Question: Change cluster parameter group

"Hi,I need to change my cluster parameter group in order to create workload queues.Will I have any downtime doing this operation?Thank you for your help.FollowComment"

Answer: "0Accepted AnswerDear Customer,You can apply dynamic properties to the database without a cluster reboot, but static properties require a cluster reboot for changes to take effect. However, if you change dynamic and static properties at the same time, then you must reboot the cluster for all the property changes to take effect. This is true whether the changed properties are dynamic or static.While dynamic properties are being applied, your cluster status is modifying. Switching between automatic WLM and manual WLM is a static change and requires a cluster reboot to take effect.You can refer to below documentation [1] stating which parameters are dynamic and which are static in nature based on the WLM(auto/manual) type.[1] Configuring Workload Management - Properties for the wlm_json_configuration Parameter  - https://docs.aws.amazon.com/redshift/latest/mgmt/workload-mgmt-config.html#wlm-json-config-propertiesWhen using manual WLM, if the timeout value is changed, the new value is applied to any query that begins running after the value is changed. If the concurrency or percent of memory to use are changed, Amazon Redshift changes to the new configuration dynamically. Thus, currently running queries aren't affected by the change. For more information, see [2][2] WLM Dynamic Memory Allocation  - https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-dynamic-memory-allocation.htmlRegards,KKEdited by: KalyanN-aws on Jan 29, 2020 8:12 PMCommentShareKalyanN-awsanswered 3 years ago0Most modifications to an existing parameter group are applied dynamically and do not require a rebootParameter group changes that require a reboot: switching to a different parameter group, adding or removing queues.Redshift reboots typically complete quickly.CommentShareAWS-User-2965899answered 3 years ago0I might add to what Joe said to further help you expectation of what will occur is that your open read-only sessions will get parked and the current active query restarted after the reboot.  However, your ope writer sessions will get severed and the SQL clients will need to reconnect to establish a new session.Regards,-KurtCommentShareklarsonanswered 3 years ago"


Question: Embedding Quicksight Visual with parameters

"We have a QuickSight dashboard in which we have a filter on a particular visual. We are trying to embed the visual in our application. I am able to generate the embed URL for the visual using the documentation. However, the parameters being passed are being reset to default which can be inferred from the following event which I see triggered once the content is loaded.{  "eventTarget": {    "experienceType": "VISUAL",    "discriminator": 0,    "contextId": "123",    "dashboardId": "xyz",    "sheetId": "abc",    "visualId": "pqr"  },  "eventName": "PARAMETERS_CHANGED",  "message": {    "changedParameters": [      {        "Name": "Lane",        "Values": [          "All"        ]      }    ]  },  "timestamp": 1681736836332,  "eventId": "7965be29-c80e-4ab0-97cc-00a81ba5d664"}What we are trying to embed is the tabular visual from the following dashboard:We have a QuickSight dashboard in which we have a filter on a particular visual. We are trying to embed the visual in our application. I am able to generate the embed URL for the visual using the documentation. However, the parameters being passed are being reset to default which can be inferred from the following event which I see triggered once the content is loaded.{"eventTarget":{"experienceType":"VISUAL","discriminator":0,"contextId":"123","dashboardId":"xyz","sheetId":"abc","visualId":"pqr"},"eventName":"PARAMETERS_CHANGED","message":{"changedParameters":[{"Name":"Lane","Values":["All"]}]},"timestamp":1681736836332,"eventId":"7965be29-c80e-4ab0-97cc-00a81ba5d664"}What we are trying to embed is the tabular visual from the following dashboard:Following are the parameters we are passing while loading the visual into application web page using amazon-quicksight-embedding-sdkFrameOptions:{  "url": "EMBED_URL",  "container": "CONTAINER_ID",  "height": "100px",  "width": "100%",  "onChange": "",  "resizeHeightOnSizeChangedEvent": false}`Content Options:{  "toolbarOptions": {    "export": false,    "undoRedo": false,    "reset": false  },  "sheetOptions": {    "initialSheetId": "SHEET_ID",    "singleSheet": true,    "emitSizeChangedEventOnSheetChange": false,    "sheetId": "SHEET_ID"  },  "attributionOptions": {    "overlayContent": false  },  "parameters": [    {      "Name": "Lane",      "Values": [        "MENASHA,WI - HANOVER,MD"      ]    }  ]}The frame loads appropriately, however the parameter does not seem to be applied as am expecting to see a single row. The same filtering works, with same parameters, when I embed the dashboard instead of a visual. Just wanted to understand if there is something am missing. Tried scavenging the documentation but unfortunately couldn't deduce much. Any pointers / directions would be much appreciatedFollowing is the code where we embed the parameters using the amazon-quicksight-embedding-sdkembedVisual = async(props, quickSightUrl) => {        const embeddingContext = await createEmbeddingContext({            onChange: (changeEvent, metadata) => {                console.log('Context received a change', changeEvent, metadata);            },        });        const dashboardProps = props.dashboardOptions;        if(dashboardProps){            const frameOptions = this.getFrameOptions(dashboardProps, quickSightUrl);            const contentOptions = this.getContentOptions(dashboardProps);            console.log([frameOptions, contentOptions]);            let embeddedDashboardOrVisual = null;            embeddedDashboardOrVisual = await embeddingContext.embedVisual(frameOptions, contentOptions);            this.setState({embeddedDashboardOrVisual: embeddedDashboardOrVisual});        }    }    getFrameOptions = (props, dashboardUrl) => {        console.log(document.getElementById(props.dashboardId + this.props.id));        const frameProps = props && props.frameOptions;        let options = {            url: dashboardUrl ? dashboardUrl : props.dashboardUrl,            container: document.getElementById(props.dashboardId + this.props.id),            height: frameProps && frameProps.height ? frameProps.height : "700px",            width: frameProps && frameProps.width ? frameProps.width : "1000px",            onChange: (changeEvent, metadata) => this.onDashboardChange(changeEvent, metadata)        }        return options;    }    getContentOptions = (props) => {        let options = {            toolbarOptions: this.getToolbarOptions(props.toolbarOptions),            sheetOptions: this.getSheetOptions(props.sheetOptions),            attributionOptions: this.getAttributionOptions(props.attributionOptions),            onMessage: async (messageEvent, experienceMetadata) => this.onMessage(messageEvent, experienceMetadata)        }        if(props.parameters && props.parameters.length > 0){            options.parameters = props.parameters;        }        return options;    }    getToolbarOptions = (props) => {        let options = {            export: props && props.export ? props.export : false,            undoRedo: props && props.undoRedo ? props.undoRedo : false, // use this option to show or hide the undo and redo buttons            reset: props && props.reset ? props.reset : false, // use this option to show or hide the  reset button        }        return this.appendOptions(props, options);    }    getSheetOptions = (props) => {        let options = {            initialSheetId: props && props.sheetId ? props.sheetId : null,            singleSheet: props && props.singleSheet ? props.singleSheet : false, // use this option to enable or disable sheet tab controls            emitSizeChangedEventOnSheetChange: false, // use this option in combination with resizeHeightOnSizeChangedEvent property, to allow iframe height to resize dynamically, based on sheet height, on changing sheets.        }        return this.appendOptions(props, options);    }    getAttributionOptions = (props) => {        let options = {            overlayContent: props && props.overlayContent ? props.overlayContent : false,        }        return this.appendOptions(props, options);    }Following are the props parameters being passed to the **embedVisual** method.dashboardOptions = {{                     dashboardId: hard_coded_dashboardId,                     visualId: hard_coded_visualId,                     sheetId: hard_coded_sheetId,                     frameOptions: {                         height: '100px',                         width: '100%',                         resizeHeightOnSizeChangedEvent: false                     },                     toolbarOptions: {                         export: false,                         undoRedo: false,                         reset: false                     },                     sheetOptions: {                         sheetId: hard_coded_sheetId,                         singleSheet: true                     },                     parameters: [{                         Name: 'Lane',                         Values: [lane && lane.toUpperCase()]                     }]                 }}FollowComment"

Answer: "0Hi, @NikhilK.I think your approach using options.parameters is correct.Please check the following:Can you provide your entire embed code? I want to know if the option parameter setting method is correct.Does the visual respond correctly if I explicitly set the same parameters with setParameters?CommentShareEXPERTiwasaanswered a month agoNikhilK a month agoHi @iwasa, thanks for responding, appreciate your time. I've updated the question above to include the client code which is responsible for the embedding. For the point 2, are you talking about setting the parameters while retrieving the URL from quicksight? If so then I've not tried it yet but I will try it and update the finding here. That would be a good try indeed, thanksShare0Hello,As per your use case, could you please check the what’s the URL for the iframe, and make sure it has the expected parameter in the query string.Ex:if you want to use the value from the embedded URL, make sure you have parameter Lane in QS and &Lane={value} in the URL. If the value is not part of the predefined list, QS will show the default value. Additionally, If the value has space or special char, please make sure you are encoding correctly.AWS API will be helpful get an anonymous embedded URL, and then add parameters manually to the URL in the code rather than SDK.Hope this helps.thanks!CommentSharerePost-User-4539178answered a month ago"


Question: EMR main instance is not reachable. Please check your instance status.

"Intermittently, the EMR parent node gets unreachable with the below error, which impacts the scaling of worker/task nodes and ultimately leads to batch job failures after few days (even the EMR CW monitoring metrics stop getting logged during this time)."WaitingResize for group (ig-********) is pending because parent instance is not reachable. Please check your parent instance status."We tried running the below command on parent node, which solves the problem temporarily, though again gets into the same situation after couple of days."/etc/alternatives/jre/bin/java -Xmx1024m -XX:MinHeapFreeRatio=10 -server -cp /usr/share/aws/emr/instance-controller/lib/*:/home/hadoop/conf -Dlog4j.defltInitOverride aws157.instancecontroller.Main &"What would be the root cause?FollowComment"


Question: AWS CodePipeline is disabling polling in inactive pipelines

""Hello,You are receiving this message because you have one or more polling pipelines in your account. A polling pipeline is defined as a pipeline that has at least one source action configured to poll for changes. The AWS CodePipeline team will be disabling polling in inactive pipelines effective May 25, 2023. An inactive pipeline is defined as one that has not had a pipeline execution started in the last 30 days. Inactive pipelines that only use Amazon EventBridge rule, or AWS CodeStar Connections, or webhooks to trigger the pipeline will not be affected. Additionally, any active pipeline will also not be affected.We recommend that you update to use Amazon EventBridge, or AWS CodeStar Connections, or webhooks as the trigger mechanism for your source. Follow the instructions in the documentation[1] for making this change. Changing your pipeline from polling to event based will improve performance for pipeline executions by ensuring they respond to source changes quicker.If you have questions about this change, the AWS Support Team is available on re:Post [2] and via Premium Support [3]."Questions about this Change:Does this impact only codepipelines with polling as default that are inactive?If the inactive codepipelines are made active within the next 30 days before May 25, 2023 and subsequently within 30 days thereafter, would that prevent deactivation of the default polling?Does the default polling use more of AWS resources from AWS perspective/side for the default method to warrant this change to event driven method on the customer side now?FollowComment"

Answer: "3Please find the answers of your question.Yes, this change only impacts inactive pipelines that have at least one source action configured to poll for changes. If you have an active pipeline, or if your inactive pipeline only uses Amazon EventBridge rule, AWS CodeStar Connections, or webhooks to trigger the pipeline, then it will not be affected by this change.Yes, if an inactive pipeline is made active within the next 30 days before May 25, 2023 and has a pipeline execution started, then it will not be considered inactive and will not have its polling disabled. However, if the pipeline remains inactive for 30 days after the last pipeline execution, then its polling will be disabled.The change is primarily driven by the need to improve performance for pipeline executions by ensuring they respond to source changes quicker. Polling is a resource-intensive operation that can impact the performance of the pipeline, especially when multiple pipelines are polling for changes on the same repository or source location. By moving to event-driven triggers, pipeline executions can be triggered more quickly and efficiently, without the need for polling. This can improve the overall performance of AWS resources and benefit both AWS and customers.CommentSharehashanswered a month ago0In the CDK you can add trigger in codepipeline_actions.S3SourceAction to resolve it.P.S.: Do not forget setting CloudTrail for dataEvents [4]source:[1] https://github.com/aws/aws-cdk/blob/5bdb0128e8181cd3a33a118a1f121f67b0f78b20/packages/aws-cdk-lib/aws-codepipeline-actions/lib/s3/source-action.ts#LL135C76-L135C85[2] https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements[3] https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codepipeline_actions.S3SourceAction.html[4] Do not forget setting CloudTrail for dataEvents : https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/log-s3-data-events.htmlimport * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail';declare const sourceBucket: s3.Bucket;const sourceOutput = new codepipeline.Artifact();const key = 'some/key.zip';const trail = new cloudtrail.Trail(this, 'CloudTrail');trail.addS3EventSelector([{  bucket: sourceBucket,  objectPrefix: key,}], {  readWriteType: cloudtrail.ReadWriteType.WRITE_ONLY,});const sourceAction = new codepipeline_actions.S3SourceAction({  actionName: 'S3Source',  bucketKey: key,  bucket: sourceBucket,  output: sourceOutput,  trigger: codepipeline_actions.S3Trigger.EVENTS, // default: S3Trigger.POLL <----});CommentShareNeil Kuananswered a month ago0I have doubts about this because I used the script to verify if my pipelines are polling pipelines and the script return that YES, but all my pipelines are using s3 as source and in the Change detection options Amazon cloudwatch events and the AWS support told me that this kind of pipelines won't be affected, so the script said yes but aws support said noCommentShareArnyRinconesanswered a month ago"


Question: How to use Lex Automated Chatbot Designer in an API call?

We have tried the amazing Lex new feature - Automated Chatbot Designer from Lex console using our transcript dataset.  How do we use this Lex Automated Chatbot Designer from an API call?  I could not find any documentation on using this new feature from API.  Could you provide an example on how to create a Lex bot from transcripts on an S3 bucket?FollowComment

Answer: 0StartBotRecommendation API should be used to start the bot recommendation process.CommentSharenavneetsabbineni-awsanswered 9 months ago0Great!  Thank you for the info - will give it a try.CommentSharerePost-User-4826668answered 9 months ago


Question: Anyone out there using Gamelift Realtime Scripts? Want to join a discord/slack?

Anyone else using gamelift realtime scripts for their game? I was thinking it would be good to form a discord or slack channel to be able to talk to people who are also using realtime scripts. Would anyone be interested in that?FollowComment

Answer: "0what engine are you talking about? If about lumberyard, then you can create an additional tab on the discord channel and talk about this topic there. This is my proposalCommentSharerePost-User-0396919answered 2 years ago0Well, I am not so concerned about the engine but the hosting solution. I didn't know there was a discord for lumberyard. Can you send a link to it?CommentSharerePost-User-3973093answered 2 years ago0https://discord.gg/V4haydb7CommentSharerePost-User-0396919answered 2 years ago0Yes, I have a discord for this: https://discord.gg/6Wr9y4jCS5CommentShareBatteryAcidDevanswered 10 months ago"


Question: Using ECS and EFS with an Application load balancer

"I have an a few clusters I have created in ECS using the fargate service. These are all connected to a load balancer and work as they are supposed to. Today I created a task definition for a new cluster using thecloudmd image. I'm following this official AWS video. Sadly, I seem to be experiencing an issue I can't figure out.My issue is that even though I've mounted my EFS file system using the task definition as directed in the video, the file system does not seem to mount properly.Opening the website when the service has finished deploying gives me this error:ENOENT: no such file or directory, lstat '/usr/src/app/cloudcmd'From my investigation, this issue seems to stem from the load balancer.How I arrived at this conclusion was that I launched a service, but I didn't add a load balancer. Instead I created a public IP and used that to access the container. Without the load balancer, the cloudcmd image loads perfectly and also shows my mounted EFS file system. Immediately I add the load balancer, it does not work.To also be sure that the issue is not from the docker image, I used an nginx image and pointed it to the HTML file I created on my file system. This also worked when I didn't add the load balancer but once I added the load balancer again, I could not access the specified HTML file.My question is that I really don't know what to do at the load balancer level and would like some help figuring out what the issue could be and any solutions to it.I can always create a service and not add it to a load balancer but rather use the public IP but for me that is unsafe, and I would rather my service be behind a private subnet.ThanksFollowComment"

Answer: "0For further investigation, we would have to look on the ELB Logs.CommentShareKumudhan Cherarajananswered 2 months agorePost-User-4597389 2 months agoThat's a good starting point. I would start thereShare"


Question: Help with HIVE_BAD_DATA: No columns in row group error

Started getting this error today when querying data from Athena in a table created from parquet files in our S3 bucket:I'm thinking a bad file somewhere but unable to narrow it down. Any steps or tips to resolve would be much appreciated. Thanks!FollowComment


Question: "line 1:8: mismatched input 'external'. expecting: 'or', 'schema', 'table', 'view'"

"I have the error of the title using this query:CREATE EXTERNAL TABLE (id BIGINT,idade BIGINT,sexo STRING,dependentes BIGINT,escolaridade STRING,tipocartao STRING,limitecredito DOUBLE,valortransacoes12m DOUBLE,qtdtransacoes12m BIGINT)ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.OpenCSVSerde'STORED AS TEXTFILEWITH SERDEPROPERTIES ('separatorChar' = ',','quoteChar' = '"','escapeChar' = '\')LOCATION 's3://klausbucketsql/'How can I solve it:FollowComment"

Answer: "1You don't specify the table name, which goes before the first open parenthesis.  Here's an example.  https://docs.aws.amazon.com/emr/latest/ReleaseGuide/EMR_Hive_Commands.htmlCommentSharejschwar313answered 5 months agoEXPERTFabrizio@AWSreviewed 5 months ago"


Question: GGC v2 component can not find python module awsiot

"I created a GG v2 component and want to use the awsiot component inside a python file of the component.So i added this script line to my recipe:"Install":{"Script": "python3 -m pip install awsiot"},When i try to run the component the module installs just fine:2021-05-13T09:13:06.470Z INFO (Copier) com.Componet.Test: stdout. Requirement already satisfied: awsiot in /home/ggc_user/.local/lib/python3.7/site-packages (0.1.3). {scriptName=services.com.Component.Test.lifecycle.Install.Script, serviceName=com.Component.Test, currentState=NEW}But when i try to import the module the error occurs:2021-05-13T09:13:07.125Z WARN (Copier) com.Component.Test: stderr. ModuleNotFoundError: No module named 'awsiot'. {scriptName=services.com.Component.Test.lifecycle.Run, serviceName=com.Component.Test, currentState=RUNNING}I assume it has something to do with user privilegs. Is the python script not called by default with the user ggc_user specified in when installing the core device with the option --component-default-user ggc_user:ggc_group ?Any advice would be appreciated.Thanks,SebastianFollowComment"

Answer: "0Hi SebastianBerryroad,You would have to install awsiotsdk https://pypi.org/project/awsiotsdk/ and also add --user in the pip command.Could you give this another try with those changes and let me know if that works for you?Thanks,Navya.CommentShareNavyaKuchibhotla-AWSanswered 2 years ago0Installing also awsiotsdk did the trick!Thank youCommentShareSebastianBerryroadanswered 2 years ago"


Question: Invalid parameter "codeHook" when calling UpdateIntent API of LexV2

"Hello,I need to enable CodeHooks for IntentConfirmation through a call to the UpdateIntent API for a LexV2 bot.I see in the documentation it should be possible with the parameter "intentConfirmationSetting" with the "codeHook" field but when I try I have the following error:["errorMessage": "Parameter validation failed:\nUnknown parameter in intentConfirmationSetting: "codeHook", must be one of: promptSpecification, declinationResponse, active"].My bot seems misaligned with the doc: (https://docs.aws.amazon.com/lexv2/latest/dg/API_IntentConfirmationSetting.html)  any idea to solve the issue ?FYI my bot has been created on the 7th of September so with the last version of LexV2.Thank YouFollowComment"

Answer: "0Hello,Generally, the Unknown parameter/Parameter validation failed can hint at issues with the version of SDK/CLI on the client's end. Updating/upgrading your SDK version or CLI version should be the first step to check if you are still receiving the error.Similar error have also been reported for service like ECS etc where the Parameter validation failed due to usage of older SDK version.However, if you receive errors when running AWS Command Line Interface (AWS CLI) commands, then please make sure that you're using the most recent AWS CLI version.Installing or updating the latest version of the AWS CLI - https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.htmlAdditionally, you can check the version of your CLI using aws --version command.If the suggestions above do not help resolve the issue, we might need to troubleshoot based on your configurations. Could you please create a support case instead so we may discuss details on your resource configurations?Please do not post any sensitive information over re:Post since this is a public platform.As always, feel free to reach back with any further questions or concerns in the meantime!CommentShareSUPPORT ENGINEERYash_Canswered 8 months ago"


Question: 'Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting' occurred when create studio

"I am consistently getting the error below when creating a studio.It seems to be affected by a change in ACL policy in April this year.Is there any way to resolve this issue?If anyone has resolved this issue, I would really appreciate your help.Thanks.FollowComment"

Answer: 0It was solved by the lastest update in this may update releaseCommentSharetra-zucanswered 11 days ago


Question: while am creating cloud front distribution am getting trouble as mentioned below

"our account must be verified before you can add new CloudFront resources. To verify your account, please contact AWS Support (https://console.aws.amazon.com/support/home#/) and include this error message.while am creating cloud front distribution am getting this trouble shoot please helpFollowComment"

Answer: "0Hello,As the error message indicates that your account must be verified to create a CloudFront Distribution, please reach out to AWS support team to get your account verified by following the below steps:Create an issue at Support Center - https://console.aws.amazon.com/support/home/Share the error message in the case.Wait for the support to get your account verified.Thank you!CommentShareSUPPORT ENGINEERawsprabpawanswered a year ago"


Question: Certificate renewal is not possible

"When renewing a certificate in AWS Certificate Manager, we get: Status Failed. Detailed status: Additional verification required to request certificates for one or more domain names in this request.What do I do with this?FollowComment"

Answer: "0Hello,I understand that you are experiencing the error below when attempting to renew an ACM certificate:Status Failed. Detailed status: Additional verification required to request certificates for one or more domain names in this request.The steps for troubleshooting ACM certificate renewal issue can be seen in the documentation here[1]. As per the referenced documentation ACM will attempt automatic renewal 60 days prior to the certificate expiration date. If ACM is unable to renew after 15 days you will receive email instructions on how to manually resolve the renewal issue. Therefore as a next step in resolving this issue I recommend first checking for the ACM email and the steps required to renew your certificate.The process to manually resolving the renewal issue is different depending on how the Certificate was originally validated. ACM certificates can be created using either email or DNS validation. The requirements for renewing both email and DNS validated certificates can also be seen at the referenced link[1].Troubleshooting managed certificate renewal[1] https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.htmlCommentSharePhindianswered a year ago"


Question: what cost i am getting charged for my AWS account

i have all my services are shut down but still i am getting charged under AWS cost.please let me know the reason?FollowComment

Answer: "2Try using AWS Cost Explorer (https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) to see the details of your charges. Cost Explorer is free when you use the console with out of the box settings the only billable features are hourly & resource granularity & direct API requests.Initially Cost Explorer will group the costs by Service, making it easy to see which service is responsible for the cost. You can also switch the Group By dimension to Usage Type, which will show you the next level of detail: the specific units by which your charges are being metered.Some examples of items that you might find:EBS:SnapshotUsage - EBS Snapshots that need to be deletedElasticIP:IdleAddress - unused elastic IPsCommentShareMichael_Ranswered 2 months ago0Did you check the details of your bill: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/getting-viewing-bill.htmlIt should indicate where it comes from.Some hints:Did you destroy all S3 buckets?Do you some commitments (EC2 reserved instances, etc.(  still valid to pay even you stopped corresponding services?CommentShareDidier_AWSanswered 2 months ago"


Question: Ingesting intermittent rtsp streams

"Hi, I need to ingest server rtsp streams and do further analyses with Rekognition. Such streams are not always available. I'm following the following AWS guide: https://github.com/aws-samples/rekognition-streaming-video-events.The problem is that working with commands like the following:./kvs_gstreamer_sample DemoStream rtsp://foo.barcan't handle intermittent streams. If the stream is not available, it returns.I'm wondering how to deal with this scenario in a serverless fashion and if Kinesis is the right tool for doing that job.FollowComment"

Answer: "0Accepted AnswerIf you need to ingest intermittent RTSP streams in a serverless fashion, then you can consider using AWS Elemental MediaLive and AWS Elemental MediaPackage. AWS Elemental MediaLive can receive and transcode your RTSP stream into a format that can be consumed by other AWS services such as AWS Lambda, Amazon Kinesis Video Streams, and Amazon Rekognition. AWS Elemental MediaPackage can package and deliver the transcoded streams for playback.To handle intermittent streams, you can use AWS Lambda to start and stop the AWS Elemental MediaLive channel when the RTSP stream becomes available or unavailable. You can trigger the Lambda function using CloudWatch Events, which can be configured to monitor the RTSP stream's availability and trigger the Lambda function when the stream becomes available or unavailable.Alternatively, if you want to stick with using Kinesis Video Streams, you can use the Kinesis Video Streams Producer SDK to ingest the RTSP stream into Kinesis Video Streams. The Producer SDK provides an API that can be used to ingest video and audio streams from RTSP cameras, USB cameras, and other sources. You can use AWS Lambda to start and stop the Kinesis Video Streams producer when the RTSP stream becomes available or unavailable. When the RTSP stream becomes available, the Lambda function can start the producer, which will ingest the stream into Kinesis Video Streams. When the stream becomes unavailable, the Lambda function can stop the producer.CommentSharehashanswered a month ago0Thank you very much!CommentSharefloatingpurranswered a month ago"


Question: Detecting multiple instances of the AWS Softphone across tabs using connect streams API

"I've been looking through this documentation: https://github.com/amazon-connect/amazon-connect-streams/blob/master/Documentation.mdI can't find anything that will allow me to detect what the original/contact softphone is, and what the signalling only softphones are.Does this functionality exist? Is it possible to get the ID for the current softphone tab?FollowComment"

Answer: "0Hello,Since the connect streams API is using WebRTC you may need to utilize the https://github.com/aws/connect-rtc-js feature if you're use case isn't possible with the connect-streams API. The connect streams API allows you the extend the default behaviors of Amazon Connect so it depends on what you're trying to accomplish. For further details on the APIs capabilities the best spot would be to open a GitHub issue with snippets of code you're using. There the team can see if you're use case is possible with the specific API.CommentShareSUPPORT ENGINEERTim_Panswered a year ago"


Question: Is it possible to register CA with AWS IoT Core without having access to Private Key ?

Let's say we are getting our device certificates signed by 3rd party CA e.g digicert. Can we register this 3rd party CA on AWS IoT Core for JITP without having access to Private Key ? As the registration process requires the proof of ownership.  [https://aws.amazon.com/about-aws/whats-new/2022/07/aws-iot-core-provision-iot-devices-aws-accounts-registrations-certificate-authorities/](This Blog) seems to suggest that it's possible but did not find details anywhere on the workflow.FollowComment

Answer: "1Hi Ravi,you can register a CA without having access to the private key in SNI_ONLY mode: https://docs.aws.amazon.com/iot/latest/developerguide/register-CA-cert.htmlCheers,PhilippCommentSharePhilipp Sanswered 5 months agoRavi Trivedi 5 months agoOk, In this case does device need to send SNI in the TLS handshake? or its is applicable only when the device cert ( Not CA cert ) is registered as SNI_ONLY ?Share"


Question: Better understanding how automatic backfill works

"I was able to play around with matchmaking and thought I would ask a few questions. For example, if I had a rule that on minimum, required two players to be in a game and on maximum four players to be in a game. I know that once two players find a match successfully, an auto backfill ticket is created. When this backfill ticket gets fulfilled after another two people join, if one of these 4 players leave, is there supposed to be another backfill ticket to replace the player who left? From what I have found, automatic backfill only gets fulfilled once.Also, I have found that when a player leaves a game and tries joining a new match, the auto backfill ticket associated with the game session that the old player left gets cancelled. Why does this happen? Or is this not supposed to happen?Thirdly, if a player leaves a game session with an open backfill matchmaking ticket, does the matchmaking ticket get updated with the information that a player left?Lastly, has anyone come across this message associated with a backfill ticket and knows what it means?The game session null was not found, or was in a state which wouldn't accept new player sessions.Thanks in advance once again.FollowComment"

Answer: "0Accepted AnswerQuick stab at your questionsAutomatic backfill currently only handles bringing players to your game. If players drop post FlexMatch, then automatic backfill doesn't backfill the player. There are backlog items for FlexMatch to fix this on PlayerSessionTerminate etc as it makes certain game modes harder to support.Also note that theres only ever one automatic backfill ticket in flight at a time.A player (identified by their player ID) can only be included in one active matchmaking request at a time. When you create a new request for a player, any active matchmaking tickets with the same player ID are automatically canceled.  https://docs.amazonaws.cn/en_us/gamelift/latest/developerguide/match-client.html FlexMatch is not updated on players leaving a game session. See #1The game session null, means that theres no longer an active game session id associated (most likely terminated or crashed has been removed) or it could be full if you have max player limits or allowing players in manually.Hopefully that helps a little.CommentSharerePost-User-5332620answered 3 years ago0Thank you Pip, that was very helpful. If you don't mind me asking a couple more questions, you said that there is only ever one automatic backfill ticket in flight at a time, does this mean that once a backfill ticket reaches one of these status:MatchmakingSucceededMatchmakingTimedOutMatchmakingCancelledMatchmakingFailedthat automatic backfill is officially over? And please correct me if I am either missing or incorrectly included certain statuses. Also, can that be generally said about any matchmaking request?Lastly, with regards to matchmaking tickets with statuses of PotentialMatchCreated, do these tickets ever get updated if let's say the max number of game sessions is running, but one of the players in the PotentialMatchCreated ticket drops, will the ticket get updated or cancelled?CommentSharerePost-User-5100160answered 3 years ago0Sorry to bug you again, but another question did pop into my mind. You mentioned that a player can only be included in one active matchmaking request. Currently, I use the player's username for the playerId field when creating a new matchmaking request. The reason for this was to prevent a user from spamming GameLift with a bunch of matchmaking requests as well as making it easier to assign wins and losses when a match ends. I saw a blog before that they used the uuid npm package for making the player id, so I am wondering if this and just adding the player's username as additional data to the matchmaking request is a better approach? My only worry with this approach is that players can theoretically spam GameLift with matchmaking requests considering a new uuid will be generated randomly per each request. Of course, we can also do other things such as restricting players to one running client instance on one device per account, but I just want to make sure that this is a legitimate concern or if at this point I should just go with manual backfill instead.CommentSharerePost-User-5100160answered 3 years ago0player id is generally thought of as an opaque private piece of data known only internally to your game/server (ie player user name -> playerid).Typically a game will:Use short lived, in memory credentials that aren't accessible to the playerHave a UI 'cool-downs' or similar that prevent the player spamming matchmaking tickets (ie they can only have one request in flight at a time).Or call a back end service to make requests (https://aws.amazon.com/blogs/gametech/fitting-the-pattern-serverless-custom-matchmaking-with-amazon-gamelift/) which limits player requests etc.CommentSharerePost-User-5332620answered 3 years ago0I see, sorry for asking this but I just want to confirm, is it ok to use the player's Cognito username for the player id in matchmaking requests then? I am technically doing all three practices that you are mentioning, and I have come to the realization that for my purposes, I may have to do backfill manually.Also, do backfill tickets expire like regular matchmaking tickets in the sense that the request timeout value specified in the matchmaker configuration applies to backfill tickets the same way they do to regular matchmaking tickets? I have found oddly, that backfill tickets do not seem to expire the way regular matchmaking tickets do unless I did not see something or it works differently for manual vs automatic.CommentSharerePost-User-5100160answered 3 years ago0I can't think of any particular reason against using cognito id as player id. I would ensure player can't easily see/know it or if logged its an opaque id (rather than something that contains anything that identifies it as a cognito id - I remember they are typically REGION:GUID)Backfill requests should be like any other FlexMatch request, the only difference is that they have pre-formed partial or full team(s). They should obey the same timeout rulesIf you are talking automatic backfil, you may be seeing new requests but using the same ticket id (code may even retry with same ticket id on certain failures). So you may see the tickets 'living longer' due to reused ticket id (but these are effectively new requests). You should be able to see the ticket transition states to see this.My recollection of automatic backfill may be a little hazy here, will try and do some digging for you.CommentSharerePost-User-5332620answered 3 years ago0Hey Pip, just want to clarify this statement,I would ensure player can’t easily see/know it or if logged its an opaque id (rather than something that contains anything that identifies it as a cognito id - I remember they are typically REGION:GUID)I wasn't necessarily referring to the cognito id, but rather the cognito username value. Since you said that the playerId should be opaque, would it better to use the cognito id rather than a player's cognito username? Also, I'm not even sure what a cognito id is, excuse me for my ignorance. I know that users in Cognito have a sub value, is this what you meant by cognito id, but this does not have the REGION:GUID format? Or were you talking about cognito username this whole time, because I was confused when you mentioned REGION:GUID.Also, if you have any other recommendations for what to use for the playerId field, please let me know. I think some kind of unique value tied to Cognito or a user's account is good because it can prevent players from spamming matchmaking requests.CommentSharerePost-User-5100160answered 3 years ago"


Question: "Another account accepted my organization invitation, but no account appear"

"Another account accepted my organization invitation, but no account appear. How should I do?FollowComment"

Answer: "1HelloPlease verify the following points:Please check this link from the Master account from where you are invited https://us-east-1.console.aws.amazon.com/organizations/v2/home/accounts/invitations  You must see the status ACCEPTED invitation in this pageGo to the target account and check organisations the master account associated Organization ID is correctOnce both 1 & 2 are Good, Lets go the Master Payer account https://us-east-1.console.aws.amazon.com/organizations/v2/home/accounts search  here the **name of the account **you must seeStill you do not see the account, Please try contacting AWS support for this. Thank YouCommentShareGKanswered a year ago0Accepted AnswerI found that the member account own its organization, I have to delete the organization first https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html. However, the AWS limit support told me that the free tier of the member account will lose after joining the 'no free tier' organization. Anyone could confirm that?Thank you very much.CommentSharePlAwAnSaIanswered a year ago"


Question: cant access s3 via CLI

"aws s3 sync s3://fast-ai-imageclas/cifar10 s3://myvirginiabucket/fast-ai-imageclas/cifar10fatal error: An error occurred (SignatureDoesNotMatch) when calling the ListObjectsV2 operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.(base)  ✘ ✝  Downloads/software/REPOS  aws configure listName                    Value             Type    Location----                    -----             ----    --------profile                <not set>             None    Noneaccess_key     ****************IB7X shared-credentials-filesecret_key     ****************IB7X shared-credentials-fileregion                us-east-1      config-file    ~/.aws/configthe user has access to S3. this is the users policy:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:"],"Resource": ""}]}FollowComment"

Answer: "0The error above suggests that there is an issue with the signature of the request. This could indicate an incorrect access key or secret key, or a problem with the signing method being used.To resolve the issue, you can try thisCheck that the access key and secret key being used are correct.aws configureCheck that the AWS CLI is configured to use the correct region.aws configure listCheck that the user has the necessary permissions to access the S3 bucket. You can do this by checking the policy attached to the user's IAM role, and ensuring that it grants the necessary permissions for the S3 bucket.Double check that the S3 bucket name is correct and that the user has permissions to access it.CommentShareWilklinsanswered a month ago0Hi,This error is usually related with the AWS credentials, so I recommend you take the following actions:Open the  ~/.aws/credentials file and check that aws_access_key_id and aws_secret_access_key values matches your IAM user credentials.Check that you have not set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, since AWS cli will use those values instead what is defined at the ~/.aws/credentials file.Finally, if the error still persists, check that the time on the system is in sync to the current time.CommentShareMikel Del Tioanswered a month ago0In addition to the above, specify --profile on the command to use the specific profile in your ~/.aws/credentials file. This will override any environment variables or instance profile (if running from EC2).You can also check who you are by running aws sts get-caller-identity --profile YOUR_PROFILE_NAME.CommentShareEXPERTkentradanswered a month ago"


Question: AmazonLexRuntimeV2Client.RecognizeUtteranceAsync RecognizeUtteranceResponse field is compressed with gzip and then base64 encoded.

"I am trying to link unity3d with Lex using .net sdk. I am able to connect to the Lex bot using RecognizeTextAsync. However, I am not able to use RecognizeUtteranceAsync because the respond has many fields that are gzip and base64 encoded. I have tried many suggestion from stackoverflow to unzip and decode the response. None of them work. Does anyone have sample or tutorial that work with RecognizeUtteranceAsync? Thank you.FollowComment"


Question: how to set default region for aws account

"HiCan you please help me here, when I log in to my AWS account my default region is Oregon, how can i choose a different region as a default? so that any resource I. create goes into this default region.Thanks for your help.RegardsSamFollowComment"

Answer: "2Accepted AnswerI assume you are referring to the AWS Management Console. The AWS Management Console stores the last region selected in your browser, and unless you reset your browser history or use incognito mode AWS Management Console will default to the last used region, when using the default url namely: https://console.aws.amazon.com. You can change the region selected in the top right of the browser, from the drop down where it currently references Oregon.Alternatively you can bookmark the URL of the region you prefer.For example to access Dublin, Ireland Directly:https://eu-west-1.console.aws.amazon.com/console/home?region=eu-west-1 orhttps://console.aws.amazon.com/console/home?region=eu-west-1Or to access Cape Town, South Africahttps://af-south-1.console.aws.amazon.com/console/home?region=af-south-1 orhttps://console.aws.amazon.com/console/home?region=af-south-1You can access this page for a complete list of regions.CommentShareJason_Nanswered a year agoEXPERTJames_Sreviewed a year ago0Sadly AWS has a cache bug. It does not remember your default region, and will go to us-east1 every time. I have tried many things but to no avail.CommentShareFWD079answered 4 months ago"


Question: AWS Forecast Export - Create Only One CSV File?

"When I am creating an AWS Forecast Export, it creates multiple small CSVs in the S3 bucket. Seemingly 1 for each item_id that I am making predictions for.My question is, is there a setting I can change to export all of this information as 1 CSV file? I am using the AWS CONSOLE, not the CLI.Thanks in advance, I am new to AWS Forecast and I could not find this question on the forums via search.FollowComment"

Answer: "1Accepted AnswerThe AWS Forecast service does not currently have a method to reduce the number of output files using the console, CLI, or the SDK. The service is designed in such a way that it dynamically calculates the number of output CSV files.A feature request exists for exporting data to a single file but I am unable to provide an ETA of when/if such a feature would be implemented. To work around this, you may consider using the “Improving Forecast Accuracy with Machine Learning” solution (1) to create an aggregated view of all your forecast data (inputs and outputs), query your forecast output within AWS Athena, and then export the query results as a single CSV.Resources:(1). https://aws.amazon.com/solutions/implementations/improving-forecast-accuracy-with-machine-learning/CommentShareSUPPORT ENGINEERSawyer_Hanswered a year ago"


Question: https still refuses connection

"Hi, I have finished setting aws ec2 ssl cert to use https://mydomain, but after setting all including application load balance I still get connection refuse if I try to connect with https. Http is working well. I used ssl and domain from outside(imported). So I have done the extra setting for importing domain such as ns forwarding. I can't find any solution. Please help me on this.FollowComment"

Answer: "0First, check to make sure that your security group allows connections on HTTPS (TCP/443). If that is configured, try running telnet mydomain 443 from an external host (or from another instance within the VPC). This will tell you whether your web server is configured to listen on port 443 or not.CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: AWS parameterized Glue Concurrent jobs using step functions with enabled bookmarks - throws Version mismatch exception

"I have a parameterized glue job , that will be called in parallel (25 glue job) through step functions, when bookmark enabled , version mismatch exception is thrown, when disabled, it runs fine..Below are the inputs to the step function{"JobName": "gluejobname3","Arguments": {"--cdb": "catalogdbname","--ctbl": "tablename","--dest": "s3://thepath/raw/","--extra-py-files": "s3://thepath/mytransformation.py.zip"}}When bookmarks are disabled, the step functions calls the parameterized glue job, and loads the data into the different s3 location.below is the glue job scriptimport sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobimport mytransformationargs = getResolvedOptions(sys.argv, ["JOB_NAME","cdb","ctbl","dest"])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)this was given so that while it was initialized each job would have their unique idjob.init(args["JOB_NAME"]+args["ctbl"], args)#Custom parameters that will be dynamically passed through with the call to the parameterized glue jobdb = args["cdb"]tbl = args["ctbl"]dest = args["dest"]Script generated for node MySQL table#dynamically creating a variable name. so that transformation_ctx would be unique for each glue jobglobals()[f'MySQLtable_sourceDf{tbl}'] = glueContext.create_dynamic_frame.from_catalog(database=db,table_name=tbl,transformation_ctx = '"'+f'MySQLtable_sourceDf{tbl}'+'"')#passing the same transformation_ctx into the destination framedestination_Df = mytransformation.tansform(globals()[f'MySQLtable_sourceDf{tbl}'])Script generated for node Amazon S3 # : "s3://anvil-houston-preprod"#creating the dynamic unique transformation ctx name since the jobs will be run concurrentlyglobals()[f'S3bucket_node{tbl}'] = glueContext.write_dynamic_frame.from_options(frame=destination_Df,connection_type="s3",format="glueparquet",connection_options={"path": dest, "partitionKeys": []},format_options={"compression": "snappy"},transformation_ctx='"'+f'S3bucket_node{tbl}'+'"')job.commit()Above runs fine , while the execution is started through step functions ( 25 parallel parameterized glue job), the job runs fine, and loads to 25 diffferent locations. When bookmark is now enabled, the job fails with version mismatch . An error occurred while calling z:com.amazonaws.services.glue.util.Job.commit. Continuation update failed due to version mismatch. Expected version 1 but found version 2 (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: VersionMismatchException;Please helpFollowComment"


Question: S3 Put API taking time for the first document upload

We have a document upload Lambda created which generates a signed url of s3 bucket for PUT api. This PUT api is being used by front-end to store the file in S3 bucket. In the front end screen we  have to upload 5 files and for each file upload it first generates the signurl by invoking the lambda then use the signed url to upload physical file.The first file upload takes around 15 second where as the 2nd/3rd/.. files takes around 2 sec to upload the same size of (200kb) file. Is the any way to enhance this s3 put api response for first upload.FollowComment

Answer: 1My guess here is that the first time a file is uploaded the Lambda function is being initialised and that leads to a longer start time - what is called a "cold start". Subsequent invocations are "warm starts" and are therefore faster.There are ways to minimise cold start times so it's worthwhile starting your reading at this blog post.CommentShareEXPERTBrettski-AWSanswered 8 months agoEXPERTIndranil Banerjee AWSreviewed 8 months ago


Question: "FTP Transfer Family, FTPS, TLS resume failed"

"We have:an AWS transfer family server with FTPS protocola custom hostname and a valid ACM certificate which is attached to the FTP servera Lambda for the Identity providerThe client is using:EXPLICIT AUTH TLSour custom hostnameport 21The problem is:the client can connect, the authentication is successfully (see below for the auth test result), but during the communication with the FTP server a TLS_RESUME_FAILURE occurs.The error in the customer client is "522 Data connection must use cached TLS session", and the error in the CloudWatch LogGroup of the transfer server is just "TLS_RESUME_FAILURE"I have no clue why this is happen.Any ideas?Here is the auth test result{    "Response": "{\"HomeDirectoryDetails\":\"[{\\\"Entry\\\":\\\"/\\\",\\\"Target\\\":\\\"/xxx/new\\\"}]\",\"HomeDirectoryType\":\"LOGICAL\",\"Role\":\"arn:aws:iam::123456789:role/ftp-s3-access-role\",\"Policy\":\"{\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"AllowListAccessToBucket\", \"Action\": [\"s3:ListBucket\"], \"Effect\": \"Allow\", \"Resource\": [\"arn:aws:s3:::xxx-prod\"]}, {\"Sid\": \"TransferDataBucketAccess\", \"Effect\": \"Allow\", \"Action\": [\"s3:PutObject\", \"s3:GetObject\", \"s3:GetObjectVersion\", \"s3:GetObjectACL\", \"s3:PutObjectACL\"], \"Resource\": [\"arn:aws:s3:::xxx-prod/xxx/new\", \"arn:aws:s3:::xxx-prod/xxx/new/*\"]}]}\",\"UserName\":\"test\",\"IdentityProviderType\":\"AWS_LAMBDA\"}",    "StatusCode": 200,    "Message": ""}FollowCommentdustin-stamped 10 months agoJulian I have to thank you for posting your follow up to this question.  It's been a week of suffering (including deploying a FTP server to ECS instead of using AWS Transfer) but your solution posted I think has solved my problems.Thank you!Share"

Answer: "1Accepted AnswerWhen creating a Transfer server with FTPS (TLS) support, the default mode for TLS session resumption is ENFORCED which means the FTPS client needs to resume the same TLS session between control and data connections.https://docs.aws.amazon.com/transfer/latest/userguide/API_ProtocolDetails.html#TransferFamily-Type-ProtocolDetails-TlsSessionResumptionModeNot all FTPS clients can support TLS session resumption between control and data connections so this setting may need adjusting in your case.CommentShareAWS-User-1246470answered a year agoJulian Kleinhans a year agoThats it! Awesome. Thanks.The solution is to switch from ENFORCED to ENABLEDaws transfer update-server --server-id SERVER_ID --protocol-details TlsSessionResumptionMode=ENABLEDThanks also to Christopher H. from Amazon, who also helped me successfully via AWS support.Share"


Question: Update ControlTower CloudTrail S3 Bucket to Use Log file SSE-KMS encryption

"I am using an MDR service called Adlumin that consumes CloudWatch log streams created by my Org CloudTrail log.Part of that requirement is that my Log files use SSE-KMS encryption, which is not the case by default for Control Tower.I would like to enable it, but while my management account owns the CloudTrail, my logging account owns the S3 bucket.  So when I attempt to update that setting in my CloudTrail it let's me know that I "don't have adequate permissions in S3 to perform this operation."My Questions:Will updating this setting for my S3 bucket be blocked by any Control Tower Guardrails?What kind of policies would I need to establish with my bucket (and IAM?) to give my management account access to update this configuration for my logging accounts S3 bucket?FollowComment"

Answer: "0Hi ThereControl Tower has a few mandatory controls that protect the logging bucket from being modified outside of Control Tower.You should update the KMS settings through the Control Tower dashboard under "Landing Zone Settings" then choose "Modify Settings"CommentShareEXPERTMatt-Banswered 2 months agonodnarbHQ 2 months agoI followed the instructions to add the KMS via this GUI page and I ran into similar issues. Giving me issues with the bucket policy in my logging account. Trying to remove the key through the wizard then gives me an error of:AWS Control Tower failed to set up your landing zone completely: AWS Control Tower failed to deploy stack(s): arn:aws:cloudformation:us-east-1:<REDACTED>:stack/AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER/<REDACTED>UPDATE: After retrying a few more times it successfully finished the Landing Zone set up. But I am not sure if I want to try enabling KMS again... The CF Stack in question is still showing drift where the expected and actual don't match. it is showing it is expecting this "KMSKeyId": "", but that key just isn't there in the actual when it is NULL or empty.Share"


Question: I get there is error any one help me please

I get this error any one help me to solve this problemFollowComment

Answer: "0I understand you using Session Manager to connect, you need to install the Session Manager Agent.https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.htmlIf you don't have access, create a key pair and temporarily grant SSH access.Alternatively, you can install the SSM Agent when creating the instance in Advanced details > User Data.enter the lines to automatically install on instance startup.sudo snap install amazon-ssm-agent --classicsudo snap start amazon-ssm-agentCommentShareAlberto Fernandesanswered 5 months ago"


Question: Costs associated with Data Pipeline S3Datanode staging

"I'm confused about how staging of an S3Datanode is billed when done as part of a ShellCommandActivity with the 'stage' property set to true (i.e. I do not have CSV data and am not using a CopyActivity).Here is an example: https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-concepts-staging.html#dp-concepts-datastagingI see a 'runsOn' option for S3Datanode.  Is that how you control the resource used to do the copy?  That would make sense since it seems that is how CopyActivity works.  I'm just not sure because I don't see any examples doing so.To wrap up, is the idea that I can use a cheaper instance for the data staging to save money?  (I understand that the staging also simplifies my workflow but just wondering if there is a cost incentive as well).https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-object-s3datanode.htmlFollowComment"


Question: How to effectively check the existence of an edge

"How to effectively check the existence of an edge? I tried using a query of this type:g.V(srcId).out(edgeName).has(dstId).hasNext()But after checking the performance, I realized that this is not an efficient query (it takes about 0.1-0.3 seconds) while extracting edges takes ~0.02FollowComment"

Answer: "0I don't think this is a correct query. "has(dstId)" seems wrong, see  https://tinkerpop.apache.org/docs/3.5.0/reference/#has-step . Perhaps you meant "hasId(dstId)"?CommentShareAWS-User-2456424answered 2 years ago0Indeed, I made a mistake... ThanksCommentSharewindoxanswered 2 years ago"


Question: Utilize Glue ETL for mapping misspelled information to existing data sets

"I am looking to ingest upstream files via Glue ETL and I need to match misspellings to existing, already standardized data, based on rules that I can either continually add to or train a model to learn from, to them add to my database. It is basically a continuously growing reference table(s). All of this is currently done in Excel by hand for multiple columns/fields and I need to automate it.General Example:I already have a list of known matches (e.g., "tigre" = "tiger"), so any field that has "tigre" should map to the proper spelling without any additional steps.I believe that I need to have a training step for matches that don't already exist. So when the spelling "tigerrr" comes along, I can map to "tiger" and, next time the process runs, the mapping occurs properly.I dove into DataBrew, but does not appear to be able to handle large reference tables for mapping in the recipes. It did not look like FindMatches in Glue Studio was quite the right tool either as it appears to focus on full record matching, not individual field matches.Any recommendations?FollowComment"


Question: Customizations for AWS Control Tower Solution - CFN SAM Support

"Hi - We are using CfCT, which is great. We currently have cloudformation templates mapped to specific Organizational Units and it works like a charm. I now have a AWS SAM Template that I would like to deploy but I could find 0 documentation about it. At the solution repository, I can see that are features enabled to support SAM[1], but no guidance on how to do it.Could you please share more information on how to deploy a AWS SAM Template through CfCT?[1] - https://github.com/aws-solutions/aws-control-tower-customizations/blob/08f76abd9548cc88d091ab6a8d8f127c768c331b/CHANGELOG.md#L18FollowComment"

Answer: 0You should be able to simply take the CloudFormation route of deploying SAM:Transform: AWS::Serverless-2016-10-31Resources:  SomeServerlessFunc:    Type: AWS::Serverless::Function    Properties:      Handler: index.handler      Runtime: nodejs12.x      CodeUri: 's3://bucketo/source.zip'(Same goes for AWS::Serverless::Application et al)CommentShareEXPERTRaphaelanswered a year ago


Question: ec2 instance rebooted by itself

"Hi,Our instance(i-0acf52896afa35c0f) August 25 morning 08:29 (UTC+8) after the automatic restart is still inaccessible, We restored it to normal at 08:36 after a manual reboot at the console, but the system log(/var/log/message,dmesg) found no errors.>last rebootreboot   system boot Thu Aug 25 08:36 - 17:05 (5+08:28)   reboot   system boot Thu Aug 25 08:29 - 17:05 (5+08:35) # /var/log/message snippetAug 25 08:20:34 ip- nm-dispatcher: req:1 'dhcp4-change' [eth0]: start running ordered scripts...Aug 25 08:22:28 ip- dhclient[471465]: DHCPDISCOVER on docker0 to 255.255.255.255 port 67 interval 3 (xid=0x343ac688)Aug 25 08:22:31 ip- dhclient[471465]: DHCPDISCOVER on docker0 to 255.255.255.255 port 67 interval 5 (xid=0x343ac688)Aug 25 08:22:36 ip- dhclient[471465]: DHCPDISCOVER on docker0 to 255.255.255.255 port 67 interval 7 (xid=0x343ac688)Aug 25 08:22:43 ip- dhclient[471465]: DHCPDISCOVER on docker0 to 255.255.255.255 port 67 interval 18 (xid=0x343ac688)Aug 25 08:22:57 ip- dhclient[471465]: DHCPREQUEST on eth0 to x.x.x.x port 67 (xid=0x71963ea7)Aug 25 08:22:57 ip- dhclient[471465]: DHCPACK from x.x.x.x (xid=0x71963ea7)Aug 25 08:36:41 ip- journal: Runtime journal is using 8.0M (max allowed 743.7M, trying to leave 1.0G free of 7.2G available â†’ current limit 743.7M).Aug 25 08:36:41 ip- kernel: Initializing cgroup subsys cpusetAug 25 08:36:41 ip- kernel: Initializing cgroup subsys cpuAug 25 08:36:41 ip- kernel: Initializing cgroup subsys cpuacctWe found a instance and system status check error in cloudwatch starting at 08:24.CloudTrail only has records of our manual restart instances at 08:36.I would really appreciate some help.FollowComment"

Answer: "0Accepted AnswerSystem Status checks indicate that there was a hardware failure on the host that your instance was running on (AWS end). Stop starting the instance moves it away from the faulty hardware to a healthy host, basically each stop starts moves the instance to a different host. EC2 now has an automated service that does this and it had already triggered a stop start when you were rebooting on the console, and the stop start is what actually migrated the instance to a healthy host.You can read more about System status checks below:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html#types-of-instance-status-checksCommentShareAWS-User-9002671answered 9 months ago"


Question: OpenVPN client IP will not route accross VPC Peering

"I have two OpenVPN servers in two separate regions.  Region A OpenVPN IP =172.16.0.2/24  and Region B OpenVPN IP = 172.17.0.2/24 .Region A OpenVPN clients (on the Internet) Poll of IP is 10.55.55.0/24  and  Region B OpenVPN clients (on the Internet) Poll of IP is 10.66.66.0/24With my VPC Peer route tables, I have told it to route 10.66.66.0/24 to Region B and Also in Region B I set it to route that subnet to the OpenVPN EC2 adapter.I have basically done allow All for the various VPC groups and ACL.  When I try to ping a VPN client in Region B from Region A I see the packet leaving the OpenVPN adapter then it goes into oblivion.I have turned off the source/destination check and have verified my Openvpn IPtables.I also tried putting the Region B machine into the same subnet as Region A and when both OPENVpn servers were in the same subnet there's no problem.Can you route an IP range across a Peer to a machine interface when the IP range (on the OpenVPN client)  does not exist in the VPC's subnet's CIDRs?Any thoughts would be appreciated. Thank you so much.FollowComment"

Answer: "0I'm not convinced that this will work but a few more details are required:When a VPN client connects and is allocated an IP address of 10.55.55.x - what is that client trying to connect to? A 10.66.66.x address? Or a 172.17.0.x address?You mentioned that you've added routes in region B but have you also added the "opposite" routes in region A? Routing is a two-way process - adding the routes in one direction doesn't automatically make it work the other way around for return traffic.CommentShareEXPERTBrettski-AWSanswered a year agoScott a year agoHey Brettski. Thanks for the reply. Sorry, I probably didn't think out my question well enough.I did put routes in both VPC's to send it to the peering connection. It seems like the Peering is doing something like src/dst checking. When I put a sniffer on either destination EC2 ens5 interface I don't even see the ICMP Echo hit it. I see it leave from the source ens5 however.Here is the expected behavior.vpn client @10.55.55.2 <-> ast01(Openvpn1 ec2 machine)ens5/172.16.0.2 <-> VPC A main routing table <-> Peering Conention <-> VPC B Main Routing table <-> ens5/172.17.0.2 (Openvpn2 ec2 machine) ast0/10.66.66.1 <-> vpn client @ 10.66.66.2VPC A routing tableroute 10.66.66.0/24 to PeeringRoute 10.55.55.0/24 to Openvpn1 ens5 adaptorVPC B Routing TableRoute 10.55.55.0/24 to PeeringRoute 10.66.66.0/24 to Openvpn2 ens5 adaptorSo in scenarios A to B I see the packet leave Openvpn1 ens5 but I don't see the packet even reach Openvpn2's ens5.It's like it's getting blackholed. I've checked the ACL's dozens of times before just putting in allow all and ICMP 0.0.0.0/0 for those. Also put allows in the VPC group security on both sides for those 10.x addresses and VPC subnet addresses.I imagine anyone could try adding a route to a nonexistent IP in the AWS network across A VPC to a destination EC2.  You should still see a packet hit the destination interface? It doesn't seem too.ShareScott a year agoHey Brettski. Thanks for the reply. Sorry, I probably didn't think out my question well enough.I did put routes in both VPC's to send it to the peering connection. It seems like the Peering is doing something like src/dst checking. When I put a sniffer on either destination EC2 ens5 interface I don't even see the ICMP Echo hit it. I see it leave from the source ens5 however.Here is the expected behavior.vpn client @10.55.55.2 <-> ast01(Openvpn1 ec2 machine)ens5/172.16.0.2 <-> VPC A main routing table <-> Peering Conention <-> VPC B Main Routing table <-> ens5/172.17.0.2 (Openvpn2 ec2 machine) ast0/10.66.66.1 <-> vpn client @ 10.66.66.2VPC A routing tableroute 10.66.66.0/24 to PeeringRoute 10.55.55.0/24 to Openvpn1 ens5 adaptorVPC B Routing TableRoute 10.55.55.0/24 to PeeringRoute 10.66.66.0/24 to Openvpn2 ens5 adaptorSo in scenarios A to B I see the packet leave Openvpn1 ens5 but I don't see the packet even reach Openvpn2's ens5.It's like it's getting blackholed. I've checked the ACL's dozens of times before just putting in allow all and ICMP 0.0.0.0/0 for those. Also put allows in the VPC group security on both sides for those 10.x addresses and VPC subnet addresses.I imagine anyone could try adding a route to a nonexistent IP in the AWS network across A VPC to a destination EC2.  You should still see a packet hit the destination interface? It doesn't seem too.Share0I redid this with a whole 10.66.0.0/16 network and then put 10.66.66.0/24 on the VPN side and still the destination isn't getting routed through the Peering when I point it to the 10.66.0.2 adapter. I am convinced Peering isn't working and this is a bug.CommentShareScottanswered a year agoBrettski-AWS EXPERTa year agoMy plan is to build this out but (apologies) I haven't had a chance to test it yet.Share"


Question: Cloudfront direct links to edge server

"I use a third-party service to send emails to subscribers. During the email send process, they shorten links for tracking purposes. The issue is that these shortened redirect links point to the "edge server" URL instead of the original Cloudfront URL.This is causing issues for us since it appears that these direct links cannot be invalidated. In other words, if I change the file on S3 (I also have Cloudfront caching disabled), the Cloudfront URL will show the new file immediately. However, these direct links to the "edge server" do not, they continue to show the old version.I'm guessing the the email service runs a process to understand the URL that is being served before being shortened, and instead of using the original, it grabs the "edge server" link instead.Any advice or thoughts? I need to be able to change these files (at times) after the email has been sent and am not able to.FollowComment"

Answer: "1It sounds like the issue may be related to the caching behavior of the edge server. When a user clicks on the shortened link in the email, the request is routed through the edge server, which may cache the content for a certain amount of time before checking for updates on the origin server.One potential solution is to configure the caching behavior of the edge server to reduce the cache time, or to disable caching altogether. This may cause a higher load on the origin server, but would ensure that updates are reflected in the content served by the edge server.Another solution may be to use a different service for link tracking that does not rely on the edge server URL. For example, some URL shortening services provide the option to use a custom domain for the shortened links, which would allow you to use your Cloudfront URL instead of the edge server URL. Alternatively, you could set up your own URL shortening service using a tool like YOURLS or Bitly, which would give you full control over the URL generation process.Finally, you may want to consider using a different email service provider that does not modify the URLs in your emails. While this may not be feasible depending on your specific requirements and workflows, it may be worth exploring as a potential solution.CommentShareAWS_Guyanswered 3 months ago"


Question: How can we store feature transforms in a feature store?

"AWS' feature store pages describe feature groups and how to store features and their types (https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-introduction-notebook.html) . However, it is not clear how to store feature transforms if needed.  Is this possible with AWS' feature store?FollowComment"

Answer: "0Accepted AnswerYou can use SageMaker Data Wrangler to create data transformation workflows. Once your data is prepared, you can build fully automated ML workflows with Amazon SageMaker Pipelines to publish the transformed features in SageMaker Feature Store so you can share features across your team and others can reuse them for their own models and analysis.SageMaker Feature Store keeps track of the metadata of stored features (e.g. feature name or version number) so that you can query the features for the right attributes. Also if you like to monitor your features in production for any drift you could use data profiling integration with Feature Store, more details in this blog post.CommentShareIoananswered a year ago"


Question: API Gateway Disconnect Client from Server

"Hello, I'm using the new websocket api and I want to manually disconnect a client from the server. According to https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html you can disconnect a client by using the @connections route. I don't see any example of how to do that though. Is that undocumented? Thanks!Your backend service can use the following WebSocket connection HTTP requests to send a callback message to a connected client, get connection information, or disconnect the client.FollowComment"

Answer: "0The documentation online doesn't have it yet, however I just skimmed through an AWS video on websockets and I found the answer! You can watch it here: https://youtu.be/3SCdzzD0PdQ?t=718 but I'll outline it below:https://${Api}.execute-api.${AWS::Region}.amazonaws.com/${Stage}/@connections/${id}Operation   ActionPOST        Sends a message GET         Gets the latest connection statusDELETE      Disconnects the connectionCommentShareCPanswered 4 years ago"


Question: How to compile lua scripts

"I'm working with learning how to use the lua script component, but it seems like when I make a change to a script then save and go back to the editor, the changes are not reflected when I run the game. I either have to remove the lua script component and re-add it, or sometimes I have to restart lumberyard.Follow"

Answer: "0I have been working extensively with Lua scripts recently and have had no problem with them updating when saving.What version of LY?How are you implementing the script? Component entity? Standard entity? Other?SharerePost-User-4796539answered 6 years ago0@REDACTEDUSER1.7 but this still occurred in 1.6The Lua Script component entity.Is is because my setup assistant doesn't have 'compile game code' and 'compile lumberyard editor and tools' checked? I'll try installing all required plugins for those and seeing if that helps, although I was pretty sure I did in 1.6... [EDIT - did this, and the scripts still don't want to update]SharerePost-User-5499201answered 6 years ago0Hi, I have the same issues. The Lua scripts are not refreshed every time after Saving them in LuaIde Editor. As a workaround please try turn on debug mode and add breakpoint inner then usually script are updated to fresh one.SharerePost-User-0352889answered 6 years ago0Are you still having the problem? We've seen an issue that is similar to this that is happening sometimes in certain cases which should be fixed for 1.8.SharerePost-User-8353690answered 6 years ago0Hi, I need decompile file luac to lua. Someone help me please. Thankslink file https://drive.google.com/drive/folders/1-fMSJW43fnFia2bZRxoLisRvwpHNzAU8?usp=sharing (you can edit)SharerePost-User-3608725answered 5 years ago"


Question: INVALID_FUNCTION_ARGUMENT: Invalid format: "13-12-2022" is malformed at "-12-2022"

"Hi,I'm trying to convert a string into a date. The format  from the string is 13-12-2022 (or for example 4-12-2022). I've used the follwing query:, date_parse(Openingsdatum, '%d/%m/%Y')In which Openingsdatum refers to the string colum of the dates. I figured out that the query uses tho format  %m%d%y, so it switched. Could somebody explain why I'm getting this error?FollowComment"

Answer: "0Accepted AnswerI believe you just need to replace the / with -.I tried running the below statement with "13-12-2022" and "4-12-2022" . It worksselect date_parse('4-12-2022', '%d-%m-%Y') as does_it_workCommentShareAnanth Tirumanuranswered 9 months agolisannegesch 9 months agoThat would've been very easy but unfortunately I still got an error. A different one this time:SYNTAX_ERROR: line 25:3: Unexpected parameters (varchar, varchar(8)) for function date_format. Expected: date_format(timestamp with time zone, varchar(x)) , date_format(timestamp, varchar(x))This query ran against the "db_retail_datascientists" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: cd450b06-454d-4cb4-9719-b5a01e63e375Sharelisannegesch 9 months agoI'm sorry, wrong error haha. This is the error which I got. But I think I can fix this:INVALID_FUNCTION_ARGUMENT: Invalid format: ""Thank you!Share"


Question: [InternalServerError] Any way to get more specific error message

"I'm trying to get Personalize to work with my data, and it looks like all requirements are met, but I'm still getting "InternalServerError: We encountered an internal error. Please try again." error when initializing Solution creation.Batch imports of Users, Items, and Interactions went well, so it checks out with schemas so I don't have any idea on what's wrong here. Is there a way to get more specific error message or an example of invalid data?FollowCommentDataRipper a year agoI''m having similar issues with AWS Personalize recently. Data loads work perfectly. Solution creation always results in an InternalServerError. I've reloaded data from a previous working Dataset/Solution, exact same data, exact same files on S3, exact same solution type (custom solution). However this still results in an Error. It seems independent of data, schema, solution, it all results in this error. CloudTrail is useless. And it taking advice from the previous answers, Support ticket is unaccessible without a service plan.Share"

Answer: "0In which step of process do you receive the error?Are the schema well formed?CommentShareGiuseppe_Banswered a year agoQuazar a year agoI'm receiving this error during the Solution version's creation. Schemas should not be the issue as I checked them against the documentation and found no issue.Share0CloudTrail may provide more detail about the error. You can read more about CloudTrail with Personalize here:  https://docs.aws.amazon.com/personalize/latest/dg/logging-using-cloudtrail.htmlYou might be exceeding one of the maximums of the Personalize service. Review the Service Maximums as specified in the developer docs here:  https://docs.aws.amazon.com/personalize/latest/dg/personalize-dg.pdfCommentShareEXPERTAshleyMilleranswered a year agoQuazar a year agoCloudTrail, as I've read, will only help with API calls - that won't give me any useful insights, sadly.Share0I believe I may have found a resolution. It appears that AWS Personalize has a Items Service Quota for training, I.e. if you exceed this amount of Items then a solution/model training will fail. This quota is 750k as seen in the documentation. I took a previous solution that was failing, limited the Item dataset to 750k, and magically the solution finished training.This is potentially problematic if you have a larger Items Data set. But it also seems that the quota may potentially be increased with a standard support ticket that does not require paid support.CommentShareDataRipperanswered a year ago-1I would raise a support ticket for this issue. The support team have the ability to troubleshoot within the service to determine what failed in this case.CommentShareEXPERTBrettski-AWSanswered a year agoQuazar a year agoIs there other way to submit a ticket than with paid developer support?Share"


Question: OSX V3 Client Command Key Remapping

"Hello,In the v2 osx workspaces client I could remap the command key to the windows key using the following terminal command:defaults write "com.amazon.Amazon WorkSpaces Client" remap_cmd_to_ctrl 0(found on a previous thread here https://forums.aws.amazon.com/thread.jspa?messageID=617918 )This command doesn't seem to work in the v3 client anymore.Is it possible to use the command key for the windows key in v3?Thanks!FollowComment"

Answer: "0Seems this has just been added to the latest client. Thanks!CommentSharehuwanswered 3 years ago0Which version was it just added to? I have the most recent version. Last updated Feb 17. And it is not working for me. Which is really anoying since the remap does not even work properly. For example cmd_c remaps to ctl_c, But cmd_shift_c does not remap to ctrl_shift_c.CommentSharepncaanswered 3 years ago0The update just showed up for me 3.0.5. Can confirm it works! thanks :)Even better it fixed the remap of command_shift_key. So now I can nicely use command as control in vscode in workspacesEdited by: pnca on Mar 26, 2020 5:00 PMCommentSharepncaanswered 3 years ago"


Question: Ingest data from a REST API and store into Redshift

"We have a use case where we need to retrieve data from an external system using a REST API interface and store it into Redshift. The volume of data is expected to be quite small and the process needs to run on a schedule, once a day.What tools and architecture is recommended for this?Thanks!FollowComment"

Answer: "0Accepted AnswerHi,I would reccomend the following:Use EventBridge Scheduler https://docs.aws.amazon.com/scheduler/latest/UserGuide/getting-started.html and associate it with a lambda function which has to be in a VPC.if your data from third party does not take minutes to be found, I would use a lambda function with your favorite programming language of choice. As the redshift cluster needs to be in a VPC, then you need to provision a NAT Gateway in public subnet so that you are able to call the api via internetif is the same lambda, then you can execute statements towards redshift, this is an example in python: https://github.com/aws-samples/aws-lambda-redshift-event-driven-app/blob/main/LambdaRedshiftDataApiETL.py.If you want to have separated lambdas for retrieving data and store data to redshift, you could consider to use step function with 2 states, one for each lambda (retrieve data and store to redshift).This link contains part of what you are trying to accomplish: https://aws.amazon.com/blogs/big-data/building-an-event-driven-application-with-aws-lambda-and-the-amazon-redshift-data-api/Hope it helps ;)CommentShareEXPERTalatechanswered 2 months agosanimesa 2 months agoThank you so much, this is very helpful.Share"


Question: Errors at dimensions (empty value) in Timestream from an IoT Rule

"Hello:I'm trying to insert data into Timestream from AWS IoT, where I created a rule as:SELECT * FROM 'dataTopic'ACTIONS: Write a message into a Timestream      DB: test,      table:  sensors,      dimension name: device,      dimension value: ${device}Republish a message to an AWS IoT topic: testERROR ACTION:Republish a message to an AWS IoT topic: errorAnd publishing data as:{       "device": "abc123",       "temperature": "24.50",       "humidity": "49"}works fine.NOW, my real data is actually like this;{  "state": {    "reported": {       "device": "abc123",       "temperature": "24.50",       "humidity": "49"   }  }}So I had to modify my Rule as:SELECT state.reported.* FROM 'dataTopic'but when I test it, I get an error from Timestream as it seems "failures" : [ {    "failedAction" : "TimestreamAction",    "failedResource" : "test#sensors",    "errorMessage" : "Failed to write records to Timestream. The error received was 'Errors at dimensions.0: [Dimension value can not be empty.]'. Message arrived on dataTopic, Action: timestream, Database: test, Table: sensors"However, checking the data received at topic test, I don't see differences with the original data;{  "device" : "abc123",  "temperature" : "24.50",  "humidity" : "49"}What could be the problem? So far, I see same data being ingested but for some reason, Timestream is seeing something different. I tried to use Cloudwatch to see what exactly is Timestream receiving, but I couldn't see the logs from this service.I would appreciate any help.ThanksFollowComment"

Answer: "1Accepted AnswerThe root cause for the issue is that you can't use the output of IoT SQL statements in substitution templates. So you can use SELECT state.reported.* to generate an input for the Timestream action, but for dimension value you can only reference the device by ${state.reported.device}.If for whatever reason you can't use  ${state.reported.device} and need to use ${device} for dimension, the simplest way to work around here is to use "Republish" action with the content of SELECT state.reported.* to another IoT Rule. To make it cost efficient you can republish to another IoT Rule using basic Ingest, e.g. using topic like $aws/rules/MyRule. However, for your use case I am quite confident that the approach I describe above should work and you don' need a second IoT Rule.CommentShareAndrei Sanswered a year agoAWS-User-SOS a year agoThanks for the answer.The problem is I'm targeting sensor's agnostic code, so each sensor might have a different name for it's sensors (i.e.; temperature, temperature_internal, temperature_external, temp, t1, etc.). Is there any way to target this use case?ShareAndrei S a year agoSorry AWS-User-SOS, the answer I provided was worded in a confusing way, I updated it to make it easier to understand. Is it fair to assume that "device" attribute is available in each message?  If so, you approach will work if you replace dimension value: ${device}with dimension value: ${state.reported.device}Share"


Question: SimulateCustomPolicy operation: Invalid Input Actions: [kms:Decrypt] and [kms:List*] require different authorization information

"Getting "Invalid Input Actions" while making SimulateCustomPolicy with 2 KMS actions, works fine if pass 1 action at a time with same resource ARN and same PolicyInputList.Below are some variations I tried in action-names and resource-arn, it is weird that multiple action call is failing only for KMS. I have tired cloudwatch, sqs calls with multiple actions and resource arn and working fine.Failing:aws iam simulate-custom-policy --policy-input-list '{"Version":"2012-10-17","Statement": [.....]}' --action-names kms:Decrypt kms:List* --resource-arns arn:aws:kms:::key/abc arn:aws:kms:::key/xyzPassed:aws iam simulate-custom-policy --policy-input-list '{"Version":"2012-10-17","Statement": [.....]}' --action-names kms:List* --resource-arns arn:aws:kms:::key/xyz arn:aws:kms:::key/abcPassed:aws iam simulate-custom-policy --policy-input-list '{"Version":"2012-10-17","Statement": [.....]}' --action-names kms:Decrypt  --resource-arns arn:aws:kms:::key/xyz arn:aws:kms:::key/abcFollowComment"

Answer: "1Hi,Thank you for contacting us! I understand that you would like to simulate a custom policy to determine the policy's effective permissions evaluated against multiple actions and resources.I confirm that you are able to use the 'simulate-custom-policy' CLI command on multiple actions and resources. The following sample command worked for me:aws iam simulate-custom-policy --policy-input-list '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"kms:*","Resource":"arn:aws:kms:us-east-1:<account-ID>:key/12345-6789-12345asdf-fghj-123455yz"}]}'  --action-names "kms:Decrypt" "kms:ListGrants" --resource-arns "arn:aws:kms:us-east-1:<account-ID>:key/12345-6789-12345asdf-fghj-123455yz" "arn:aws:kms:us-east-1:<account-ID>:key/abcdef-6789-12345asdf-fghj-123455abcd"Note the format I have used to include multiple action names and resources within double quotes.This syntax for passing multiple action names and resources is also outlined in the following document under the --action-names and --resource-arns CLI options:https://docs.aws.amazon.com/cli/latest/reference/iam/simulate-custom-policy.htmlPlease let us know if you need any further assistance. We'll be glad to assist!CommentShareSUPPORT ENGINEERSumukhi_Panswered a year ago0I think I found the issue, the policy has actions names with STAR. Like kms:List* to include all the actions starts with List.I have tried few other combinations with other AWS services actions (i.e. S3, CloudWatch, CloudFormation) and it seems the same issue. It only works when Resource is provided with *. If Resource has ARN and Action name has STAR it will fail.CommentShareManananswered a year ago"


Question: AWS Transcribe - Getting english words also in hindi when trying on hindi call audio. Expected english words to get in english

"Hi,I am getting english words also in hindi when trying AWS transcribe on hindi call audio as shown below. But I need english words to be in english and hindi words to be in hindi (Hinglish) in the transcript. What settings do I need to do for that? I also tried 'Automatic multiple languages identification' by adding en-IN and hi-IN in Language options, but still english words are coming in hindi only.Example:Output by aws transcribe: मैंने ये सोचना देने के लिए कॉल कर रहा था की आनेवाले संडे को उससे स्कूल के बच्चों के लिए ऑनलाइन सेमिनार था ।Expected: मैंने ये सोचना देने के लिए call कर रहा था की आनेवाले sunday  को उससे स्कूल के बच्चों के लिए online seminar था ।Where as for telugu (te-IN) language, I am getting expected output where telugu words are in telugu, and english words are in english. So, I am thinking there must be a way for such one for Hindi audio also?FollowComment"


Question: Windows cannot access \\filesystemid\share

"Hello,I was wondering if anyone could provide some guidance. I've got a share built in us-east-1. There is a trust between my on prem domain and the managed ad fsx is joined to. The "Everyone" group and my specific user account from the on prem domain have full permissions on the share. According to this post, it seems the share should be accessible via VPN: https://aws.amazon.com/about-aws/whats-new/2019/02/amazon-fsx-for-windows-file-server-now-supports-on-premises-access/However, when I attempt to connect to the share from an on prem machine in the trusted domain with my user account, I receive the following error message"windows cannot access \filesystemid.managedad.com\share Check the spelling of the name. Otherwise there might be a problem with your network..."There's no issue with network connectivity, VPN is up, routes are there, SGs are allow all from the on prem subnet, NACLs are allow all inbound and outbound, host based firewalls are off and network based firewalls are allow all outbound, I can resolve host names in the managed ad via my on prem forwarder (including the IP of the filesystem), I can ping and rdp into stuff in the same subnet, heck even my VPC flow logs for the FSX network interface show Accepts from my on prem host to the fsx eni on ports 445, 139, and 120.Despite all this, I get the above error when attempting to use the share, and I cannot telnet to the IP of the share on port 445 from my on prem machine. Telnet to the same port and IP from within the subnet works. Again, there is nothing but Accepts in my flow logs. It seems like it has to be fsx dropping the traffic? What am I missing?Any help would be greatly appreciated.FollowComment"

Answer: "0Hello,The new access capabilities announced today (access over AWS Direct Connect, VPN, VPC Peering, or Transit Gateway) are available for all new Amazon FSx for Windows File Server file systems.Can you please verify that the file system you are attempting to access from your on-premises network was created today (after the launch announcement at 9am PT on 2/22)? If this file system was created at an earlier time, you can create a new file system containing your existing data by taking a backup and creating a new file system from that backup. See the following page for more information on how to create and restore from backups: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/using-backups.html.Best wishes,AndyCommentSharecrudge-awsanswered 4 years ago0Thank you!CommentSharevDingusanswered 4 years ago"


Question: Using NLB as a listener for HTTPS

"Hi,Is it possible to define a NLB as an HTTPS endpoint, terminating SSL and forwarding traffic to an EKS cluster? (Assuming I don't need URL routing)I'm trying to figure out which option would be cheaper, ALB or NLB, assuming both are possible.Thank you!FollowComment"

Answer: "0Accepted AnswerYes it would be possible to terminate HTTPS (TLS) traffic with NLB, by using a TLS listener as documented here.Generally speaking, we could think about if ALB's layer 7 features such as WAF or Advanced Request Routing would be of help, otherwise LCU cost of NLB is slightly cheaper than ALB from the connections perspective. Refer to the pricing page for more details.CommentShareweidianswered 3 months agoEXPERTTushar_Jreviewed 3 months ago"


Question: Very new to IoT. Is AWS IoT correct for my business use case?

"My company is developing a raspberry pi consumer electronics product that will be connected to the internet in our users' homes. Users will be able to tell the device what to do via Alexa voice commands.We need a solution forKeeping the remote devices listening for commands (from lambda)Keeping the remote devices up-to-date (software/security)Activating/deactivating devices as subscribers come and goIt appears that AWS IoT might be good for this use case, but the tutorials seem to indicate the service is for managing devices WITHIN your own company... i.e. lots of varied devices in, say, a factory.Is AWS IoT also intended for my use case -- where we're sending thousands of the same device to end users (i.e. off our own premises, no longer under our direct control*)?Keep in mind: *Our devices cannot be encrypted and users could theoretically access all the information on the SD card. This means that multi-user private keys are out of the question. (We can still install a single-use private key or unique identifier on the device... but it would need to be unique for every device.)Thanks in advance for confirmation that AWS IoT is suitable for this use case.Edited by: Cyrus on Oct 3, 2019 5:48 AMFollowComment"

Answer: "0Hi Cyrus,AWS IoT has many customers in the consumer electronics space. See https://aws.amazon.com/solutions/case-studies/iot/ for a few references. The services offered are designed with managing a fleet of devices sold to many end customers. There are multiple features to deliver the specified capabilities, including support for private key per device. I'm linking a few resources you may find useful.https://aws.amazon.com/blogs/iot/using-device-jobs-for-over-the-air-updates/https://aws.amazon.com/blogs/iot/setting-up-just-in-time-provisioning-with-aws-iot-core/https://aws.amazon.com/iot/solutions/connected-home/iot-and-alexa/https://d1.awsstatic.com/whitepapers/architecture/AWS-IoT-Lens.pdfHTH,Ryan@AWSCommentShareRyan_Banswered 4 years ago0Awesome. That was very helpful and I now have a lambda function sending job and topic messages to my (only) raspberry pi device. I have a followup question, but will post separately.CommentShareCyrusanswered 4 years ago"


Question: Can't launch valid JSON CFN except through Designer

"I'm not able to launch valid CloudFormation JSON templates from either direct upload or when they're placed in an S3 bucket -- when I ask Designer what the problem is via "View In Designer", I see the most baffling syntax highlighting problem ( https://imgur.com/a/Q3aVtPq ). However, for these same templates, if I upload them directly into Designer, Designer accepts them as valid without issue, and I can proceed with stack creation.Please see https://s3.amazonaws.com/openemr-cfn-useast1/OpenEMR-Express-Plus.json for an example of a template that CloudFormation cannot parse (but Designer can load), or see https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=OpenEMR&templateURL=https://s3.amazonaws.com/openemr-cfn-useast1/OpenEMR-Express-Plus.json for one-stop review of the issue.Thanks!FollowComment"

Answer: "0Seems you figured it out. It works now when I tested via validate-template as well as direct upload. :)CommentShareEvanswered a year agoasher a year agoHello, Ev.I appreciate you checking! Unfortunately, I didn't change anything and after testing just now I'm still seeing the same behavior -- on two otherwise-unconnected AWS accounts, no less. As soon as I hit the orange "Next" button I slap right back to the same screen with a red banner announcing "Template contains invalid characters", and selecting "View in Designer" gives the same deranged parse I quoted in the screenshot.Is there anything I can provide to help narrow this issue down?Shareasher a year agoJust to let you know, I had another user test and verify this issue as well -- that's two people, four accounts, that have uniformly shown this behavior. Is there a CR/LF thing that Designer doesn't get tripped up by but straight import does, maybe?Share0Okay, I found it. My stack files were being built by the Python library troposphere and written to disk via pipe, and SOMEWHERE in that chain of great decisions the files were being written in UTF-16 encoding, which explains all of this behavior -- CloudFormation is unable to parse the file, and Designer correctly shows the bloat of incomprehensible two-byte characters (which is why everything was spaced out funny in the parse screenshot) but when the file is directly uploaded into Designer, Designer is smart enough to transcode the file back into UTF-8 and export something CloudFormation could accept.To me this is a clear CloudFormation bug -- if it doesn't like the encoding it should be detecting and rejecting it on those terms, because the only reason I figured this out is because I spotted VSCode mention UTF16 when I was uselessly toggling the CRLF encoding.Thanks!CommentShareasheranswered a year ago"


Question: Is there a cost for the data transfer between Redshift and QuickSight

"Hello,in the case a customer uses QuickSight to Access data within a VPC (as in https://docs.aws.amazon.com/quicksight/latest/user/working-with-aws-vpc.html) on which, for example, redshift is running, will the customer be charged for data transfer out of the the VPC. If yes, will the cost be based on the PrivateLink price,  the Internet price or another priceThanks a lotFollowComment"

Answer: "0Accepted Answer"Network traffic from Amazon QuickSight then originates from this network interface when Amazon QuickSight connects to a database or other instance within your VPC using a VPC connection. Because this network interface exists inside your VPC, traffic originating from it can reach destinations within your VPC using their private IP addresses."It's not PrivateLink - it is an ENI in the VPC which allows QuickSight to access data sources within a VPC. Since it is an ENI there's no data transfer fee within an AZ. If the traffic cross AZs there'd be an inter-AZ data transfer fee.CommentShareAWS-James-Devineanswered 4 years ago"