Question: Deploying application on AWS ECS Cluster

"I developed and hosted locally a Spring Boot application with PostgresDB and Angular UI.I'd like to deploy this application on AWS ECS. Should I create an image for Spring Boot backend, an image for Angular UI, and define them in the container definition?What about DB? Should I create an RDS Postgres DB in AWS? How does my application talk to RDS? Any help would be greatly appreciated. Thank you.FollowComment"

Answer: "1Yes, this is a good practice to split backend and frontend into different containers.As for DB - you can use RDS or PostgreSQL-compatible Aurora - Aurora usually is a better choice unless you have particular reasons to not use it.As for communication between app backend and DB - usually configuration for connection is exposed through environment variables.So basically you launch your DB, you get it's host, username, password and add them as env variables to ECS container definition. Since credentials is sensitive information it might be a good idea to store them (or at least password) in Secrets Manager/Systems Manager Parameter Store and use value from them in container definition.CommentShareA-Shevchenkoanswered a year agoAWS-User-5291433 a year agoI use the Spring Boot properties file to connect to the DB locally. Does it have to match with container environment variables? Thanks.ShareA-Shevchenko a year agoWith properties file it might be a bit challenging because of securit concerns. It's not a good idea to have the same values (username and password) on local and production environments, so at least you can use different properties files per environment. But then, you need to store production properties file somewhere and since it contains DB credentials it should be stored securely . And it makes challenging usage of properties file for DB credentials. So I'd really recommend to rewrite your app a bit to use environment variables for credentials instead of properties file.Sharemwrb a year agoWhile I agree that Aurora can handle higher concurrent workload and has very useful features (global databases, consistent low replica latency, etc.), I respectfully disagree with the blanket statement that it's a better starting point over standard RDS PG/MySQL. Mainly because of the higher per-instance hour cost and the additional per-IO read/write cost (which seems to catch folks off guard). I suggest starting with regular RDS PG/MySQL unless you know you need the extra capability of Aurora. It's easy to upgrade to RDS PG/MySQL down the road if you need it.Share1Hello.To be fair to all that is out there, you can have a look into AWS AppRunner / AWS Copilot that will deal with a fair amount of configuring out the ECS Settings and resources needed to deploy your application.I would imagine that you'd gone down the path of using docker-compose locally to build your application with a service for each thing : your frontend/backend/DB nicely defined in compose format following the hundreds of guides out there to do just that.If you have not done that, I'd highly recommend to look into it to speed up your development and local testing.To take to the cloud, if you look at AppRunner / Copilot, you then have to rewrite all that to fit within what AWS specific format for it. To save yourself that effort, you can then try out ECS Compose-X.This software will parse your services defined in compose format, and generate all the ECS Task/Execution IAM roles, CPU/RAM configuration (see this) and the ECS Task and Service definition. On top of that, to then move your DB into AWS RDS, you can then use Compose extension field for it that compose-x will understand and deal with for you (see docs).  This will allow you to either define all the settings you want using the AWS CloudFormation properties for RDS (i.e. for a DBCluster). But not only: you can then map to that DB resource which service(s) should have access to it: this will then automatically create Security Group ingress between the services and the DB, create IAM access to retrieve the DB Password etc.If you do not have an existing infrastructure (VPC/ECS Cluster etc.) compose-x will take care of creating all of that for you, following best practices. You can tweak the configuration by setting the respective x-<field> of the resources you want to have. If you did have an existing infrastructure, you can then have compose-x lookup these resources in your account based on tags and/or resources ARN. It will then automatically pickup the right value and set the parameters accordingly.You can find examples in the labs and feel free to ask question on the Slack channel about it.Hope this helps!CommentShareJohnPrestonanswered a year agoAWS-User-5291433 a year agoThanks for your explanation. It's not EKS. What is the big deal to configure ECS? Create cluster, TD/Containers & Service in a few clicks.Sharemwrb a year agoOne of the problems with AppRunner is that the service you deploy runs outside of your VPC and currently has no way to get private connectivity back to your VPC... the app would be unable to access your RDS database directly. I don't think you can give AppRunner a static IP, and thus couldn't safely rely on the RDS security group rules to limit traffic. Even if you could, public RDS scares me.While I haven't used Copilot, it does sound like a good shortcut to configure ECS... but for someone learning like this, I still suggest configuring ECS "from scratch" to learn the underlying mechanicsShare1So there are 3 main components for your applications:Angular UISpring Boot BackendPostgreSQL DB.Angular UIAngular UI is mostly static files, they can be in an S3 bucket which a Cloudfront CDN, this is what I usually use. Since s3 + cloudfront is very simple plug and play solution it will be very less effort as compared to creating the container image and deploying on ECS.Spring Boot BackendFor Spring boot backend you will create container images and ideally push them to ECR. From their your  task definitions will pull the images and run them. The containers usually serve traffic via an AWS ALB so you have to keep that in mind while designing your infrastructure, specially VPC.PostgreSQL DatabaseThe PostgreSQL database should be deployed using AWS Aurora because of the performance boost it provides, also push button compute scaling and storage auto-scaling are my favorite features of AWS Aurora.  In case if you have specific version requirements for PostgreSQL you can check AWS RDS as well.The question that how my application will talk to RDS?, usually when you deploy VPC you create public, private and db subnets. The database will be deployed in db subnet and will only allow communication from private subnet and from spring boot backends. When you deploy the Aurora or RDS based DB, you get a hostname and other DB credentials. You can utilize AWS Secrets manager to auto rotate the DB credentials which is the recommended practice for security. Please check the below article to see how you can integrate your application with AWS Secrets manager. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/manage-credentials-using-aws-secrets-manager.htmlFeel free to ask if you need more clarification on anything.CommentSharehameedullahanswered a year agomwrb a year ago+1 on hameedullah's comment about exploring S3+CloudFront for static HTML/JS frontends.Now, an S3-hosted frontend wouldn't have VPC connectivity to the springboot backend, which may or may not be ok. If this is a typical 3-tier where only the frontend should talk to backend, things get more complicated. May need API GW in-front of backend and some sort of auth mechanism for the frontend. Not a bad thing, just saying it starts to complicate things and the "right" answer might depend on circumstances.Share1Images & Container DefinitionsIs it correct to say that your Spring Boot backend and Angular UI are running as two separate processes, e.g. mvn spring-boot:run for the backend and something like ng serve or npm start for a NodeJS HTTP server w/ Angular? (I don't know Java/Spring Boot, so just want to double-check).If so, then yes, you would build a separate Docker image for each process and push to Amazon ECR (or other supported container repo), and you would reference these images in your ECS task definitions.In a production environment, you would often use separate, single-container Task Definitions for the two images, with each Task Definition mapped to its own auto-scaling ECS service. This has several benefits, such as allowing the backend to scale independently from the frontend.However, it sounds like you're newer to ECS - and if this is just for learning or early-stage dev/test, my personal suggestion would be to first start with a single Task Definition running both containers side by side. It will simplify some of the additional networking setup needed for service-to-service communication. If you do want to dive into separate services, read up on "ECS Service Discovery" (here's an example workshop).Database QuestionsShould I create an RDS Postgres DB in AWS?So first, yes, you likely want to use RDS if you need a relational database - its a big time saver over trying to set one up yourself on say EC2.As for RDS Postgres specifically, do you have a preference for, or does your app require, Postgres? RDS can run MySQL, MariaDB, and others... and as long as your app is flexible, you can use the engine of your choice.Let's say you decide to use Postgres or MySQL. You can run these two ways on RDS... first, you have "RDS Postgres" and "RDS MySQL". These are standard-issue open source engines that AWS manages for you; like EC2, you pay a per-hour cost for the VM, a per-GB-hour cost for EBS disk size, and potentially some ancillary costs depending on the features you use (enhanced logs, multi-AZ, etc.).Now, if you are doing this as part of a learning exercise and don't expect to drive much traffic to the database and/or it may go many hours without activity while not in use, I would instead suggest you look at RDS Aurora Serverless, which is "Postgres compatible"  and "MySQL compatible" option and, to you and your application, looks just like the open source versions (in certain cases, there might be code change needed, but that's typically edge cases). Both instance-based Aurora and Aurora Serverless come with many performance enhancements and AWS-unique features that can help when you need to scale beyond what the normal open source versions can handle. But I specifically recommend Aurora Serverless for learning/small traffic because the serverless version, the database engine can automatically turn off when not in use so that you do not pay unnecessary hourly instance cost. Note, I would not use the regular Aurora instance-based option (non-serverless) for low-traffic dev/test, because that version is more expensive per hour that regular RDS Postgres/MySQL and you don't need the extra performance.How does my application talk to RDS?Both ECS tasks and RDS databases run in a VPC & subnet(s) of your choosing. Anything running in a VPC will always be given an Elastic Network Interface (ENI), aka virtual network card, and an ENI will always have a private IP address coming from your subnet CIDR.If running in the same VPC, then two ENIs, e.g. from an ECS task and an RDS database, typically can communicate with one-another as long as their attached security groups allow the necessary traffic. I say "typically" because there are lots of ways to configure your VPC (e.g. Subnet ACLs, custom DNS, AWS firewall rules, etc.) and for simplicity, I'm assuming you're not doing anything unique here.However, with AWS-managed services like RDS, the IP address is assigned randomly from your subnet CIDR and there are certain cases (like a hardware failure where AWS restarts the database on a new host) where the IP address might change. This means you do not want to hardcode the RDS database IP in your container code or ECS task definition environment variables. Instead, AWS provides each RDS database with a DNS name that stays constant, and if the database IP(s) change, RDS will automatically update the DNS entry with the new IPs. If your application code uses this DNS, you do not have to worry about IPs changing. The DNS names will look like myexampledb.a1b2c3d4wxyz.us-west-2.rds.amazonaws.com, and you can read more about them here.How do you give the RDS DNS name to your container?There are several acceptable ways to do this... but one that you should avoid is hard-coding the DNS name in your application code or Dockerfile because, if you ever re-create the database or need to switch between databases (say in dev vs prod), you would have to rebuild your image or maintain multiple images.Instead, there are two basic patterns that are much better to use:Inject the DNS name into your container environment variables when your ECS task starts - as part of your ECS Task Definition's optional Environment Variables. For example, if you provide the RDS DNS name as an environment variable named DATABASE_ENDPOINT in the task definition, you could reference its value in your Springboot code with something like System.getenv("DATABASE_ENDPOINT"). Note that this is not a good way to provide secrets (like your database password, because the secrets are stored and visible in plaintext.Have your container read the DNS name from a central parameter store - sometimes you might have multiple apps, AWS services, etc. that need to reference the same value. Rather than putting that value in multiple places, you could put it in one, central place and dynamically have your app code (or certain supported AWS services) read the value at runtime and store it in memory. This is also the recommended way to retrieve secrets (like database passwords), so that you do not have to hardcode them in your app code or ECS Task Definition. ECS has out of the box support for retrieving encrypted secrets from AWS Parameter Store, and I'd recommend this approach for your database password. The nice thing with ECS's Parameter Store integration is that access to Parameter Store is based on IAM... and you would just grant the ECS Task's role IAM permission to retrieve the value.To summarize, you should use ECS Task Definition environment variables to insert non-secret values like your database endpoint, port, etc.  If this is just for learning and there's no sensitive data in your database, you could also use env vars for the password... but if building for production or storing sensitive data, you should dynamically retrieve these values at runtime using a method like above.CommentSharemwrbanswered a year ago"


Question: Instead of Outbound Calling It is making Inbound Calling while using StartOutboundVoiceContact API!

"I am using StartOutboundVoiceContact API to make automate outbound calls, i have assigned permission of StartOutboundVoiceContact to lambda role and than configure the parameters as below:const AWS = require('aws-sdk');AWS.config.update({ region: 'us-east-1' });exports.handler = (event, context, callback) => {    let connect = new AWS.Connect();    const customerName = event.name;    const customerPhoneNumber = event.number;        let params = {        "InstanceId" : '8XXXefXX-18XX-4XXf-bXXf-328XXXX8fXX4',        "ContactFlowId" : 'XX59XXXf-XXXe-4XX6-XX5d-5XXd7XXX1XX1',        //"SourcePhoneNumber" : '+18XXX675XXX',        "QueueId": '7dXXXX19-XXXX-450f-XXXX-XXXXaf1dfXXX',        "DestinationPhoneNumber" : customerPhoneNumber,        "Attributes" : {            'name' : customerName,        }    }        connect.startOutboundVoiceContact(        params, function (error, response){                        if(error) {                console.log(error, error.stack)                callback("Error", null);            } else            {                console.log('Initiated an outbound call with Contact Id ' + JSON.stringify(response.ContactId));                callback(null, 'Success');            }        }        );and testing with test event:{  "name": "Abdul",  "number": "+18XXX749XXX"}It does initiating a call but from Destination to Source instead of Source to Destination. I have used an outbound flow but than it gives me the error of Invalid Contactflow Typ/Id.FollowComment"

Answer: "0Hello,Thank you for reaching out to us . I have implemented your code in my local with few more changes and could able to successfully initiate outbound calling. Please find the code below :const AWS = require('aws-sdk');AWS.config.update({ region: 'us-east-1' });exports.handler = (event, context, callback) => {let connect = new AWS.Connect();const customerName = event.name;const customerPhoneNumber = event.number;let params = {    "InstanceId" : 'xxxxxxx-7f52-4d2f-992d-xxxxxxx',    "ContactFlowId" : 'xxxxxx-5afb-428e-bbae-xxxxxx',    "DestinationPhoneNumber" : customerPhoneNumber,    "SourcePhoneNumber" : "+1xxxxxxxx",    "Attributes" : {        'name' : customerName,    }}connect.startOutboundVoiceContact(    params, function (error, response){                if(error) {            console.log(error, error.stack)            callback("Error", null);        }        else        {            console.log('Initiated an outbound call with Contact Id ' + JSON.stringify(response.ContactId));            callback(null, 'Success');        }    }    );}Test Event   -{"name": "Namratha","number": "+1xxxxxxxx"}CLI Command. -aws connect start-outbound-voice-contact --region us-east-1 --destination-phone-number +1xxxxxxxxxx --contact-flow-id 1b3xx98ab0-xxxxxx-428e-bbae-xxxxxxx --instance-id d56bce38-7f52-4d2f-xxxxx-xxxxxx --source-phone-number +1xxxxxxxxxDestination number and source number needs to be provided to the command to execute outbound calling. Please refer to this document for more information on outbound calling [1] .References:https://docs.aws.amazon.com/cli/latest/reference/connect/start-outbound-voice-contact.htmlCommentShareSUPPORT ENGINEERNamratha_Kanswered a year ago"


Question: Calculate PASSWORD_CLAIM_SIGNATURE solution .NET SDK sync

"Brief Description:As the title says I am looking for a way to calculate the password claim signature for a PASSWORD_VERIFIER response using the .NET SDK and without async (as part of InititateAuth and the USER SRP AUTH process).  From the examples I have seen and worked with this should be pretty easy once I have the correct formula.The Details:Every solution I find is either using devices or has information that doesn't seem to be accurate for my use case.  I know for a fact I am inputting the correct user name and password but still receive a "NotAuthorizedException: Incorrect username or password" error.  So this leads me to believe (along with the other troubleshooting / fixes) that it's my password claim signature formula.Currently using this (AuthenticationHelper.AuthenticateUser) for password claim signature generation:  https://github.com/aws/aws-sdk-net-extensions-cognito/tree/master/src/Amazon.Extensions.CognitoAuthentication/Util  - but this appears to be calculating it wrong from the values the associated GetPasswordAuthenticationKey takes in (and at any rate doesn't seem to be working)I would perfer not to but - if the .js version is accurate I can adapt it from: https://github.com/amazon-archives/amazon-cognito-identity-js/blob/6b87f1a30a998072b4d98facb49dcaf8780d15b0/lib/CognitoUser.js?#L299  and the associated helper scripts featured on line 291.A possible alternate solution:  https://stackoverflow.com/questions/75977941/how-do-i-use-initiateauth-command-aws-sdk-client-cognito-identity-provider-to  I would love to find the SRPClient featured here as part of answer step #4, but cannot find the assembly it is part of.  It looks like this might solve my problem but I am unsure about it's function with SYNC calls.Specific Goal:A PASSWORD_CLAIM_SIGNATURE formula for USER_SRP_AUTH PASSWORD_VERIFIER response that utilizes minimal request information.FollowComment"


Question: Auditing KMS AWS owned key

"Hello folks!I am trying to audit an AWS owned key using Cloudtrail, the intention is to eventually create a metric filter in Cloudwatch that will generate an alert in case of unwanted usage of that key to perform crypto operations. I read in the AWS documentation (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) that AWS owned keys cannot be audited: "You do not need to create or manage the AWS owned keys. However, you cannot view, use, track, or audit them". However in my default Cloudtrail for management events, I can see Decrypt events that use that AWS managed key based on the arn of the key itself. I am wondering if anybody here has ever tried to track usage of an AWS owned key and/or trying to achieve the same goal I am describing in this post?Thanks!FollowCommentJaccoPK a year agoSeems entirely plausible that auditing is possible.I inspected Cloudwatch and it does not report having any metrics available to display.Maybe you would need to make a EventBridge rule attached to a lambda that logs them to CloudWatchShare"

Answer: "1Accepted AnswerHi Nicco, most AWS services offer the choice of an AWS managed CMK, or an AWS owned CMK.As explained in the docs, the AWS managed CMK is visible in the customer's account. Customers can view the CMK and its key state, and use GetKeyPolicy to view (but not change) the key policy. They can also track use of the AWS managed CMK by AWS services in CloudTrail logs. The key policy uses a kms:ViaService condition key that allows the key to be used only by the service on the customer's behalf; not by the customer directly. Also, customers are charged a per-use rate for AWS managed CMKs, although some services eat that cost.These features are not available on an AWS owned CMK (In your account, it is displayed as aws/servicename, eg. aws/ebs), which is not in customer's account. However, despite the decreased visibility, the key is easy to use. The service creates, maintains, and uses the CMK on the customer's behalf.CommentShareNaj_AWSanswered a year ago1There is a difference between "AWS Owned" and "AWS Managed" keys. What you are seeing in the logs is the "AWS Managed" keys.CommentShareEXPERTkentradanswered a year ago"


Question: S3 server access logs to Cloudwatch?

Is there a way to get S3 access logs into CloudWatch?FollowComment

Answer: "0Accepted AnswerS3 Data Events can be enabled and delivered to CloudTrail, which in turn can be delivered to CloudWatch Logs. There is a cost implication with Data Events, but you can enable this on a per-bucket basis.This is a different file format to Access Logs, but similar (and additional) information is captured:https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.htmlhttps://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.htmlCommentShareAlastairanswered 5 years ago"


Question: AWS Device Farm: Not able to change context to webview

"Hi,I am writing test for a hybrid Android app using Appium Nodejs with WebDriverIO.I am able to test the native screens well. I am not able to change context to webview.The code to change context looks as follows    var ctxs1 = await client.getContexts();    console.log("Available Contexts in fitBitLogin-----");    console.log(ctxs1);    ctxs1.every(async function(value, index, array) {            if(value.includes('WEBVIEW')) {                 await client.switchContext(value);                 return false;            }            return true;    })The following are the logs. You can see that both native and webview contexts are available. But changing the context to webview is failing.2022-10-01T19:13:50.492Z INFO webdriver: COMMAND getContexts()2022-10-01T19:13:50.492Z INFO webdriver: [GET] http://127.0.0.1:4723/wd/hub/session/d9377f5a-50d8-44db-9d09-f16f92aaf511/contexts2022-10-01T19:13:51.723Z INFO webdriver: RESULT [ 'NATIVE_APP', 'WEBVIEW_chrome' ]Available Contexts in fitBitLogin-----[ 'NATIVE_APP', 'WEBVIEW_chrome' ]2022-10-01T19:13:51.723Z INFO webdriver: COMMAND switchContext("WEBVIEW_chrome")2022-10-01T19:13:51.724Z INFO webdriver: [POST] http://127.0.0.1:4723/wd/hub/session/d9377f5a-50d8-44db-9d09-f16f92aaf511/context2022-10-01T19:13:51.724Z INFO webdriver: DATA { name: 'WEBVIEW_chrome' }2022-10-01T19:14:16.728Z INFO webdriver: COMMAND findElement("xpath", "//*[@id='ember654']")2022-10-01T19:14:16.728Z INFO webdriver: [POST] http://127.0.0.1:4723/wd/hub/session/d9377f5a-50d8-44db-9d09-f16f92aaf511/element2022-10-01T19:14:16.728Z INFO webdriver: DATA { using: 'xpath', value: "//*[@id='ember654']" }2022-10-01T19:15:03.858Z WARN webdriver: Request failed with status 500 due to An unknown server-side error occurred while processing the command. Original error: Process didn't end after 10000ms (cmd: '/opt/chromedriver/linux/65/chromedriver --url-base\=wd/hub --port\=8000 --adb-port\=5037 --verbose')Please note, on my local machine, with an Android emulator, the test works without any issues.Any guidance/help will be very useful. Do let me know if you need more inputs.Thanks!FollowCommentrePost-User-1218289 2 months agoHi Parag, I am facing the same issue. Were you able to solve this ? If yes, can you please guide me on the steps.Share"


Question: How much interactions data do you need for decent/good recommendations in amazon personalize? Any suggestions?

"In the documentation, on the quotas page there is information about the minimum and maximum limits for the datasets we give to personalize. But can someone suggest how much interaction data you would need in order to generate decent/good recommendations?I used the movielens-100k dataset and set performHPO to True. For the trained solution, the normalized discounted cumulative gain @ 25 was 0.2977 and the precision @ 25 was 0.0512. Is this low performance due to not having enough interaction data?FollowComment"

Answer: "0Hi,The Amazon Personalize quotas represent the absolute minimum for the service to be able to train a model. For a machine learning model to learn, it needs to be able to extract information from the data you sue for training. Good datasets have:multiple users interacting with multiple items, i.e. each user interacts with many itemsmany items have interactions from multiple users, i.e. each item has many interactions from usersThis does not have to be true for every item and every user, but you should have a "core" of users and items that have a large number of interactions.Depending on your data, the overall total number can vary and depending on the behaviour of your users, you will need more or less interactions for the model to be able to give good recommendations.Also, please keep in ming that the Movielens dataset is not  a dataset of actual user interactions - which is what a recommendation engine should be trained on -, but rather a movie ratings dataset that is publicly available and you can convert to data you can use to get familiar Amazon Personalize. As users interact with items recommended to them by the recommendation solution, the data you use for the next training will also improve, as the user is being presented more things that are interesting to them and consequently interacting with them. Because the Movielens dataset is not an interactions dataset and also does not reflect how users would interact with items over time, you will see this reflected in the metrics. Therefore any metrics resulting from experiments using the Movielens dataset should be taken with a grain of salt.Interestingly, this is also the case when you use data that was generated from a different recommendation solution to train an Amazon Personalize model. The metrics are generated initially on the historical data, where users interacted with what was on their screen (recommended by the previous solution), but they might have interacted with something else if something else was offered.Because of this, you should always finally evaluate recommendation engines using A/B testing.In this blog you can find methods for A/B testing with Amazon Personalize: https://aws.amazon.com/blogs/machine-learning/using-a-b-testing-to-measure-the-efficacy-of-recommendations-generated-by-amazon-personalize/For a build path, there are workshops in the Retail Demo Store for A/B, interleaving, and multi-armed bandit testing.https://github.com/aws-samples/retail-demo-store/blob/master/workshop/3-Experimentation/3.2-AB-Experiment.ipynbhttps://github.com/aws-samples/retail-demo-store/blob/master/workshop/3-Experimentation/3.3-Interleaving-Experiment.ipynbhttps://github.com/aws-samples/retail-demo-store/blob/master/workshop/3-Experimentation/3.4-Multi-Armed-Bandit-Experiment.ipynbYou can use Amazon CloudWatch Evidently to record your A/B testing experiments.CommentShareAnna_Ganswered 7 months ago"


Question: How to Enable Region Programmatically

We are looking to enable an AWS region programmatically using either boto3 or terraform.FollowComment

Answer: "1Actually this is now possible for standalone accounts and organization member accounts [1].Please keep in mind that it might take several hours until the region is useable. To check its status execute the get_region_opt_status [2] after your enable_region request [3].References:[1] https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html[2] https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/account.html#Account.Client.get_region_opt_status[3] https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/account.html#Account.Client.enable_regionCommentShareMichael Aicheranswered 4 months ago0Hello Dyasic,I understand that you are trying to enable an AWS Region programmatically using either boto3 or terraform. However, an AWS Region can only be enabled using the AWS Management Console, see reference [1].Regions introduced before March 20, 2019 are enabled by default. You can begin creating and managing resources in these Regions immediately. You cannot enable or disable a Region that is enabled by default, see reference [2] for more information regarding this. The following regions are disabled by default:Africa (Cape Town)Asia Pacific (Hong kong)Asia Pacific (Jakarta)Europe (Milan)Middle East (Bahrain)All other regions are enabled by default.However, to enable a Region that is disabled by default using the AWS Management Console, you must have permission to enable Regions, see reference [3].References:[1] https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html[2] https://docs.aws.amazon.com/general/latest/gr/rande-manage.html[3] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-enable-disable-regions.htmlCommentShareAsenathianswered a year ago0If you look at reference [1], it says that it is not available via CLI or SDK. Please contact your account team to present your use case, and they will work with the appropriate team to get it on the backlog for implementation.CommentShareRodney Lesteranswered a year ago"


Question: How to check error stack trace of AWS data pipeline from AWS CLI?

"Hello, when we see the AWS data pipeline console we see a message that AWS is planning to remove access to console by 04/03/2023. So we are checking how can we use the data pipelines from AWS CLI commands. Please can you let me know what AWS CLI command can be used to check the error stack trace of a pipeline with status FAILED.I have checked https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-troubleshoot-locate-errors.html where the steps are described for checking error from AWS console.I have also checked https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-error-logs.html but from the pipelineLogUri we can only receive the Activity log but not the error stack trace.Please help.FollowComment"

Answer: "0The Data Pipeline CLI documentation is here - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/index.html.  That should provide commands for all Data Pipeline API calls, including what you're after.CommentShareEXPERTskinsmananswered 3 months agorePost-User-5041732 3 months agoThank you for the documentation link. I was checking the commands in this documentation but I could not find a command to retrieve the error stack trace. Are you referring to any specific command?Share"


Question: How to validate header values in the API Gateway request before the integration

"Many customers have been trying to restrict the access to APIs on API Gateway from their CloudFront distribution only. The forms of restriction can come as:Have an allow list of IP CIDRs that Cloudfront use, but this can be bypassed if the attacker uses a proxy to reach the targetHTTP Headers, that can be validated in multiple ways as ex:Custom Authorizer that will validate the normal authentication header and any extra header that CF could includeAPI Gateway in Proxy Mode where the app will deal with the request authentication and any extra header that CF could includeMy idea is to validate the header before we hit the integration phase or even waste processing cycles to invoke a lambda function in the custom authorizer if the request didn't come from my trusted source the API Gateway will drop the request earlier.My current solution that maybe is not ideal is:Add a required header in the Method Request with something like: X-CDN-XXXXXXXXXX where XXXXXXXXXX is a hash that CloudFront inject in the origin request. The header is required and the value can be just CloudFront or if we are using this mechanism with multiple CDNs we can add the CDN name in the value.Changing the default response for Bad Parameters to stop returning the name of missing parameter as this name is sensitive now.Optional mechanism to increase the security is:Second HTTP Header with secret in another headerAdding a second header like X-CDN-KEY with the secret as value. If the request pass by the method request validation from the existence of those 2 headers the request move forward to the integration and the application will process the request.This approach can potentially reduce costs in processing, reduce latency, reduce the risks of DDOS attacks and increase scalability. But something that would make even better is to validate header values before we hit the integration (and potentially invoke a lambda function or any back-end to process the request)OpenAPI supports parameters as path, query, header, cookie and they can have schema to validate the parameters values using type, format, regular expressions and static values.But using API Gateway I didn't see how I can apply a model to a HTTP header and then validate the header value in the method request phase.Is that possible?FollowComment"

Answer: 0Accepted AnswerCheck out this blog post: https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-2/CommentShareEXPERTachrafanswered 3 years ago


Question: finding length of string in spark SQL

"Hi,I am trying to find length of string in spark sql, I tried LENGTH, length, LEN, len, char_length functions but all fail with error - ParseException: '\nmismatched input 'len' expecting <EOF>(line 9, pos 9). I have imported - from pyspark.sql.functions import * in my script.What is the actual function and what I am missing?FollowComment"

Answer: "2the problem is probably somewhere else as "length" is indeed a spark sql functionhttps://spark.apache.org/docs/latest/api/sql/#length can you please post the whole SQL statement you're trying to execute?CommentShareAlex_Tanswered a year agoEXPERTFabrizio@AWSreviewed a year agoAWS-User-6872462 a year agoI rechecked the code and found that athena syntax was left for date conversion in length function, which was causing the issue, now the query runsShare1Length is indeed a valid method, and the correct latest documentation link is here:https://spark.apache.org/docs/latest/api/python/reference/api/pyspark.sql.functions.length.htmlPlease provide a code snippet to resolve your question.CommentSharevamshi_indlaanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Remote Desktop can’t connect to the remote computer

"i have been trying to connect through remote desktop but am getting the following message, tried everything i knew to resolve it.Remote Desktop can’t connect to the remote computer for one of these reasons:Remote access to the server is not enabledThe remote computer is turned offThe remote computer is not available on the networkMake sure the remote computer is turned on and connected to the network, and that remote access is enabled.Kindly help me resolve the same at the earliest.Instance: i-0d5a6effc2f7c715fFollowComment"

Answer: "1This message means there is a network connectivity issue to your instance. We have a bunch of troubleshooting steps for this here. Please indicate what you have already done.CommentShareEXPERTPeter_Ganswered 2 years agoAWS-User-7619860 2 years agoHello i have followed most of the steps as mentioned in the document, but it does not seem to connect. Kindly help me resolve it ThanksSharePeter_G EXPERT2 years agoBit more detail please, is the instance in public/private subnet, does it have public ip, where are you connecting from, have you got onto the instance via alternative means eg ssm session manager to check remote desktop is running and windows firewall is configured correctly, is this a newly launched instance or an instance you were previously able to connect to. Do not provide any specific ip addresses or IDs in this public forumShare0In addition to the above mentioned steps, ensure the PC you are using with an RDP client is not blocking outbound port 3389. If you are on a corporate network, connected through a VPN, or outbound traffic flows through a proxy often times organizations will prevent port 3389.CommentShareJarrid_Kanswered 2 years agoDave_G a year agoas mentioned above if you are on your company/work device, please sign off of your corp vpn and / or try it from a home pc or device.  95% of the time this issue is security group/nacl or corp network issues.  next step to try would be security group changesShare0Helloi have followed most of the steps as mentioned in the document, but it does not seem to connect.Kindly help me resolve itThanksCommentShareAWS-User-7619860answered 2 years ago0Hi,There are couple of reason for the above mentioned error which you can check for the issue. I hope you have checked all steps in the documents and assuming that you have correct port and IP range in the security group, public IP address associated with the instance etc.Can you also check by attaching the ENI as a secondary network interface and assign the public IP to it. Then try to access sit from the assigned public IP. Check for the security group rule for the ENI.Thanks & RegardsRimpal JohalCommentShareRiJoanswered 2 years ago0You could try launching a Linux instance in the same subnet and connecting through ssh to rule out network issues.CommentShareEXPERTHernitoanswered 2 years ago0I have same issue how i can resolve i read all replies and followed everything not issue is stillIf possible then please amazon expert create the followup at my emailAsadaligame6272@gmail.comThank youCommentSharerePost-User-1177567answered 10 months ago"


Question: Will setting docker --storage-opt be deprecated?

"My batch jobs depend on increasing the disk space available to docker by setting --storage-opt in the launch template.  According to https://aws.amazon.com/premiumsupport/knowledge-center/increase-default-ecs-docker-limit this setting actually only applies to Amazon Linux 1 AMIs, which will soon be deprecated:Important: This article is applicable if you're using Amazon Linux 1 AMIs to launch container instances in your ECS cluster. Amazon Linux 2 AMIs use the Docker overlay2 storage driver, which gives you a base storage size of the space left on your disk. Amazon Linux 1 will no longer be supported after December 31, 2020.I guess this means I am using a v1 AMI; how then do I select a v2 AMI?  I have never manually selected an AMI, I always use the defaults; in which case I am surprised that a soon-to-be-deprecated AMI is still the default.FollowComment"

Answer: "0It seems the reason this is occurring is because M4 instances use an Amazon Linux 1 AMI by default.  It is possible to set the AMI to a v2 AMI in the Batch compute environment setup -- you need to look up the specific AMI for your region though.It seems some instance types automatically pick a v2 AMI by default; hopefully this will be the case for M4 instances in the future as well.CommentShare4TufZBanswered 3 years ago0note that with the recent support for AL2, you don't need to look it up anymore - just specify AL2CommentShareAWS-User-3176245answered 3 years ago"


Question: AWS WAF efficient rule for allowing specific IPs and Countries  for specific URLs

I want to allow abc.example.com/* in a specific country  xyz what will be best rule for it ?what will be rule in case to allow only specific ips to acces abc.example.com?FollowComment

Answer: "0You could accomplish this via rules in a Web ACL in AWS WAF.A geomatching rule like this:Action": {    "Block": {}    "Statement": {       "NotStatement": {          "Statement": {"GeoMatchStatement": {          "CountryCodes": [            "CA"                      ]        }in your Web ACL would block all traffic except traffic originating in Canada.You can also restrict access to an approved group of IP addresses by creating a list of  addresses in WAF, and then creating a rule in the Web ACL to allow only those IP addresses.CommentSharejwesleyanswered a year agoAWS-User-0338648 a year agoGood , but I want to knowe.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URLShareAWS-User-0338648 a year agoGood , but I want to knowe.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URLShare0You need to write a string match or regex match rule that looks at host header field AND put another condition to look for the country you want to allow. You may want to set web ACL default action to block as well.Might want to look at this as well https://www.youtube.com/watch?v=ll-uvVgQ3Jg (skip to 50%){  "Name": "test-rule",  "Priority": 0,  "Action": {    "Allow": {}  },  "VisibilityConfig": {    "SampledRequestsEnabled": true,    "CloudWatchMetricsEnabled": true,    "MetricName": "test-rule"  },  "Statement": {    "AndStatement": {      "Statements": [        {          "ByteMatchStatement": {            "FieldToMatch": {              "SingleHeader": {                "Name": "Host"              }            },            "PositionalConstraint": "STARTS_WITH",            "SearchString": "abc.example.com",            "TextTransformations": [              {                "Type": "LOWERCASE",                "Priority": 0              }            ]          }        },        {          "GeoMatchStatement": {            "CountryCodes": [              "US"            ]          }        }      ]    }  }}CommentSharekumo-hiyorianswered a year agoAWS-User-0338648 a year agoThanks @Kumo-Hiyori for a reply,I try the above rule with country statement and without country statement, but it doesn't work.I don't know what's the reason behindButThen I try  single statement rule  looking for single header host starts with abc.example.com and block all trafficbut it still allows , I don't know why ,Any solution?Share"


Question: Cannot find a valid baseurl for repo: amzn2-core/2/x86_64

"Hello,I have an amazon linux 2 instance sitting within a VPC that has a gateway endpoint attached to it.When trying to run yum commands, I get a 403 forbidden error "Cannot find a valid baseurl for repo: amzn2-core/2/x86_64".I've read this can be caused by the requested repository sitting within an S3 bucket, which is blocked by the gateway endpoint.I've whitelisted arn:aws:s3:::repo.us-east-1.amazonaws.com on my gateway endpoint, but this has not worked.Does anyone know how I can solve this issue?Thank you,Ryan MEdited by: RyanM1234 on Mar 19, 2021 2:30 PMEdited by: RyanM1234 on Mar 19, 2021 2:31 PMFollowComment"

Answer: "1Hello.Check your outbound rules in the security group you have chosen for your instance.In my case I'm allowing all traffic.CommentSharermmcostaanswered 5 months agoDennisAdams 4 months agoAllowing all outgoing ports on the security solves this for me.Share0Had the same error. Possible network issue.I found this on stack Overflow and it worked for me:To solve this, adding a valid nameserver into resolv.conf (use sudo if you are not root user)$ echo nameserver 8.8.8.8 > /etc/resolv.confCommentSharekk2021answered 2 years ago0I had exactly the same problem today and the way I fixed it was to go to the Sydney region, where it worked (sudo yum update -y). However, if you are using t4g instance types, you may need to go to somewhere like Tokyo. Once there, you can run the updates, create an Amazon Machine Image and then copy that back to where you need it. Be aware though that when you transfer the image over the network, you may incur charges.CommentShareKevin Foulgeranswered 8 months ago0I'm came here for the same problem...I had the same problem but for my deployment I am using terraform in different regions like: sa-east 1, us-east-1 and 2 and us-west-1 and 2.I saw rmmcosta's answer, it got me thinking and looking at my hashcode... and . . . explode!!Dude, in my code in resource aws_security_group I left only port 22 externally accessible by tcp protocol on ingress and all ports on egress but only tcp protocol. Did means my instances cannot browse on the web or find any types URLs.RESUME:Change egrees rules maitaning all ports and put all protocols (tcp and udp) and allowing all traffic to browse and find urls, ping and repos.resource "aws_security_group" "allow-vpc-master" {name = "allow-vpc-master01"  vpc_id = aws_vpc.vpc-master01.id  ingress {    description = "Libera porta 22"    from_port   = "22"    to_port     = "22"    protocol    = "tcp"    cidr_blocks = "0.0.0.0/0"  }  egress {    from_port   = "0"    to_port     = "0"    protocol    = "-1"    cidr_blocks = "0.0.0.0/0"  }  CommentShareEtoreGaroneanswered 3 months ago"


Question: Cookie based routing on CloudFront

"Hello All!I'm trying to route traffic based on a cookie with a Lambda function. But getting  this error message when I test it and I couldn't figured out why. I would be glad if anyone can point me to right direction.ERRORInvoke Error {"errorType":"TypeError","errorMessage":"Cannot read properties of undefined (reading 's3')","stack":["TypeError: Cannot read properties of undefined (reading 's3')","    at Runtime.exports.handler (/var/task/index.js:16:32)","    at Runtime.handleOnce (file:///var/runtime/index.mjs:548:29)"]}or it says "Cannot read properties of undefined (reading 'custom')" when I send another cookie value.My code is this and using runtime Node.Js 16.x'use strict';exports.handler = (event, context, callback) => {    const request = event.Records[0].cf.request;    //Setup the two different origins    const originA = '<s3 origin url>';    const originB = '<load balancer url>';//check v2=true cookie if exists    if (request.headers.cookie) {        for (let i = 0; i < request.headers.cookie.length; i++) {            if (request.headers.cookie[i].value === 'v2=true') {                console.log('Origin A cookie found');                request.headers['host'] = [{key: 'host', value: originA}];                request.origin.s3.domainName = originA;                break;            }             else {                console.log('Origin B cookie found');                request.headers['host'] = [{key: 'host', value: originB}];                request.origin.custom.domainName = originB;                break;            }        }    }            callback(null, request);};I am testing it with the below code.{  "Records": [    {      "cf": {        "config": {          "distributionId": "<my distrubitonid>"        },        "request": {          "uri": "/",          "method": "GET",          "clientIp": "<my ip>",          "headers": {            "cookie": [              {                "key": "Cookie",                "value": "v2=true"              }            ]          }        }      }    }  ]}FollowComment"

Answer: "0I believe the issue is that request.origin is never defined, so the following lines are going to fail as undefined.request.origin.s3.domainName = originA;request.origin.custom.domainName = originB;To quickly test this, add an empty request.origin object in your test object. It should pass.The fix is to define request.origin. You could do something like the following right after your const request variable definition.let request.originCommentShareJeremyAWSanswered 10 months agoYavuzhan 10 months agoI have followed these guides but they don't define request.origin, they define request and do origin = request.origin or just simply use request.origin instead of origin variable.https://aws.amazon.com/tr/blogs/networking-and-content-delivery/dynamically-route-viewer-requests-to-any-origin-using-lambdaedge/https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.htmlI am going to try define request.origin fields for two origins.Share"


Question: Need to change instance family in aws ec2 savings plan or change the plan

"Hi, I purchased an ec2 savings plan for aws region and a1 instance family type. When I try to create an instance of a1 type in a particular zone a of that region it is not allowing me to create any instance.  I want to create instance only in that zone otherwise I want to change instance family in current plan or change the savings plan itself.FollowComment"

Answer: 0Raise a support case with AWS as soon as possible to ask for a change to your plan.  If you've only just purchased the plan there's a good chance AWS will agree though they're not obliged to.CommentShareEXPERTskinsmananswered 2 months ago


Question: What should be suggested way to do object classification in a streamed video using pre-trained model with custom label?

"Hello Everyone,I'm trying to create new model or with the help of pre-trained model for classification which can support video streaming data.I've tried custom label in AWS Rekognition for classification but I could evaluate that model only with image data (not in a streaming mode). Is there a way to evaluate a model for object detection or classification in a streamed video data?I've used AWS kinesis video stream to stream my laptop cam to AWS kinesis video stream. When I try to integrate Kinesis video stream with AWS Rekognition, I understood that it supports only face detection and specific object detection like pet, person or package labels with the pre-trained model. Is my understanding correct? or is there a way to use pre-trained model for a custom labels in a video streaming data.Can anyone suggest me the better solution for this requirement?Any help would be appreciated.FollowComment"

Answer: "0Hello,It seems from your question that that Rekognition Custom Labels is what you're looking for, but the only feature that is lacking is the ability to stream video. One option is to extract images from Kinesis Video Streams (here) and pass those images to Rekognition Custom Labels.If you want to use off-the-shelf Rekognition models and directly stream video you are limited to either face detection or person, pet, package detection. Please let me know if you have anymore questions.CommentSharetranjaanswered 6 months agoGaneshkumar 6 months ago@tranja Thanks for your reply. If I'm generating images from Kinesis Video Streams and pass it to Rekognition custom labels it will work for a single image but for live video stream processing it can't handle. If this is not possible with Rekognition then Is this solution possible with Sagemaker? (like handling live video stream with the custom model to do object classification).Share"


Question: t1.micro reboots ok but can't connect

"Hello, I have a t1.micro instance i-79f03708 that I had to start and stop. It went back online ok but I can't reconnect to it, neither from the SSH client nor from the browser-based connection.Here is the error I get from the browser-based connection window:There was a problem setting up the instance connectionAn error occurred and we were unable to connect or stay connected to your instance. If this instance has just started up, try again in a minute or two.Can I regain access?FollowComment"

Answer: "0For the record. It's just painfully slow. If that happens to you, wait 10+ minutes and try again. That worked for me.CommentSharejanalijouranswered 3 years ago"


Question: AMI image issue

I'm trying to create AMI image for my EC2 instance. But getting this error ''Failed to create image from instance i-0a4f***********''. Request limit exceeded.Why is it so ? I have tried to create even after rebooting my instances.I'm getting the same error with shutdown instances too.FollowComment

Answer: 0AMIs are subject to quotas (formerly called limits). You can read more about AMI quotas at this link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-quotas.htmlCommentShareMarilynAWSanswered 6 months agorePost-User-9692824 6 months agoThank you for responding. But we are sure that we did not use 50000 quota.Share0Are you sure? I think that error just indicates that you've exceeded the request rate limit for that api:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-launch-multiple-requestlimitexceeded/CommentShareMODERATORphilawsanswered 6 months ago


Question: [API Gateway] What is the maximum size of the connection ID used in @connections commands?

"I plan to store the connection IDs used in @connections commands in DynamoDB.cf., https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.htmlI would like to know the maximum size of a connection ID for calculating the Capacity Unit of DynamoDB.Is there a specification for the maximum size of Connection IDs?FollowComment"


Question: Move Cognito user pool to another account?

"Problem: I created cognito user pools for staging and production under the same root AWS account. I need to move them to separate accounts for security purposes.I know that AWS doesn't have great support for transferring resources between accounts, but I think a case can be made for Cognito user pools. I would happily create a new pool in the new account and write a script to create the user accounts in the new pool using the emails from the old pool, but there are two problemsAWS doesn't allow exporting password hashesAWS doesn't export 2FA tokensSo there's no way for existing users to log in to the new pool.If you google for people who faced this problem, they come up with hacky solutions like signing in users to the old pool, then triggering a signup on the new pool, and forcing a password reset. Obviously this solution is not acceptable since I don't want to force my users to reset their passwords + users with 2FA enabled now have to re-enable it!Another problem: this "solution" depends on the user to come back to your site and log in. I don't want to have to wait months/years for this transition to happen. I want to be able to move my pools freely.Please AWS give us a solution.FollowComment"

Answer: "0Unfortunately, looks like there is no solution to both issues you state here.If you can allow a long "lazy" migration, you have to use a custom UI, redirect customers to another pool using Lambda Trigger migration.https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-import-using-lambda.htmlIf you want to save time and use a bulk migration you lose the passwords and 2FA tokens.https://aws.amazon.com/solutions/implementations/cognito-user-profiles-export-reference-architectureCommentShareawskostaanswered 9 months ago"


Question: How to filter a DynamoDB Scan in a StepFunction?

"Trying to perform a DynamoDB scan and Filter in a Step Function, but the filter matches no items.My Task is;"Scan (2)": {      "Type": "Task",      "Parameters": {        "TableName": "Users",        "FilterExpression": "#Scope = :Global",        "ExpressionAttributeValues": {          ":Global": {            "S": "Global"          }        },        "ExpressionAttributeNames": {          "#Scope": {            "S": "Scope"          }        }      },      "Resource": "arn:aws:states:::aws-sdk:dynamodb:scan",      "Next": "Pass"    },the task runs successfully and produces the following output;{  "Count": 0,  "Items": [],  "ScannedCount": 4}Whereas this task, running a Scan (without a Filter) against the same table;{  "Type": "Task",  "Parameters": {    "TableName": "Users"  },  "Resource": "arn:aws:states:::aws-sdk:dynamodb:scan",,  "Next": "Scan (2)"}Produces this output;{  "Count": 4,  "Items": [       {      "Scope": {        "S": "Global"      },      "ServiceName": {        "S": "Driver"      },      "lastVisitDateTime": {        "N": "1680022000"      }    },      {      "Scope": {        "S": "us-east-1"      },      "ServiceName": {        "S": "Driver"      },      "lastVisitDateTime": {        "N": "1680022106"      }    },      {      "Scope": {        "S": "Global"      },      "ServiceName": {        "S": "Rider"      },      "lastVisitDateTime": {        "N": "1680022106"      }    },      {      "Scope": {        "S": "Global"      },      "ServiceName": {        "S": "Driver"      },      "lastVisitDateTime": {        "N": "1680022200"      }    }  ],  "ScannedCount": 4}FollowCommentskinsman EXPERT2 months agoYour output with the 4 items looks incomplete - there are more "}" than "{".  Were bits removed?  Hard to see what's going on.ShareDB 2 months agoOh shoot, that was an editing error.   I have a Partner name field, which I cannot expose so when I pulled that out I mistakenly removed the leading opening "{".    I just edited the question and made sure the response json is valid now.   Sorry for the confusion.Share"

Answer: "1Accepted AnswerYour expression should look like the following:        "FilterExpression": "#Scope = :Global",        "ExpressionAttributeValues": {          ":Global": {            "S": "Global"          }        },        "ExpressionAttributeNames": {          "#Scope": "Scope"        }However, its important to not how in-efficient your Scan is. Its not scalable, and as a result will become expensive and slow over time. It would be much more efficient to create a Global Secondary Index for Scope which will allow you to use a Query which is more efficient in both performance and cost over Scan.CommentShareEXPERTLeeroy Hannigananswered 2 months agoskinsman EXPERT2 months agoThere's an echo in here! ;)ShareDB 2 months agoThank you, I completely missed that I mistakenly included the data type for ExpressionAttributeNamesShare1I'm way out of practice with filter expressions but I think it should be something like:        "FilterExpression": "#Scope = :Global",        "ExpressionAttributeValues": {          ":Global": {            "S": "Global"          }        },        "ExpressionAttributeNames": {          "#Scope": "Scope"        }CommentShareEXPERTskinsmananswered 2 months ago"


Question: Trying to understand routes in routes table

I am trying to understand what else I can add to custom route table that I have created for my VPC other than the local route and the internet gateway route (that enable internet traffic to the IGW). I have thought routes are the place to connect the public subnets to the internet gateway. But when I try to do that it gave me an error. So I am looking for an explanation for what I can do with routes in a route table ( I think I am confused with routes in a route table and subnet association in the route table). If somebody can explain this to me would be really grateful.Thanks.FollowCommentMiguelUT 7 months agoCan you provide an example of your inputs and what error you're getting when you try to configure your route table to route to the IGW?  Because this is absolutely the place where you create a route from a subnet to the IGW (thus making it a public subnet).Share

Answer: "0It sounds like what you are describing is one of the primary use cases for route tables (i.e. creating a route with destination 0.0.0.0/0 and target IGW to make a subnet public).  I'd be curious to know what error your are getting (and at what point in the process) when you try to do that.  If you want more examples of common types of routes that are configured in a route table there is a page in the Virtual Private Cloud documentation with Example routing options you might find useful.CommentShareMiguelUTanswered 7 months agouspa19 7 months agoThanks for your response, MiguelUT. I have two public subnets in my VPC. And when I was trying to add the CIDR blocks of the two subnets into the routes table as routes (public subnet CIDR block as Destination and internet gateway as the Target, thinking I need to connect the subnet to IGW to make the internet traffic flow to my subnets) I received the following error, "The destination CIDR block is equal to or more specific than one of this VPC's CIDR blocks. This route can target only an interface or an instance.". This is where I thought that my thinking what routes in a route table are wrong, hence seeking an explanation from the community to correct my misunderstanding on routes in routes table.UPDATE: In the AWS docs, in this URL, https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html, for routes table, its says, "You can add a route to your route tables that is more specific than the local route. The destination must match the entire IPv4 or IPv6 CIDR block of a subnet in your VPC. The target must be a NAT gateway, network interface, or Gateway Load Balancer endpoint."I think this what I took wrong, thinking that I can add subnet CIDR as routes.ShareMiguelUT 7 months agoIf you're trying to route out to the internet then you need to route the 0.0.0.0/0 traffic to the IGW -- that's basically saying any traffic not destined for the subnet (or I guess technically any traffic NOT specifically subject to another route in the table) should go to the internet.Share"


Question: Cannot install OpenSSH server on Windows_Server-2022-English-Full-Base-2022.10.27

"Hello,I tried to find a way to report an issue concerning the following Amazon AMI (Windows_Server-2022-English-Full-Base-2022.10.27 - ami-017cdd6dc706848b2).I cannot install the OpenSSH server feature either programmatically or manually.I have to go back to the 2022.10.12 AMI or run Windows Update to get the latest cumulative KB.Let me know where I can report it.Thanks.FollowComment"


Question: How do you replace an SSL Certificate that was already on an elastic load balancer?

"I have an SSL certificate that has now expired. It was set up on a elastic load balancer. I simply want to reinstall my renewed SSL certificate. Everything im being told is about how to create a new ELB through the VPC. But all of that is already there.  Am I creating a new one? Do I delete the old one?  I tried to install the SSL through the E2C, but that was wrong as I was told I have an ELB and have to do it through the VPC. Now my app and system has stopped because it needs the secure server. I cannot get a straight answer. only how to create a new one from a classic bl.  It seems like a 3 minute fix is taking days.FollowComment"

Answer: "0Hi There,I understand that you want to replace an expired SSL Certificate that was already on an elastic load balancer.If this is correct then you can change the certificate for the HTTPS listener.To replace the certificate using the console [1] :1- Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.2- On the navigation pane, under LOAD BALANCING, choose Load Balancers.3- Select the load balancer and choose Listeners.4- Select the check box for the listener and choose Edit.5- For Default SSL certificate, do one of the following:* If you created or imported a certificate using AWS Certificate Manager, choose From ACM and choose the certificate.* If you uploaded a certificate using IAM, choose From IAM and choose the certificate.6- Choose UpdatePlease note that you can also replace the certificate using the AWS CLI [1] :by using the modify-listener [2] command.I hope the information above is helpful.===== references =====[1] Replace the default certificate : https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-certificates.html#replace-default-certificate[2] modify-listener : https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-listener.htmlCommentShareMfaneloanswered a year agorePost-User-8241326 a year agoThe certificate has already been replaced through that process. When I go to the website, it is still reporting that it is not secure. I was told that the certificate cannot be changed in the E2C (the space you said) for it to work, but has to be done through an ELB (which it already has). And I get to that area through the VPC.  When I go to the VPC I have all of the subnets and everything already created.  Something is still directing traffic to the old cert. So I was told that I needs to be configured in the ELB. But my question is am I creating a NEW ELB or is there a way to use the existing one I have?  I don't want to create a new one and mess something up. but if I need to create a new one with new subnets and all that, then I will. And after I do that, I assume I delete the old one so there are no issues later?Its a matter of the public IP vs the private IP apparently.ShareMfanelo a year agoHi there,No, you do not need to create a new ELB, you can use the one you have been using as mentioned above, you only need to edit your listeners and select your new certificate from there, please note that you would need to Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/. to do this and follow the steps [1].You can also troubleshoot your SSL Certificate installation problems on your server including verifying that the correct certificate is installed, valid, and properly trusted by using a commonly used third-party website [2].Reference:[1] Replace the expired certificate : https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-certificates.html#replace-default-certificate[2] https://www.sslshopper.com/ssl-checker.htmlShareMfanelo a year agoHi There,Were you able to identify the issue using https://www.sslshopper.com/ssl-checker.html ?Please note that you do not need to send your personal details as this is a public platform but feel free to share with me what error you are getting if any at all in order to resolve the issue you are getting.Share"


Question: botocore BUG when using DAX client?

"Hi, I am using the DAX Python client as below and I eventually use batch_write_item as below.session = botocore.session.get_session()dax_hook = amazondax.AmazonDaxClient(session, region_name="us-east-1", endpoints=[endpoint])...with concurrent.futures.ThreadPoolExecutor(    max_workers=MAX_WORKERS    ) as executor:        for items_data_batch in items_data:            executor.submit(write_batch, dax_hook, items_data_batch, ddb_table_name)The write_batch function essentially tries to write to the cache (and eventually table) via dax_hook.batch_write_item(RequestItems={table_name: batch}). The issue I am facing is this succeeds most of the time but sometimes I get an exception as below. If I retry the batch, with high probability this works (out of 30M keys, 175 fail after this retry; most succeed on the first try). I am not sure, how do we interpret this Exception? I pulled some of the batches that failed and reran and this also worked (on first try), so I am thinking the ValidationException does not make sense (I have a few ideas about what might be the problem but I am not sure). Is this a possible bug in the Exception logic, and another Exception should be thrown?The Exception I am getting looks like this:ERROR - An error occurred (ValidationException) when calling the  operation: Unknown parameter in RequestItems.some-table[0].PutRequest: "attr_names", must be one of: ItemFollowComment"

Answer: "0Hi there,In order to investigate this issue, could you please provide the following details:DAX Python client versionDAX cluster ARNtimestamp of the errorsCommentShareSUPPORT ENGINEERPeter_Xanswered a year ago"


Question: my website is not open www.bdmhospital.com/

"but still open https://bdmhospital.com/ on this link plz help me to solve this problemFollowCommentab 14 days agoto better answer please elaborate. Are you using Route53? How do you host your website? What are your current DNS records? What is your current certificate for HTTPS, with the alternate names SAN?Share"


Question: Trying to isolate IAM user to have AmazonEC2ReadOnlyAccess to only select instances using python boto3

"Ok so the policy arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess looks like this:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "ec2:Describe*",            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "elasticloadbalancing:Describe*",            "Resource": "*"        },        {            "Effect": "Allow",            "Action": [                "cloudwatch:ListMetrics",                "cloudwatch:GetMetricStatistics",                "cloudwatch:Describe*"            ],            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "autoscaling:Describe*",            "Resource": "*"        }    ]}This works to allow the IAM user to perform most ec2 read functions.Problem is that this is too permissive. What I need to do is allow all the same functionality as this but ONLY for certain instances. So what I attempted to do is isolate this given a list of instance ids instanceids (using python boto3):ResourceIds = [ f"arn:aws:ec2:{REGION_NAME}:{AWS_ACCOUNTID}:instance/{iid}" for iid in instanceids]Ec2ReadOnlyPolicy = {    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "ec2:Describe*",            "Resource": ResourceIds        },        {            "Effect": "Allow",            "Action": "elasticloadbalancing:Describe*",            "Resource": ResourceIds        },        {            "Effect": "Allow",            "Action": [                "cloudwatch:ListMetrics",                "cloudwatch:GetMetricStatistics",                "cloudwatch:Describe*"            ],            "Resource": ResourceIds        },        {            "Effect": "Allow",            "Action": "autoscaling:Describe*",            "Resource": ResourceIds        }    ]}response = iam_client.put_group_policy(    PolicyDocument=json.dumps(Ec2ReadOnlyPolicy),    PolicyName=EC2_RO_POLICY_NAME,    GroupName=UserGroupName,)Problem is that this doesn't seem to allow the user to list instances they have access to:$ aws ec2 describe-instancesAn error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.What am I doing wrong?FollowComment"

Answer: "2Accepted AnswerHi!Good question.  When crafting IAM Policies, keep in mind that some actions do not support resource-level permissions.  If those do not support resource-level permissions, you must specify all resources ("*") in the Resource element of the policy for it to work.You can determine if actions support resource-level permissions by the actions page (example below).  If there are no values in the Resource types column, that means it does not support resource-level permissions.In your case with DescribeInstances, that action does not support resource-level permissions and must come with all resources specified.What you can do is separate out the actions that do not support resource-level permissions into 1 block and the ones that do into another block to achieve more granular IAM policies like you're trying to do above.https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.htmlCommentSharejsoncanswered a year agochrisjd20 a year agoAwesome thanks so much for that I had no clue. Ill give that a try real fast and let you know how that goes.Share1You could also limit access based on tags instead of instance IDs. As an example, below statement gives access to all resources where resource either doesn't have "owner" -tag OR "owner" -tag has the same value as pricipals (=IAM user or role) "owner" -tag has. Untagged resources are accessible for everyone using this policy, but once "owner" tag is attached, only the user (or role) with the same owner -tag value can modify it (including changening the tag).          - Sid: 'AllowUnlessOwnedBySomeoneElse'            Effect: Allow             Action: '*'            Resource: '*'            Condition:              StringEqualsIfExists:                'aws:RequestTag/owner': ${aws:PrincipalTag/owner}                'aws:ResourceTag/owner': ${aws:PrincipalTag/owner}You can then limit Actions same way you did to EC2s etc. There are also other variables you can use in place of aws:PrincipalTag.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.htmlAbove statement is part of longer story how you can isolate multiple teams working on single account, and yet allow them to create their own IAM policies. https://carriagereturn.nl/aws/iam/policy/boundary/2021/10/07/iambound.htmlCommentShareKalluanswered a year agochrisjd20 a year agoOh dang that looks really promising. Ill give it a try. If this works, it would really help me isolate this even further.Share"


Question: EMR studio workspace error using pySpark

"Hi,I have a workspace that successfully attaches to a EMR (Spark cluster with applications = ["Spark", "JupyterEnterpriseGateway"] ) cluster. But when i run any commands from the notebook, i get errors likefrom pyspark.sql import SparkSessionreturns:The code failed because of a fatal error:Session 0 unexpectedly reached final status 'dead'. See logs:stdout: stderr: 23/05/22 12:35:03 WARN NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java classes where applicable23/05/22 12:35:05 INFO DefaultNoHARMFailoverProxyProvider: Connecting to ResourceManager at ip-10-1-0-235.eu-west-2.compute.internal/10.1.0.235:803223/05/22 12:35:07 INFO Configuration: resource-types.xml not found23/05/22 12:35:07 INFO ResourceUtils: Unable to find 'resource-types.xml'.23/05/22 12:35:07 INFO Client: Verifying our application has not requested more than the maximum memory capability of the cluster (1792 MB per container)Exception in thread "main" java.lang.IllegalArgumentException: Required AM memory (1494+384 MB) is above the max threshold (1792 MB) of this cluster! Please check the values of 'yarn.scheduler.maximum-allocation-mb' and/or 'yarn.nodemanager.resource.memory-mb'.at org.apache.spark.deploy.yarn.Client.verifyClusterResources(Client.scala:431)at org.apache.spark.deploy.yarn.Client.submitApplication(Client.scala:218)at org.apache.spark.deploy.yarn.Client.run(Client.scala:1339)at org.apache.spark.deploy.yarn.YarnClusterApplication.start(Client.scala:1776)at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:1006)at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:180)at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:203)at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:90)at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:1095)at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:1104)at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)23/05/22 12:35:07 INFO ShutdownHookManager: Shutdown hook called23/05/22 12:35:07 INFO ShutdownHookManager: Deleting directory /mnt/tmp/spark-5661aa05-db9f-493a-bb39-3b7ce9906c5bYARN Diagnostics: spark-submit start failed.Some things to try:a) Make sure Spark has enough available resources for Jupyter to create a Spark context.b) Contact your Jupyter administrator to make sure the Spark magics library is configured correctly.c) Restart the kernel.FollowComment"

Answer: "0Scaled up a bigger master and and core instance group size to get that bit working! Still get errors on different things that id except to work.example:The AWS spark example code:df = spark.read.parquet('s3://amazon-reviews-pds/parquet/product_category=Books/*.parquet')I get error:---------------------------------------------------------------------------KeyboardInterrupt                         Traceback (most recent call last)/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/command.py in execute(self, session)     60             statement_id = response["id"]---> 61             output = self._get_statement_output(session, statement_id)     62         except KeyboardInterrupt as e:/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/command.py in _get_statement_output(self, session, statement_id)    133                 progress.value = statement.get("progress", 0.0)--> 134                 session.sleep(retries)    135                 retries += 1/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/livysession.py in sleep(self, retries)    362     def sleep(self, retries):--> 363         sleep(self._policy.seconds_to_sleep(retries))    364 KeyboardInterrupt: During handling of the above exception, another exception occurred:LivyClientTimeoutException                Traceback (most recent call last)/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/command.py in execute(self, session)     77                     )---> 78                     session.wait_for_idle()     79             except:/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/livysession.py in wait_for_idle(self, seconds_to_wait)    336                 self.logger.error(error)--> 337                 raise LivyClientTimeoutException(error)    338 LivyClientTimeoutException: Session 0 did not reach idle status in time. Current status is busy.During handling of the above exception, another exception occurred:SparkStatementCancellationFailedException Traceback (most recent call last)<ipython-input-9-8c1806c06a24> in <module>----> 1 get_ipython().run_cell_magic('spark', '', "df = spark.read.parquet('s3://amazon-reviews-pds/parquet/product_category=Books/*.parquet')\n")/mnt/notebook-env/lib/python3.7/site-packages/IPython/core/interactiveshell.py in run_cell_magic(self, magic_name, line, cell)   2417             with self.builtin_trap:   2418                 args = (magic_arg_s, cell)-> 2419                 result = fn(*args, **kwargs)   2420             return result   2421 /mnt/notebook-env/lib/python3.7/site-packages/decorator.py in fun(*args, **kw)    230             if not kwsyntax:    231                 args, kw = fix(args, kw, sig)--> 232             return caller(func, *(extras + args), **kw)    233     fun.__name__ = func.__name__    234     fun.__doc__ = func.__doc__/mnt/notebook-env/lib/python3.7/site-packages/IPython/core/magic.py in <lambda>(f, *a, **k)    185     # but it's overkill for just that one bit of state.    186     def magic_deco(arg):--> 187         call = lambda f, *a, **k: f(*a, **k)    188     189         if callable(arg):/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/exceptions.py in wrapped(self, *args, **kwargs)    163     def wrapped(self, *args, **kwargs):    164         try:--> 165             out = f(self, *args, **kwargs)    166         except Exception as err:    167             if conf.all_errors_are_fatal():/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/exceptions.py in wrapped(self, *args, **kwargs)    124     def wrapped(self, *args, **kwargs):    125         try:--> 126             out = f(self, *args, **kwargs)    127         except exceptions_to_handle as err:    128             if conf.all_errors_are_fatal():/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/kernels/kernelmagics.py in spark(self, line, cell, local_ns)    483             args.samplefraction,    484             None,--> 485             coerce,    486         )    487 /mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/magics/sparkmagicsbase.py in execute_spark(self, cell, output_var, samplemethod, maxrows, samplefraction, session_name, coerce, output_handler, cell_kind)    128     129         (success, out, mimetype) = self.spark_controller.run_command(--> 130             Command(cell, None, cell_kind), session_name    131         )    132         if not success:/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/sparkcontroller.py in run_command(self, command, client_name)     39     def run_command(self, command, client_name=None):     40         session_to_use = self.get_session_by_name_or_default(client_name)---> 41         return command.execute(session_to_use)     42      43     def run_sqlquery(self, sqlquery, client_name=None):/mnt/notebook-env/lib/python3.7/site-packages/sparkmagic/livyclientlib/command.py in execute(self, session)     79             except:     80                 raise SparkStatementCancellationFailedException(---> 81                     COMMAND_CANCELLATION_FAILED_MSG     82                 )     83             else:SparkStatementCancellationFailedException: Interrupted by user but Livy failed to cancel the Spark statement. The Livy session might have become unusable.But i can run all the steps of the AWS example word-count-woth-pyspark...Running boto3 never seems to end either:example :s3 = boto3.client('s3')response = s3.list_buckets()# Output the bucket namesprint('Existing buckets:')for bucket in response['Buckets']:    print(f'  {bucket["Name"]}')I get an orange field in notebook and no response ever comes.  soon as i press run it gives me a Last executed at but thats it.. never finishesCommentShareAWS-User-9621341answered 13 days ago"


Question: "Elastic Beanstalk, Unable to assume role "arn:aws:iam::xxxxxxx:role/aws-elasticbeanstalk-service-role". Verify that the role exists and is configured correctly."

"One of My Beanstalk environment started to be in sever/degraded status and showing me the errorUnable to assume role "arn:aws:iam::xxxxxx:role/aws-elasticbeanstalk-service-role". Verify that the role exists and is configured correctly.Upon checking, there is nothing changed in this service role, and all my other EB enviornment using this service role works fine. The service role has two managed policis (AWSElasticBeanstalkEnhancedHealth & AWSElasticBeanstalkService) attached with proper trust relashionship setup as below. I also confirmed my USER IAM policy is Admin, which give access to do anything (including assume/pass roles). What else can be causing this error? How do I fix it{     "Version": "2012-10-17",     "Statement": [         {             "Sid": "",             "Effect": "Allow",             "Principal": {                 "Service": "elasticbeanstalk.amazonaws.com"             },             "Action": "sts:AssumeRole",             "Condition": {                 "StringEquals": {                     "sts:ExternalId": "elasticbeanstalk"                 }             }         }     ] }FollowComment"

Answer: "0Hi,From the case notes I understand that you are getting the error Unable to assume role "arn:aws:iam::xxxxxx:role/aws-elasticbeanstalk-service-role", in your elastic beanstalk environment.Per the Elastic Beanstalk documentation the trust policy that you have for your service role is correct. I am attaching the following documentation for that here (1). After testing I was not able to replicate this issue in my account as Elastic Beanstalk was successfully able to assume the service role with this trust policy.  Based off of this I would recommend opening a case with AWS support in order to allow a support engineer to better troubleshoot the issue.I hope you have a great rest of your day!References(1) https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html#iam-servicerole-consoleCommentShareSUPPORT ENGINEERPatrick_Vanswered a year ago"


Question: Please refer to the editor log file

"HelloI can not start a project it says (Game can not be initialized, please refer to the editor log file)please can you help me, this are my log.file i guess 5058-editor.txt|attachment (61 KB)editor.txtFollowComment"

Answer: "0Accepted AnswerHey @REDACTEDUSERSorry for the troubles — let me get you some answers from our team on this issue :)CommentSharerePost-User-5738838answered 6 years ago0Hi @REDACTEDUSERThank you for the answerREMOVEDUPLOADscreenshot-2.pngI ok step-by-stepI install the lamberyard engien.install visual 2015 C++install all SDKsinstall autodeskrun Projekt Configurator, create a new projekt and set it to default and then enable all the gems what i need or use.waiting untile jops are done then start the editor and then the error massage apears.CommentSharerePost-User-6002047answered 6 years ago0Thank you !!CommentSharerePost-User-6002047answered 6 years ago0Hi @REDACTEDUSERCould you give me some more details? Are you running your project from the cmd line, and if so, what is the command you are executing? How are you starting the project - what editor buttons or commands are you using? Would you mind providing a step-by-step? I'm taking a look at the log file and will see if I can get some answers back for you!CommentSharerePost-User-3342048answered 6 years ago0still have the error.CommentSharerePost-User-6002047answered 6 years ago0Hi @REDACTEDUSERAre you able to get the engine to run? Because you are creating a new project, you will need to compile the game code. Here's a detailed guide for this:http://docs.aws.amazon.com/lumberyard/latest/userguide/configurator-projects.htmlWith the specific information for compiling the game code here:http://docs.aws.amazon.com/lumberyard/latest/userguide/game-build-game-code.htmlThe basic idea is that Lumberyard allows you to do both C++ and Lua development, which means that the game code for the project needs to be compiled (you do not need to compile the whole engine, which takes longer - I noticed you have that option checked in your setup screenshot).Let me know if this helps!CommentSharerePost-User-3342048answered 6 years ago0Hi @REDACTEDUSERIs that with the compiled game code from the answer below?CommentSharerePost-User-3342048answered 6 years ago0Hi @REDACTEDUSERI reinstalled everything and got still the same report. Game can not be initialized, please refer to the editor log file.5038-editor.txt|attachment (124 KB)editor.txtCommentSharerePost-User-6002047answered 6 years ago0@REDACTEDUSERCommentSharerePost-User-3725558answered 6 years ago0Hi @REDACTEDUSERFirst thank you for the answer's and sorry for the troublePut it still don't worke i runed the "lmbr_waf.bat" in the windows comandline it was all sucessfully. I followed your step 1 and step 2 and 3 put i get the same report again.It it is just awful.let me know what you think i can do to make it runThank youCommentSharerePost-User-6002047answered 6 years ago0Hi @REDACTEDUSERI'm really sorry to hear this and no worry about the trouble, that's why we are here!I might suggest at this point that you try using 1.10, as it just launched the other day, and that new version might work better for you.I'll let you know as I determine other steps to try!CommentSharerePost-User-3342048answered 6 years ago0Hi @REDACTEDUSERNe version new try put get same report again put its a diffrend log file 5030-waf-configure.txt|attachment (1.42 KB)waf-configure.txtCommentSharerePost-User-6002047answered 6 years ago0Hi @Andrae,Doesthe editor run for you? If the editor runs and you are creating a new project in the project configurator, there is a step beyond the installation of the engine, which is compiling the game code either through the command line or through a program like Visual Studio. When you run lmbr_waf configure with a new project it should generate a Visual Studio solution like the lumberyard engine, which you can compileto get your project to work. You can also verify that the engine is set to use the right project by typing                                 mbr projects set-active *MyNewProject*inthe command line in the LmbrSetup directory (MyNewProject would be replaced by your actual new project name - check out the links above fora step-by-step). Let me know if this helps!CommentSharerePost-User-3342048answered 6 years ago0Hi @ChronosI thought if you whant you can take a look with teamview if you have tome time for itCommentSharerePost-User-6002047answered 6 years ago0Hi @Andrae and @cclements1384,Inresponse to your point cclements, it is entirely possible that it is something else. I actually just went through the whole process last night on a new machine and encountered the same issue. I resolved it bychecking the following things (I use Visual Studio 2015):Makesure you have compiled the "game" (or project) itself (not the engine -it will be a project in the VS solution that contains lumberyard - you can build the 'game' directory there by right clicking on game and choosing build). I know that you are aware of this step, but I just want to verify that this step is done for clarity, because setting a newproject as default does not compile the code or allow the editor to run. A new project set as default must first be compiled via Visual Studio or the command line - launching the editor from Setup Assistant without compiling first will cause the process to fail.Verify that Visual Studio has all the libraries and updates it needs - this isn't specifically a lumberyard issue, but VS2015 does not install all C++ libs by default, and is sometimes resistant to doing so! It took several attempts (going to Add/Remove programs->Visual Studio 2015->Modify->Programming Languages->Visual C++. You'll at least need "Common Tools for Visual C++ 2015" and "Microsoft Foundation Classes for C++", but you wish to just check everything and make sure itis installed (again, this took several tries for some reason). Withoutthese libs, the game won't compile and the editor won't launch correctly.Launch the editor from SetupAssistant. I say this because there are multiple ways to launch the editor, and dependingon your setup/installation, you may be trying to launch a version tied to VS2013, which will also fail.Let me know if these steps help resolve your issue.CommentSharerePost-User-3342048answered 6 years ago0Hi @Andrae,Accordingto your log, it looks like there is something out of sync between your project creation and everything else. I would verify that your startingfolder in bootstrap.cfg (in the dev folder) matches your project (it should be marked as the default project in project configurator), and your user-settings should show that your project Andra_01 is enabled. If either of those does not show Andra_01, your project will not start! Let me know if this helps!CommentSharerePost-User-3342048answered 6 years ago"


Question: Will DynamoDB global tables be available soon in Paris/eu-west-3 region

"We currently use DynamoDB global tables replication to synchronize data accross multiple regions for our Lambda functions. However this feature is missing on the Paris(eu-west-3) region which means the local instance has a separated database that needs to be manually synced. Is the Global table feature planned for the Paris region and if yes, when ?FollowComment"

Answer: "0Hi. We are always evaluating opportunities to extend global tables to new regions and appreciate your feedback, but we do not comment on releases in a public forum. I have communicated your request to the DynamoDB product team to add to the priority list. For the latest information about DynamoDB, be it releases, how to info, or good articles to read, I recommend following @DynamoDB on Twitter. https://twitter.com/dynamodbCommentShareKirk-AWSanswered 3 years ago0Seems DynamoDB global tables are now available in Paris/eu-west-3 :https://aws.amazon.com/fr/about-aws/whats-new/2020/02/dynamodb-global-tables-are-now-available-in-the-asia-pacific-mumbai-canada-central-eu-paris-and-south-america-sao-paulo-regions.CommentSharecybronicsanswered 3 years ago"


Question: Crontab entries ignored on Amazon Linux 2 instance

"I really can't figure out how one is supposed to set up periodic jobs on those instances. Should I use crontab -e? anacron? The crontab service is running, but not logging anything in journalctl except for edits through crontab -e.I tried various commands, with and without the user field, and nothing ever gets executed.Here is what I did:sudo crontab -esudo crontab -l1 * * * * echo foobar >> /tmp/cron-log 2>&1I also tried to edit /etc/crontab directly, to add this line:1 ** ** ** ** root echo foobar >> /tmp/cron-log 2>&1sudo service crond status● crond.service - Command Scheduler   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)   Active: active (running) since Sat 2019-10-05 11:35:27 UTC; 5 days ago Main PID: 3236 (crond)   CGroup: /system.slice/crond.service           └─3236 /usr/sbin/crond -njournalctl | grep -i cron | grep jobsOct 10 02:01:01 ip-172-31-43-96.us-east-2.compute.internal anacron[25202]: Normal exit (0 jobs run)Oct 11 00:01:01 ip-172-31-43-96.us-east-2.compute.internal anacron[28268]: Normal exit (0 jobs run)Oct 11 01:01:01 ip-172-31-43-96.us-east-2.compute.internal anacron[31336]: Normal exit (0 jobs run)Oct 11 02:01:01 ip-172-31-43-96.us-east-2.compute.internal anacron[1942]: Normal exit (0 jobs run)journalctl |grep -i cron|tail -20Oct 11 03:35:11 ip-172-31-43-96.us-east-2.compute.internal sudo[6988]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/crontab -eOct 11 03:35:11 ip-172-31-43-96.us-east-2.compute.internal crontab[6989]: (root) BEGIN EDIT (root)Oct 11 03:35:34 ip-172-31-43-96.us-east-2.compute.internal crontab[6989]: (root) REPLACE (root)Oct 11 03:35:34 ip-172-31-43-96.us-east-2.compute.internal crontab[6989]: (root) END EDIT (root)Oct 11 03:36:01 ip-172-31-43-96.us-east-2.compute.internal crond[3236]: (root) RELOAD (/var/spool/cron/root)This is beginning to drive me crazy, any help would be appreciated!FranckEdited by: franck102 on Oct 10, 2019 9:08 PMFollowComment"

Answer: "1RandyTakeshita wrote:Hi,Was your original intention to run the command every 1 minute?If yes, your cron job should look like the following after typing crontab -e:* * * * * echo foobar >> /tmp/cron-log 2>&1Arrgh, indeed, thanks!So this finally works, after I gave up on /etc/crontab and crontab -e, and instead created my own file in /etc/cron.d.FranckCommentSharefranck102answered 4 years ago0A bit more info: the instance is using cronie; still no idea why nothing gets executed...[ec2-user@ip ~]$ sudo yum list installed | grep -i croncronie.x86_64                         1.4.11-19.amzn2                installedcronie-anacron.x86_64                 1.4.11-19.amzn2                installedcrontabs.noarch                       1.11-6.20121102git.amzn2       installed[ec2-user@ip ~]$ repoquery --list cronie.x86_64/etc/cron.d/etc/cron.d/0hourly/etc/cron.deny/etc/pam.d/crond/etc/sysconfig/crond/usr/bin/crontab/usr/lib/systemd/system/crond.service/usr/sbin/crond/usr/share/doc/cronie-1.4.11/usr/share/doc/cronie-1.4.11/AUTHORS/usr/share/doc/cronie-1.4.11/COPYING/usr/share/doc/cronie-1.4.11/ChangeLog/usr/share/doc/cronie-1.4.11/INSTALL/usr/share/doc/cronie-1.4.11/README/usr/share/man/man1/crontab.1.gz/usr/share/man/man5/crontab.5.gz/usr/share/man/man8/cron.8.gz/usr/share/man/man8/crond.8.gz/var/spool/cronIt is unclear whether cronie actually uses the /etc/crontab file, so I created a file in /etc/cron.d - still nothing executed :([ec2-user@ip cron.d]$ cat influx-updateSHELL=/bin/bashPATH=/sbin:/bin:/usr/sbin:/usr/bin1 * * * * root echo foobar >> /tmp/cron-log 2>&1Edited by: franck102 on Oct 10, 2019 9:36 PMCommentSharefranck102answered 4 years ago0Hi,Was your original intention to run the command every 1 minute?If yes, your cron job should look like the following after typing crontab -e:* * * * * echo foobar >> /tmp/cron-log 2>&1The way you currently have it setup with the "1" in the first position means that the cron job will run once every hour... i.e. 6:01am, 7:01am, 8:01am, etc...Hope this helps,-randyCommentShareRandyTakeshitaanswered 4 years ago"