Question: Serverless RDS MySQL will not scale to 0

"I am experimenting with a serverless RDS instance. It has the following configuration:a minimum Aurora capacity unit (ACU) of 1 (there is no option for 0)autoscaling timeout of 2 minutes"scale to 0 ACUs when cluster is idle" is checkedamount of time that the cluster can be idle before scaling is 15 minutesHowever, over the past 3 hours, with zero connections to the database, the "serverless database capacity (count)" graph remains at 1. It has brief moments when it dips to 0, but it does not stay at 0, despite no active connections for hours. How do I ensure that the database can scale to 0?FollowComment"

Answer: "1Accepted AnswerHi there.From Serverless documentation, if any "database connections are requested when an Aurora Serverless DB cluster is paused, the DB cluster automatically resumes and services the connection requests", so I'd recommend checking not only that the DatabaseConnections CW metric is zero (which indicates no persistent connections), but also that the ConnectionAttempts CW metric is zero for longer than the SecondsUntilAutoPause value (15 minutes in your setup). Any connection request/attempt within the SecondsUntilAutoPause time frame resets the AutoPause counter.If ConnectionAttempts is greater than zero at any point in time and you're not sure where it comes from, I'd then recommend enabling audit for the CONNECT event on Aurora Advanced Audit settings for your cluster, and looking into the logged events in the CW Logs log group when it happens again after enabling audit.I hope this helps. If you'd like or need a more detailed investigation into your cluster, I'd recommend opening a technical case with AWS Support, as they'll be able to work with you through it, step by step.CommentShareValter_Ranswered a year agoamoffat a year agoYou solved the mystery! The ConnectionAttempts metric was the key. It was keeping the ACUs from scaling down, and the source was an NLB's health check on the target group containing the database. Once I removed the target group from the NLB (it was just for debugging anyways), the ACUs scaled down to 0. Thank you!Share0Hello!Good question.  You're right on the configuration.  You cannot have the minimum capacity set to less than 1.Check out the option to "Pause compute capacity after consecutive minutes of inactivity".  Default is 5 minutes, but you can configure this to your needs: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.how-it-works.html#aurora-serverless.how-it-works.pause-resume.For example, if you using CloudFormation - make sure the AutoPause is set to true. "ScalingConfiguration" : {                  "AutoPause" : true,                  "MinCapacity" : 4,                  "MaxCapacity" : 32,                  "SecondsUntilAutoPause" : 1000}Another thing to pay attention to: if autoscaling doesn't find a scaling point before timing out, Aurora will keep the cluster at the current capacity.  To change this behavior, you can select the Force the capacity change option as well.  Check that at the ForceApplyCapacityChange property.  More information here: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.how-it-works.html#aurora-serverless.how-it-works.timeout-actionCommentSharejsoncanswered a year agoamoffat a year agoThanks for the response. In my original post, I noted that I have enabled "scale to 0 ACUs when cluster is idle", which is under the "pause after inactivity" section of my configuration. I shouldn't need to (nor want to) enable "force capacity change", since there are no db connections to my database. Here is the relevant section of my config, as retrieved from aws rds describe-db-clusters            "Capacity": 1,            "EngineMode": "serverless",            "ScalingConfigurationInfo": {                "MinCapacity": 1,                "MaxCapacity": 64,                "AutoPause": true,                "SecondsUntilAutoPause": 900,                "TimeoutAction": "RollbackCapacityChange",                "SecondsBeforeTimeout": 120            },The database doesn't seem to ever want to scale down past 1 though.Share0My recent billing statement for December 2021 shows that RDS is not scaling down at all over the course of the month:Amazon Relational Database Service for Aurora MySQL $44.42$0.06 per Aurora Capacity Unit hour running Amazon Aurora MySQL Serverless740.341 ACU-Hr $44.42USD 0.021 per GB-month of backup storage exceeding free allocation for Aurora MySQL0.169 GB-Mo $0.00CommentShareamoffatanswered a year ago"


Question: Invoke Lambda function URL

"How I can invoke a lambda function URL with IAM role?I know how it can be invoked using Auth type as IAM_USER  by generating AWSSIGv4.But not sure or have the step to use the same with an assigned Iam role instead of iam user.Suppose i enable lambda url Auth type as IAM instead of None. Then in the resource-based permission granted function url invoke by using an IAM role  X.Then I assigned the iam role X to an EC2 instance.In this case, what do I need to do to invoke the lambda function URL from the ec2 instance?FollowComment"

Answer: 0Accepted AnswerFinally i got it as working1] role itself added to trusted entities of the role assigned to ec2.2] From the instance using assume role-generated credentials.3] used those credentials to generate AWSSIGv44] Invoked lambda function url with AWSSIGv4in lambda function url Auth type iam and resource-based identity permission set with the role in step1.CommentShareManu Sabuanswered a month ago0You need to do the same thing as with an IAM user. You get the Role's credentials and you use them to SigV4 sign the request.CommentShareEXPERTUrianswered a month ago0I already tried that way by getting a temporary access key and secret of the IAM role and then used it for generating AWSSIGv4. But got "The security token included in the request is invalid."Note:-used the key and secret here curl http://169.254.169.254/latest/meta-data/iam/security-credentials/$role to generate AWSSIGv4CommentShareManu Sabuanswered a month ago


Question: Examples: Rust Neptune client & Gremlin client

"I'd love to use Neptune in my next project, but I've been unable to find any examples of how to set up and start querying with the Rust Neptune / Gremlin client. Do you know of any examples?FollowComment"

Answer: "1There is a Gremlin Rust client located at https://github.com/wolf4ood/gremlin-rs/. It is not one of the official Apache TInkerPop Gremlin clients but there are people using it with Neptune.That repo includes some sample code here https://github.com/wolf4ood/gremlin-rs/tree/master/gremlin-tutorial/src/chaptersKeep in mind though, that Amazon Neptune, to a Gremlin client, looks just the same as a Gremlin Server. The difference being instead of connecting to (for example) "localhost" running on your desktop/laptop, you connect to the remote Neptune endpoint.There are some considerations to take into account there in terms of how you allow access to the Neptune VPC, but those are the same with any of the clients.Please let us know if you have additional questions.CommentShareAWS-KRLanswered a year ago"


Question: Disable bucket ACL(s) in a given AWS account

"Hi AWS,I have a requirement where I need to disable the Access Control List (ACLs) for the s3 buckets in a given AWS account. Doing this manually is a time consuming and not the appropriate method so I have written a basic boto3 script to accomplish the same. The code snippet is as follows:import boto3def main():    bucket_acl()def bucket_acl():    client = boto3.client('s3')    response = client.list_buckets()    for bucket in response['Buckets']:        name = bucket['Name']        bucket_acl_status = client.get_bucket_acl(            Bucket=name        )        print(bucket_acl_status['Grants'])        disable_bucket_acl = client.put_bucket_ownership_controls(            Bucket=name,            OwnershipControls={                'Rules': [                    {                        'ObjectOwnership': 'BucketOwnerEnforced'                    },                ]            }        )        print(disable_bucket_acl)main()While I am running the python code, the following error is coming:botocore.exceptions.ClientError: An error occurred (InvalidBucketAclWithObjectOwnership) when calling the PutBucketOwnershipControls operation: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced settingI was following the documentation to disable the bucket ACL: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/put_bucket_ownership_controls.html#but it didn't work out. Please help!FollowComment"

Answer: "2From the docs is looks like you have to reset the ACL and migrate the permissions to a bucket policy.For example, if an existing bucket ACL grants public read access, you cannot apply the bucket owner enforced setting for Object Ownership until you migrate these ACL permissions to a bucket policy and reset your bucket ACL to the default private ACL. CommentShareEXPERTkentradanswered a month agoEXPERTalatechreviewed a month agoArjun Goel a month agoIs it possible that someone from the AWS community will update the boto3 script I provided above by taking an example of a dummy S3 bucket by applying different ACL types @kentrad and @alatech?Share"


Question: Strict transport security header on appsync responses

What's the best way to have strict transport security header added to appsync responses?I have seen recommendations around setting up cloudfront in front of appsync and setting the headers in cloudfront.FollowComment

Answer: "0Hi,I do see that there are similar workarounds to the workaround which you have mentioned. However, there is a feature that was just recently released by AppSync which adds support for custom response headers. Please refer to this page for the announcement of the feature.This adds a new resolver utility $util.http.addResponseHeaders() to configure additional headers in the response for a GraphQL API operation.The other workarounds will add additional workload/steps so it is recommended to use this utility to add headers in the appsync response.CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: authentication error with SAML + EMR + Lake formation

"I have an errror when I try to login with an IDP (Auth0) and EMR integrated with Lake formation.I'm following the workshop Lake formation & EMR integrationI have configured an Auth0 account, aws IDP, EMR cluster (aws service) and  data lake permissions with (idp users).But I have an error when I do the login with [EMR Zeppelin] (https://EMRMasterNodeDNS:8442/gateway/default/zeppelin/). I do the login with Auth0 and EMR but I can't do it with lakeformation.This is the error that I had on EMR proxy agent:Caused by: java.lang.NullPointerException at org.apache.knox.gateway.util.SamlUtils.getSamlAwsRoleAttributeValues(SamlUtils.java:149) at org.apache.knox.gateway.pac4j.aws.AwsLakeFormationSamlImpl.getAwsCredentials(AwsLakeFormationSamlImpl.java:106) at org.apache.knox.gateway.pac4j.aws.AwsSamlHandler.processSamlResponse(AwsSamlHandler.java:78) at org.apache.knox.gateway.pac4j.filter.Pac4jDispatcherFilter.doFilter(Pac4jDispatcherFilter.java:234) at org.apache.knox.gateway.GatewayFilter$Holder.doFilter(GatewayFilter.java:372) at org.apache.knox.gateway.GatewayFilter$Chain.doFilter(GatewayFilter.java:272) at org.apache.knox.gateway.filter.XForwardedHeaderFilter.doFilter(XForwardedHeaderFilter.java:30) at org.apache.knox.gateway.filter.AbstractGatewayFilter.doFilter(AbstractGatewayFilter.java:61)I think that I need to do the step 6 on the documentation amazon EMR. But I don't know were I have to do this configuration.Any help?Thank youFollowComment"

Answer: "0Based on the use case , I would recommend you to explore the following options for fine grain data authorization with Amazon EMR.Amazon EMR recently released a new feature to support Job Runtime roles with EMR Steps for batch jobs.  Take a look the following blogs post on how to implement.https://aws.amazon.com/blogs/big-data/introducing-runtime-roles-for-amazon-emr-steps-use-iam-roles-and-aws-lake-formation-for-access-control-with-amazon-emr/Also for interactive workloads, currently Amazon SageMake Studio supports AWS Lake Formation integration with EMR for fine-grain data authorization and following blog has more details on how this works.https://aws.amazon.com/blogs/machine-learning/apply-fine-grained-data-access-controls-with-aws-lake-formation-and-amazon-emr-from-amazon-sagemaker-studio/CommentShareSreekanth Munigatianswered 5 months ago"


Question: GameServer multiple versions

"Hi.I'm trying to find a way that will result in deploying a new version of GameServer (C#) without downtime and less GameLift infra management (builds, fleets, queues etc) and also to be able to support multiple GameServer (and clients) versions in parallel, without launching a new set of GameLift infra (builds, fleets, queues etc).This ideea consists in using the GameServer binary (server process) to load the required version code from a DLL.The versioned DLLs will be stored in S3 together with a JSON index file. The advantage is that for a new version I just need to upload the new DLL to S3 and update the JSON index file, then the server process will pick up the changes and do the rest.Actual flow:When the GameServer EC2 instance launches, will start the 50 processes that will check-in with GameLift as part of the InitSDK and then will wait for a GameSession/onStartGameSession. The server process gets the version DLL that should load, from GameSession data and downloads it from S3. Then, the server process runs the onStartGameSession callback function. When ready to accept player connections, the server process calls ActivateGameSession() and waits for player connections.Will this flow work?Thank you.FollowComment"

Answer: "0Hi @REDACTEDUSERInteresting idea. My hunch is that this shouldn't be something used in production since this goes against any examples I've seen for large software development. However, I don't see why this cannot be achieved.First and foremost, if you are just trying to speed up development iteration or testing different versions of build, then there is a workaround to replace the build directly on the instance. Here is a post on this: https://forums.awsgametech.com/t/how-to-ssh-to-instance-and-replace-build-in-place-to-iterate-quickly/11339If you are thinking about doing this in production, here are some thoughts that I have about this approach:You'll probably want to cache the DLL and avoid downloading the same DLL twice. This is to save cost. However, this will certainly increase complexity. What happens if 2 processes start at the same time? Or if one process haven't finished downloading and another process starts up requiring the DLL? You'll need some orchestration and locking mechanism.Even if you apply caching on an instance level, every single instance will initiate at least 1 S3 download per version. Depends on the number of instances that you have, the sizes of the DLLs, and the cadence of your update, the S3 download cost may add up. See S3 pricing plan. This is a scalability concern.I'm curious to know why you think deploying new version of GameServer would cause downtime. The recommended practice is that, you create new fleets and put them in a new queue (easy if you have proper automation setup), then you swap the queue ARN in your backend service so that StartGameSessionPlacement/StartMatchmaking now calls the new queue with the new build. Is it possible that you are storing queue name in the client directly? If that's the case then we'd recommending adding a backend service to proxy between clients and GameLift. Not only this gives your more flexibility like hotswapping queue ARN, there is also security improvement (i.e. you no longer need to store AWS credentials on the client and risk getting bad actors denying your GameLift access via excessive calls that triggers throttling). See example of game backend service: https://github.com/aws-samples/aws-gamelift-and-serverless-backend-sample. You can also use the GameLift Unity Plugin to create a backend within minutes: https://github.com/aws/amazon-gamelift-plugin-unityCommentSharerePost-User-7108006answered 2 years ago0Hi.Thank you for the reply.  Valuable information in there. Didn't know that you can replace the binary in an active fleet. I though that the GameLift Java service would complain and restart the instance.1&2 Yes, a cache mechanism should be in place and only one time the DLL will be downloaded on an instance (with validation like SHA etc).Actually we are not changing the Queue arn. We are using the same Queue and just replacing/updating the fleets in that Queue. The client doesn't have the information about Queue or anything GameLift related. The client is calling Lambdas for MatchMaking Start/Status/Stop.The reason for the initial post was to explore other possibilities of doing A/B testing, blue-green/canary deployments, staged rollouts for GameServers in GameLift.CommentSharerePost-User-0378389answered 2 years ago0Got it, your setup sounds great. Please let us know how well it works if you decide to go with this approach :)You might already know this, but just leaving the more conventional alternatives here:A/B testing wise, you can create 2 MM configurations with different queues containing different builds (it's not advisable to put fleets with different builds in the same queue since you cannot guarantee % of distribution), and use lambda to randomly select a configuration to call StartMatchmaking.Above can also be applied to staged rollouts, where your lambda would gradually dial down the MM configuration with the older build, and dial back up to rollback if issues occur with your new builds. If you setup autoscaling on your fleets correctly, your instances on the underutilized fleets should eventually be scaled in thus saving cost.CommentSharerePost-User-7108006answered 2 years ago0Regarding your comment for staged rollouts, do you have any example of the Lambda that will handle that? I'm curious how does the Lambda keeps track of the percentage and where does it get the info about the current MM configurations to send players to. I was thinking that a microservice will be better suited for this kind of task.Auto scaling is configured together with a buffer to compensate for the slow instance start.Thank you.CommentSharerePost-User-0378389answered 2 years ago0Either Lambda (serverless) or microservice (I assume you meant your own managed resources) would work here. I only mentioned Lambda because that's what you said your clients are currently calling.With lambda, if implementing the AB testing logic by ourselves, on top of my head, one way would be to create a hashing function for your player ids, for instance, hash to values uniformly distributed between 0 and 100 (example), and in your lambda environment variable, assign a THRESHOLD integer (e.g. 25): if the hash is greater than threshold, use logic A, if the hash is less than the threshold, use logic B.If you want to use a managed solution within AWS, this could be helpful: https://medium.com/buildit/a-b-testing-on-aws-cloudfront-with-lambda-edge-a22dd82e9d12CommentSharerePost-User-7108006answered 2 years ago0Great stuff. Appreciate your responses. Cheers!CommentSharerePost-User-0378389answered 2 years ago"


Question: Column comment on late binding view ("NO SCHEMA BINDING") not possible

"For our database documentation we would like to add comments to columns in different views. Most of those views are currently late-binding views.Example for a late binding view:CREATE OR REPLACE VIEW schema.viewASSELECT table."Col1", table."Col2"FROM schema.tableWITH NO SCHEMA BINDING;When trying to add a column comment to a late binding view byCOMMENT ON COLUMN schema.view."Col1" IS 'Some useful information';we  get the following error message:"Column "Col1" of relation "table" does not exist;"Any advice on how to add comments on late binding views?Thank you!FollowComment"

Answer: 0Are quotation marks necessary?I felt it would work in the following way.COMMENT ON COLUMN schema.view.Col1 IS 'Some useful information';CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-0188291 a month agoThank you for your answer!The quotation marks are not strictly necessary. Only in the case of case sensitive data it's relevant.Leaving them away does not change the behavior unfortunately...Share


Question: Mirgrating/recovering inaccessible server

"Hello,I am wondering if there is a way to recover data/information or migrate a EC2 server (that I can no longer access due to issues with MRD) to another AWS EC2 server?FollowCommentJohn Vold a year agoWhat is MRD?Share"

Answer: "0I'm not exactly sure what is meant by "MRD"?   As long as the volume is still available, you can just spin up another EC2 instance and mount that volume to the new EC2 instance to recover the data.CommentShareMichael_Sanswered a year ago"


Question: Unable to Sign-in to AWS Skill Builder

"I am unable to sign-in to AWS Skill Builder, message says, Something went wrong. I used my www.amazon.in, log-in credentials, to sign-in to AWS Skill Builder. Please help?FollowComment"

Answer: "0Hi,refer to this: https://repost.aws/questions/QUc0gMsU_NTt-3yz40oT8pEQ/problem-on-aws-skill-builder-login.Hope it helps ;)CommentShareEXPERTalatechanswered a month ago"


Question: emr primary can't rpc core on port 8020 for HUE HADOOP

Trying to use HUE as a web interface hosted on EMR server to issue HIVE QL.  The file connection works fine -- can explore S3 files no problem (which probably doesn't require controlled core machines.)  But any attempt to use HIVE QL to create tables (which probably does require controlled core machines for efficiency) results in remote procedure call error: "java.net.NoRouteToHostExceptionNo Route to Host from ip-xxx-xx-xx-xxx.us-west-1.compute.internal/172.31.29.217to       ip-yyy-yy-yy-yyy.us-west-1.compute.internal:8020failed on socket timeout exception: java.net.NoRouteToHostException: No route to host;But according to emr service port listing (https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-service-ports.html) 8020 is used by namenode for rpc and is started automatically -- users should not set up the port for access; violates security.  So what can I do to fix this error?FollowComment

Answer: "1Accepted AnswerAre you sure these IP's / FQDN's belong to same EMR cluster and they have Route to each other ?ip-xxx-xx-xx-xxx.us-west-1.compute.internal/172.31.29.217ip-yyy-yy-yy-yyy.us-west-1.compute.internal:8020Since this is happening on CREATE table statement, I am suspecting that you might be creating a HIVE table on HIVE DB pointing to different cluster's HDFS. Were you using a common HIVE metastore for this cluster and previously terminated EMR cluster ? you can verify the LOCATION on your DB / Table by usingDESCRIBE DATABASE EXTENDED your_database_name or going to Metastore DB and checking the relevant schema.CommentShareMannem Ranswered 5 months ago0You are completely correct.  The problem is that we took the default for AWS GLUE catalog storage -- which is in EMR hdfs which disappears when the cluster is terminated.  In fact we were using a different cluster, but GLUE was trying to get to where its detailed catalog data used to be but no longer existed.Besides the fact the ip address wasn't in our current cluster, the other clue was the error message mentioned that the the core was trying to find out if the data was encrypted -- metadata that only exists in catalog.For others who may be new to GLUE the following info may be interesting.When you create a Hive table without specifying a LOCATION, the table data is stored in the location specified by the hive.metastore.warehouse.dir property. By default, this is a location in HDFS. If another cluster needs to access the table, it fails unless it has adequate permissions to the cluster that created the table. Furthermore, because HDFS storage is transient, if the cluster terminates, the table data is lost, and the table must be recreated.We can update the property "hive.metastore.warehouse.dir" using any one of the below ways.hive shell, set command like belowset hive.metastore.warehouse.dir=s3://cr_test_bucket/prefix1/EMR console , please refer [2] for sample configurations\t[2] Configure applications - https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html/etc/hive/conf/hive-site.xml file in the primary node, we need to restart hive services to reflect the update.CommentSharerePost-User-2802631answered 5 months ago"


Question: "Hosting private with route53, but no domain connection."

"After configuring ineternal alb, I connected to private hosting with A record.Connection with internal alb dns worked fine, but when connecting to the domain (test.example.com) configured for private hosting, an error "ERR_NAME_NOT_RESOLVED" occurs.In the vpc setting, both DNS hostnames and DNS resolution are enabled, and vpc and hosting are created in the same account. And that domain name is not used by any of the domains I host.Is there a way to connect to "test.example.com" without "ERR_NAME_NOT_RESOLVED"?FollowComment"

Answer: 0Accepted AnswerOther vpn Vender DNS config probelm. not aws problem.CommentSharejokeranswered 7 months ago


Question: ALB Rewrite-path and alter

"There's requirements that we need to use ALB in front for path fwd+rewrite at the same time, We expect to use same fqdn, and use path to separate environment for dev, uat, and prod.For Example:app.com/dev/service1 -> Rewrite to -> service1.app.dev-aws-sg.domain.com/service1app.com/uat/service1 ->  Rewrite to -> service1.app.uat-aws-sg.domain.com/service1app.com/prod/service1 -> Rewrite to -> service1.prod.dev-aws-sg.domain.com/service1What should be the good approach for this specific scenario.Thank you in advanced.FollowComment"

Answer: "0I would say a redirect in the ALB listener configuration would be your best bet https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#redirect-actionsIf path =app.com/dev/service1Redirect to:Host: service1.app.dev-aws-sg.domain.comPath:/service1CommentShareAJ_Canswered a year agoChatchai Komrangded a year agoHi AJ_C Thank for your reply, We have worked, and check found out to go with adding a proxy in between the ALB and the targets to perform the URI modification.Share"


Question: "Bug: S3 bucket static website hosting requires an index document value, even if it's just one space (when set in the management console)"

"The AWS S3 service allows turning on static website hosting on a S3 bucket.In the AWS CloudFormation user guide, the IndexDocument field is specified as optional (Required: No).However, in the management console, when configuring an S3 bucket for static website hosting, the "Error document" field is marked "optional", meanwhile "Index document" is not, and trying to save the changes with that field left blank doesn't work (it is highlighted with "Must be at least 1 characters long."). Making "Index document" one empty space makes it no problem.This is in line with what the S3 user guide says:When you enable website hosting, you must also configure and upload an index document.Steps to reproduceView a specific S3 bucket in the S3 management consoleIn the "Properties" tab, scroll down to "Static website hosting" and click "Edit"Under "Static website hosting", select "Enable"Leave "Index document" blankClick "Save changes"The "Index document" field will be highlighted in red with "Must be at least 1 characters long."Enter one empty space in the "Index document" fieldClick "Save changes"The changes will now be saved.Expected results"Index document" should be optional.FollowComment"


Question: Transit gateway

"Hello,I need to attach Transit gateway to below AWS services within MUMBAI regiontwo VPC across two AZstwo direct connect ports attached to direct connect gatewayOne IPsec VPN TunnelQuestionsWill above be treated as  attachments (2 VPC + 1 Direct connect+1 IPsec )Will there be data transfer charges for inter VPC traffic across AZs as I understand data transfer is now free across AZshttps://aws.amazon.com/about-aws/whats-new/2022/04/aws-data-transfer-price-reduction-privatelink-transit-gateway-client-vpn-services/So , will the data processing charges for transit gateway only be applicable for IN OUT traffic flowing from Direct connect towards VPC?FollowComment"

Answer: "1Hello,Yes, It will be 4 different attachments as you mentioned.Yes, the cross-AZ traffic would be free of charge as mentioned in the link above.For pricing, you will be charged, AWS Transit Gateway hourly charge & Transit Gateway data processing charge.Refer to https://aws.amazon.com/transit-gateway/pricing/ to be exactly sure of the pricing.Hope this answers your question. for any detailed queries regarding Pricing, please contact AWS Support.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 7 months ago"


Question: NoSQL Workbench - “DDBLocalStart” can’t be opened because (null) is not allowed to open documents in Terminal.

"When I try to run DynamoDB Local using the latest version (3.4.0) of the NoSQL Workbench on my M1 Mac, I get an error:“DDBLocalStart” can’t be opened because (null) is not allowed to open documents in Terminal.It looks like the NoSQL Workbench is trying to shell commands out to start DynamoDB Local?Stopping the local server doesn't work with a similar error.The product feedback sends me to the old forums, which redirect to here...FollowComment"

Answer: "1I faced the same issue on MacOS Ventura with NoSQL Workbench: Version 3.4.0 (3.4.0). I couldn't find a way to allow the app to open the script in the default Terminal. I found a work around though, if you use iTerm, you can set that as your default to open scripts. Hope that helps!CommentShareDinaanswered 5 months ago0Thanks! I doubted it was the problem though, since I code in Neovim in the MacOS Terminal all day. :)But, I checked, and Terminal already has access to all the directories. I also giving the Terminal full disk access and that didn't work either. Doing the same with NoSQL Workbench didn't make any difference either.From an app design point of view, shelling out commands doesn't sound like the ideal way to do things.CommentShareAdrian Heskethanswered 5 months ago-1You may need to grant Terminal permission to access Documents in System Preferences > Security & Privacy > Files and Folders. Alternatively, you can give Terminal Full Disk Access in the same pref pane. DynamoDB Local is .jar file and NoSQL Workbench starts it by invoking a shell command.CommentShareccole-awsanswered 5 months ago"


Question: Does Amazon Cognito supports FIDO passwordless authentication for apple and android?

"I have been looking information but nothing, and it is not clear if it is supported or not the use of FIDO passwordless authentication for apple and android OS in mobile devices in combination with Amazon Cognito. If supported, references appreciated.FollowComment"

Answer: 1Cognito's custom authentication functionality supports passwordless authentication for iOS and android applications with email authentication.References:https://aws.amazon.com/blogs/mobile/implementing-passwordless-email-authentication-with-amazon-cognito/https://aws.amazon.com/blogs/mobile/build-a-mobile-app-with-passwordless-login-on-top-of-aws-amplify/CommentShareAWS-User-9401600answered 5 months ago


Question: Does Kafka Security patches causes data Loss

"Hi there,We recently got a notification about the Kafka MSK security patches update. We had brokers spread across 3 AZs to avoid data loss according to AWS best practices. Upon the patches completion, we realised the Kafka was shut down during the patches, See the Cloudwatch log below.here is the Cluster configuration. Please lemme know if I'm missing anythingauto.create.topics.enable=truedefault.replication.factor=2min.insync.replicas=2num.io.threads=8num.network.threads=5num.partitions=1num.replica.fetchers=2replica.lag.time.max.ms=30000socket.receive.buffer.bytes=102400socket.request.max.bytes=104857600socket.send.buffer.bytes=102400unclean.leader.election.enable=truezookeeper.session.timeout.ms=18000ThanksFollowComment"

Answer: "1Hi there, security patching will trigger a rolling reboot. During this time partition leadership moves from one broker to another as brokers are restarted. Clients can get connection errors with a message saying that Connection refused/Timeout errors or leader is not the same as before, but they request metadata again for the correct leader and automatically retry operations against other available brokers. This could manifest as client side latency but does not impact the functionality of the client and wouldn't cause any data loss as long below best practices are followedEnsuring the topic replication factor (RF) is at least 2 for two-AZ clusters and at least 3 for three-AZ clusters. An RF of 1 can lead to offline partitions during patching.Set minimum in-sync replicas (minISR) to at most RF - 1 to ensure the partition replica set can tolerate one replica being offline or under-replicatedEnsure clients are configured to use multiple broker connection strings. Having multiple brokers in a client’s connection string allows for failover if a specific broker supporting client I/O begins to be patched.Since you have 3AZ, please have RF=3 and minISR=2(this is already set to right number in your config). On producer side configuration please make sure you have enough retries set and since it can take few milliseconds for leaders to transfer to another broker, you can set retry.backoff.ms to 50-100ms so that it can wait for few milliseconds before retrying.CommentShareSUPPORT ENGINEERHarshith_Manswered a year ago"


Question: AWS System Manager Running AWS-RunRemoteScript doesnt redirect stream output to file

"I have a script that runs across our estate. It includes running a SQL script, and ideally I need to capture the output into a text file on that instance. As the Powershell script uses Invoke-SQLCMD, i need to redirect the verbose output to capture it.This works as intended when running the script\line in a PS window direct on the instance and the verbose output is captured in my file $logfile:(Invoke-SQLCMD -ServerInstance ".\$InstanceName" -Query $OptimizeIndexesSQL -Verbose -ErrorAction Stop) 4>&1 | Tee-Object -FilePath $LogFile -AppendWhen the script runs via SSM, it fails to push the verbose output to the file.Why?FollowComment"

Answer: "0Accepted AnswerResolved-ish.AWS SSM Service on each instance runs as "LOCAL SYSTEM", yet the logic to connect to the local SQL instance uses a trusted connection. As LOCAL SYSTEM does not have access to SQL, the running of the script fails. I have since moved the job out to Windows Task Scheduler, which works as intended, but not as clean to manage across multiple instances.It doesnt answer why I didnt get any output within my log file (such as "Access Denied" from SQL), however the initial issue is now closed and resolved a different way.CommentShareinvtomyanswered a year ago0Thanks for your suggestions. All the powershell modifications work, but they still dont write the output to the log file when executed via AWS SSM.I also cannot use AWS-RunPowerShellScript, as I am pulling the .ps1 file from S3 storage. The extract is part of a larger housekeeping script, which would be too cumbersome to put in a single SSM document.CommentShareinvtomyanswered a year agogsfritz 3 months agoI realize this post is quite old now, but...RE: "pulling the .ps1 file from S3 storage". There is an "AWS-RunRemoteScript" document that allows you to copy a script from a specified S3 location onto the local instance and then execute it.RE: Why the script wouldn't write the output.  As you note, the SSMAgent runs as a local user, so is this another permissions issue where the SSMAgent didn't have access to the file ($LogFile) you specified for the output?  Separately, did you try specifying an S3 bucket in the "Output Options" so that the output would be written there?  Of course, in order for this to work you would also need to add the PUT privilege to the S3 bucket in the instance profile associated with the instance.Share0The last option here would solve your issue completely.  You can change the options for your needs.  Lastly, try 'AWS-RunPowerShellScript' instead of 'AWS-RunRemoteScript' maybe.Try this.(Invoke-SQLCMD -ServerInstance ".$InstanceName" -Query $OptimizeIndexesSQL -Verbose 4>&1 -ErrorAction Stop) | Tee-Object -FilePath $LogFile -AppendOr this:(Invoke-SQLCMD -ServerInstance ".$InstanceName" -Query $OptimizeIndexesSQL -Verbose 4>&1 -ErrorAction Stop) | Out-File -FilePath $LogFile -AppendOr this will log ALL the things:Start-Transcript -Path $LogFile # -append , or -force?;Invoke-SQLCMD -ServerInstance ".$InstanceName" -Query $OptimizeIndexesSQL -Verbose 4>&1 -ErrorAction Stop;Stop-TranscriptCommentSharePowershell_is_the_wayanswered a year ago"


Question: SSO with Managed AD as idp - 403 forbidden

"Hi,I've connected the SSO idp to the Managed Active Directory with AD Connector as proxy between SSO and Active Directory.User and groups are sync correctlyI can loggin to the SSOI can attach permission set to accountAfter logging to the SSO when I click on the account to assume the role  I got a 403 error{"message":"No access","__type":"com.amazonaws.switchboard.portal#ForbiddenException"}I don't know where to search to solve this issue.Can you please help me ?RegardsFollowComment"

Answer: "0Accepted AnswerHI,Solved, the issue was a mapping problem between AWS Managed AD and SSO. The SSO user primary-email field was empty.We change the mapping, everything works wellRegardsCommentShareFabienGanswered 4 months agoKisshore Gunasekaran 3 months agoHi @fabieng, can you please share the attribute mapping configured on the SSO.Share0I recommend you review the metadata issued and supported by AWS SSO. Then check the attribute mapping making sure the format is set to "transient"CommentShareGeraanswered 4 months ago"


Question: Verification on employer who contacted me via email

Does this person work for amazon AWS KYC or Accounts Receivable I received two different emails with different phone numbers in two separate invoices plus they responded in LinkedIn too?https://www.linkedin.com/in/patrickcapillas/FollowCommentFranky Chen a year agoPlease verify is the email comes from an @amazon.com or @amazon.ph email address.Share

Answer: "0Do not open any attachments or click any links on emails that seem suspicious.If you’re not sure that the email is from Amazon, see:https://repost.aws/knowledge-center/amazon-spoofed-emailTo report a suspicious email, follow these instructions:https://aws.amazon.com/security/report-suspicious-emails/CommentShareBriNasAWSanswered a month ago"


Question: Timesream multi-measure vs single measure record - best practices

"I have 3 types of devices in the same site (I need them in the same table, cause join between tables is not supported)device A - have 3 measures:   temperature, power, voltagedevice B - have 3 measures:   temperature, power, socdevice C -have 2 measures:  temperature, powerI have 2 option - which on is the best?single measure tablemulti measure table -  however soc and/or voltage column will be null in more than half of the records.Will the answer be any different if there was 20 common measures (that exists in all record) and 2 specific measures (that exist in only some of the records)? What about 10 common and 1 specific?Is there any rule of thumb or best practice when to choose multi over single?Is there any cost to an empty column in a multi record table?Thank You!!FollowCommentExtracted a year agoI would love to know this as well! Specifically whether there is a cost associated with empty measures in multi-measure records.What if I have 250 different measures and almost always receive just one or two of them at the same time? (But sometimes many more)Share"

Answer: "0One of the reasons to choose multi measure table is if the query pattern involves comparison between different measures in the same query For e.g. return all rows where avg(temperature) > avg(power). If the measures are stored in a single measure table, then the query is complicated and involves multiple CTEs. With multi measure table the query is simple and intuitive.Timestream supports joins between tables but joins come with their own cost depending upon the number of rows to be joined.Timestream does not support NULL values on ingestion and hence if the ingested record does not include a measure, then it will be not charged for storage.CommentShareRajesh Iyer - AWSanswered a year ago"


Question: UE4+Gamelift client connection fails

"Hello!) I have an issue with client/server connection. I created a game session, reserved a player session, got the URL for a client. But when the UE4 client calls ClientTravel("ip+port+?+PlayerSessionId=...), the server's game mode doesn't fire either Login() or PreLogin() functions. Because of that, I can't get a PlayerSessionId from the "Options" argument and validate the PlayerSesssion on the server and Gamelift closes it after 1 minute. When I run a server locally without Gamelift, "Login()" fires as expected. Gamelift health check works great in the server's game mode as well. Please help!FollowComment"

Answer: "0Accepted AnswerHi Igor, as per my understanding it seems to be that the UE4 client isn't able to send requests to your game sever on GameLift. Have you verified that your GameLift fleet is configured to accept inbound connections on the port it is expecting requests from the client? You can do this by using the update-fleet-port-settings command. Find more documentation here: https://docs.aws.amazon.com/cli/latest/reference/gamelift/update-fleet-port-settings.htmlCommentShareShashankJ_AWSanswered a year ago"


Question: Unable to connect to EC2 instance in private Subnet

"**** IGNORE ****Kindly ignore this thread, the problem is due tot he AMI image, able to connect with original AMI.ThanksExperts,I am unable to connect to my EC2 instance in private subnet hosted in (AP-South-1a), to resolve this I did the following check.Elastic IP attached to InstanceSystem Instance CheckSecurity Group - Port 22 openNACL-Inbound and Outbound are allowedPrivate subnet hosting the associated instance with Route TableVPC Route Table to Internet Gate Way (0.0.0.0) default route.Any direction to resolve to the above issue highly appreciated.ThanksAhmedEdited by: ahmedyas on Jan 24, 2021 1:46 AMEdited by: ahmedyas on Jan 24, 2021 1:48 AMFollowComment"

Answer: "0AMI issue, connected with original EMI, able to launch the instanceCommentShareahmedyasanswered 2 years ago"


Question: CDK - CodePipeline notification rule - Resource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule"

"We have a helper method in our CDK library (based on Amazon.CDK.Lib 2.28.1) to establish a CodePipeline notification rule to SNS topic that delivers events to a Microsoft Teams channel via Lambda function.internal static void ToMicrosoftTeams(CodePipelineNotifierProps props){var topic = EstablishEventsTopic(props);props.Pipeline.NotifyOnExecutionStateChange("NotifyOnExecutionStateChange", topic);// Pull the lamdda function python code embedded in assembly.using var fileStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("CdkLibrary.Lambda.CodePipeline_events_MicrosoftTeams.py");using var streamReader = new StreamReader(fileStream);var lambdaCode = streamReader.ReadToEnd();var funcName = $"{props.ProductName}-{props.PipelineName}-events-to-teams-{props.Environment}";var lambdaFunc = new Function(props.Pipeline, funcName,new FunctionProps{FunctionName = funcName,Runtime = Runtime.PYTHON_3_9,// Inserting code as raw string; resulting code file will default as index.py.// Function lambda_hanlder()Handler = "index.lambda_handler",Code = Code.FromInline(lambdaCode),Environment = new Dictionary<string, string>{{ "TeamsChannelUrl", props.TeamsChannelUrl}}});topic.AddSubscription(new LambdaSubscription(lambdaFunc));}private static Topic EstablishEventsTopic(CodePipelineNotifierProps props){string topicName = $"{props.ProductName}-{props.PipelineName}-events-{props.Environment}";return new Topic(props.Pipeline, topicName, new TopicProps{DisplayName = props.PipelineName + " events",TopicName = topicName});}This setup fine in our testing. However today in deploying a new environment, there seem to be a new error encountered on creating the notification rule.AppService-stack | 3/10 | 2:59:02 pm | CREATE_FAILED        | AWS::CodeStarNotifications::NotificationRule | AppService-pipeline-dev/AppService-pipeline-dev/NotifyOnExecutionStateChange (AppServicepipelinedevNotifyOnExecutionStateChangeE355A12F) Resource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule" (RequestToken: <GUID>, HandlerErrorCode: InvalidRequest)AppService-stack | 3/10 | 2:59:03 pm | CREATE_FAILED        | AWS::IAM::Role                               | AppService-pipeline-dev/AppService-pipeline-dev/AppService-pipeline-events-to-teams-dev/ServiceRole (AppServicepipelinedevAppServicepipelineeventstoteamsdevServiceRoleDE6A960E) Resource creation cancelledWhy has this been considered an invalid request?FollowComment"

Answer: "0Accepted AnswerDon't know why, but after updating the local CDK runtime to 2.31.0, without changing our library reference version (2.28.1), the cdk deploy now succeeds for the notification rule and the other resources.UPDATE (WORK AROUND)Following further comment as per below, to work around this problem, either have to define the CodePipeline constructs in another stack or comment it out first, so that dependency resources can initially all succeed. Then let the CodePipeline deployment fail small and quick on first attempt, and deploy again which will be more likely to succeed.CommentShareicelavaanswered a year ago0This seems to happen too often when deploying new stacksApp-stack | 159/212 | 4:52:22 pm | CREATE_FAILED        | AWS::CodeStarNotifications::NotificationRule | App-stack/App-stack-pipeline/App-stack-pl/NotifyOnExecutionStateChange (AppstackpipelineNotifyOnExecutionStateChange5933C726) Resource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule" (RequestToken: GUID, HandlerErrorCode: InvalidRequest)It has a very nasty side effect of breaking and stalling the deployment-destruction of resources, just because of this random error.CommentShareicelavaanswered 9 months ago"


Question: Presigned POST File Submission Invalid JSON

"Hello there,I am trying to send data from my website to my S3 Bucket with pre-signed POST. I was pretty sure I created my form-data correctly but error returned was:<?xml version="1.0" encoding="UTF-8"?><Error>InvalidPolicyDocument<Message>Invalid Policy: Invalid JSON.</Message><RequestId>0D3E83A53CC40B0D</RequestId><HostId>2DjNg4vUUOrP21XFT4ves6I8vS/4FM3APeMQStFnPX96wnciMCyONzgsG4RgWpb77DKopC/812Y=</HostId></Error>```Here's my back-end code that generates the pre-signed POST's required form data:/**Get Signed POST form data for uploading medias*/router.get('/postdata', function (req, res, next) {let postdata;let id = uuid();s3.createPresignedPost({Bucket: 'bucket',Conditions: [{ "bucket": "bucket" },["eq", "$key", 'file']["content-length-range", 1, 1024 * 1024 * 15],{"success_action_status": "200"}],Expires: 300}, (err, data) => {data.fields.key = 'file'data.fields.name = id;data.fields.success_action_status = "200";postdata = data;});res.json(postdata);});And here's how I generated the FormData object:let form = new FormData();Object.keys(result.fields).forEach(key => {form.append(key, result.fields[key]);});form.append('file', document.getElementById('file').value);The request body is also properly being encoded as multipart/form-data.     So my question is, what part of this is "Invalid JSON". Also, what I don't understand even more is I have a working example but this one does just does not work anyway and anyhow I tried it.FollowComment"

Answer: "0OK so I just realized that I needed to include the Content-Type header with the request.fetch(action, {    method: "POST",    headers: {        "Content-Type": "...."    },    body: form})But when I set my Content-Type to "multipart/form-data", I'm getting this error:<?xml version="1.0" encoding="UTF-8"?><Error>MalformedPOSTRequest<Message>The body of your POST request is not well-formed multipart/form-data.</Message><RequestId>7F543E78F106B3A4</RequestId><HostId>YV+rDi49ovxQJhZ9cGAWAxWwHz4g8xBS55gaD/tPN4EgAvrkAnMSbXiXL5m3g9xi+BvE8Rj76fw=</HostId></Error>```And when I set it to undefined, null or false like what I've read from many sources, I get this:<?xml version="1.0" encoding="UTF-8"?><Error><Code>PreconditionFailed</Code><Message>At least one of the pre-conditions you specified did not hold</Message><Condition>Bucket POST must be of the enclosure-type multipart/form-data</Condition><RequestId>E2993D140D291888</RequestId><HostId>+HZFLQbfjAWBQ7SY8FXWh4hUarRr2YefjOENWH/Eh7XZzuxyfa5DMy1didMZWhPA14XW3ql47iQ=</HostId></Error>```Also if I did not specify the Content-Type, I will go back to receiving Invalid JSON error like beforeEDIT: Actually, not setting Content-Type leaves my browser to set the correct Content-Type and its boundary. But I'm still getting Invalid JSON error...CommentShareionizeranswered 6 years ago0Ok, sorry. Silly me.Conditions: [    { "bucket": "bucket" },    ["eq", "$key", 'file'] (<-------- MISSING COMMA)    ["content-length-range", 1, 1024 * 1024 * 15],    {"success_action_status": "200"}]Problem solved.Edited by: ionizer on Nov 14, 2017 1:30 AMCommentShareionizeranswered 6 years ago"


Question: DMS for Replicating Data in Oracle Application Container

"Does AWS DMS support using Oracle Application Container Database ( Application root and application PDB ) as a source ? If so, are there differences in the way replication setup is configured to replicate data from application root ( common data) and data from application container PDB ?FollowComment"

Answer: 0As mentioned at DMS Oracle as source limitations:https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.Oracle.html#CHAP_Source.Oracle.Limitations*AWS DMS doesn't support the multi-tenant container root database (CDB$ROOT). It does support a PDB using the Binary Reader.*CommentShareAWS-User-8174525-subhashanswered a year agoAWS-User-7197113 a year agoThank you. Appreciate your help.Share


Question: Lower pricing options on DocumentDB

"Hey everyone, I was wondering if there are any plans on AWS's side on providing cheaper options for DocumentDB? RDS provides options with micro, small and medium EC2 instances, but DocumentDB only supports large and xlarge instances.For the use case of the project I'm in, the available options are completely overkill, especially for our development environments. This is the only reason currently holding us back from using Mongo, as our client does not want us to host our clusters anywhere outside AWS.FollowComment"

Answer: "0We absolutely want to provide our customers with a lower price options and thank you for providing the feedback.In the meanwhile, there are ways to cut costs for dev/test environments with start/stop and single instance clusters: https://docs.aws.amazon.com/documentdb/latest/developerguide/best_practices.html#best_practices-cost_optimizationCommentShareAWS-User-2073714answered 3 years ago0Amazon DocumentDB now support t3.medium instances: https://aws.amazon.com/about-aws/whats-new/2020/06/amazon-documentdb-supports-t3-medium-instances/CommentShareAWS-User-2073714answered 3 years ago"


Question: How to ensure that the most recent version of a docker container image is being used when deploying a GreenGrass component

"I have a GreenGrass component which uses aws.greengrass.DockerApplicationManager to download and run a docker image stored in AWS ECR.In a initial deployment, the GreenGrass core authenticates to ECR and downloads the image defined in recipe.yaml.If the docker image is updated in ECR (and the new image is tagged latest), subsequent deployments do not download the new image and continue to boot containers from the old image stored in the GreenGrass device.I tried to add a "docker pull" as part of the Install stage of the component's Lifecycle, but the command fails because it doesn't have credentials to connect to ECR. I understand that the GreenGrass Core has credentials but I have not been able to attach them to the "docker pull" command.How can I ensure that the component is always using the "latest" tagged docker image that is available in ECR after a deployment?Thanks in advanceFollowComment"

Answer: "2Accepted AnswerThe best practice is for you to not use the LATEST tag. Instead, set the artifact URI to point to a specific image hash. This way, each version of your component is entirely well-defined with a single immutable image version.This will ensure that when you publish a new version of your component with the updated artifact, the new image will be downloaded at that time.CommentShareEXPERTMichaelDombrowski-AWSanswered 9 months ago"


Question: error with aws lambda

Been fighting with this error in AWS console where it doesn't let me manage Lambda functionsFollowComment

Answer: 1The smoking gun here is that the console is saying it was last updated 53 years ago. There have been quite a few posts about this recently and the general solution appears to be that there is an issue with the account and you should contact the support team.CommentShareEXPERTBrettski-AWSanswered 3 months ago


Question: Lambda concurrent invocations - collision using same '/tmp/yourfilename.csv'?

"We plan to use Lambda invoced by SNS to read json data from S3, process it and save in csv fromat to another bucket.Current approach to create temporary file, then use boto3 upload_file.df.to_csv('/tmp/csv_file.csv', index=False, encoding='utf-8')s3.upload_file('/tmp/csv_file.csv', OUTPUT_BUCKET, + key)But I wonder would it create collisions if I will have several concurrent invocations of the lambda, both trying to write to the same /tmp/csv_file.csv?Or /tmp/.. will be different for each Lambda invocation?FollowComment"

Answer: "3Accepted AnswerEach concurrent Lambda invocation runs in its own run time environment with its own /tmp folder. There will not be collisions. Subsequent invocation may reuse existing environments, so the file may still be there in the /tmp, but again, it is from a previous invocation and not from a concurrent one.CommentShareEXPERTUrianswered a year agoEXPERTBrettski-AWSreviewed a year ago3Lambda will not have parallel invocations that use the same container.  Containers will be reused if they have previously been provisioned and are idle (before being reclaimed by the service after some time), but no container will serve multiple requests at the same time.  In the case of multiple requests, separate containers will be provisioned for each and there will be no race conditions on your file.  Just make sure your code pulls down a fresh copy of the CSV every time the function is invoked.CommentShareJustin Ganswered a year agoEXPERTBrettski-AWSreviewed a year ago0You can always add a random number job id or use aws_request_id (https://docs.aws.amazon.com/lambda/latest/dg/python-context.html) to your csv file name to make them unique.CommentSharerePostfanclubanswered a year ago"


Question: SES Account hacked!

"Hi,my SES account was attacked and someone is sending a lot of phishing emails!Please, how can I block all sendings?It's very urgent!FollowComment"

Answer: "0Sorry to hear that!  If you haven't already - I would start by limiting IAM Access in your account itself.For IAM Users, rotate their credentials (passwords) and disable access keys.  https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keysYou can remove the ability for IAM entities to use SES by removing allow policies or attaching deny policies on SES usage.If using Organizations, you can use SCPs.Futhermore, you could also check SES:Putting the account back in Sandbox Mode (this limits sending to unverified emails).Turning on more logging: https://docs.aws.amazon.com/ses/latest/dg/event-publishing-add-event-destination-firehose.htmlFrom a security perspective, if someone has access via IAM to your account, I would also check CloudTrail and other logging to see what else they have done in the account.This is not comprehensive, but a good start: https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/I would also reach out to AWS Support: https://console.aws.amazon.com/support/home#/CommentSharejsoncanswered a year ago0I only managed to achieve this using AWS cli. If you do not already have cli access keys:access AWS console: https://us-east-1.console.aws.amazon.com/iamv2/home#/users(while you're there take a look into who accessed what resources how recently)select your User and then select the tab "Security credentials"click button "Create access key" (you need these credentials for next step)enter terminal command aws configure and enter the key and secret generatedcheck SNS statusaws ses get-account-sending-enabled --region {REGION_OF_SNS}expect this response:{    "Enabled": true} Disable SNS:aws ses update-account-sending-enabled --no-enabled --region {REGION_OF_SNS}Confirm SNS statusaws ses get-account-sending-enabled --region {REGION_OF_SNS}expect this response:{    "Enabled": false}Now please upvote my answer  : )and figure out what else might be happening, and how this happened to you:check out https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/reach out to AWS Support: https://console.aws.amazon.com/support/home#/CommentShareSuperManfredanswered 9 months ago"


Question: "[Launch Announcement] New Gateway Load Balancer enhancement provides options to define a flow using 2-, 3- or 5- tuple"

"Amazon Web Services (AWS) Gateway Load Balancer (GWLB) is a new member of Elastic Load Balancing (ELB) product suite to help you easily deploy, scale, and manage your third-party virtual appliances. GWLB now supports configurable flow stickiness, enabling you to configure the hashing used to maintain stickiness of flows to a specific target appliance. You can modify the target group of your GWLB to maintain stickiness of flows using 3-tuple (source IP, destination IP, transport protocol) or 2-tuple (source IP, destination IP)  in addition to the default method of 5-tuple. The configuration applies to all traffic using the target group.The configurable flow stickiness is intended for customers who need to support applications, such as IDS/IPS that identify flows using 3- or 2-tuple, or applications, such as FTP, Microsoft RDP, Windows RPC, and SSL VPN that use separate streams or dynamic port numbers but require to map all traffic from the same client to the same target, using GWLB. The configuration applies to all traffic using the same target group and requires you to drain existing flows to avoid disruption. Configurable flow stickiness doesn’t work if you are using GWLB with transit gateway (TGW) and TGW Appliance Mode is enabled. Please visit Gateway Load Balancer Documentation (https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/target-groups.html#flow-stickiness) to learn more.FollowComment"

Answer: 0[Announcement] Does not require an answer.CommentShareEXPERTIsraa-Nanswered 18 days ago


Question: Lambda Function URL /ping endpoint

"Why do my Lambda Function URLs answer the "/ping" path with 200 OK text/plain "healthy"? It seems to happen it on any subdomain, whether it's valid or not (try https://notarealurl.lambda-url.us-east-1.on.aws/ping). The de-facto API gateway seems to eat that route, and the request never makes it through to my function.FollowComment"


Question: Unable to Compile Gamelift 3.2.0 UE4 4.18

"Hey guys,Excited to see the new backfill update and all the hard work you guys are putting in to helping us developers!I downloaded the newest update today and tried to update the plugin in my Unreal Project (UE4 4.18) and was getting some compile errors that I'm not sure how to resolve.I compile the dlls and libs successfully, but when going to compile my game, I was getting the following errors:When compiling for DEVELOPMENT EDITOR:ErrorLNK2019unresolved external symbol "__declspec(dllimport) public: __cdecl Aws::GameLift::Server::Model::GameSession::~GameSession(void)" (__imp_??1GameSession@Model@Server@GameLift@Aws@@QEAA@XZ) referenced in function "public: void __cdecl UE4Tuple_Private::TTupleImpl<struct TIntegerSequence<unsigned int> >::ApplyAfter<class <lambda_f590ae0d51793d36e8b7ecaf8a2e91d6> const &,class Aws::GameLift::Server::Model::GameSession &>(class <lambda_f590ae0d51793d36e8b7ecaf8a2e91d6> const &,class Aws::GameLift::Server::Model::GameSession &)const " (??$ApplyAfter@AEBV<lambda_f590ae0d51793d36e8b7ecaf8a2e91d6>@@AEAVGameSession@Model@Server@GameLift@Aws@@@?$TTupleImpl@U?$TIntegerSequence@I$S@@$$V@UE4Tuple_Private@@QEBAXAEBV<lambda_f590ae0d51793d36e8b7ecaf8a2e91d6>@@AEAVGameSession@Model@Server@GameLift@Aws@@@Z)ErrorLNK2019unresolved external symbol "__declspec(dllimport) public: __cdecl Aws::GameLift::Server::Model::GameSession::GameSession(class Aws::GameLift::Server::Model::GameSession const &)" (__imp_??0GameSession@Model@Server@GameLift@Aws@@QEAA@AEBV01234@@Z) referenced in function "public: void __cdecl UE4Tuple_Private::TTupleImpl<struct TIntegerSequence<unsigned int> >::ApplyAfter<class <lambda_f590ae0d51793d36e8b7ecaf8a2e91d6> const &,class Aws::GameLift::Server::Model::GameSession &>(class <lambda_f590ae0d51793d36e8b7ecaf8a2e91d6> const &,class Aws::GameLift::Server::Model::GameSession &)const " (??$ApplyAfter@AEBV<lambda_f590ae0d51793d36e8b7ecaf8a2e91d6>@@AEAVGameSession@Model@Server@GameLift@Aws@@@?$TTupleImpl@U?$TIntegerSequence@I$S@@$$V@UE4Tuple_Private@@QEBAXAEBV<lambda_f590ae0d51793d36e8b7ecaf8a2e91d6>@@AEAVGameSession@Model@Server@GameLift@Aws@@@Z)When compiling for DEVELOPMENT_SERVER:ErrorLNK2005"public: __cdecl Aws::GameLift::Server::Model::GameSession::GameSession(class Aws::GameLift::Server::Model::GameSession const &)" (??0GameSession@Model@Server@GameLift@Aws@@QEAA@AEBV01234@@Z) already defined in aws-cpp-sdk-gamelift-server.lib(aws-cpp-sdk-gamelift-server.dll)The compile DOES SUCCEED for both when I comment out these lines:auto onGameSession = [=](Aws::GameLift::Server::Model::GameSession gameSession) {GameLiftSdkModuleRef->ActivateGameSession();};params->OnStartGameSession.BindLambda(onGameSession);These compile errors didn't happen to me in 3.17.I'm not sure what I could be missing. Any Ideas?Thanks!FollowComment"

Answer: "0Hey @REDACTEDUSERSorry to hear you are having compilation issues with the latest SDK. We are investigating on our side, and we will give you an update as soon as we have a better idea of what could be going on and by end of day regardless.CommentSharerePost-User-4056962answered 5 years ago0Hi @REDACTEDUSERWhen upgrading to 3.2.0 make sure you copy the new Plugin from:GameLift_02_08_2018\GameLift-SDK-Release-3.2.0\GameLift-Unreal-plugin-3.2.0\UE4.16-4.18\GameLiftServerSDKto<your project folder>\Plugins.Then after building the binaries with -DBUILD_FOR_UNREAL=1 you'll need to copy them into <your project folder>\Plugins\GameLiftServerSDK\ThirdParty\GameLiftServerSDK<Win64 or Linux>.https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-engines-setup-unreal.htmlAnother possibility is you have some intermediate binaries that aren't getting rebuilt. Try doing a clean and rebuild or delete <your project folder>\Intermediate and <your project folder>\Binaries.Good luck and let me know if you run into further problems.BenCommentSharerePost-User-9883495answered 5 years ago0Hey @REDACTEDUSERhttps://s3-us-west-2.amazonaws.com/gamelift-release/GameLift_02_15_2018.zipCommentSharerePost-User-5697045answered 5 years ago0Hi @REDACTEDUSERThanks for the response. I recompiled dlls and libs, and reimported everything into my project again, deleted all binaries and intermediate folders, and still getting the same errors.Not sure what the problem could be?CommentSharerePost-User-8584359answered 5 years ago0Hey @REDACTEDUSERYes, you have it correct -- that workflow with FlexMatch is the better implementation. To understand how FlexMatch fits, it might be better to refer to this architecture diagram. That diagram shows and discusses your Game Service, the service that sits between your game clients and GameLift services, like FlexMatch.You should not be having your game clients communicate directly with GameLift. At a minimum, you do need something (like API Gateway, as you are finding) to handle client side authentication.The idea with FlexMatch notifications is that your Game Service will receive the Notifications from FlexMatch and then relay them down to the game client through whatever your notifications mechanism is to communicate between clients and services.What is your notifications mechanism to clients?If you are still building that, you can have a Lambda hooked up to your SNS topic to handle receiving the messages from FlexMatch notifications and writing them to a DynamoDB table. Then you could have another Lambda between that table and your game clients that handles the game client polls for status.Hopefully that starts to point you in the direction of how to hook up a serverless architecture to support client notifications.Let me know if you have more questions.CommentSharerePost-User-4056962answered 5 years ago0Hi @REDACTEDUSERThanks for the clarifications! I will start using the API Gateway route.I realize this thread is getting long and we are getting off topic from the original post, but I have a few more questions.Is there no way to have the client send a matchmaking request to the gateway and then receive an event that the matchmaking is completed without polling?If there is no way to do it without polling, what is the point of having an SNS topic write notifications to DynamoDB when I could just poll the Gamelift service by calling DescribeMatchmaking?How would I go about client authentication if I am running my game through steam? I could hard code the api keys into my game, but I assume that this is not what I want to do?After playing around with the API Gateway a little, I have run into some problems, is there no way for Gateway to directly communicate with GameLift, or does it have to be done through Lambda?CommentSharerePost-User-8584359answered 5 years ago0Hi @REDACTEDUSERThanks for your response, this has helped clear up a lot, I really appreciate it.The one thing I am concerned about is if my clients continuously poll the API Gateway during matchmaking, then there are instances where the cost would skyrocket. An optimistic but not unrealistic example is if I have 100,000 concurrent users and on average each of them poll to check matchmaking status 10 times each time they look for a match, then the number of API calls would be very high and my cost of using Gateway, along with the extra cost of pairing it up with Lambda and DynamoDB, would be very very high.I am just trying to figure out the best and most cost efficient way to go about this. I have started using API Gateway for now as we are still in the alpha and testing phase, but going forward, I would like to figure out a better solution (if there is one). The only alternative I can think of is if I spun up some web-servers to handle the requests, but I'm not sure how much that would help. Is there another way to handle it?Sorry for all the questions. This is my first time making a backend for a video game so I am trying to get it right!Thanks again for everyone's help!CommentSharerePost-User-8584359answered 5 years ago0Hey @REDACTEDUSERAt the end of the day, I think you'll either need to poll, or you'll need a way to send messages to your game clients. The easiest is probably polling, the more complicated but more cost efficient is to build a notification system which can send messages back to your clients.Either will incur costs, but I think you'll find API Gateway to be cost efficient. I would expect it to be a small proportion of your total backend costs.If you chose to build a system to send messages to your clients, AWS IOT would be my recommendation. You could also integrate a higher level service such as GameSparks to use in conjunction with GameLift, which in turn would handle client authentication for you and provides functionality for pushing messages to your clients.CommentSharerePost-User-5646792answered 5 years ago0@MisterGameLiftUnfortunately, I'm seeing the same compile errors.But I have been doing some investigating and I think I know what could be causing the problem.I created a blank ue4 4.18 project. Copied and pasted the new Server SDK and the code DID compile. Then I added the AwsCore, CognitoIdentity, and GameLiftClient SDKs to the blank project and the code DID NOT compile with the same errors as above. I think there might be a conflict between these extra modules?I have been using the client sdk in UE4 as a part of my game so that clients could communicate with the gamelift service from the game client.I have been reading that a better implementation was to use an API Gateway for the client side functions, which would also allow me to add some other functionality to my game as well, but I was doing it from the game for now.I was reading this article:https://aws.amazon.com/blogs/gamedev/fitting-the-pattern-serverless-custom-matchmaking-with-amazon-gamelift/Is that workflow (updated with flexmatch) a better implementation? If yes, how does the client know when the matchmaking is done? I am having trouble wrapping my head around the flexmatch event notification system. How am I able to send the matchcreated event back to my game clients?CommentSharerePost-User-8584359answered 5 years ago0Hey @nicholasbagamian,I'll see if I can address your questions.No, not without another layer. GameLift in general doesn't have a way to send notifications directly to clients, it can only respond to HTTP requests from the client. The StartMatchmaking API is asynchronous (as it could take a while if there's no one to match against), so we can't hold the connection open while we wait. You could theoretically have your gateway API hold an HTTP connection open while your backend processpolls GameLift, but I really don't think that would be a good approach.Ifyou are looking for a way to send notifications from backend services to your game clients, I'd recommend taking a look at AWS IOT (https://aws.amazon.com/iot-core/), where you'd treat each of your game clients as a "device" in their nomenclature. If you had this (or another way to push messages to your clients), you could listen to the SNS messages, then post a specific notification to the specific client/player who was just matched.The client couldjust poll, but we don't recommend this for when your game launches. There are throttling limits that GameLift will enforce on your game if across all clients they are polling at too high a TPS. For large games that could have hundreds or thousands of clients in matchmaking simultaneously, you could exceed your polling limits quickly. Hence whywe don't recommend you launch with this set up.Youdefinitely don't want to hardcode AWS keys in your game clients (if I'mreading your question correctly). We don't recommend calling GameLift directly from your game client due to this restriction. Most developershave a backend service which authenticates their players, and that backend service is what calls GameLift. For developers who don't have existing backend services, we recommend building one by using API Gateway backed by Lambda functions. In the Lambda code you can perform authentication per what's appropriate for your game, then your Lambda code will call GameLift on behalf of the customer.Correct, API Gateway calls can't go directly to GameLift, they need to go to your Lambdas, which can call GameLift.Hope that helps!CommentSharerePost-User-5646792answered 5 years ago"


Question: HTML Motion Graphics in MediaLive Initializes to first input resolution it gets.

"Configuration:RMTP push inputsingle pipelinesingle HLS output to s3max input res: 1080p at 10mpbsoutput: 720p QBVR optimized for mobile streamingHTML motion graphics enabledWe have a system that builds up the RTMP input resolution based on mobile network conditions. We have noticed that the HTML motion graphics takes its frame reference as the first input resolution that it gets.e.g if the input resolution starts at 240p, the HTML motion graphics look distorted(looks like 240p basically) even though the output resolution is 720p. The expected behavior would be that the video quality would be low since the input is of a low resolution, but the HTML motion graphics should be based on a 720p frame and hence should be clear.As a result, even if our input resolution builds up from say 240p -> 720p, the HTML motion graphics continue to be of lower quality.FollowComment"

Answer: "0When is the HTML5 overlay for the MediaLive channel inserted? Is it done before the channel has started? After the channel has begun? You may want to test starting the insertion after the channel has been started. Motion Graphics overlays needs to be enabled in the channel, then insertion turned on/off via the Scheduling function.Dynamically changing the resolution in the MediaLive RTMP input may cause other issues. Creating a 720p output from lower resolutions will yield a poor quality image.Have you considered varying the bit rate of the RTMP signal and holding the resolution static, if possible?CommentShareMike-MEanswered a year agorePost-User-9162674 a year agoThanks for the prompt reply."""When is the HTML5 overlay for the MediaLive channel inserted? Is it done before the channel has started? After the channel has begun? You may want to test starting the insertion after the channel has been started. Motion Graphics overlays need to be enabled in the channel, then insertion turned on/off via the Scheduling function."""Motion Graphics overlays are enabled after the channel goes into a "running" state as an immediate mode scheduling action."""Have you considered varying the bit rate of the RTMP signal and holding the resolution static, if possible?"""unfortunately, holding the resolution static is not possible in our current architecture to support optimized mobile-based streamingShare"


Question: Custom container not running under root account?

A customer wants to enforce these rules in their custom SageMaker containers:•Processes running inside a container must run with a known UID/GUID and never as root.•Avoid using privilege escalation methods that grant root access (e.g. sudo)How do we ensure this?FollowComment

Answer: "0Accepted AnswerSageMaker requires that Docker containers run without privileged access. See:  https://docs.aws.amazon.com/sagemaker/latest/dg/amazon-sagemaker-toolkits.htmlSageMaker Docker containers do not run in Privileged mode and have the following Linux capabilities removed: SETPCAP, SETFCAP, NET_RAW, MKNODCommentShareEXPERTMahesh_Vanswered 2 years ago"


Question: apt update:  Cannot initiate the connection to repo.mongodb.org:443

"My goal was to update the community server mongodb on an EC2  Ubuntu 20.04.3 LTS.  There seems to be a network connectivity problem though.  I can't quite believe that this is a problem in software, since it appears as though the ec2 instaance isn't configured correctly to make/sustain the connection for updates.  What would be the place to start in understanding and correcting where the to change or report configuration data?ubuntu@ip-172-31-76-213:~$ lsb_release -dcDescription:    Ubuntu 20.04.3 LTSCodename:       focalubuntu@ip-172-31-76-213:~$ sudo apt updateErr:1 https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.2 InRelease                                                                                Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Could not connect to repo.mongodb.org:443 (13.32.151.96), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.61), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.30), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.5), connection timed outErr:2 https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 InRelease                                                                                Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable)Err:3 https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/6.0 InRelease                                                    Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable)Err:4 http://security.ubuntu.com/ubuntu focal-security InRelease                                                             Cannot initiate the connection to security.ubuntu.com:80 (2001:67c:1562::15). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2001:67c:1562::18). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2620:2d:4000:1::16). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2620:2d:4000:1::19). - connect (101: Network is unreachable) Could not connect to security.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.38), connection timed outErr:5 http://us-east-1.ec2.archive.ubuntu.com/ubuntu focal InRelease                                                         Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (18.232.150.247), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (34.201.250.36), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (34.237.137.22), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.73.36.184), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.91.65.63), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.207.133.243), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (54.87.19.168), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (54.165.17.230), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (3.87.126.146), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (3.209.10.109), connection timed outErr:6 http://us-east-1.ec2.archive.ubuntu.com/ubuntu focal-updates InRelease  Unable to connect to us-east-1.ec2.archive.ubuntu.com:http:Err:7 http://us-east-1.ec2.archive.ubuntu.com/ubuntu focal-backports InRelease  Unable to connect to us-east-1.ec2.archive.ubuntu.com:http:Reading package lists... DoneBuilding dependency tree       Reading state information... Done72 packages can be upgraded. Run 'apt list --upgradable' to see them.W: Failed to fetch http://us-east-1.ec2.archive.ubuntu.com/ubuntu/dists/focal/InRelease  Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (18.232.150.247), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (34.201.250.36), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (34.237.137.22), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.73.36.184), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.91.65.63), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (52.207.133.243), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (54.87.19.168), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (54.165.17.230), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (3.87.126.146), connection timed out Could not connect to us-east-1.ec2.archive.ubuntu.com:80 (3.209.10.109), connection timed outW: Failed to fetch http://us-east-1.ec2.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease  Unable to connect to us-east-1.ec2.archive.ubuntu.com:http:W: Failed to fetch http://us-east-1.ec2.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease  Unable to connect to us-east-1.ec2.archive.ubuntu.com:http:W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/focal-security/InRelease  Cannot initiate the connection to security.ubuntu.com:80 (2001:67c:1562::15). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2001:67c:1562::18). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2620:2d:4000:1::16). - connect (101: Network is unreachable) Cannot initiate the connection to security.ubuntu.com:80 (2620:2d:4000:1::19). - connect (101: Network is unreachable) Could not connect to security.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.36), connection timed out Could not connect to security.ubuntu.com:80 (185.125.190.39), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.38), connection timed outW: Failed to fetch https://repo.mongodb.org/apt/ubuntu/dists/bionic/mongodb-org/4.2/InRelease  Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Could not connect to repo.mongodb.org:443 (13.32.151.96), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.61), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.30), connection timed out Could not connect to repo.mongodb.org:443 (13.32.151.5), connection timed outW: Failed to fetch https://repo.mongodb.org/apt/ubuntu/dists/focal/mongodb-org/5.0/InRelease  Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable)W: Failed to fetch https://repo.mongodb.org/apt/ubuntu/dists/focal/mongodb-org/6.0/InRelease  Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:c600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ba00:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:a400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:4400:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:600:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:e200:0:bd83:86c0:93a1). - connect (101: Network is unreachable) Cannot initiate the connection to repo.mongodb.org:443 (2600:9000:2009:ca00:0:bd83:86c0:93a1). - connect (101: Network is unreachable)W: Some index files failed to download. They have been ignored, or old ones used instead.ubuntu@ip-172-31-76-213:~$ FollowComment"

Answer: "0I agree this seems like a networking issue.  Here are some places to start:Make sure your EC2 instance has a route to the internetThere are a couple ways to do this -- both require a VPC with an attached Internet Gateway.  A public subnet is a subnet that has a route in the route table to the Internet gateway.If you put your EC2 instance in a public subnet then you should have a route to the internet.  I can't tell what type of subnet you're deployed in based on your terminal prompt since it looks like you connected to the EC2 instance via a private IP within the AWS network.If you don't want to put your EC2 instance in a public subnet, you need to put a route to a public subnet with a deployed NAT gateway from your private subnet.Check your EC2 Security Group doesn't block outbound access on port 443If you're using the default security group then this should not be the case but if you've edited them at all they could be blocking access on port 443.  Keep in mind that the default behavior for a security group is to block -- so unless there's a specific rule for allowing outbound 443 then you'll need to configure this.Check your Network Access Control List (ACL) and make sure it is allowing outbound traffic on 443 and inbound traffic on ephemeral portsAgain, if you are using the default NACLs they allow all traffic.  If not, you'll need to make sure this traffic is specifically allowed.  You'll need to allow outbound on 443 and inbound on ephemeral ports.CommentShareMiguelUTanswered 8 months agorePost-User-9822842 7 months agoI hadn't changed the ACL at all from the normal outbound rules  default  (all traffic/all ports).  Logging in via ssh doesn't change the situationWelcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.15.0-1015-aws x86_64)Documentation:  https://help.ubuntu.comManagement:     https://landscape.canonical.comSupport:        https://ubuntu.com/advantageSystem information as of Tue Oct 18 14:45:23 UTC 2022System load:  0.0                Processes:             121Usage of /:   25.4% of 29.01GB   Users logged in:       0Memory usage: 1%                 IPv4 address for eth0: xxx.31.76.xxxSwap usage:   0%79 updates can be applied immediately.To see these additional updates run: apt list --upgradableThe list of available updates is more than a week old.To check for new updates run: sudo apt updateFailed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsLast login: Tue Oct 18 13:39:58 2022 from xxx.65.111.41routeKernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Ifacedefault         ip-172-31-xxx-1. 0.0.0.0         UG    100    0        0 eth0172.31.xxx.0     0.0.0.0         255.255.240.0   U     0      0        0 eth0ip-172-31-xxx-1. 0.0.0.0         255.255.255.255 UH    100    0        0 eth0ShareMiguelUT 7 months agoIs the mongo repo the only one that's reporting as unreachable?  Are you able to install and/or update other packages?  It looks like your EC2 instance is also having trouble connecting to east-1.ec2.archive.ubuntu.com:80.ShareMiguelUT 7 months agoAlso -- have you edited the iptables at all?Share"


Question: Do CloudFront or S3 support dynamic compression for HTTP range requests?

CloudFront can dynamically compress files under certain circumstances. But do CloudFront or S3 support dynamic compression for HTTP range requests? I couldn't find any hints in the documentations.FollowComment

Answer: 0Does this help -https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.htmlCommentShareRajesh Sanswered 9 months ago0Some tests have shown when dynamic compression is enabled in AWS CloudFront the range support is disabled. So Range and If-Range headers are removed from all request.CommentSharerePost-User-7080606answered 9 months ago


Question: JavaScript example for responding to Cognito's SRP authentication challenges

"There's a python example here. Does anyone have a link to an example for JavaScript?Alternatively, can anyone provide guidance on how to access the functions inside AuthenticationHelper.js (to build the SRP challenge responses during authentication) per this AWS knowledge article?SRP_A = g^a (mod N)Use g as defined in AuthenticationHelper.js on the AWS Amplify (JavaScript) GitHub repository.FollowComment"


Question: route 53 can not register the domain name

"We weren't able to register the domain name. This is because:We can't finish registering your domain. Contact AWS Support at https://console.aws.amazon.com/support/home#/ for further information.We apologize for the inconvenience. For more information, contact Amazon Web Services Customer Support.FollowComment"

Answer: "1Hello AWS Customer,It needs more information related to the domain to confirm the domain registration issue. And this issue can be assisted by AWS Support.Also, AWS provides a Basic support plan, free of charge, for all AWS customers. The plan includes assistance related to domain registration.To contact AWS Support when you're able to sign in to your AWS account, perform the following procedure:Using the AWS account that the domain is currently registered to, sign in to the AWS Support Center.Important: You must sign in by using the root account that the domain is currently registered to. This requirement prevents unauthorized users from hijacking your account.Specify the following values:Regarding: Accept the default value of Account and Billing Support.Service: Accept the default value of Billing.Category: Accept the default value of Domain name registration issue.Severity: Choose the applicable severity.Subject: Enter a brief summary of the issue.Description: Describe the issue that you're having in more detail, and attach any relevant documents or screenshots.Contact method: Choose a contact method, Web or Phone. If you choose Web, we'll contact you using the email address that's associated with your AWS account. If you choose Phone, enter the applicable values.Choose Submit.To contact AWS Support when you can't sign in to your AWS account, perform the following procedure:Go to the I'm an AWS customer and I'm looking for billing or account support page.Fill out the form.Choose Submit.Hope you will find this information useful. Please let me know if you have any further questions or concerns. I will be more than glad to assist you.I hope you are always healthy and have a nice day.CommentShareSUPPORT ENGINEERJisoo_Kanswered 4 months agoEXPERTMatt-Breviewed 4 months ago"


Question: Http Api gateway realtime mutation for subscription & SDK generation:

"Recently I have started using http api gateway.I have 2 questions:1. Does http api gateway support SDK generation?2. Can we do the same thing as an AWS appsync realtime mutation for subscription, observe query, available data offline locally etc. using the http API gateway?FollowComment"

Answer: "2Accepted AnswerNo.No. HTTP API is for REST APIs, while AppSync is for GraphQL.CommentShareEXPERTUrianswered 9 months agoEXPERTToni_Sreviewed 9 months ago"


Question: How can make multi model endpoint with SageMaker?

"This is my code.from datetime import datetimefrom sagemaker.multidatamodel import MultiDataModelmme = MultiDataModel(    name="LV-multi-" + datetime.now().strftime("%Y-%m-%d-%H-%M-%S"),    model_data_prefix=model_dir, # 2에서 구한 모델이 모여있는 폴더(경로)!!,    model=sagemaker_model,  # 모델 객체 1개 우선 넣기    sagemaker_session=sess)predictor = mme.deploy(    initial_instance_count=1,    instance_type="ml.g4dn.xlarge")And error message.How can I find Ecr Image(within multi-models=true)?ClientError: An error occurred (ValidationException) when calling the CreateModel operation: Your Ecr Image 763104351884.dkr.ecr.ap-northeast-2.amazonaws.com/pytorch-inference:1.8.1-gpu-py3 does not contain required com.amazonaws.sagemaker.capabilities.multi-models=true Docker label(s).FollowComment"

Answer: "1Accepted AnswerHi there - thanks for opening this thread. Multi-model endpoints are not supported on GPU instance types, see here: https://docs.aws.amazon.com/sagemaker/latest/dg/multi-model-endpoints.html#multi-model-endpoint-instanceIn order to host a multi-model endpoint, choose a CPU instance type instead. The ECR image for CPUs will contain the required  com.amazonaws.sagemaker.capabilities.multi-models=true label, see here: https://github.com/aws/deep-learning-containers/blob/master/pytorch/inference/docker/1.8/py3/Dockerfile.cpuCommentShareHeikoanswered 10 months agorePost-User-8794903 10 months agoThanks for your help. I struggle with this problem FOR A MONTH. X)My Best Person at this month is you!Share"


Question: Codebuild Fails Pulling Source when using CodePipeline Source Provider(GH Enterprise)

"I have a Codepipeline Project with 3 states(Source, Build, Test). The source is pointing to a GHE connection and the Codebuild project is using Codepipeline as the source provider.I get the following error during the execution of the build project.CLIENT_ERROR: invalid pkt-len found for primary source and source version. FollowComment"


Question: Degraded hardware.

I rechived notice The instance is running on degraded hardware.FollowComment

Answer: "0Accepted AnswerHi Mauliksinh,This guide should make it clear: https://repost.aws/knowledge-center/ec2-linux-degraded-hardware.I hope it helps and if it does I puked appreciate if answer can be accepted so that community can benefit for clarity, thanks ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: OIDC Provider Couldn't retrieve verification key from your identity provider

"I am trying to create Keycloak as an Identity Provider in the console but I am getting a"Could not connect to openid configuration of provider" when I click get thumbprint.I am able to create the OIDC provider through the CLI, but when I try to do a AssumeRoleWithWebIdentity call, I get"couldn't retrieve verification key from your identity provider, please reference AssumeRoleWithWebIdentity documentation for requirements"I have referenced https://forums.aws.amazon.com/thread.jspa?threadID=248411&tstart=0 and https://forums.aws.amazon.com/thread.jspa?messageID=600673The jwks uri exists at the provider url appended with "/.well-known/openid-configuration".I am using self signed certs for Keycloak, and still not entirely sure whether this is okay.I have also referenced https://forums.aws.amazon.com/thread.jspa?threadID=254423 and have tried with both wildcard and non-wildcard self signed certs.Been stuck on this for a while, anyone have any insight? Thank you.FollowComment"

Answer: 0I"m also facing the same problem with Keycloak(IDP). Has there any luck? Did you able to get through this issue?CommentSharerePost-User-5257879answered 6 months ago