slot type with regex fails when using : character

"I am trying to create a custom slot that can recognise time format 10:00:00 for example,so i created a custom slot "extended slot type" and tried using regex like this [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2} it failed with "Check the regular expression and try your request again" error so i tried using the unicode character for "colon" like [0-9]{1,2}\u003A[0-9]{1,2}\u003A[0-9]{1,2} even this fails with the same error i tried using other unicode and special characters like - which works absolutely fine.so, How can i use a colon special character in regex validation ?FollowComment"


Question: ECS: Capacity Provider vs Autoscaling Group

"Hi all, I'm trying to understand the difference between capacity providers and autoscaling groups in ECS. They both help to autoscale EC2 instances while we configure our services to deploy and scale our tasks. Capacity providers have target capacity to scale EC2 instances conditionally, and autoscaling groups provide customizable autoscaling policies that can achieve the same results.  Any idea what advantage/convenience capacity provider brings over autoscaling groups? Or is it just a wrapper around the latter to interface with services?FollowComment"

Answer: "2Capacity Providers do use ASG underneath. They are just a way to make ECS "ASG aware". Prior to CP ECS would have no idea that ASG existed and viceversa. My suggestion would be to watch this re:Invent presentation about the announcement of Capacity Providers because it provides a lot of background re what they are and what their value is (Vs using raw ASGs).CommentShareEXPERTmreferreanswered a year agoPaul a year agoI see. Thanks for clarifying, I'm watching the video now (:Share1As mreferre said, the CP drives the ASG capacity based on the services' task definitions which express CPU/RAM requirements for the tasks to run for that service. Instead of having to do complex logic into your CW Alarms etc. driving the ECS instances provisioning / deprovisioning, ECS deals with that for you to maintain available compute resources to satisfy services scaling.Mind you though, for your capacity providers strategy, you can't mix-and-match FARGATE with AS capacity providers.See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html#capacity-providers-considerationsCommentShareJohnPrestonanswered a year agoPaul a year agoI see. Yeah that makes sense, Fargate is meant to be a severless service. Thanks for your help, I'll read through the documentation you sent overShare0Given that re:Post showed this question whilst answering another one, linking to it for posterity: https://repost.aws/questions/QU0UOJ8gczSkWlXTztwrF-ow/ecs-capacity-providers-best-practicesCommentShareJohnPrestonanswered a year ago"


Question: Getting group ID from inside a Lambda

"I want to fetch certain metadata about my Greengrass group inside a (python) lambda running on the Greengrass Core. I see that the Core thing name is accessible from env var 'AWS_IOT_THING_NAME'. Whats the simplest and best way to get the Greengrass group ID of which it belongs?I see there is a Greengrass Discovery HTTP API [1], is that the best approach? How would I construct requests to that API, do I need to add authorization headers etc?I also see that there is an {'AWS_GG_MQTT_ENDPOINT': 'greengrass.iot.eu-central-1.amazonaws.com:8883'}, is that an MQTT variant of the above HTTP API or something different entirely?[1] https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-discover-api.htmlEdit: FormattingEdited by: andersgb on Jan 17, 2019 2:02 AMEdited by: andersgb on Jan 17, 2019 2:04 AMFollowComment"

Answer: "0The Greengrass team do need to work on information given to local Lambda.For now, as the group ID will never change, the simplest way would be to add the known Group ID to the Lambda Environmental Variables when setting up the function resource definition, such as the following:response = greengrass_client.create_function_definition_version(        FunctionDefinitionId=definition_id,        Functions=[            {                'Id': 'somearn',                'FunctionArn': 'somearn',                'FunctionConfiguration': {                    'Environment': {                        'AccessSysfs': False,                        'Variables': {                            'GG_GROUP_ID': gg_group_id,                            'LOG_LEVEL': 'debug'                        },                        'ResourceAccessPolicies': resource_access_policies,                    },                    'MemorySize': 512000,                    'Pinned': True,                    'Timeout': 30                },            }        ]    )I assume it is is also possible to define environmental variables from the Greengrass console also,Hope this helps,MartyCommentSharemartysweetanswered 4 years ago0Thanks, that'll work. It will create some overhead in the group creation, but I guess I can live with that.CommentShareandersgbanswered 4 years ago"


Question: How to upgrade Aurora PostgreSQL major version via CloudFormation?

"Hello.I tried upgrade Aurora PostgreSQL from 10 to 11 via CloudFormation with CDK.At first, I simply changed PostgreSQL version in CDK and tried cdk deploy.I got this error:UPDATE_ROLLBACK_COMPLETE: The specified DB Instance is a member of a cluster. Modify the DB engine version for the DB Cluster using the ModifyDbCluster API.So, I tried upgrade Aurora PostgreSQL in AWS Console manually, I got success it.But I want to sync this upgrade with CloudFormation template.I changed PostgreSQL version in CDK and tried cdk deploy.I got this error:UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cannot change VPC security group while doing a major version upgrade.(..."I cannot look latest message via Google search.How to upgrade Aurora PostgreSQL major version with Cloudformation?FollowCommentChristoph 10 months agoI don't have an answer buy I have the same problem when trying to upgrade from Auroa MySQL Serverless v1 Mysql 5.6 to Mysql 5.7 (specifically 5.6.10a to 5.7.mysql_aurora.2.07.1). A CDK diff only shows the expacted changes:Resources[] AWS::RDS::DBCluster xxxxxxx may be replaced├─ [] Engine (may cause replacement)│   ├─ [-] aurora│   └─ [+] aurora-mysql└─ [~] EngineVersion├─ [-] 5.6.10a└─ [+] 5.7.mysql_aurora.2.07.1There are no changes to the security group...Share"


Question: Amazon Translate Formality Setting Not Working - .Net

"When making the following call, I get an "Object reference note set to an instance of an object" - is there a problem with my code or how the .Net implementation was created?  I'm using 3.7.5.35 and this also happens when trying request.Setting.Profanity:Note: This is not an Async call - if it were, I would expect to get an InvalidRequestException instead of System.NullReferenceException (-2147467261)Sample part of the code where the error gets thrown (last line):using (var client = new AmazonTranslateClient(awsCredentials, selectedRegion))                    {                        var request = new Amazon.Translate.Model.TranslateTextRequest();                        request.Text = toTranslate;                        request.SourceLanguageCode = sourceLanguage; // SourceLanguageItem.LanguageCode;                        request.TargetLanguageCode = translateLanguage; // TranslateLanguageItem.LanguageCode;                        request.Settings.Formality = "FORMAL";FollowCommentvabtm 7 months agoStill no luck (it's been a month now) and I'm still getting the same error even with the recently announced update for both real time and asynchronous operations (https://aws.amazon.com/about-aws/whats-new/2022/10/amazon-translate-formality-customization-support-dutch-korean-mexican-spanish/).  Note: I also tried request.Settings.Profanity and the object is coming back null so I can't even check to see what the setting is.Sharevabtm 7 months agoI thought maybe replacing request.Settings.Formality = "FORMAL" to request.Settings.Formality = Formality.FORMAL; would do the trick but still getting the System.NullReferenceException error.Share"

Answer: "0Updated code with solution that works for me:using (var client = new AmazonTranslateClient(awsCredentials, selectedRegion))                    {                        var request = new Amazon.Translate.Model.TranslateTextRequest();                        request.Text = toTranslate;                        request.SourceLanguageCode = sourceLanguage; // SourceLanguageItem.LanguageCode;                        request.TargetLanguageCode = translateLanguage; // TranslateLanguageItem.LanguageCode;                                                TranslationSettings settings = new TranslationSettings();                        settings.Formality = "FORMAL";                        request.Settings = settings;CommentSharevabtmanswered 7 months ago"


Question: Unable to create a new revision of Task Definition

When viewing a task definition on ECS I clicked on Create New Revision. Without changing anything I clicked Create and get the error "Unable to create a new revision of Task Definition <task definition name>". There is no more descriptive error and the console logs a 400 POST Bad Request with no error message. How can I update my task definition? Thanks!FollowComment

Answer: "1Hello Laine,I've seen such cases arise when the iam user doesn't have sufficient permissions when creating the new revision. Could you please check your cloudtrail api calls at the time of the issue and see if you can find any failures.CommentShareManikandananswered 2 years ago"


Question: Can CloudWatch metric filters be created on logs in a different account?

"Alarms and dashboards can be created in one monitoring account based on metrics from one or more source accounts using CloudWatch's cross account cross region  capability. Can metric filters be created in a similar way - deployed to the monitoring account but based on source accounts?I assume not given AWS::Logs::MetricFilter has property "LogGroupName" rather than ARN, but hope to be wrong. This would be great for use cases where alarms are centralised but there's no requirement for, or even security or governance constraints against centralising logs.FollowComment"

Answer: "0Accepted AnswerHello,Thank you putting your query on re:Post.Yes your understand is correct. At the moment we cannot create a metric filter for cross account scenarios.However, I will make sure to forward it is a good feature use case with our internal team and echo your feedback. I hope it helps.Please feel free to reach out to us in case you have any further queries.Have a great day ahead!CommentShareSUPPORT ENGINEERJAY_Janswered a year ago"


Question: AWS Secrets Manager Canonical Request AWS Signature V4

"Hello everyone, I'm struggling to create the Canonical Request of the GetSecretValue action from the AWS Secrets Manager Api.I tried to create by using the sample request provided in the documentation.Sample Request:`POST / HTTP/1.1Host: secretsmanager.region.domainAccept-Encoding: identityX-Amz-Target: secretsmanager.GetSecretValueContent-Type: application/x-amz-json-1.1User-Agent: <user-agent-string>X-Amz-Date: <date>Authorization: AWS4-HMAC-SHA256 Credential=<credentials>,SignedHeaders=<headers>, Signature=<signature>Content-Length: <payload-size-bytes>{  "SecretId": "MyTestDatabaseSecret",}`Taking that example in consideration, I made a request using the postman to test if my credentials was right and its returning the value that i need.And, finally i tried to create the canon request using all of that info.MINE`POST/GetSecretValueaccept-encoding:identitycontent-type:application/x-amz-json-1.1host:secretsmanager.sa-east-1.amazonaws.comx-amz-content-sha256:beaead3198f7da1e70d03ab969765e0821b24fc913697e929e726aeaebf0eba3x-amz-date:20230111T145646Zx-amz-target:secretsmanager.getsecretvalueaccept-encoding;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-targetbeaead3198f7da1e70d03ab969765e0821b24fc913697e929e726aeaebf0eba3`CANONICAL REQUEST Example`GET/test.txthost:examplebucket.s3.amazonaws.comrange:bytes=0-9x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855x-amz-date:20130524T000000Zhost;range;x-amz-content-sha256;x-amz-datee3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  `Can someone tell what i did wrong? or if the structure of the request is incorrect?FollowCommentrePost-User-8750082 2 months agoAny solution for this? Am also trying same now. issue with mismatch signature calculationShare"


Question: "Very basic DNS setup, not working"

"I've in the past succesfully transferred domains registered elsewhere to Route 53, and now I've bought a domain name with Route 53. After buying the domain I created a Hosted Zone and added an A record to the public IP of my EC2 instance. This has been done a couple of hours ago.Using the IP address and public amazon dns name I can access the Apache webserver, but using my domain name http://glia-pkg.org I can not. Using nslookup I get the following error:nslookup glia-pkg.orgServer:  UnKnownAddress:  192.168.43.1DNS request timed out.timeout was 2 seconds.DNS request timed out.timeout was 2 seconds.*** UnKnown can't find glia-pkg.org: Server failedDig:id 10622opcode QUERYrcode SERVFAILflags QR RD RA;QUESTIONglia-pkg.org. IN A;ANSWER;AUTHORITY;ADDITIONALEdited by: RobinDeSchepper on Dec 8, 2019 12:51 PMFollowComment"

Answer: "0The problem was that creating the Hosted Zone created it with different nameservers than the domain was registered to, even though Amazon has always been the domain registrar.CommentShareRobinDeSchepperanswered 3 years ago0Hi,When you register a domain, we automatically create a hosted zone for you, and associate the four name servers for the hosted zone with the domain registration. If you create another hosted zone, we give the new hosted zone four different name servers.ScottCommentShareEXPERTAWS-User-6179575answered 3 years ago"


Question: How to post a DeviceEUI to a IoT topic?

"I have several Wireless/LoRa devices with their own DeviceId and DevEui identifiers.  I have them routing their uplinks to a vanilla topic like devices/lorawan/uplink.But I'd like them to post their uplinks on their own subtopic using their DevEui or DeviceId.e.g. devices/lorawan/ab123fffe4567890/uplinksI assume this is done using a Wireless destination, but it's not clear what the variable is when configuring the topic inside the destination settings.  Something likedevices/lorawan/${WirelessMetadata.DevEui}/uplinks?FollowComment"

Answer: "1Accepted AnswerHi,my proposed approach is to follow these steps:Point a Wireless Destination to an AWS IoT Rule (let's call it ProcessLoRaWANUplink)Use the following IoT SQL:SELECT *Add "Republish" action and specify a topic as following: devices/lorawan/${WirelessMetadata.LoRaWAN.DevEui}/uplinksPlease notice:You should double-check that including metadata is enabled in the Service Profile you assigned to the LoRaWAN deviceDouble-Check that IAM Role assigned to the "Republish" action us allowing "iot:Publish" to  "devices/lorawan/*".  In this specific case, I recommend not to use "Create role" option when creating an Action the Management Console, but create a role  using AWS IAM Management Console, using the following trust relationship:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": "iot.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}and the following policy:{    "Version": "2012-10-17",    "Statement": {        "Effect": "Allow",        "Action": "iot:Publish",        "Resource": "arn:aws:iot:<Region e.g. eu-west-1>:<Account id>:topic/devices/lorawan/*"    }}best regards, AndreiCommentShareAndrei Sanswered a year agoAWS-User-9404308 a year agoThank you! Got it working.Question though, is there any kind of scalability / pricing penalty for republishing which is effectively doubling the number of messages on the broker?ShareAndrei S a year agoShort answer is: yes, there will be price impact and no, there are no scalability concerns I see here.Long answer:The IoT Core Message broker is not involved if you "just" specify an IoT Rule in your Wireless Destination. In such case you are billed "only" for the IoT Rules invocations and Actions executions.If you follow the approach proposed in my reply, you will additionally be billed for a/ Repbulishing action b/ IoT IoT Core Message broker publishing.Based on my experience I recommend to look to the actual cost estimation (https://aws.amazon.com/iot-core/pricing/), especially for LoRaWAN devices that typically ingest only few times a day / hour.Share"


Question: Include additional python module in Glue job

"I am trying to include python-oracledb in my job.I have followed the instructions from here, saving various versions of the relevant .whl files from PyPi.I have set the Glue job parameter --additional-python-modules as the key and the value as the S2 URI.When i run my job I still get the NoModuleFoundError: No module named oracledb.Please help.    import sys    from awsglue.transforms import *    from awsglue.utils import getResolvedOptions    from pyspark.context import SparkContext    from awsglue.context import GlueContext    from awsglue.job import Job    import boto3    import oracledbFollowCommentrePost-User-3189673 7 months agoJust found the error in the log, it is not supported. Any idea if it will ever be supported.Share"

Answer: "0Hi,I understand you wish to use python-oracledb in you Glue PySpark ETL job. I did some tests with my test environment and I'm able to confirm  this can be done by either of the following approaches:If your Glue job runs in a VPC subnet with public Internet access (a NAT gateway is required since Glue workers don't have public Ip address [1]). You can specify the job parameter like this:Key:  --additional-python-modulesValue:  oracledbIf your Glue job runs in a VPC without internet access, you must create a Python repository on Amazon S3 by following this documentation [2] and include oracledb in your "modules_to_install.txt" file. Then, you should be able to install the package from your own Python repository on S3 by using following parameters. (make sure replace the MY-BUCKET with the real bucket name according to your use case)"--additional-python-modules" : "oracledb","--python-modules-installer-option" : "--no-index --find-links=http://MY-BUCKET.s3-website-us-east-1.amazonaws.com/wheelhouse --trusted-host MY-BUCKET.s3-website-us-east-1.amazonaws.com"Ref:[1] https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/[2] https://aws.amazon.com/blogs/big-data/building-python-modules-from-a-wheel-for-spark-etl-workloads-using-aws-glue-2-0/CommentShareEthan_Hanswered 6 months ago0Hello,Thank you for your question. My name is Yvonne, from RDS team.From your question I understand that you experienced an error "NoModuleFoundError: No module named oracledb" and also noticed the error in the log "it is not supported" while trying to include python-oracledb in your Glue job, so you want to know when it will be supported.Unfortunately i am not able to provide the timelines as our development team has their own timelines however we announce all new features when we release them in below blogs [1] [2] .Please note that 'additional-python-modules' is applicable for Spark Glue Job with Glue version 2.0 and 3.0. You can include the external python library as mentioned in the link[3] .For supported versions please refer to the below documentation:[+] https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-libraries.htmlIn case you require further assistance or have any queries, feel free to respond back to the case and I will be happy to assist you.References:[1] https://aws.amazon.com/new/[2] https://aws.amazon.com/blogs/aws/[3] https://docs.aws.amazon.com/glue/latest/dg/reduced-start-times-spark-etl-jobs.html#reduced-start-times-limitationsCommentSharerePost-User-2763036answered 6 months ago"


Question: Streaming MP4 mpeg4 videos files / AS3 bucket

"Is there a way to stream MP4 mpeg4 video files saved in an Amazon S3 bucket?When I upload the files, it plays only audio without the video image.(I'm going for this format instead of MP4 H.264 because it compresses videos at a higher resolution and smaller file size)Any help will be greatly appreciated!FollowComment"

Answer: "0Yes, you can in fact, here's a tutorial on Hosting video on S3You'll want to setup a CloudFront distribution and access the video from it. You may consider Elemental MediaConvert to transcode the video into an adaptive bitrate stream format more suitable for streaming like CMAF (common media application format) or HLS.CommentShareJason_Wanswered 3 months ago"


Question: Is there a way to create a VPN with an external IP already defined?

"So I need to create a VPN, but every time I do it, I'm getting a new external IP.Is there a way/configuration/service to use the same IP, like I do it with elastics ips?Why I need this? I'm not going to maintain my VPN always available, so I'm going to create it and then delete it every time...I know I can use domains to do it... But is there another way?Best regardsEze.FollowComment"

Answer: "0AWS will allocate two public Outside IP Addresses when the VPN connection is created. It is not possible to choose the Outside IP Address when creating a Site-to-Site VPN connection.That being said, If you only 'modify' the VPN connection options, the VPN endpoint IP addresses on the AWS side do not change, and the tunnel options do not change. Your VPN connection will be temporarily unavailable for a brief period while the VPN connection is updated.CommentShareEXPERTTushar_Janswered 23 days agoEXPERTBrettski-AWSreviewed 23 days ago"


Question: are we going to update the corretto8 docker image anytime soon?

"The grype are failing on our pipelines due to https://alas.aws.amazon.com/AL2/ALASCORRETTO8-2022-002.html, it is related to java-1.8.0-amazon-corretto. In our pipelines, we are consuming 489478819445.dkr.ecr.us-west-2.amazonaws.com/corretto8:latest,  this is also the image consumed on https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/docker-install.html.  On github, https://github.com/corretto/corretto-docker/blob/main/8/jdk/al2/Dockerfile, it has been updated to consume ARG version=1.8.0_332.b08-1, but for the docker images we used internally, it's created 2 years back, do we have any plan to address the issue?docker image inspect 489478819445.dkr.ecr.us-west-2.amazonaws.com/corretto8:latest[    {        "Id": "sha256:9af30af8ca03289fbf53d120cd092435f7ef329d9b1c4575fd8d9b64a10e46f1",        "RepoTags": [            "489478819445.dkr.ecr.us-west-2.amazonaws.com/corretto8:latest"        ],        "RepoDigests": [            "489478819445.dkr.ecr.us-west-2.amazonaws.com/corretto8@sha256:f1f253dd5be74598ade8a7a7d9c100a06046928a14c8ff573be94daa5ae5f123"        ],        "Parent": "",        "Comment": "",        "Created": "2020-07-31T22:43:15.83119562Z",        "Container": "0de2867cbb7dbdb39eac288fba6ec790dd55e836580d3af3b8a27e93cd4553e1",FollowComment"


Question: DKIM configuration is not successful even after adding DKIM records

DKIM configuration is not successful even after adding DKIM records for the domain abcdefh.com .We are getting an error while sending any email as"diagnosticCode": "smtp; 550-5.7.26 Unauthenticated email from abcdefh.com  is not accepted due to\n550-5.7.26 domain's DMARC policy. Please contact the administrator of\n550-5.7.26 abcdefh.com  domain if this was a legitimate mail. Please visit\n550-5.7.26  https://support.google.com/mail/answer/2451690  to learn about the\n550 5.7.26 DMARC initiative. n3-20020a170902e54300b0017cb3aec328si12748332plf.279 - gsmtp"FollowComment

Answer: "0Hi,I'm sorry to hear you're experiencing problems with configuring your DKIM records. The error seems to come from an incorrectly configured SPF record. Can you check if you SPF record allows Amazon to send email for your domain?Kind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months agoAWS-User-2925357 8 months agoHi Robin,Thank you for addressing our issue.We have checked about the adding of SPF record and its been taken care of. Even after adding the correct SPF record, its still not configured.Sharerobinkaws MODERATOR8 months agoHi,Are there any missing configurations reported on the domain details page in the WorkMail console?RobinShareAWS-User-2925357 8 months agoHi Robin,There are no any missing configurations, we have cross checked.The DKIM and SPF records are been added correctly. Even though the DKIM is not configured.What else can be reason for the failure of DKIM configuration.Share"


Question: Unable to add container commands for elastic beanstalk deployment

"I have a django web app hosted via elastic beanstalkDue to the fact that ./platform/hooks/postdeploy migrate command seems to no longer be working (https://repost.aws/questions/QUciLyPjuLThyZ-uLafausLg/elastic-beanstalk-database-migrations-no-longer-running) I have tried to use container commands in my django.config file insteadcontainer_commands:  00_test_output:    command: "echo 'testing.....'"  01_migrate:    command: "source /var/app/venv/staging-LQM1lest/bin/activate && python manage.py migrate --noinput"    leader_only: trueThis, however, provokes the error on deployment:2022-05-25 08:03:36    WARN    LoadBalancer awseb-e-g-AWSEBLoa-Q8MLS7VPZA00 could not be found.2022-05-25 08:03:36    ERROR   Failed to deploy application.                                                                              ERROR: ServiceError - Failed to deploy application.This error occurs even if only the 00_test_output command is included. Does anyone have an idea as to why the loadbalancer cannot be found when container commands are added?FollowComment"


Question: AnalyseExpense Api: "Leergut" with negative price  not shown as Line Item

"I am working on automated analysis of receipts. Obviously, the AnalyseExpense feature of Textract seems like the way to go. Although it is targeted at English documents, I am still getting reasonable results for German receipts as well (which is my main use case).In Germany there is a deposit system and if you bring your empty containers ("Leergut") back to a supermarket you get the deposit refunded. This usually shows up as a line item with a negative price. If I send such receipts to Textract, I repeatedly do not receive these line items back where I would expect them. I see the word and the negative amounts inside the Blocks array, but I do not see them inside the LineItems array.Is this intentional?Is there a roadmap when to expect German support in AnalyseExpense?FollowComment"

Answer: "0Hi, Thanks for reaching out.  Currently the model does not return the line item if there is no valid price in the line and in this case the price is considered invalid since it is negative. We are looking to address this challenge in a future release. To troubleshoot further please feel free to submit a customer support ticket with the sample document and we can work with you closely.CommentShareSManswered 4 months ago"


Question: AWS RedShift: Concurrency scaling not adding clusters during spike

"Hello,We have set up Redshift and are trying to implement WorkLoadManagement. We have set out Concurrency Scaling mode to auto using manual and auto WLM. Tested both but Concurrency Scaling does not add additional  cluster during spike.Upon adding load onto the Redshift Cluster, the CPU Utilisation hits the 100% mark but upon checking the workload concurrency no additional clusters have been added.In my WLM Parameters, i have added max_concurrency_scaling_clsuters to 4. However, when the CPU Utilisation hits 100% for the compute nodes, a additional  clusters does not get added under Workload ConcurrencyWhat could I be missing in my configuration that doe not allow an additional cluster to be added during a spike?https://stackoverflow.com/questions/65129469/aws-redshift-concurrency-scaling-not-adding-clusters-during-spike  -- Link. to question asked on stackoverflow with attachmentsFollowComment"

Answer: 0Concurrency Scaling clusters are added when a WLM slots are taken by running queries and other queries are waiting for a WLM slot to execute.It does not add clusters in response to high CPU since Redshift is designed to use as much CPU as possible (for maximum speed!).https://docs.aws.amazon.com/redshift/latest/dg/concurrency-scaling.htmlCommentShareAWS-User-2965899answered 3 years ago


Question: Snapshot of AWS lex Build is not scalable or maintainable

"Question regarding AWS Lex: We are using AWS lex for the chatbot, however we want to track the version of training data we give to lex, and the build results, in console, build results are evident. However after the build of bot, we only want to update our external data snapshot on the intents that are changed not the entire list. The build often fails with some error which is not tractable via automation pipeline apart from the console making low-code chatbot setup not maintainable.FollowComment"

Answer: "0Hello, thank you for reaching out.Can you please open a support case with AWS so that one of support engineer can take a look.These are very generic statements about build failure.We will require below information on the support case so that we can point you to the right direction.Is it Lex V1 or V2?Error logs?What automation are you using?Details of console error?Thank you.CommentShareSUPPORT ENGINEERStewyn_Canswered 9 months ago"


Question: AWS Lambda Applications and NodeJS

"I noticed that NodeJS is the only runtime option when creating an application.https://us-east-2.console.aws.amazon.com/lambda/home?region=us-east-2#/create/application/configureIs there a reason that NodeJS is the only option? I've heard that NodeJS is able to cold start faster than Java for lambdas. I also noticed the example Java lambda project defaults to 512MB MemorySize and NodeJS  defaults to 128MB. Is Amazon trying to push us to NodeJS when building lambda applications because it's a better language for the environment?Is it possible to create a Java lambda resource within the template.yml of an application? Do I need to build the classfiles and upload them manually?The java-test folder in my project has this structurejava-test/src/main/java/example/Handler.javajava-test/src/main/resourcesjava-test/build.gradleI've tried the following Resource configuration, but the example.Handler class cannot be found.  javaTest:    Type: AWS::Serverless::Function    Properties:      CodeUri: java-test/      Handler: example.Handler      Runtime: java11      Description: Java function      MemorySize: 512      Timeout: 10      # Function's execution role      Policies:        - AWSLambdaBasicExecutionRole        - AWSLambda_ReadOnlyAccess        - AWSXrayWriteOnlyAccess        - AWSLambdaVPCAccessExecutionRole      Tracing: ActiveI copied parts of the blank-java lambda project below.https://github.com/awsdocs/aws-lambda-developer-guide/tree/main/sample-apps/blank-javaHere's the full build outputdocker ps"C:\Program Files\Amazon\AWSSAMCLI\bin\sam.cmd" build javaTest --template C:\Users\bensi\IdeaProjects\team-up\template.yml --build-dir C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build --use-containerStarting Build inside a containerBuilding codeuri: C:\Users\bensi\IdeaProjects\team-up\java-test runtime: java11 metadata: {} architecture: x86_64 functions: ['javaTest']Fetching public.ecr.aws/sam/build-java11:latest-x86_64 Docker container image......Mounting C:\Users\bensi\IdeaProjects\team-up\java-test as /tmp/samcli/source:ro,delegated inside runtime containerBuild SucceededBuilt Artifacts  : .aws-sam\buildBuilt Template   : .aws-sam\build\template.yamlCommands you can use next=========================[*] Invoke Function: sam local invoke[*] Test Function in the Cloud: sam sync --stack-name {stack-name} --watch[*] Deploy: sam deploy --guided        Running JavaGradleWorkflow:GradleBuildRunning JavaGradleWorkflow:CopyArtifacts"C:\Program Files\Amazon\AWSSAMCLI\bin\sam.cmd" local invoke javaTest --template C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build\template.yaml --event "C:\Users\bensi\AppData\Local\Temp\[Local] javaTest-event5.json"Invoking example.Handler (java11)Skip pulling image and use local one: public.ecr.aws/sam/emulation-java11:rapid-1.36.0-x86_64.Mounting C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build\javaTest as /var/task:ro,delegated inside runtime containerSTART RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303e Version: $LATEST{"errorMessage":"Class not found: example.Handler","errorType":"java.lang.ClassNotFoundException"}Class not found: example.Handler: java.lang.ClassNotFoundExceptionjava.lang.ClassNotFoundException: example.Handler. Current classpath: file:/var/task/:file:/var/task/lib/aws-lambda-java-core-1.2.1.jar:file:/var/task/lib/gson-2.8.6.jarEND RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303eREPORT RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303eInit Duration: 0.07 msDuration: 271.19 msBilled Duration: 272 msMemory Size: 512 MBMax Memory Used: 512 MBFollowComment"

Answer: "1You can use AWS Serverless Application Model (AWS SAM) to create application locally and deploy it to AWS.AWS SAM CLI allows to create applications for a wide range of Lambda runtimes (Java/.NET/NodeJS/Python/Go/Ruby). sam init -r java11, for example, will guide you through creating a new Java11 application from an AWS Quick Start Template or a custom one, if you have any. If you choose to use an AWS provided Quick start application (e.g. sam init --name java11-demo-app --runtime java11 --dependency-manager gradle --app-template hello-world) will have template.yaml file created for you, so that you can just build and deploy the demo app without writing any code.CommentShareDmitry_Ganswered a year agoAWS-User-1 a year agoI created the demo app and copied over the files in ./gradle/wrapper/. It looks like the gradle jar needs to be uploaded with the source code of the project, but it's only 54KB so that's not too bad. I'll be checking out more of these quick start templates for other languages too. Thanks!ShareAWS-User-1 a year agoI spoke too soon. I was able to upload the project, but when I invoke it I get the same error.Class not found: helloworld.App: java.lang.ClassNotFoundExceptionjava.lang.ClassNotFoundException: helloworld.App. Current classpath: file:/var/task/Here's the source code of the project I'm playing withhttps://github.com/bennebbenneb/sample-appBTW when I run this project locally with sam build && sam local start-api --host 0.0.0.0 I can invoke the Java endpoint and get the response back. It throws the class not found error when deployed to AWS.Share1You can use Java. You should look into provisioned concurrency as well to avoid cold start problems. I don't use Java with Lambda so I can't be of much more help beyond these links:https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.htmlhttps://aws.amazon.com/blogs/aws/new-provisioned-concurrency-for-lambda-functions/CommentSharePhilipKoshyanswered a year ago"


Question: AWS NLB sends 120 byte of unknown TCP Keep-alive packet to clients

"We have an IoT device that connects to our MQTT broker behind the NLB. We are keeping the connection between IoT device and broker by utilising MQTT Keep Alive time and brokers heartbeat intervals.Our IoT device sleeps most of the time. It wakes up in the following situations.Whenever it wants to send PINQREST(every 340s -MQTT Keep Alive time) sends it to the broker. Other microservices publish some data, and brokers send that information to IoT devices.Our objective is to sleep the IoT device as much as possible and maintain the connection to save the battery.***Problem: ***Normally, this particular IoT device sleeps most of the time. Our objective is to keep it sleeping as much as possible while maintaining a connection between IoT Device and the MQTT broker.The problem is that IoT Device continuously wakes up every 20s whenever the broker sends some downstream data to the IoT device. This usually happens whenever IoT Device receives downstream data from a broker.Based on our vendor's packet analysis, we found that NLB sends 120 bytes of TCP Keep-alive packets to IoT devices every 20s right after the broker publishes some downstream data. This is entirely sent by NLB and not by the broker.***Only happen in TLS : ***We found that this happens if we use TLS(8883) in NLB and terminate the TLS in NLB. If we remove the TLS, add the listener on a non-secure port (1883), and forward the traffic to Target's non-secure port, things are working as expected, and there are no 20s wake-up or keep-alive packet sent by NLB every 20s.We also tested the same setup with CLB in an SSL port. It works without any problem and does not send a keep-alive to the client (IoT device).We have removed the TLS and opened the non-secure port as a temporary workaround.Why does NLB send keep-alive packets every 20s if we use TLS ? is this an intended behaviour of NLB? Any idea how we could resolve it?***The overview of the cloud setup: ***MQTT broker runs in ECS FargateMulti-AZBroker in a private subnet NLB is in betweenClient (IoT device) and Target(MQTT Broker)NLB idle time keep resetting by two thingsKeep alive time sent by Client(IoT device) every340s Heartbeat time published by Target (MQTT Broker)every 340s Connection remains open NLB offload the TLS in port 8883 and forward the traffic to target port 1883FollowComment"

Answer: "0I can't find any documentation on the behaviour of NLB for KeepAlive, except for a mention here https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#connection-idle-timeoutThe difference between TCP and TLS, it's that in TLS the communication is encrypted from your client to the NLB, and then a new connection with encryption happens between NLB and the server (there is SSL termination at LoadBalancer), whilst in the case of TCP the SSL is not terminated at load balancer but the request is sent as received directly to the server, and then it will be the server to decrypt the request and the SSL handshake is done directly between the client and the server.I think that is the reason why the behaviour is different, as for TLS, you need an SSL handshake between client and NLB, and the keepAlive from NBL for that reason.CommentShareMikianswered a year agoThabo a year agoThanks, Miki, for the answer. Yes, it is not documented. Besides, as you already noted, this happens on TLS. However, my question is why the TLS connection in NLB should send a Keepalive time to the Client while the Client already sends a Keepalive to keep the connection. I am just wondering am i experiencing this behaviour due to some bug  in NLB ?Share0Please check our updated at documenthttps://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#connection-idle-timeoutWhen a TLS listener receives a TCP keepalive packet from either a client or a target, the load balancer generates TCP keepalive packets and sends them to both the front-end and back-end connections every 20 seconds. You can't modify this behavior.It explained your question and difference behavior between TCP and TLS listener in your IoT device .CommentShareMark_Wanswered 6 months ago"


Question: Granular billing details

"Most AWS services are metered as multiple dimensions yet in Cost Explorer I can only see a single $ value which represents the service charge. For example. Secrets manager is priced as a combination of $0.40 per secret per month + $0.05 per 10,000 API calls.If my monthly charge is $15/month, how can I see a detailed breakdown of the billed API calls that have been charged?Thanks!FollowComment"

Answer: 0You can use 'Group by' option and select 'API operation'. This will display the breakdown of the total charge by API operation in the month:CommentShareSlavaanswered 2 months ago


Question: SSM Patch Manager OS Support

"I'm new to SSM so I'm not sure if this is question has an obvious answer or not, but I've added some Debian 11 servers to my inventory successfully because that OS is on the SSM supported OS list and they are failing to scan for patches due to UnsupportedOperatingSystem. Now I see in the Patch Manager prerequisites that only Debian 8, 9, and 10 are supported by Patch Manager. When can we expect parity between supported operating systems for SSM in general and supported operating systems for Patch Manager?FollowComment"

Answer: "0Hi, @xelprepAs far as I know, patch managers tend to start support later.Therefore, we need to make sure that patch manager is also supported even when using an OS supported by SSM.Until now, SSM was supported in RHEL 8.3, but it was recently supported by the patch manager in the document.https://aws.amazon.com/jp/about-aws/whats-new/2022/06/aws-systems-manager-patching-windows-server-2022-other-linux-operating-systems/CommentShareEXPERTiwasaanswered a year ago"


Question: "Failed to start the instance. Insufficient Capacity" error

I tried starting a couple of my ec2 instances this morning on the us-east-1a zone and kept getting an error saying "Failed to start the instance.  Insufficient Capacity".  I was trying to start 1 instance at a time and a total of 7 instances.  Each instance has 32 vcpu and 192GB RAM.  I've been running ec2 instances for a couple years now and have never ran into this issue or seen it before.  Is there something I can do so this doesn't happen again in the future?FollowComment

Answer: "3Insufficient instance capacity covers the steps that you can take to address the error you can getting.I would also recommend checking out Why am I receiving the error "Your requested instance type is not supported in your requested Availability Zone" when launching an EC2 instance?You can run aws cli commands to get which Availability Zones, Azs can run your instance typeTry running your workload over multiple AZs.On-Demand Capacity Reservations enables you to reserve compute capacity for your Amazon EC2 instances in a specific Availability Zone for any durationCommentShareMichael_Kanswered a year ago2Occasionally, demand for certain instance types can be so high that AWS does not have sufficient capacity at the moment you request it. In that case, you have several options:Use a different instance type if you need immediate resources, and switch back to the preferred instance type later;Try launching the instance in a different Availability Zone;Wait a few seconds and retry;Consider purchasing Reserved Instances if you want the greatest likelihood that the specific instance type will be available to you in your preferred AZ when you request it.CommentShareEXPERTMichael_Fanswered a year ago"


Question: Can't see Backup File location in SSMS on AWS FSx

"I created 2 SQL failover server by using AWS FSx as the databases. But when I launched Microsoft SQL Server Management Studio, and tried to restored the database from AWS FSx, I can't see any files in the database location and can't see any file path. Do you have any suggestion to that then I can see the bakup files?Thanks.FollowCommentketrelzhang 8 months agoCan anyone help with this?Share"


Question: How to get IDs of ALL new rows instead of just one from RDS.executeStatement?

"When inserting rows into an Aurora RDS database, RDS will only return this:{ generatedFields: [ { longValue: 26 } ], numberOfRecordsUpdated: 3 }Which is obviously wrong and pretty useless. RDS knows it just inserted 3 rows, but only returns 1 new ID (not even the last one, but the first). Is there any way to fix this and get the full, correct information?(Calling RDS from Lambda Node btw)FollowComment"

Answer: "0Hello Kevin!Q1:  I'm afraid I am not quite sure what your question is. The returned object looks exactly like posted. The only ID returned is the 26 there.Q2: If there were 3 records updated, I would expect RDS to return 3 IDs, of course. Not only 1. Like this:{ generatedFields: [{ longValue: 26 }, { longValue: 27 }, { longValue: 28 }] , numberOfRecordsUpdated: 3 }CommentShareAWS-User-0144563answered a year agoKevin_Z SUPPORT ENGINEERa year agoHi,Thank you for getting back to me here with desired view. Let me check with the team and get back to you with feedbacks.Share0Hi,From the description, if I am understanding correct are you referring to that:From lambda, when you insert 3 rows to the Aurora RDS database (Aurora MySQL/PostgreSQL/MySQL Serverless/PostgreSQL Serverless, may you confirm which one?) then you are getting below as return from insert call:{ generatedFields: { longValue: 26 } , numberOfRecordsUpdated: 3 }Q1: May you elaborate how the return of ID looks like?From the public doc: https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_ExecuteStatement.html#API_ExecuteStatement_ResponseElementsThe returned field as listed.Q2: May you elaborate more on how you want the return looks like?CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: "How do I query X-ray using a http URL, where that URL is not the first part of the request?"

"Hello.Suppose that I have the following architecture:API Gateway (service name: gateway api) -> Lambda Function (service name: gateway handler) -> API Gateway (service name: internal service) -> Lambda Function (service name: internal service handler)The "internal service" api gateway has 2 endpoints (POST /endpointA and POST /endpointX), which both proxy to the same "handler" lambda function. Depending on a feature flag, incoming requests are requests to the "gateway handler" are sent to either POST /endpointA or POST /endpointX. All of these services are set up for tracing with AWS X-ray.I want to query X-Ray to gain insights into the performance of requests send to X vs A.I tried the following queryservice("gateway handler") AND service("internal service") AND http.url ENDSWITH "/endpointX"// and also //service("gateway handler") AND service("internal service") AND http.url ENDSWITH "/endpointA"However this does not seem to work. In general I cannot query using http.url, when that http request is not the first request in a trace.Is there a way around this? Bonus points if it does not require me to add additional code to annotate traces for the xray system.FollowComment"

Answer: "0Hi Dilski,As you observed, all of the http filters are scoped to only the root segment of the trace. This means that it is not possible to filter on http.url for a downstream segment. In your case, I would suggest that the internal service node be split into two, one for each API. This would let you view the aggregated statistics of each endpoint separately on the service graph and to filter the traces with the expressionsservice("gateway handler") AND service("internal service /endpointA")orservice("gateway handler") AND service("internal service /endpointX")Hope this helps!CommentSharelexguanswered a year ago"


Question: Issue with receiving message for AWS Transfer Family AS2

"When setting up the Transfer Family for AS2, I'm running into an error with receiving a message. After using this guide (https://docs.aws.amazon.com/transfer/latest/userguide/as2-end-to-end-example.html#as2-create-certs) to create the certificates, I tried to set up the AS2 Transfer Family AS2 to receive messages. The VPC is created and the endpoint can be reached. However, when actually sending the message, a 400 error Bad Request is returned with no other information. On the console, there's no record of data going in or out. Is there a way to view more information?Also, just to confirm, when the guide says to send public keys, that's the signing-cert.pem/encrypting-cert.pem, correct? I had that set up in the partner and there's no error but I just want to make sure that it's not an authentication issue.By the way, using this guide (https://docs.aws.amazon.com/transfer/latest/userguide/as2-end-to-end-example.html#as2-test-config), when using the link format in Step 7, I'm not able to connect. The endpoint connection is actually http://s-1234567890abcdef0.SERVER.transfer.us-east-1.amazonaws.com:5080. The link is correct in the server configuration but the guide is incorrect.FollowComment"

Answer: "1Accepted AnswerHello,A 400 error could be returned from the endpoint if a valid AS2 message is not received. It is possible that the AS2-From and AS2-To headers do not match the values for an agreement associated with the server. The AS2-From header should match the AS2 ID in the partner profile, whereas the AS2-To header should match the AS2 ID in the local profile. Could you confirm if this is not the case?Also, do check that the agreement has an access role with permission to read and write from the S3 bucket and that the role’s trust policy allows the transfer service to assume the role as described here [1].Further, if the server has a logging role configured, check whether the server's CloudWatch Logs contain any AS2 message logs. If the logs do not contain the reason for the failure, do raise a support case providing the AS2 Message ID and VPC Endpoint ID so that the Support team can check for the exact reason why the message is not being accepted by the endpoint.Also, to your question, as you correctly pointed out, signing-cert.pem and encryption-cert.pem from the example are both the public certificates which are shared with the trading partner. signing-key.pem and encryption-key.pem should not be shared with the trading partner.References:[1]  https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html.-- SagarCommentShareEXPERTsagarb-awsanswered 9 months ago"


Question: Savings plan billing

if I had c6i.4xlarge under cost saving plan for the family c6i and I upgrade it to c6i.8xlarge for 2 weeks and then downgrade it . what happens in this case to my charges? will it have doubling effect in the charges for the 2 weeks?FollowComment

Answer: "1If you have a savings plan that covers a c6i.4xl and you upgrade to the c6i.8xl, then the savings plan will cover half the cost of the c6i.8xl and the other half will be the on-demand price. When you return the instance to c6i.4xl, the savings plan will continue to cover it. Therefore, you will have an on-demand charge for the time the instance is a c6i.8xl, but the savings plan utilization should not change.https://docs.aws.amazon.com/savingsplans/latest/userguide/sp-applying.htmlCommentShareEXPERTShlomo Dubrowinanswered 12 days agoEXPERTRiku_Kobayashireviewed 12 days ago-1It will replace the cost for 2 weeks in which you use upgraded size and cost will be according of upgraded size for 2 weeks and remaining cost will be according to downgraded sizeCommentShareArsalananswered 12 days ago"


Question: Questions about Cognito SAML Authentication process

"Hi,I need few clarifications as below about how AWS cognito works with SAML providers.Does cognito SAML request Signing Certificate?Does cognito support Token Encryption Certificate?Which Secure Hash Algorithm does cognito use: SHA 1 or SHA 256 for SAML authentication?Thanks,FollowComment"

Answer: "1Does cognito SAML request Signing Certificate?Cognito requires that you upload a metadata document or specify a metadata URL. I believe the signing certificate is included in this metadata, whether the document is uploaded manually or specified through the URL. If your Idp requires a signed logout request, you can also download the signing certificate from your user pool and upload it to your identity provider, so the single logout requests can be verified.Does cognito support Token Encryption Certificate?Cognito service does not support the use of Token Encryption Certificates. This is due to the fact that the Cognito service can only be used in a service provider flow, not an identity provider flow and as such cannot send any tokens to other applications.Which Secure Hash Algorithm does cognito use: SHA 1 or SHA 256 for SAML authentication?Could you clarify on where you expect this hashing to be used? I cannot find any reference to hashing in the SAML flow for your user pool. https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp-authentication.htmlIf there is hashing involved, it will be on the IdP side, not done by the Cognito user pool, with relation to SAMLCommentShareGovind Kumaranswered a month ago"


Question: Enable private DNS resolution on peered VPCs using CloudFormation

"How can I enable private DNS resolution on a VPC peering connection, using CloudFormation?FollowComment"

Answer: "1Accepted AnswerHi, I see in the CloudFormation Public Roadmap, this issue https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/169 is still outstanding.  A CDK custom workaround is mentioned there, but it would be possible in CloudFormation using a Resource Type or Custom Resource, calling this API - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcPeeringConnectionOptions.html.I find that for situations where a Custom Resource is well-suited it's really quick to implement via a Python lambda using crhelper (https://github.com/aws-cloudformation/custom-resource-helper) described at https://aws.amazon.com/blogs/infrastructure-and-automation/aws-cloudformation-custom-resource-creation-with-python-aws-lambda-and-crhelper/).CommentShareEXPERTskinsmananswered 3 months ago"


Question: Cognito Forgot password email not received.

"I am using the amazon-cognito-identity-js NPM module to interface with Cognito for signup, login, logout, forgot password, change password, etc.Forgot password was working and recently ceased to work.  It appears to work in that I get the 200 OK from the https://cognito-idp.us-east-2.amazonaws.com/ POST.  The data being posted with the ClientId and Username is also correct.    Invoking the API also responds back with the "Email with verification code has been sent to d***@g***.com".  The problem is that the email that should contain the verification code never arrives.  I know the email address is fine because it works for the signin and add user scenarios.In Cognito->MFA and Verifications I have the account recovery set to "Email Only".I was using the default email in Cognito and thought that might be the issue yet the problem continues after integration with SES.I'm at a loss.  In summary, the forgot password appears to work as I have confirmed that no errors are received when communicating with AWSCognitoIdentityProviderService.ForgotPassword end-point yet the email with the verification code is never sent.FollowComment"

Answer: 0I found the issue.  The user attribute email_verified was not set to true.CommentSharedlhuffmanjr1answered 2 years ago


Question: Add dynamo db access permission to lambda function in cdk

"I have a lambda function which write data to and read data from dynamo db.  I want to add resource based policy to lambda function. But I couldn't find any relevant method in the cdk. Though I found function.addPermission method, it provides permissions to other AWS services to invoke this lambda.FollowComment"

Answer: "1Accepted AnswerFor this you can use the add_role_to_policy function:from aws_cdk import aws_lambda as _lambdafrom aws_cdk.aws_lambda_python import PythonFunctionfrom aws_cdk import aws_iam as iammy_function = PythonFunction(    #function logic)  my_function.add_to_role_policy(iam.PolicyStatement(    effect=iam.Effect.ALLOW,    actions=[        'dynamodb:GetItem',    ],    resources=[        'TABLE_ARN',    ],))The above policy uses Python and grants the Lambda GetItem permissions on the DynamoDB table which ARN you provide.More info can be found hereCommentShareEXPERTLeeroy Hannigananswered a year ago1In general, it is recommended to use the grant function rather than granting permission directly from the cdk.for example,const lambdaFunc = new lambda.Function(....);const ddbTable = new ddb.Table(...);ddbTable.grantReadData(lambdaFunc);ddbTable.grantReadWriteData(lambdaFunc);CommentShareAWS-Kwonyulanswered a year agoLeeroy Hannigan EXPERTa year agoWhere is this recommended? It seems its not as granular as adding a policy to the function where you can refine the permission policy to API/Resource? Instead, your example allows all API's against the table which is quite permissive.If you were to use this approach it would be best if you use the grantStream(grantee, ...actions) function where you can be more restrictive with your permissions.Share"


Question: Unable to test Datasource in AWS Managed Grafana

"I am trying to use AWS Managed Grafana for monitoring purposes.I added cloud watch as its data source.But when I am trying to save and test it, it's showing below error. <title>504 Gateway Time-out</title>
504 Gateway Time-out
        Gateway Time-outPlease help how to troubleshoot this error.FollowComment"

Answer: "0Hi there,Thank you for posting the question and the detailed explanation. To answer your question, we require details that are non-public information. Please open a support case with AWS using the following linkThank you!CommentShareSUPPORT ENGINEERSanket_Kanswered 3 months ago"


Question: Athena Error NOT_SUPPORTED: ROW comparison not supported for fields

"Getting following error while executing Node and edge sql :   ERROR: NOT_SUPPORTED: ROW comparison not supported for fields with null elementsThis query ran against the "wow_athena" database, unless qualified by the queryAny Idea ?FollowComment"


Question: "Redshift Spectrum- How to grant user group permission to SELECT from a view created on external table, without granting access to the underlying external table"

"Hi,I want to restrict access to some fields of the external table to user group. To cater this requirement I am creating a view in internal schema on top of that external table to select only required field. I want to grant access to the view created. I did so by grant select on internal_schema.view_name to group g1;But while querying the view it is returning error saying underlying external schema access is required. I don't want to grant Usage on the external schema as it will expose all the tables to the group again. Do we have a way to restrict this?FollowComment"

Answer: "0Hello,Firstly, I would like to inform you that if you GRANT USAGE privilege to a user over an external schema, then the user would be able to query all the tables under that external schema. This is an expected behavior.You can achieve your use case by using materialized views instead of simple views. A materialized view contains a precomputed result set, based on an SQL query over one or more base tables. You can issue SELECT statements to query a materialized view, in the same way that you can query other tables or views in the database. Amazon Redshift returns the precomputed results from the materialized view, without having to access the base tables at all [1].Please kindly refer the sample steps below,Create a materialized view [2].Grant SELECT access to this view to the concerned user/group using the below command,    - grant select on local_schema.materialized_view_name to username;Now if you query the view from the concerned user, you would be successfully able to get the expected results, without giving explicit access to the user on your external schema.However, here please note that, you would have to update the data in the materialized view, by refreshing it. Amazon Redshift identifies changes that have taken place in the base table or tables, and then applies those changes to the materialized view. As a materialized view owner, make sure to refresh materialized views whenever a base table changes.References -[1] https://docs.aws.amazon.com/redshift/latest/dg/materialized-view-overview.html[2] https://docs.aws.amazon.com/redshift/latest/dg/materialized-view-create-sql-command.htmlCommentShareSUPPORT ENGINEERAWS-User-2028185answered a month agorePost-User-7896719 a month agoThanks for the response.Please note the underlying external table gets dropped and recreated, hence I was creating a late binding view. Since materialized view would not work no schema binding, do we have any alternate option here?Share"