Question: Can EFS rollback files ?

"Hello,From time to time we notice that our PHP files in EFS revert to older versions."Can Lifecycle cause such a thing?" We started to think.Does Lifecycle only optimize by adjusting the access time or does it version the files within itself as we feared?FollowComment"

Answer: "0we noticed this in regular EBS file system.  seems like whenever a reboot occurred (always or sometimes, i dont know) the drive would revert to some older version of files.  crazy.  just happened again when I made an AMI snapshot 2 weeks ago.  it has been happening for years.   it is a true bug in their setup.  it may be related to your issue.here is the thread, i have archived the old forum thread on this because it is going away on march 31:it is still an issue mar 2022https://www.dropbox.com/s/49k82ow853zv1l6/AWS%20Developer%20Forums%3A%20EBS%20volume%20magically%20auto%20reverted%20back%20....pdf?dl=0CommentShareAWS-User-2223434answered a year ago"


Question: AWS Cognito GetUserList results inconsistent with the set Limit when query is filtered

"The getUserList API seems to return lesser results than the set limit when a query filter is applied. For example without a filter if the limit is 20, then it returns 20 records. However, when a filter is applied, even if there are more than 20 records that matches the criteria, the API seems to return lesser results. Wondering if anyone has noticed this kind of a behaviour?FollowCommentTaka_M 10 months agoWhich Cognito API are you using https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html? I don't see GetUserList API from the list. Is that a function from a library? If so, which one? Also, can you share the code snippet to reproduce the issue?Share"

Answer: "0Can you post the CLI command or API call you are making with the filter included?CommentShareSiva_Ranswered 9 months ago0Assuming your using ListUser APIhttps://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html#API_ListUsers_RequestSyntaxPlease check if you have PaginationToken which might be link to next list of users.An identifier that was returned from the previous call to this operation, which can be used to return the next set of items in the list.Refer the link above for details.CommentSharePravoanswered 9 months ago"


Question: can't send xml to non-Amazon REST API

"I am submitting valid xml via POST to an external REST API site (at my location) from the AWS API Gateway. I have tried setting the Content-Type header as text/xml and application/xml.On my server (the receiving end) I get an empty xml request as if the xml wasn't sent in the request body.  The round trip for the API call works because my system sees this and returns the correct error to the Gateway. I know the API call should work because when I try the same API call from the Chrome Restlet extension, the request is successful.How can I submit valid xml to my server from the AWS Gateway?  Do I need to add a setting somewhere or use a different header?Thanks,SteverionEdited by: Steverion on Jul 19, 2019 7:00 AMEdited by: Steverion on Jul 19, 2019 8:02 AMEdited by: Steverion on Jul 22, 2019 12:23 PMEdited by: Steverion on Jul 23, 2019 7:10 AMFollowComment"

Answer: "0It turns out this is easy but not documented anywhere I could find.  You have to set the header in 2 places:In the HTTP Request Headers in the Method request, you need to add the header Content-Type.  There's no value entered there.  I needed to add this to make it work.The value is also entered on the test page as a header :Content-Type: text/xmlSteverionCommentShareSteverionanswered 4 years ago"


Question: DMS task target load error: Invalid input for table (SQL Server 2017)

"I have two DMS tasks which load to the same table (both source and target are SQL Server 2017) with different filters - the task that succeeds has this filter:            "filters": [                {                    "filter-type": "source",                    "column-name": "id",                    "filter-conditions": [                        {                            "filter-operator": "ste",                            "value": "391471128"                        }                    ]                }            ]the task that fails has this filter:            "filters": [                {                    "filter-type": "source",                    "column-name": "id",                    "filter-conditions": [                        {                            "filter-operator": "gte",                            "value": "391471129"                        }                    ]                }            ]Getting error2023-04-19T16:57:59 [TARGET_LOAD     ]E:  **Invalid input for table** 'dbo'.'blablabla' in line number 1000 [1022510]  (sqlserver_endpoint_imp.c:2683)Tried reloading into that table again in the task table stats UI but got the same error in the task log.Couldn't find a shred of info on this error in Google nor in repost.aws.FollowComment"

Answer: "0Hello There,I understand that you have a DMS task that is failing with mentioned filter with the error message [TARGET_LOAD     ]E:  Invalid input for table 'dbo'.'blablabla' in line number 1000 [1022510]  (sqlserver_endpoint_imp.c:2683)First of all, This kind of error happens on a SQL Server target generally as result of primary key violations. You can review that from your side as well. There is also a part of documentation here which covers this kind of error.[+] : https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Troubleshooting.html#CHAP_Troubleshooting.General.PKErrorsAs mentioned, The above error indicates that DMS failed to apply records to the target database due to constraint violation issues so here we have to make sure target tables are empty before reloading the tables. If the target tables were not truncated before reloading the tables, these errors are expected.Initially, you can verify and note down the migration type and what value is set for TargetTablePrepMode and then you can follow the set of action below if the issue can be mitigated.Modify the DMS task TargetTablePrepMode to "TRUNCATE_BEFORE_LOAD" if there is any other value set.Try to set the recovery model to 'FULL' or 'BULK LOGGED'.Check the tables that should have atleast one primary key or unique key. If not, please add them in order to run validation on the table.Enable the control table task settings to check if the tables are suspended.Restart your DMS task.Moreover, if you still face the issues you can enable debug logging to see more detailed information on these errors and troubleshoot further. Please refer to document [1] and [2] for more information on logging. Kindly note that, enabling detailed debugging causes increased storage usage. Please ensure to disable logging after troubleshooting/relevant log generation.That being said, since this issue might need deeper investigation you can always open a support case with AWS Support Engineering Team. Certain non-public information might be required such as your DMS task details and information regarding your source and target endpoints hence you can open a support case with AWS using the support link and the issue can be investigated for further troubleshooting.[1] : How do I set up detailed debug logging for my AWS DMS task? - https://repost.aws/knowledge-center/dms-debug-logging[2] : Logging task settings - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.Logging.htmlCommentSharerePost-User-8830651answered a month ago"


Question: Best Practice to Monitor Beanstalk Instances Dynamically

"Hi,We are looking into ways to best monitor our Beanstalk environment, in the most dynamic way possible. Meaning we would like to be able that whenever we have a new instance to set corresponding metric alarms, we are interested in. Since our environment was built long time ago and does not have much automation around it I have decide to leverage some CDK code, and build Clouwatch code that we can run on a schedule to detect differences and add/remove monitoring to new instances accordingly. Another option was to use eventBridge and trigger lambdas and based on some SDK code get the proper monitoring in place.The question is, based on the situation above, does eb-extensions or any other Beanstalk feature allow us to set "metric alarms" from within Beanstalk during deployment (not using the console), or other ways using other parts of the Beanstalk infrastructure to set those alarms upon deploying new app build versions?Update:After doing some digging into eb-extensions looks like we can use custom resources, but is there a way that when setting the alarm I can use insatnce IDs for the dimensions, to set the alarm per instance in the environment ?example:MetricName: "RootFilesystemUtil"Namespace: "AWS/ElasticBeanstalk"Dimensions:  - Name: InstanceId    Value: <ref_all_instances_in_the_env>FollowComment"

Answer: "0Yes, you can use the Elastic Beanstalk (EB) Extensions feature to set "metric alarms" from within Beanstalk during deployment. EB Extensions allow you to run custom scripts on instances in your Elastic Beanstalk environment. You can use these scripts to set up monitoring and alarms for your instances.To set up alarms that use the instance ID as a dimension, you can use the AWS SDK for your preferred programming language (Java, Python, etc.) in your EB Extension script to retrieve the instance ID of the instances in your environment, and then use that information to set up the alarms.You can use the CloudWatch.Client.put_metric_alarm() method to create an alarm and set dimensions by passing them as a dictionary.example :dimensions = [{'Name': 'InstanceId', 'Value': instance_id}]cloudwatch.put_metric_alarm(    AlarmName='RootFilesystemUtil',    MetricName='RootFilesystemUtil',    Namespace='AWS/ElasticBeanstalk',    ComparisonOperator='GreaterThanOrEqualToThreshold',    EvaluationPeriods=1,    Period=60,    Threshold=90.0,    AlarmActions=[sns_arn],    Dimensions=dimensions)Alternatively, you can also use CloudFormation Custom Resources to create Alarms and pass the instance ids as parameter.In any case, you would need to manage the lifecycle of the alarms. If an instance is terminated or replaced, you would need to delete the corresponding alarm.CommentShareDivyam Chauhananswered 4 months agoZiad 4 months agoThanks for the Answer, its helpful and re-enforces some of the limitations and challenges that I have already identified. We currently have an approach using cdk and its fully automated and leverages Cloudwatch cdk directly. We plan to run overnight ci/cd scheduled task to check the diff and keep the monitoring per env or instance up to date. Would you think this approach be more robust or eb-extension scripts ?Also, just to confirm, using the approach I mentioned above in my original question, I can't directly somehow reference the instance ID, for the dimension right ?Share"


Question: RDS MySQL 5.6 > 5.7 Update Issues

"I'm trying to upgrade my MySQL database to 5.7, but am running into numerous issues.I first took a snapshot and tried to restore as a new instance so that I could test out the upgrade and run a test version of my app against it.  However, it won't let me restore the snapshot as it says I can't create a database instance using 5.6.Hopefully this means that I don't just have to do it live in production, but even if I wanted to... When I try to "modify" the existing database, it doesn't give me 5.7 as an option, the only option in the dropdown for version is 5.6.It's unclear to me why the "forced upgrade" would happen a whole month after we're blocked from creating (testing) against a new instance.How do you recommend that I proceed?  This is a small side business for me and I am a team of one.I greatly appreciate any help or guidance.  Thank you!FollowCommentChris_G EXPERTa year agoWhat instance type are you using?  If this is an old instance type and you're trying to upgrade, you may need to upgrade to a newer instance type to support the 5.7 upgrade.Share"

Answer: "0Hi Nolan, It's hard to say exactly what's happening without looking at your instance specifically, but here's a few things that could be preventing a successful major version upgrade:The MySQL documentation for upgrades says "Upgrading to the latest release is recommended before upgrading to the next version. For example, upgrade to the latest MySQL 5.6 release before upgrading to MySQL 5.7." If there is a higher 5.6.x version available to upgrade, start there.Before attempting a major version upgrade, AWS also recommends that the instanceBe running in a current/recent generation instance classHave all RDS pending/available maintenance actions appliedAdditionally, because a major version upgrade can be time-consuming and resource-consuming, we recommend that the instance be running in one of the larger instance sizes, to minimize downtime.Should these tips not get the instance to the point where it can upgrade, I'd advise opening a support case for help specific to your instance.CommentShareValter_Ranswered a year ago"


Question: "AWS SDK - When iterating shards with ShardIteratorType.AT_TIMESTAMP, what is the datetime stamp stored in the data record?"

"According to the KDS API documentation, specifying a ShardIteratorType of AT_TIMESTAMP "starts reading from the position denoted by a specific time stamp, provided in the value Timestamp."  "Timestamp" is defined as "the time stamp of the data record from which to start reading."Time stamp of the data record ... is this the same time stamp that can be retrieved from the record via Record.getApproximateArrivalTimestamp()?If so, is this a useful value for checkpointing, given that (again from KDS documentation) "there are no guarantees about the timestamp accuracy, or that the timestamp is always increasing. For example, records in a shard or across a stream might have timestamps that are out of order" ?Thanks in advance.FollowComment"


Question: Remove local target from AWS Route Table

"The documentation from   https://docs.aws.amazon.com/vpc/latest/userguide/WorkWithRouteTables.html    sais:   "To delete a route from a route table using the console"  [...]  "4. Choose the delete button (x) to the right of the route that you want to delete."Clicking on the button (x) within the "Target"-field  I can only chose another target but cannot remove the whole destination.  Some destinations like gateways offer a "Remove"- Button at the right which works as expected. However this doesn't exist for "local" targets.With my test-account I can easily create another Route Table and drop the existing one. However, in a production-system there are too many dependencies, so I would assume that it should somehow be possible to remove local routing targets without taking the risk to mess up the whole infrastructure?FollowComment"

Answer: "0Accepted AnswerEvery time you add a new CIDR to your VPC - it's auto added to the Main route table and subsequent route tables you create with target being "local" - which you could only modify the target as mentioned earlier.For any other destination not in your VPC you should be able to remove it; you "can't" add a destination (routes outside your VPC) in your route table with target being "local" to begin with, since you will encounter an error.Please share an illustration of the routes in your table along with the CIDR of your VPCCommentShareJules_Nanswered a year agorePost-User-2362427 a year agoTore everything down a couple of times. Tried to reproduce why I came to my previous statement - and couldn't. So as a consequence I have to accept your answer as being correct... :-)Share0You can only modify routes that you've added.The local routes (VPC CIDR) are auto added in the "Main" table, which you can't remove, but can change the destination to be instance GWLBe, Network Interface...CommentShareJules_Nanswered a year agorePost-User-2362427 a year agoHi Jules, thanks for your answer. I read similar explanations before, however that doesn't apply to this case. The route wasn't auto added, I added it myself after creating a new CIDR (in order to reproduce/clarify the effect/situation I have seen on another system).Share0Hi Jules,  thanks for your answer. I read similar explanations before, however that doesn't apply to this case.The route wasn't auto added, I added it myself after creating a new CIDR (in order to reproduce/clarify the effect/situation I have seen on another system).CommentSharerePost-User-2362427answered a year ago"


Question: [Announcement] Announcing an updated Elastic Beanstalk Command Line Interface (EB CLI v3)

"We are pleased to announce a new version of the AWS Elastic Beanstalk command line interface (EB CLI).The new version adds the following additional capabilities,-   Easier installation experience, install with ‘pip install awsebcli’.-   Deployments no longer require the use of git (it remains a supported option for git users).-   Better management of your environment’s configuration. Configuration options are no longer stored locally,      allowing teams to collaborate on shared environments.-   Improved status, events, and logs support.-   Ability to clone environments, including configuration and environment variables.-   Ability to get and set environment variables.-   Ability to scale your environment manually, if necessary.-   Ability to open the application and the AWS Management Console in a web-browser from the CLI directly-   SSH support, including the ability to create and upload SSH keys to EC2To install the new version of the EB CLI, see Installing the AWS EB CLI. To learn more about the commands and options available, see EB CLI Command Reference. To get started with the CLI, let’s create a simple “Hello World!” application,$ mkdir HelloWorld  $ cd HelloWorld  $ eb init –p PHP  $ echo “Hello World!” > index.html  $ eb create dev-env  $ eb open  To learn more about the platforms supported by AWS Elastic Beanstalk, see AWS Elastic Beanstalk Supported Platforms.Sincerely,The AWS Elastic Beanstalk TeamFollowCommentNguyen_M SUPPORT ENGINEER5 months agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: "errorType": "OperationalError"

""errorMessage": "connection to server at "*******.amazonaws.com" (3.7.109.5), port 5432 failed: Connection timed out\n\tIs the server running on that host and accepting TCP/IP connections?\n",  "errorType": "OperationalError",  "stackTrace": [    "  File "/var/task/lambda_function.py", line 14, in lambda_handler\n    conn = psycopg2.connect(\n",    "  File "/opt/python/psycopg2/init.py", line 122, in connect\n    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)\n"Please help me out with this error.How can we resolve it.ThanksFollowComment"

Answer: "0From the error it looks like you are getting a timeout error trying to connect to PostgreSQL from Lambda.Please set the inbound rule of the security group of the EC2 or RDS running PostgreSQL to allow connections from Lambda.For example, it may be possible to solve this problem by using the security group set up in Lambda as the source and putting a setting to allow inbound PostgreSQL security groups.If this answer leads to a resolution, please approve the answer for the community plant.CommentShareEXPERTRiku_Kobayashianswered 2 months ago"


Question: Glue Jobs are failing and cannot resolve given input column when run with Enabled Job Bookmark

"Hi, I found a consistent issue with Glue Jobs using "Transform - SQL Query" activity when the job is run with "Job Bookmark" set to enabled. In this case when the job is run I get the following exceptionpyspark.sql.utils.AnalysisException: cannot resolve '`ds.name`' given input columnsds.name is just a name of the field.  Example is here The following is the error log entry (with the full script code available here https://jsfiddle.net/tvrznbuq/)2022-01-31 09:49:56,225 ERROR [main] glue.ProcessLauncher (Logging.scala:logError(73)): Error from Python:Traceback (most recent call last):File "/tmp/Transform Device Data to DB Table.py", line 88, in <module>transformation_ctx="FormatReadingOutput_node1643513054931",File "/tmp/Transform Device Data to DB Table.py", line 13, in sparkSqlQueryresult = spark.sql(query)File "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/session.py", line 723, in sqlreturn DataFrame(self._jsparkSession.sql(sqlQuery), self._wrapped)File "/opt/amazon/spark/python/lib/py4j-0.10.9-src.zip/py4j/java_gateway.py", line 1305, in callanswer, self.gateway_client, self.target_id, self.name)File "/opt/amazon/spark/python/lib/pyspark.zip/pyspark/sql/utils.py", line 117, in decoraise converted from Nonepyspark.sql.utils.AnalysisException: cannot resolve 'ds.name' given input columns: []; line 4 pos 6;'Distinct+- 'Project ['ds.device_id, 'ds.meter_id, 'ds.value, 'ds.time, 'ds.name, 'ds.channel]+- 'Filter ((('ds.name = 'ds.channel) AND NOT ('ds.value = 0.0)) AND isnotnull('ds.value))+- SubqueryAlias ds+- SubqueryAlias mydatasource+- LogicalRDD falseIt looks to me that when the job is re-run there are no results for the SQL query to return any entries, and instead of returning nothing, the entire activity fails.I've tested it with the Job Bookmark set to disabled and no errors happening.I've also tested uploading the new files to my source destination dated later then the previous run and still the job has been failing.It seems as the serious bug and I could not find any workaround.Any advise how to fix it?FollowComment"

Answer: "0Hi,what is happening is that when you read with the bookmark and there is no data, Glue generates an empty dynamicframe and Spark SQL cannot map the columns he has to an empty schema.The solution is to add a check to see if any of dynamicframe generated based on the source data is empty , and then use a if branch to decide if to exit with cleanly with a message that no process was needed or to move forward.You can insert a Custom Transform with the following code:def validate_source_table (glueContext, dfc) -> DynamicFrameCollection:    noData = 0    for i in range (0, len(list(dfc.keys()))):        if dfc.select(list(dfc.keys())[i]).toDF().rdd.isEmpty():            print(' no data in table: ' , list(dfc.keys())[i])            noData =1    if noData==1:        print('committing and exiting job without processing.')        job.commit()        quit('No new Data. Exiting')      print(noData)      return dfcthe job will still fail but it will give a better exit code specifying that there is no New Data and it is exiting.after the custom transform you need to have to SelectFromCollection and name it properly based on the schema.the SQL node will have as parent the SelectFromCollection transofrms.hope this helpsCommentShareEXPERTFabrizio@AWSanswered a year agoMichael a year agoHi, are there any complete examples of how to address this problem?I'm getting the following error "'DynamicFrameCollection' object has no attribute 'toDF'" using your snippetAdditionally, what's the best way to debug such custom code?Share"


Question: SecureTunneling port forwarding

"OverviewI'd like to use SecureTunneling to forward traffic from a PLC hanging off a Greengrass Core device as depicted below:QuestionsIs this possible to achieve?If so, how do I instruct the Greengrass Core Device for do the forwarding?BackgroundThe tutorials for the SecureTunneling Greengrass component give an overview of connecting to a Core device directly for SSH or HTTP, which is not exactly the same as this type of port forwarding operation:https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling-tutorial-open-tunnel.htmlThe page to setup a Secure Tunnel via AWS IoT allows entering a service, but the tutorials don't really show the syntax (if there is any) to achieve forwarding like this.FollowComment"

Answer: "1Accepted AnswerHi ttnickb. I don't think this is possible with the AWS-provided secure tunneling component. It's designed for accessing the Greengrass core device only. It's based on AWS IoT Device Client and that forwards to localhost.You could create a custom component to achieve what you want. Possibly based on a fork of AWS IoT Device Client. This component is probably a good starting point: https://github.com/awslabs/aws-greengrass-labs-containerized-secure-tunnelingCommentShareEXPERTGreg_Banswered 7 months agottnickb 6 months agoThanks for the suggestion.  I haven't pursued this further, but I assume you are correct based on what I have been able to find.Share"


Question: AWS Control Tower - Deployment Error

"Hi all,I'm attempting to deploy AWS Control Tower for a client.  When I start the process, I get the following error - "Your AWS environment is not ready for AWS Control Tower to be set up.  AWS Control Tower detected issues with your AWS account environment that prevent successful setup. Your existing service limits for this AWS account are not sufficient for AWS Control Tower to launch.  For more information, contact your account manager or AWS Support."  Is there any way I can see if I'm running into a quota or service issue?  Unfortunately, I don't see a way to drill down into the above error message any further to see where the limitation or issue is. Thanks!FollowComment"

Answer: "2Hi, I got the same issue. Are there anyone able to solve this problem?CommentSharegiuseppecantoanswered 2 years ago1Try starting a free tier EC2 instance (Amazon linux ami is fine), wait a few minutes, then attempt to launch Control TowerCommentSharedanjbuanswered a year agoKingsly 8 months agoFor a newly created account, this is the way to goShare0AWS support can provide you with the information needed if you file a support case. You can check the current quota status in "Service Quotas" in your account (top right menu) to see if some of the services required have reached, or are close to reaching their quota.You can see services Control Tower use and the default limits here: https://docs.aws.amazon.com/controltower/latest/userguide/limits.htmlCommentSharejannyganswered a year ago0Check in AWS Organizations > Services if the service AWS Control Tower is disabled.To enable it, open a support ticket.CommentSharemrsaizanswered 6 months ago"


Question: AWS certification exam canceled all of a sudden due to noise interruption

"I scheduled my AWS Cloud Practitioner Certification exam for 16 July. But during the exam and after the check-in, I was interrupted by a noise in my surroundings on which I hadn't had any voluntary control. And then I was asked to show my pockets to the proctor. Even after doing it all, they messaged all of a sudde  on the chat window that they saw something in the camera view and exited my exam. I couldn't even note the ticket ID that they raised for this issue. There are always certain elements on which we have no control. What do I do now? Kindly help me out.FollowComment"

Answer: 0Please refer Support for AWS Certification candidates and contact PearsonVUE / PSI / AWS Training & Certification Support - details also in blog post.CommentShareAshish_Panswered 10 months ago


Question: AWS Organization "You have exceeded the allowed number of AWS accounts." Error

"Greetings to everyone. When trying to add an AWS account to my existing organization in AWS Organization (when sending an invitation), I get the error "You have exceeded the allowed number of AWS accounts." I am aware that the default account limit is 10. And I do not exceed this limit. I get the same error when I create a new organization.Thank you in advance for your support.FollowComment"

Answer: "1In some situations, the account just might not be old enough to be 'verified'.Also, I have frequently hit this issue at the 5-account limit and not 10.When I deploy Control Tower, which consumes 3 total accounts and on the 3rd account provisioned via Account Factory, the Service Catalog product fails with the account limit error.CommentShareRoss Wickmananswered 6 months ago0The default account limit is 10, this can be increased. There is also a limit to the number of member accounts you can create concurrently, which is 5. For details of the Quota for AWS Organizations, please refers to:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.htmlCommentShareronald_lanswered 6 months agomhmtayberk 6 months agoHello I have not exceeded these limitations, on the contrary, I am well below these limitations, but I still get this error. There seems to be another problem here.Share"


Question: Why does AWS Control Tower enable access logging on the access logging bucket?

"After setting up AWS Control Tower I noticed that the S3 access logging bucket created under the Log Archive account, has logging enabled (and logging to the same bucket). This creates a situation where even doing nothing, the log bucket fills with recursive logs - any time a file is written to the log bucket, it generate another event to log to the log bucket. This just creates clutter and increased cost - is there any value in doing this? Or is this a bug/oversight?FollowComment"

Answer: "0The reason why it's done is because it's AWS best practice to enable logging on all S3 buckets.  However, the logging bucket is, and should be, the one exception to that rule for the reasons you've pointed out.  It therefore means that a customer should implement other controls to ensure that undesired access or actions cannot be taken against the logging bucket as no actions will be recorded.At this time, it's a configuration that customers can remove but AWS implements to provide a "secure by default" configuration, even if it may cause a undesired circular pattern which has a detrimental effect on customers.   There is a mechanism by which you can request this be updated and addressed by working with your account manager or through a support ticket.CommentShareAllison_Panswered 9 months ago"


Question: Any way to access locked-out vault?

"I was tightening my Glacier vault permissions policy and somehow ended up being unable to view or change it. No user can now view, save or delete the vault permissions (only one vault has this problem) - neither the root after logging into console nor a user with "AllowAll" IAM permissions granted for all vaults. The vault itself is now inaccessible - no uploads can be made.I only see "You do not have permission to view the vault access policy." after selecting Permissions tab of the vault. Needless to say that attempts to edit and change permissions fail with "Access denied" error.Tried lots of different avenues (via console and command line with various users) for several hours but nothing works to bypass the lock-out.Any help to reset permissions or, at least, to access the vault will be greatly appreciated!Edited by: IgorM on Feb 8, 2019 3:28 AMEdited by: IgorM on Feb 8, 2019 3:33 AMFollowComment"

Answer: 0The vault policy was invalid which prevented all access to the vault. I was contacted by AWS engineers who (1) fixed the policy and (2) will introduce a filter to block such invalid policies from being saved.This resolved my problem.CommentShareIgorManswered 4 years ago


Question: CodeDeploy fails

"Hello,if I create an ec2 instance with an instance IAM role then codedeploy-agent connects perfectly but if I create ec2 instance without that IAM role first then I modify IAM and give that role to ec2 but codedeploy-agent cannot connect to the serveris it happening to you guys or just me?FollowComment"

Answer: 0Accepted AnswerThere is only one catchjust modify IAM before installing codedeploy-agent in EC2.CommentSharedigpal parmaranswered 4 months ago


Question: Injecting credentials into C++ S3 CRT SDK

I want to specify a credentials file for the S3 CRT SDK to use that is not in the default location. I do not have access to change environment variables on the host machine. Is there a way to override the AWS_SHARED_CREDENTIALS_FILE variable in code or otherwise specify where to find the credentials so the SDK will find the credentials file I want?FollowComment

Answer: "0Accepted AnswerIt turns out that there is a constructor for the S3CrtClient that accepts a credentials argument. Looks like that is the way to go.S3CrtClient(const Aws::Auth::AWSCredentials& credentials, const Aws::S3Crt::ClientConfiguration& clientConfiguration = Aws::S3Crt::ClientConfiguration(), Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy signPayloads = Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never, bool useVirtualAddressing = true, Aws::S3Crt::US_EAST_1_REGIONAL_ENDPOINT_OPTION USEast1RegionalEndPointOption = Aws::S3Crt::US_EAST_1_REGIONAL_ENDPOINT_OPTION::NOT_SET);CommentSharedw-at-workanswered a year ago"


Question: What is the best IAM setup for github ( github actions ) for CI/CD?

"How would I set up github actions (CI/CD) to access AWS ? (best or recommended secure approach) ?Technical areas of expertiseIAMCI/CD with github actions (access an AWS accountI would like to know if there is any documentation that I can access on how to properly set up, or the recommended way to setup Github actions so that it can access my AWS account.Should I set up a user with a generated keypair (.pem or ssh key pair)or should I set up a role and apply a policy to a role and some how have github actions assume that role?What is the best recommended approach for a system like github (github CI/CD actions), accessing AWS resources like pushing a Docker image to AWS ECR?For my CI/CD, the only thing I need to do is to push a Docker container to AWS ECRand then test via Python HTTP GET / POST some API endpoints to make sure deployment of the container was successfully startedFollowComment"

Answer: "0The following blog is in Japanese but is set up by creating an IAM role.https://dev.classmethod.jp/articles/github-actions-aws-sts-credentials-iamrole/Basically, if you need access to AWS resources, it is better to use temporary credentials (e.g., IAM roles).CommentShareEXPERTRiku_Kobayashianswered 2 months agoDevLocalCA 2 months agoThank you very much.  I cannot read Japanese, but will see if Google translate can translate the page.It refers to OIDC which I have seen before but know little about.  I will search on that as well.Share0Hi DevLocalCA,I would look into this guide: https://aws.amazon.com/blogs/containers/create-a-ci-cd-pipeline-for-amazon-ecs-with-github-actions-and-aws-codebuild-tests/.It uses GitHub as a source code repository can use GitHub Actions to build a complete CI/CD pipeline for applications deployed on Amazon ECS, leveraging github actions such as github.com/aws-actions/configure-aws-credentials and github.com/aws-actions/amazon-ecr-login.Hope it helps you ;)CommentShareEXPERTalatechanswered 2 months ago0I've created two GH repos to support this and a related blog post linked in the second repo.The first repo has the CloudFormation to deploy an OIDC IAM Role and IDP Pair to support authentication. https://github.com/rwickit/aws-github-cicdThe second has the blog and Action examples to support deployment of AWS resources using Actions in both CloudFormation and Terraform.https://github.com/rosswickman/aws-automation-workflowsCommentShareRoss Wickmananswered 2 months ago"


Question: partial replication in dynamoDB global tables

"DynamoDB documentation on global tables is not very clear when it says this,"With a global table, each replica table stores the same set of data items. DynamoDB does not support partial replication of only some of the items."Ref - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_HowItWorks.htmlWhat does this mean exactly?Could someone explain this with an example?Thanks!FollowComment"

Answer: "0Accepted AnswerLets say you have a Global table with replicas in region 'us-east-1' and 'us-west-2'. You have performed write operation (100 items) on replica in region 'us-east-1'. So by default all 100 items will be replicated to table in us-west-2. You cant restrict or configure your Global table to only partially replicate only few items (lets say 5 out of 100).This is what is mentioned in developer docs you are referencingHopefully it helps. Let us know if you have any other questionsCommentShareAWS-User-2633450answered 4 years ago0Thanks for the reply Ankur. That seems to be what they have said.Why would anyone want to do that though?CommentShareshantanusanswered 4 years ago0shantanus wrote:Thanks for the reply Ankur. That seems to be what they have said.Why would anyone want to do that though?For example, some customers have policies, regulations, etc. that require certain data not leave home regions.-JeffCommentShareAWS-User-3100104answered 4 years ago"


Question: all i want is  all stop my service

no more request me money .from 2023-04-07right now all my AWS program seting reset please~FollowComment

Answer: "0Hello,Sorry to see you're having trouble. I'd recommend opening a case with our Billing team, so they can look into this with you and provide further guidance. You can create a case, here:go.aws/support-centerIf you're unable to sign in, you can contact our team by filling out this form:go.aws/account-supportPlease refrain from providing account or case details on re:Post, rest assured, our team will be happy to assist within your support case.In the meantime, these KC articles hosted right in re:Post, might point you in the right direction to terminate resources within your account, and locate unexpected charges:https://repost.aws/knowledge-center/terminate-resources-account-closurehttps://repost.aws/knowledge-center/resources-unexpected-charges— Ann D.CommentShareEXPERTAWS Support - Annanswered 2 months ago"


Question: "Announcement: Amazon Aurora PostgreSQL 11.x end of support is January 31, 2024"

"From January 31, 2024, Amazon Aurora PostgreSQL-compatible edition will no longer support major version 11.x. Newer major versions are available. Per the Aurora Version Policy [1], we are providing 12 months notice to give you time to upgrade your database cluster(s). We recommend that you proactively upgrade your databases running Amazon Aurora PostgreSQL major version 11.x to Amazon Aurora PostgreSQL 12 or higher at your convenience before January 31, 2024.If you do not upgrade your database running Aurora PostgreSQL 11.x before January 31, 2024, Amazon Aurora will upgrade your Amazon Aurora PostgreSQL 11.x databases to the appropriate Amazon Aurora PostgreSQL major version during a scheduled maintenance window on or after January 31, 2024.How to Determine Which Instances are Running Aurora PostgreSQL 11.xIn the Amazon RDS console, you can see details about a database cluster, including the Aurora PostgreSQL version of instances in the cluster, by choosing Databases from the console's navigation pane. To view DB cluster information by using the AWS CLI, use the describe-db-clusters command. To view DB cluster information using the Amazon RDS API, use the DescribeDBClusters operation. [2] You can also query a database directly to get the version number by querying the aurora_version() system function i.e., "SELECT * FROM aurora_version();".How to Upgrade to a New Major VersionYou can initiate an upgrade of your database instance — either immediately or during your next maintenance window — to a newer major version of Amazon Aurora PostgreSQL using the AWS Management Console or the AWS Command Line Interface (CLI). The upgrade process will shut down the database instance, perform the upgrade, and restart the database instance. The database instance may be restarted multiple times during the upgrade process. While major version upgrades typically complete within the standard maintenance window, the duration of the upgrade depends on the number of objects within the database. To avoid any unplanned unavailability outside your maintenance window, we recommend that you first take a snapshot [3] or a fast database clone [4] of your database and test the upgrade to get an estimate of the duration. To learn more about upgrading PostgreSQL major versions in Aurora, review the Upgrading Database Versions page [5].Please be aware of the following timeline:Now through January 31, 2024 - You can initiate upgrades of Amazon Aurora PostgreSQL 11.x instances to Amazon Aurora PostgreSQL 12 or higher at any time.Starting August 1, 2023, you will no longer be able to create new Aurora clusters or instances with Aurora PostgreSQL major version 11.x from either the AWS Console or the CLI. You can still add read replicas to existing Aurora PostgreSQL 11.x clusters and continue to apply changes to existing Aurora PostgreSQL 11.x instances, such as migrating to a Graviton2 R6g instance or changing instance configuration, until January 31, 2024.Starting January 31, 2024 Amazon Aurora will upgrade your Amazon Aurora PostgreSQL 11.x databases to the appropriate Amazon Aurora PostgreSQL major version during a scheduled maintenance window on or after January 31, 2024. Restoration of Amazon Aurora PostgreSQL 11.x database snapshots will result in an automatic upgrade of the restored database to a supported version at the time.If you have any questions or concerns, the AWS Support Team is available on AWS re:Post and via Premium Support [6][1]https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.VersionPolicy.html[2] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/accessing-monitoring.html[3] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_CreateSnapshotCluster.html[4] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html[5] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Updates.html[6] http://aws.amazon.com/supportFollowComment"

Answer: 0[Announcement] Does not require an answer.CommentShareEXPERTIsraa-Nanswered 18 days ago


Question: Bucket athena-examples

"Hello guys,I have a table setting in Glue, the location of this bucket is athena-examples-us-east-2, like the image below.When I click on this bucket, I can view all objects on. However, when I look for this bucket on dashboard or CLI, he doesn't exist.Curiously, I tried to open this bucket in another account, through the browser url, and I achieved! What is this bucket, it's like a sample public bucket?I noticed that there are another buckets like this, example: athena-examples-us-east-1, athena-examples-us-west-1, etc.FollowComment"

Answer: "1Yes, Its an example data that is available in the s3://athena-examples-myregion/cloudfront/plaintext/, where myregion is your current AWS RegionReference : https://docs.aws.amazon.com/athena/latest/ug/getting-started.htmlCommentShareEXPERTAWS-User-Nitinanswered 7 months ago"


Question: Cannot install Python package on SageMaker

"I am trying to install CKG Python library on my SageMaker Studio, following this instruction, https://ckg.readthedocs.io/en/latest/intro/getting-started-with-build.htmlI changed 'python setup.py install' to 'pip install .'but I still get an errorers            creating build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/__init__.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/acent.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/cheshire_tomography.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/circuits.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/image_processing.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/numpy_test.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/optimal_control.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/stock_tradeoff.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/test.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            copying examples/advanced/xpress_example.py -> build/lib.linux-x86_64-cpython-37/examples/advanced            creating build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/__init__.py -> build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/commodity_flow.py -> build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/create_graph.py -> build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/incidence_matrix.py -> build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/leaky_edges.py -> build/lib.linux-x86_64-cpython-37/examples/flows            copying examples/flows/max_flow.py -> build/lib.linux-x86_64-cpython-37/examples/flows            running build_ext            building '_cvxcore' extension            creating build/temp.linux-x86_64-cpython-37            creating build/temp.linux-x86_64-cpython-37/cvxpy            creating build/temp.linux-x86_64-cpython-37/cvxpy/cvxcore            creating build/temp.linux-x86_64-cpython-37/cvxpy/cvxcore/python            creating build/temp.linux-x86_64-cpython-37/cvxpy/cvxcore/src            gcc -pthread -B /opt/conda/envs/BookEnv_01/compiler_compat -Wl,--sysroot=/ -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -Icvxpy/cvxcore/src/ -Icvxpy/cvxcore/python/ -Icvxpy/cvxcore/include/ -I/opt/conda/envs/BookEnv_01/include/python3.7m -I/tmp/pip-build-env-21op54p3/overlay/lib/python3.7/site-packages/numpy/core/include -c cvxpy/cvxcore/python/cvxcore_wrap.cpp -o build/temp.linux-x86_64-cpython-37/cvxpy/cvxcore/python/cvxcore_wrap.o -O3            error: command 'gcc' failed: No such file or directory: 'gcc'            [end of output]              note: This error originates from a subprocess, and is likely not a problem with pip.        ERROR: Failed building wheel for cvxpy      Failed to build cvxpy      ERROR: Could not build wheels for cvxpy, which is required to install pyproject.toml-based projects      Traceback (most recent call last):        File "<string>", line 36, in <module>        File "<pip-setuptools-caller>", line 34, in <module>        File "/home/sagemaker-user/CKG/setup.py", line 52, in <module>          include_package_data=True,        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/__init__.py", line 107, in setup          return distutils.core.setup(**attrs)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/core.py", line 185, in setup          return run_commands(dist)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/core.py", line 201, in run_commands          dist.run_commands()        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/dist.py", line 969, in run_commands          self.run_command(cmd)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/dist.py", line 1243, in run_command          super().run_command(command)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/dist.py", line 988, in run_command          cmd_obj.run()        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/wheel/bdist_wheel.py", line 378, in run          self.run_command("install")        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/cmd.py", line 318, in run_command          self.distribution.run_command(command)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/dist.py", line 1243, in run_command          super().run_command(command)        File "/opt/conda/envs/BookEnv_01/lib/python3.7/site-packages/setuptools/_distutils/dist.py", line 988, in run_command          cmd_obj.run()        File "/home/sagemaker-user/CKG/setup.py", line 15, in run          check_call("pip install -r requirements.txt".split())        File "/opt/conda/envs/BookEnv_01/lib/python3.7/subprocess.py", line 363, in check_call          raise CalledProcessError(retcode, cmd)      subprocess.CalledProcessError: Command '['pip', 'install', '-r', 'requirements.txt']' returned non-zero exit status 1.      [end of output]    note: This error originates from a subprocess, and is likely not a problem with pip.  ERROR: Failed building wheel for CKG  Running setup.py clean for CKGFailed to build CKGERROR: Could not build wheels for CKG, which is required to install pyproject.toml-based projectsPlease kindly help me figure this one out.FollowCommentHemant Chugh a month ago$ cd CKG/$ conda activate ckgenvDo ls -la to see if requirements.txt file exist then run below commandpip install -r requirements.txtorpython -m pip install -r requirements.txt (just in case)Then proceed with next stepsShare"

Answer: 0You must review if the package you're trying to install is compatible with the python version of the AWS SageMaker Studio instance you're using.CommentSharevtjeananswered a month ago


Question: Linking AWS Certifications with AWS IQ

"Hi team,I recently had awareness of the AWS IQ platform, and I was compelled to sign-up for it on behalf of my firm.I have a quick concern while signing up for AWS IQ as a consulting firm: how do you integrate the certifications - currently, the firm has 71 certifications over the AWS Partner Central.Steps that I took:I added the personal information and selected the Role of Project Manager - Done"Link your AWS Certifications Account" - PendingI want to integrate those 71 certifications instead of personal certifications with the AWS IQ profile as I am not signing up as an individual expert but rather as a project manager who wants to deliver services on behalf of the firm.Please assist in this regard.Best,FollowComment"

Answer: "0If you are setting up an IQ profile for a company rather than an individual, you would provide general information about the certifications of your staff in the Marketplace details. To respond to customer requests, at least one person on the account needs a valid AWS Certification. Due to considerations such as eligible jurisdiction identified on the AWS IQ Expert FAQ  page, each staff member could be evaluated differently, so many companies have their certified staff set up an individual profile, which also helps to broaden exposure. It is always a good idea to send specific questions about AWS IQ to iq-info@amazon.comCommentShareAWSdaveanswered 4 months ago"


Question: Batch transform step not working

"I am trying to build two SageMaker pipelines. One is for training and the other is for inference. Training pipeline works and successfully registered my trained model in registry. There, I have trained a scikit-learn model with my own training script. In my inference pipeline, I am loading the model and retrieving both model_url and image_uri as follows:training_model = Model(    image_uri=step_latest_model_fetch.properties.Outputs["ImageUri"],    entry_point="./train_new.py",    model_data=step_latest_model_fetch.properties.Outputs["ModelUrl"],    sagemaker_session=pipeline_session,    role=role,    env={'SAGEMAKER_PROGRAM': 'train_new.py',        'SAGEMAKER_CONTAINER_LOG_LEVEL':'20',        'SAGEMAKER_REGION':'eu-central-1'})step_model_creation = ModelStep(name="ModelCreationStep",                          step_args=training_model.create(instance_type="ml.m5.xlarge"))then transform as follows:transformer = Transformer(    model_name=step_model_creation.properties.ModelName,    instance_type="ml.m5.xlarge",    instance_count=1,    output_path=f"s3://{bucket}/sagemaker/batch_transform_results")step_transform = TransformStep(    name="TransformStep",    transformer=transformer,    inputs=TransformInput(data=batch_data))My cloud watch error log is as below:Traceback (most recent call last):  File "/miniconda3/bin/serve", line 8, in <module>    sys.exit(serving_entrypoint())  File "/miniconda3/lib/python3.8/site-packages/sagemaker_sklearn_container/serving.py", line 146, in serving_entrypoint    server.start(env.ServingEnv().framework_module)  File "/miniconda3/lib/python3.8/site-packages/sagemaker_containers/_server.py", line 86, in start    _modules.import_module(env.module_dir, env.module_name)  File "/miniconda3/lib/python3.8/site-packages/sagemaker_containers/_modules.py", line 253, in import_module    _files.download_and_extract(uri, _env.code_dir)  File "/miniconda3/lib/python3.8/site-packages/sagemaker_containers/_files.py", line 129, in download_and_extract    s3_download(uri, dst)  File "/miniconda3/lib/python3.8/site-packages/sagemaker_containers/_files.py", line 165, in s3_download    s3.Bucket(bucket).download_file(key, dst)  File "/miniconda3/lib/python3.8/site-packages/boto3/s3/inject.py", line 277, in bucket_download_file    return self.meta.client.download_file(  File "/miniconda3/lib/python3.8/site-packages/boto3/s3/inject.py", line 190, in download_file    return transfer.download_file(  File "/miniconda3/lib/python3.8/site-packages/boto3/s3/transfer.py", line 320, in download_file    future.result()  File "/miniconda3/lib/python3.8/site-packages/s3transfer/futures.py", line 103, in result    return self._coordinator.result()  File "/miniconda3/lib/python3.8/site-packages/s3transfer/futures.py", line 266, in result    raise self._exception  File "/miniconda3/lib/python3.8/site-packages/s3transfer/tasks.py", line 269, in _main    self._submit(transfer_future=transfer_future, **kwargs)  File "/miniconda3/lib/python3.8/site-packages/s3transfer/download.py", line 354, in _submit    response = client.head_object(  File "/miniconda3/lib/python3.8/site-packages/botocore/client.py", line 508, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/miniconda3/lib/python3.8/site-packages/botocore/client.py", line 915, in _make_api_call    raise error_class(parsed_response, operation_name)botocore.exceptions.clienterror: An error occurred (404) when calling the HeadObject operation: Not FoundPlease note that I am only using one script for training/sreving that is named "train_new.py" and already contains the below functions:# inference functions ---------------def model_fn(model_dir):    clf = joblib.load(os.path.join(model_dir, "model.joblib"))    return clfdef input_fn(input_data, content_type):    """Parse input data payload    We currently only take csv input. Since we need to process both labelled    and unlabelled data we first determine whether the label column is present    by looking at how many columns were provided.    """    df = pd.read_csv(StringIO(input_data), header=None, names=["lemma"])    return df["lemma"].astype(str).valuesdef predict_fn(input_data, model):    prediction = model.predict(input_data)    return predictiondef output_fn(prediction, accept):    """Format prediction output    The default accept/content-type between containers for serial inference is JSON.    We also want to set the ContentType or mimetype as the same value as accept so the next    container can read the response payload correctly.    """    if accept == "application/json":        json_output = {"instances": prediction.tolist()}        return worker.Response(json.dumps(json_output), mimetype=accept)    elif accept == "text/csv":        return worker.Response(encoders.encode(prediction, accept), mimetype=accept)    else:        raise RuntimeException(            "{} accept type is not supported by this script.".format(accept)        )I would highly appreciate your help, I guess I have something wrong with my model container.FollowComment"


Question: Root login redirects to AWS signup

"Problem:I have an AWS account that I was previously able to access using root credentials.When I try to log in now, I am redirected to the AWS signup page.What I've tried to this point:My account is still active, the services are running and I'm receiving monthly invoices at the root emailI've confirmed that the root email is correct and can reset my password.Since I cannot log into the account, I cannot create a support ticket with AWS to help. I tried contacting amazon.com support but they referred me back to AWS.I've tried clearing cache and even installed a new browser to attempt login, but had the same issue with redirectHas anyone else had a similar redirect issue? Any thoughts on how to resolve?FollowCommentChris_G EXPERT9 months agoHello, I removed your email address image as it's not best practice to share that data on a public forum.Share"

Answer: "1Accepted AnswerHi ThereYou can contact AWS Support using this formhttps://support.aws.amazon.com/#/contacts/aws-account-support/Also check out this StackOverflow posthttps://stackoverflow.com/questions/47651648/aws-sign-in-loop-cant-access-the-portalCommentShareEXPERTMatt-Banswered 9 months agoEXPERTChris_Greviewed 9 months agosacrutcher 9 months agoMatt-B, the fix in the stackoverflow link you provided fixed my issue, thank you!For anyone else having the same issue, here is the fix that worked for me:Change your Amazon email address on www.amazon.com - You can use the same email address by using this trick. Change myemail@gmail.com to myemail+amazon@gmail.comUse the lost password recovery on the AWS login site to recover the password for the former email address (i.e. myemail@gmail.com).Use the new password to login on the AWS console with the former email address (myemail@gmail.com)Share"


Question: In App Stream 2.0 Getting error An unknown error occurred (1355).

"Hi,I am trying to setup the ADFS with App Stream 2.0  with SAML Authentication, and have done all the steps for the needful (Referred from : https://aws.amazon.com/blogs/compute/enabling-identity-federation-with-ad-fs-3-0-and-amazon-appstream-2-0/ ) , but after login to App Stream relay state URL screen, system gives an error: "An unknown error occurred (1355)."As per my research its indicating some DNS issue. When we have checked my system ip configs, its displaying something like this :Windows IP Configuration ( Host Name  : EC2AMAZ-NMGRP10 [this is my server system name], Primary Dns Suffix : example.local.Ethernet adapter Ethernet : Connection-specific DNS Suffix : sarvajeevan.comDNS Servers :   ::1     127.0.0.1Username for App Stream is : xyz@example.localAs per my understanding, our Active directory domain name is sarvajeevan.com, but internal federation domain is example.local.Please help us to understand, we are doing something wrong or something needs to fix manually from Route 53 or something else ?ThanksFollowComment"

Answer: "0I understand that your AppStream fleet is domain joined to sarvajeevan.comThis issue seems to be related to Windows user login issue that happens in AppStream in different scenarios and mentioned error code "1355" basically means "ERROR_NO_SUCH_DOMAIN". Please refer following Microsoft documentations.— System Error Codes (1300-1699):https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--1300-1699-— https://answers.microsoft.com/en-us/windows/forum/windows_xp-security/system-error-1355-errornosuchdomain/e102d0f4-499b-433c-a1bc-2ea3c0a32ca1To isolate the DNS issue, could you please verify the DHCP Option set for your VPC and ensure that it is configured correctly. Additionally, could you launch an EC2 instance in the same subnet and try to domain join and check if the issue is observed there as well.AppStream 2.0 requires that the SAML_Subject NameID value for the user who is logging in be provided in either of the following formats:domain\username using the sAMAccountNameusername@domain.com  using the userPrincipalNameKindly ensure that the above settings are configured correctly and test the authentication once again. In such case, it would be beneficial to have a look at the HAR logs and check the SAML response.I would encourage you to kindly open a support case, so that we can troubleshoot it further.CommentShareSUPPORT ENGINEERAnupama Manswered 9 months ago"


Question: Memory error in amazon sagemaker

"Memory error occurs in amazon sagemaker when preprocessing 400 mb of data which is stored in s3. No problem in loading the data. Dimension of data is 8-9 million rows and 4 columns, but I get 7000 columns after applying One hot encoding. One tying to train de model I get the following memory error: MemoryError: Unable to allocate 946. MiB for an array with shape (123962752,) and data type float64Notebook instance is ml.t2.medium. How to solve this issue?FollowComment"

Answer: "1Hello, without changing your code, one option would be to switch to an instance type having a larger amount of RAM memory. The usage pricing for each instance type is detailed on https://aws.amazon.com/sagemaker/pricing/Now, there are other options to perform one-hot encoding and other Feature Engineering tranformations, like SageMaker Data Wrangler and AWS Glue DataBrew. References:https://docs.aws.amazon.com/sagemaker/latest/dg/data-wrangler.htmlhttps://docs.aws.amazon.com/databrew/latest/dg/what-is.htmlCommentShareAWS-User-8651363answered a year agoEXPERTChris_Greviewed 9 months ago"


Question: Multi Environment deployment for AWS Serverless Application with .Net Core

"Hi,I have created a ASP.NET Core Web API project using below option from Visual Studio. Actually I needed to install AWS Toolkit for Visual Studio to use this template.I have deployed this ASP.NET Core Web API to AWS Lambda using the option of right clicking the project and using the optionWhen I try to deploy below popup appears but it doesn't give options to deploy in multiple environments.Now I want same Web API to deploy for different environment like test environment so how can I deploy the same.FollowComment"

Answer: "0So for starters, you don't need to use the AWS Toolkit to create or deploy the AWS Serverless Application for .NET.  You can also do this from the command line.  To get the project templates for the command line, install the Amazon.Lambda.Templates tool using:dotnet new -i Amazon.Lambda.TemplatesAfter that, you can create a new serverless ASP.NET Core Web API with:dotnet new serverless.AspNetCoreWebAPIordotnet new serverless.AspNetCoreMinimalAPIYou can deploy these serverless applications to Lambda the Amazon.Lambda.Tools global tool.You can install that tool using this command:dotnet tool install -g Amazon.Lambda.ToolsAfter that, you can deploy your serverless application to Lambda using:dotnet lambda deploy-serverlessTo answer your other question, about environments:  the AWS Toolkit is meant for deploying to test or dev environments, and not for production deployments. If you want to deploy to a different AWS account, choose a different profile. In your screenshot, you are using your "default" profile.  You can create multiple profiles that have credentials for multiple AWS accounts, or even for the same account but associated with different IAM users. To deploy to another account, just re-deploy the Lambda, selecting a profile that is associated with another AWS account.See the AWS docs for the .NET Core CLI for more details.CommentShareKirk_Danswered 3 months ago"


Question: SQL Queries queues

"I have N+ users, for each user backend send queue of SQL FIFO queries (each may took some time to execute), but queues of different users must run concurrently.How i can realize this?In single SQS i can't do this: FIFO option applies to full SQS, not separate queue.FollowComment"

Answer: "1You can do what you need using the message group ID when sending messages in a FIFO queuehttps://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/using-messagegroupid-property.htmlIf you attach lambda to consume SQS with concurrency greater than 1, lambda will consume the messages from SQS maintaining the order based on the message group ID with the lambda concurrency that you have specified.CommentShareMikianswered a year agoboter a year agoThenk you, i'll check this ))Share0I seek solution for pure serverless event driven srchitectCommentShareboteranswered a year ago"


Question: Amazon Linux 1 reqeust: php 7.3 packages for imagick & mcrypt

Could someone put the following packages on the list for inclusion in Linux 1 on lightsail?php73-pecl-imagickphp73-pecl-mcryptWordpress gets cranky when you don't have mcrypt installed and mildly annoyed when imagick isn't installed.Both packages exist for PHP 7.2.Thanks!davidFollowComment

Answer: "0Hello,Both of these packages are available on Amazon Linux 2, in the php 7.3 extras repository. We highly recommend moving to Amazon Linux 2, as Amazon Linux 1 is approaching its end of life. To enable the php 7.3 extra on Amazon Linux 2 run: sudo amazon-linux-extras enable php7.3Then you can use the yum command to install these packages: sudo yum install php-pecl-mcrypt php-pecl-imagickThanks,HeathCommentShareAWS-User-2400882answered 4 years ago0I'm using Lightsail and Amazon Linux 2 isn't currently an option.CommentShareDavid Ganswered 4 years ago0I have opened a request with the Lightsail team to add support for Amazon Linux 2. I can also add an item to add those packages to Amazon Linux 1, but I do not have a timeline of even if those packages can be made available.Thanks,-HeathCommentShareAWS-User-2400882answered 4 years ago0heath@AWS wrote:I can also add an item to add those packages to Amazon Linux 1, but I do not have a timeline of even if those packages can be made available.I saw that there were some PHP73 updates recently, but no mcrypt package.I'd really like to upgrade from PHP 7.2 to 7.3 on my instances.  Lack of mcrypt is the only thing holding me back at the present time.davidCommentShareDavid Ganswered 4 years ago0Hello,I did reach out to the Lightsail team, and they are working on making AL2 available on Lightsail, but they did not have a timeline for that work. We have an item on our list of things to do to add php73-pecl-mcrypt packages to Amazon Linux AMI. I have made a note that this is blocking your upgrade to PHP 7.3. Sorry for any inconvenience this has caused you, and we appreciate the feedback.-HeathCommentShareAWS-User-2400882answered 4 years ago0heath@AWS wrote:We have an item on our list of things to do to add php73-pecl-mcrypt packages to Amazon Linux AMI. I have made a note that this is blocking your upgrade to PHP 7.3.Any updates on this?  I would REALLY like to upgrade my Linux 1 instance to PHP 7.3, but can't due to the lack of mcrypt support.CommentShareDavid Ganswered 4 years ago0Hi I would also love to know if there is Amazon Linux 2 for Elastic Beanstalk platform? Thanks.CommentShareVinceanswered 4 years ago0mcrypt hasn't been updated in over 10 years. If possible, you should upgrade your code to use Sodium instead.CommentSharerparmananswered 4 years ago0While libsodium (0.4.3) is available on Linux 1, the PHP extension isn't.I tried to install libsodium using pecl and it complained that the libsodium version was too old.Wordpress seems rather insistent that mcrypt be installed.CommentShareDavid Ganswered 4 years ago0Still waiting for this.  Any progress?CommentShareDavid Ganswered 4 years ago0Bump. Also waiting for php73-pecl-imagick on Amazon Linux 1.CommentShareForums-User-1547442answered 4 years ago0Any updates? How to install extra packages!CommentSharejarrettjanswered 3 years ago0For those still needing this... took a little head-scratching.... but it is still possible to patch in the missing package support on amazon linux 1, using pecl7....yum install ...your required php73 packages from the ones availableAdd the php7-pear package and a few dependencies pecl7 will require to compile missing extensions...yum install php7-pear php73-devel mcrypt libmcrypt-devel zlib-develNow use pecl7 to install the missing extensions...pecl7 install mcrypt memcache igbinaryAdd the extensions to php.ini (or /etc/php-7.3.d/)extension=mcrypt.soextension=memcache.soextension=igbinary.soAnd finally add the pear7 path to the include_path in php.ini...include_path=".:/usr/share/pear7"CommentSharePushPaulanswered 3 years ago0Thank you very much for the tips.CommentSharealoyantanswered 3 years ago"


Question: Advise on Creating a Custom AMI from an Existing Beanstalk-Managed EC2 Instance

"Hello,I have an IIS application based on a Windows Server 2019 image.  It is a single EC2 instance managed by Elastic Beanstalk.  I'm looking to create a custom AMI based on this existing EC2 instance to provide the ability to auto-scale our Beanstalk environment as needed in the future.Constraints:This is a production environment so I'm trying to minimize downtime - a few minutes is fine but I definitely can't have a prolonged outageNeed to be able to retrieve passwords for the individual instances for RDP in the event that I need to view logsI'm looking for advice on the procedures/best practices I should follow for safely doing this. For example, should I run Sysprep?  The AWS docs say not to, for a production system, but I've had issues in the past with being unable retrieve passwords for custom AMIs, and was told that it may have been due to not running Sysprep.Thanks!FollowComment"

Answer: "0As you are currently running a single instance, beanstalk performs an in-place update when you update your application versions, and as such your application might become unavailable for a short period of time. To avoid this considered switching deployment strategies to better support future needs. For example, with a blue/green approach all you would need to do is swap the CNAMEs of the two environments to redirect to the new version instantly.There are some caveats in that the your environment must run independently of any beanstalk provisioned database.Refer to Blue/Green deployments with Elastic BeanstalkThe following table compares deployment method properties.MethodImpact of failed deploymentDeploy timeZero downtimeNo DNS changeRollback processCode deployed toAll at onceDowntime*NoYesManual redeployExisting instancesRollingSingle batch out of service; any successful batches before failure running new application version**YesYesManual redeployExisting instancesRolling with an additional batchMinimal if first batch fails; otherwise, similar to Rolling***YesYesManual redeployNew and existing instancesImmutableMinimal****YesYesTerminate new instancesNew instancesTraffic splittingPercentage of client traffic routed to new version temporarily impacted****YesYesReroute traffic and terminate new instancesNew instancesBlue/greenMinimal****YesNoSwap URLNew instancesCommentShareRoBanswered a year agodanmoore123 a year agoThanks for the response - this is good info.  Basically our goal is to move towards the rolling deployment strategy to minimize downtime and allow scalability in the future.  At this point my question is primarily about how to go about creating an AMI that will be appropriate for this configuration (eg the AMI creation process).Share"


Question: REST API for Workspaces - DescribeWorkspaces

"Following the docs at: https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaces.htmlI combined this URL: GET https://workspaces.us-west-2.amazonaws.com?Action=DescribeWorkspaces&Version=2015-04-08and call it using Postman to read all workspaces within our account in us-west-2, but am getting a 404 with <UnknownOperationException/>I am able to run REST APIs via Postman for ec2 and IAM without an issue, but maybe the workspace REST APIs are different?Seems I'm missing something simple... Any help is appreciatedThanksudoFollowComment"

Answer: 0After changing the request to POSTand adding headersContent-Type:  application/x-amz-json-1.1X-Amz-Target:  WorkspacesService.DescribeWorkspacesand body:{"limit": 25}This works fine now.CommentShareudoanswered 2 years ago


Question: Config: AWS maintained required tags rule parameter limit increase

"We are using the aws maintained required-tags rule to check for tagging compliance. Some of our resources will require more than 6 mandatory tags. The aws config rule only supports 6 by default and I cannot find a way to increase this number. Any attempts to do so via the console, terraform or Cloudformation yield an invalid parameter error. The documentation found here: https://docs.aws.amazon.com/config/latest/developerguide/required-tags.htmlindicates that 6 key-value pairs are supported. As far as I can tell I would need to deploy two config rule for a resource type if for example 8 key-value pairs are required. The supported 6 key value pairs seems arbitrary. Is there any way I can modify this? Is the code for the rule available somewhere in git? If this is the case I can utilize it to create a custom rule.FollowComment"

Answer: 0My recommendation is to create your own custom rule in AWS Config through a Lambda Function:https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.htmlCommentSharevtjeananswered a month ago


Question: Elastic BeanStalk shows unhealthy; health check not working

"I have an EBS environment with an Application Load Balancer set up. Listener set to port 80. I also set the Security Group to allow all inbound traffic from port 80 and port 8080.When I use the Public IPv4 DNS to curl the health check endpoint, I get a response. But the EBS status is coming back as severe. The Enhanced health overview says "ELB health is failing or not available for all instances."Looking at the Target Group, it shows Unhealthy with "Request timed out" on the Health status details.Did I miss a step somewhere?FollowComment"

Answer: "0Hello there,I noticed that you are facing health issues with your Elastic BeanStalk environment.The Target Group shows unhealthy because the target group failed to respond to a health check or failed a health check due to the timeout error in this case[1]. For your “HTTP 408: Request Timeout” error it means that client data was not finished sending as the idle timeout period was exhausted before sending the data through. A possible fix would be to increase the idle timeout length accordingly, as it is set 60 seconds by default [2].Also take note that if your EC2 instances are in a Public subnet they will need Public IP’s to communicate via the internet gate way, if not Public a new environment can be setup and using a CNAME swap from the old environment to the new[3]. If you are running on a Private IP you will need a NAT gate way to communicate to the internet.For troubleshooting instance in a severe state choose the error based on the warming issues [4].Another item to check is that you have the required outbound rules in your Security Group that best matches your use case. Outbound rules allow your resources to respond with an Acknowledge response back to your health checks. Resources are ticked healthy if the Health check receives a response back.For troubleshooting health warmings check the reference below [5].Also be sure to check the health check path and verify that the path is corrected.If you have a custom health check end point you will want to set or modify the  default URL to your custom one. If you have a custom  path you should modify load balancer for example: "default 80 HTTP /" to "default 80 HTTP /healthCheck"References:[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html[2] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeout[3] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html[4] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-troubleshoot.html[5] https://aws.amazon.com/premiumsupport/knowledge-center/elastic-beanstalk-yellow-warning/CommentShareAntonioanswered a year ago"


Question: Client IP Preservation for Network Load Balancer endpoints for Global Accelerator

The Global Accelerator currently does not support client IP preservation for Network Load Balancer endpoints. Is anyone aware of the reason behind this and if AWS plans to support it?FollowComment

Answer: "0Hello there,I understand that you would like to preserve Client IP for Network Load Balancer for Global Accelerator.To achieve this, you can create a target group and specify its target type which determines how you specify its targets.Possible target types include:Instance: The targets are specified by instance ID. When you specify targets by instance ID, the client IP of all incoming traffic is preserved and provided to your applications.IP: The targets are specified by IP address. When you specify targets by IP address, the following conditions apply:If the target group protocol is TCP or TLS, client IP preservation is disabled by default. In this case, If you need the IP addresses of the service consumers, enable Proxy protocol on the load balancer. See reference [3] to enable Proxy protocol.If the target group protocol is UDP and TCP_UDP, client IP preservation is enabled by default. For more information on Client IP Preservation with Network Load Balancer, refer to reference [1].Global Accelerator doesn’t support source IP preservation with Network Load Balancer as endpoint, see reference [2] for more information. The client will connect to the Global Accelerator, then Global Accelerator will use its own IPs from the edge locations to reach the Network Load Balancer which will in turn pass the Global Accelerator IPs to the target EC2 instance. If the EC2 instance is not allowing the Global Accelerator source IPs, then the connection will time out.References:[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservation[2] https://docs.aws.amazon.com/global-accelerator/latest/dg/preserve-client-ip-address.how-to-enable-preservation.html[3] https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocolCommentShareAsenathianswered a year ago"


Question: Code Commit Branching Error

"Hello, I hope someone can help, we keep going into AWS Commit Visualiser and there is a big black line going up through the middle (for which i think is the master branch), however we have two branches, branch a seems to generate a new line from the master branch of a different colour and goes back in like we expect, however branch b does not.Here is the visualiser, it shows branch a working fine however its not showing it on branch b.https://pasteboard.co/HXFoUro.pngIs it something we are doing? Here are our steps:Change to BranchMake ChangesCommit ChangesPush To OriginChange To MasterMerge Branch we made the changes on into Master.FollowComment"

Answer: "0Accepted AnswerHi,Git does a fast forward merge by default whenever it is possible (https://git-scm.com/docs/git-config#git-config-mergeff).  So when you merged the your first branch to master, since they shared the same parent commit, git did a fast forward merge.  That's the reason you don't see the branching in the graph.Now follow the same steps as you did except for a slight difference in step 3Commit and push to master branchCreate a new branch and commit a fileChange to master and merge using the following commandgit merge --no-ff <branchname>--no-ff means don't do a fast forward merge which will force to create a new merge commit.And then follow the rest of the steps.Please let me know if that resolved your question.Thanks,AashwinCommentShareAWS-User-6266406answered 4 years ago0Hi,If I understood your use case correctly, you have a branch master that look say look like thisC2 -> C1 -> C0.You create a branch off C1 (lets call this branch B1).You create another branch from C1 (lets call this branch B2) and add a commit C4Now you create a commit C3 to branch B1 and merge it into master (creating a merge commit C5).  At this time you repo looks like this          B2           |master    C4     |          \ C5 -> C2 -> C1 -> C0     \      /        C3         |        B1Now from the graph the history of master branch includes commits C5, C2, C3, C1, C0.  Hence when you visualize the master branch in the commit visualizer you can see commits C3 (which is part of branch B1 and master since we merged it into master).  However we don't see C4 since it's part of branch B2 and was never merged into master.The black line in the commit visualizer is the color of the current branch that you have selected.  So if you select master, commits C5 C2, C1 and C0 are part of the black line and commit C3 will be of a different color and will come back into master since we merged it.I hope I understood your use case and this answers your question.Thanks,AashwinCommentShareAWS-User-6266406answered 4 years ago0I hope this explains better:https://imgur.com/a/UubkgOeCommentSharelewisstevens1answered 4 years ago"


Question: AWS Drivers in RHEL7.9

"I got a red hat enterprise linux servers in my aws console.i want to know how what are the aws drivers i am using ?? (pv,nvme,ena) commands to find what version i use ??what drivers are needed to be upgraded periodically to keep instances running smooth ?and what are the steps to upgrade them to the latest vversion ?FollowComment"

Answer: "0This steps you through the process of finding the verion of the nvme driver https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html  The general advice on how to find information about drivers is still applicable to other drivers on instances running RHEL too.In short, if you regularly patch your system with sudo yum update -y then you will keep the drivers at their latest version.CommentShareRWCanswered 14 days ago"


Question: "AWS Pinpoint Android, “EventRecorder: Unable to successfully deliver events"

"I'm attempting to get AWS Pinpoint to send notifications to my Android app. I have gone through the setup testing instructions here: https://aws-amplify.github.io/docs/android/push-notificationsI'm able to get a Pinpoint client device token and send a message with the Pinpoint test messaging console. Once I send the message I get the following stacktrace in my log:2019-04-11 11:56:34.757 8880-9196/com.example E/EventRecorder: Unable to successfully deliver events to server. Events will be saved, error likely recoverable.Cognito Identity not configuredcom.amazonaws.AmazonClientException: Cognito Identity not configuredat com.amazonaws.mobile.client.AWSMobileClient.getCredentials(AWSMobileClient.java:352)at com.amazonaws.services.pinpoint.AmazonPinpointClient.invoke(AmazonPinpointClient.java:4024)at com.amazonaws.services.pinpoint.AmazonPinpointClient.putEvents(AmazonPinpointClient.java:3074)at com.amazonaws.mobileconnectors.pinpoint.internal.event.EventRecorder.submitEventsAndEndpoint(EventRecorder.java:366)at com.amazonaws.mobileconnectors.pinpoint.internal.event.EventRecorder.submitEventsAndEndpoint(EventRecorder.java:344)at com.amazonaws.mobileconnectors.pinpoint.internal.event.EventRecorder.processEvents(EventRecorder.java:315)at com.amazonaws.mobileconnectors.pinpoint.internal.event.EventRecorder$1.run(EventRecorder.java:240)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)at java.lang.Thread.run(Thread.java:914)The stacktrace suggests I need "Cognito Identity" for messaging to work, but I don't want that service as I already have user management/authentication process built.How do I resolve this issue?Thank you.Edited by: Paris on Apr 12, 2019 4:04 AMFollowComment"

Answer: 0This is a non-issue on a physical android device.CommentShareParisanswered 4 years ago


Question: View or Terminate Root User Active Sessions

Is there a way that I can check if there's any sessions previously created by a root user logging into a root account via a https://*.signin.aws.amazon.com/console link that are currently still active?FollowComment

Answer: "0You can use Systems Manager to view information about sessions in your account.https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-view-history.htmlCommentShareSachinanswered 3 months agorePost-User-8849866 3 months agoThe Systems Manager / Session Manager page doesn't show any sessions.Is that expected or should it show the current session?Share0According to the Console FAQ, console sessions only last 12 hours until they have to reauthenticate. So, you should be able to query the CloudTrail logs for root logins less than 12 hours.CommentShareEXPERTkentradanswered 3 months agorePost-User-8849866 3 months agoI'm not really familiar with CloudTrial, but have built a query using the examples as a guide; "SELECT * FROM $EDS_ID".This shows no results, even though I signed in within the last 15 mins... Am I querying the wrong table?Share0CloudTrail records sign-in events including root's, but not sure if active session details are available anywhere.for cloudTrail details you can check below link.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-event-reference-aws-console-sign-in-events-rootCommentShareSachinanswered 3 months ago0CloudTrial doesn't have anything configured.To be specific; I'm looking to see what current sessions exist in a new account without anything configured or created.An account was created the account on a machine that is no longer accessible. I want to either see the login activity from that machine to make sure I'm happy no-one could use the account or or at least ensure that any sessions created so far are all fully terminated.Is there any way to do either of those options?CommentSharerePost-User-8849866answered 3 months ago"


Question: Unable to exclude AWS Trusted Advisor item

I have one alert on a Security Groups - Unrestricted Access violation but when I select that one the button "Exclude and Refresh" is not clickable.Why can't I exclude it?FollowComment

Answer: "1Accepted AnswerAfter a refresh I was able to select that button... not sure what happened here.CommentShareAWS-User-5988924answered a year ago1Once you do a "Refresh" or an "Exclude and Refresh", you need to wait some time to be able to do it again. The cooldown interval varies among different checks. On your specific case it's around 5 minutes of interval before you can either "Refresh" or "Exclude and Refresh" again. The wait time is shared between the two actions.CommentShareRenato_Oanswered a year ago"


Question: Sagemaker Studio notebook - no module named 'tensorflow' when chosen image type "Tensorflow 2.6 Python 3.8 GPU optimized"

"Hi,I have created a simple notebook on SageMaker Studio using the Image "Tensorflow 2.6 Python 3.8 GPU optimized". But when I try to run simple statement viz. "import tensorflow", I am getting the error "no module named 'tensorflow'".I tried to install 'tensorflow' package using pip from the terminal attached to the image. But it shows the message "requirement already satisfied".Am I missing anything here? Please help.Thanks in advance,PraveenFollowComment"

Answer: "1Accepted AnswerFrom the question, I understand that you are trying to use a TensorFlow 2.6 Python 3.8 kernel in SageMaker Studio, but you are unable to import tensorflow.The service team are aware of this issue and are actively working on a fix.Mitigation OptionA)  If your use case is version flexible, version other than 2.6 should work.B) If not, you can try the following as workaroundOpen a notebook using a Tensorflow 2.6 Python 3.8 kernelExecute the following line in a notebook cell:!sed -i 's|^ *"python",|  "/usr/local/bin/python",|g' /usr/local/share/jupyter/kernels/python3/kernel.jsonStop the kernelRe-attach the kernel to your notebook.Hope it helps!CommentShareSUPPORT ENGINEERStewyn_Canswered a year agoAWS-User-7021532 a year agoThanks for informing that it's a known issue. Are there any other known issues of SageMaker Studio documented in a webpage? Please send me the link if it exists.The solution mentioned in option #B didn't work for me. Tried for couple of times, but still I am getting same error.I went for option #A and it's working fine as for Tensorflow.Thanks for the help!!ShareAWS-User-7021532 a year agoOption #B also working fine for me. Thanks for the workaround!!Share"


Question: trigger AWS CodePipeline on S3 bucket any file change

CodePipeline allows to use S3 as a source and it is easy to make it run on a change in some specific file.the question is it possible to make my pipe to wake up on a change in any file?FollowComment

Answer: "0Hi Vlad,UPDATE:After a few trials, it seems that S3 source works if you provide a single file as ZIP, but NOT if you provide a FOLDER/ *.https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-S3.htmlNoteWhen Amazon S3 is the source provider for your pipeline, you may zip your source file or files into a single .zip and upload the .zip to your source bucket. You may also upload a single unzipped file; however, downstream actions that expect a .zip file will fail.Indeed, seems that now Code Piepline S3 source action "forces" you to provide a single file (e.g. zipped).OLD ANSWER:yes, according to https://docs.aws.amazon.com/codepipeline/latest/userguide/create-cloudtrail-S3-source.html, associating S3 with CodePieplines creates an Amazon CloudWatch Events rule and a CloudTrail trail that starts your pipeline when the source changes.Hope it clarifies and if does I 'd appreciated answer to be accepted so that community can benefit for clarity when searching for similar issues, thanks ;)CommentShareEXPERTalatechanswered 3 months agoVlad Aginsky 3 months agoHi @alatech, so far i was working with GUI, and reading instructions in your answer, i dont see how can i wake my pipe on any file in my bucket. (for some  specific file there is no problem)Sharealatech EXPERT3 months agoAfter looking locally, at least S3 triggering works if you provide a zip file as part of the S3 source step. I ll try to see if it works for individual files.Sharealatech EXPERT3 months agoDoes not seems so as getting The object with key 'folder/ *' does not exist. Updated answer.Share"


Question: Unity plugin for Gamelift failing to deploy - Fleet CREATE_FAILED

"I am using the unity plugin for gamelift, I deployed the first game successfully, but failed when I deployed the second.The error information that  cloud formation shows is the following:[CREATE_FAILED - Resource handler returned message: "Error occurred during operation 'AWS::GameLift::Fleet'." (RequestToken: xx-xx-xx-xx-xx, HandlerErrorCode: GeneralServiceException)][ROLLBACK_IN_PROGRESS - The following resource(s) failed to create: [FleetResource]. Rollback requested by user]how I can get around this or what to do? I don't find any problem about my fleet seeting or limits.FollowComment"

Answer: "0I delete the first game deployed, and the new game is deployed successfully. But I don't know the reason.CommentSharelistentowindanswered 8 months agoToni_S EXPERT8 months agoDid you check the CloudFormation console for the detailed error? As said I suspect you were hitting GameLift Fleet limits. You can view the limits in console under Amazon Gamelift -> Service Limits and under the Service Quotas -> AWS Service -> Amazon GameLift.Sharelistentowind 8 months agoYes, I see the service resource limit, but it looks like there is a quota.Share0You can see the error in more details by going into AWS Console and selecting CloudFormation service. Under there you should be able to see the CloudFormation stack generated by our game. Select the stack, go into events to see what was the actual error message. For example you might have face issues with Services Quotas preventing you from launching new fleet of servers.CommentShareEXPERTToni_Sanswered 8 months ago"


Question: Cross Account S3/Athena Access in IAM Identity Center

"Earlier we were using IAM Roles and mapped those Roles to the target AWS account since we know the NAMES of the roles we could hardcode them in IAM/s3 policy documents to manage access.with IAM Permissionset inplace , we are confused as to how to easily manage the same access to our platform users. the Names are very Weird and ends with some weird number and characters.how should we manage the cross account resource and use these new roles created by permissionset ? ThanksFollowComment"

Answer: "0Accepted AnswerYou would do same as you did with IAM role names.  The Permission Set names are 'weird' because they are trying to ensure they are unique and won't conflict with anything you have created.The names don't change once created, so you can use them the same way you use IAM Roles.Hope this helps,CommentShareCarlos del Castilloanswered a month ago0Take a look at using principal and resource tagging in policy conditions. ExamplesEC2: Start or stop instances based on matching principal and resource tags.EC2: Start or stop instances based on tagsCommentShareEXPERTkentradanswered a month ago"


Question: EventBridge Scheduler

"I have scheduled an "EventBridge Schedule" to send a SQS message containing a json to be sent at a certain time.First of all I can not see that the queue have received the message. And there is no way to observe the instances of the scheduled task runs to see how many times it has run or what was the result of each run ? Do you have any idea how can I debug this scheduled task ?I have no "Rule" defined (I assume it is not needed) because it is a simple SQS message targeting a specific queue.CloudTrail has not shown me anything about the instances of the runs or a failure sign.I have changed the schedule type to rate and intended to send the message every 1 minute but still nothing seems to be in the queue.I have given the Role of the scheduled task every possible permission (I am not sure if this is the reason).            "Effect": "Allow",            "Action": [                "scheduler:*",                "logs:*",                "sqs:*",                "events:*"            ],            "Resource": "*"Thanks for your help.FollowComment"

Answer: 0Accepted AnswerFound the missing point :Created a Dead Letter Queue (which is NOT fifo) and set the dead letter queue for the scheduled task.After that failed messages will go there with the error reason in the attributes.Hope this helps someone in the future.CommentSharerePost-User-2531625answered 20 days agoEXPERTalatechreviewed 19 days ago


Question: AWS-SDK-Javascript v3 API call to DynamoDB is return undefined and ignoring execution of a console.log command

"The goal of this code snippet is retreiving all connectionsids of a chat room to reply to a chat sendmessage command in the API Gateway WebSocket.I have used PutCommand and GetCommand a lot, but today I'm using the QueryCommand for the first time.The code Part 1, the DynamoDB call:export async function ddbGetAllRoomConnections(room) {  const params = {        "TableName": "MessageTable",        "KeyConditionExpression": "#DDB_room = :pkey",        "ExpressionAttributeValues": {          ":pkey": ""        },        "ExpressionAttributeNames": {          "#DDB_room": "room"        },        "ScanIndexForward": true,        "Limit": 100  };  console.log("ddbGetAllRoomConnections-1:",params);  const data = await ddbClient.send( new QueryCommand(params) );  console.log("ddbGetAllRoomConnections-2:",data);  return data;}The calling part:            const normalConnections = ddbGetAllRoomConnections(connData.lastroom);            if (typeof normalConnections.Items === 'undefined' || normalConnections.Items.length <= 0) {              throw new Error("Other Connections not found");            }The following logfile entries are occuring in sequence:logfile puzlle message1:ddbGetAllRoomConnections-1: {  TableName: 'MessageTable',  KeyConditionExpression: '#DDB_room = :pkey',  ExpressionAttributeValues: { ':pkey': '' },  ExpressionAttributeNames: { '#DDB_room': 'room' },  ScanIndexForward: true,  Limit: 100}logfile puzlle message2:ERRORError: Other Connections not found    at Runtime.handler (file:///var/task/chat-messages.js:49:21)    at processTicksAndRejections (node:internal/process/task_queues:96:5) {  statusCode: 500}logfile puzlle message3:END RequestId: Waht irritates me is, the following sequence of occurences in the logfile:ddbGetAllRoomConnections-1: is coming correctly before the ddbClient.send commandafter the ddbClient.send command there is no ddbGetAllRoomConnections-2 log entryThe next logentry is after the call of ddbGetAllRoomConnections showing the value undefined.I tried also PartiQL per ExecuteCommand, then debugging with Dynobase I retrieved the code for the params section in the current setting.FollowComment"

Answer: "1Accepted AnswerI think in the calling part you should also await:const normalConnections = ddbGetAllRoomConnections(connData.lastroom);should beconst normalConnections = await ddbGetAllRoomConnections(connData.lastroom);Your code is valid but normalConnections will be a promise and not a resultCommentShareJaccoPKanswered a year agoOliver Weimar-Drese a year agoSo obvious, that I didn't see it. Thanks for pointing out.ShareJaccoPK a year agoHappy to help :-) Can you accept the answer? It gives me 10 points in stead of 1 :-)Share"


Question: EKS Auto Scale: How To?

"When setting up an EKS Cluster, how would one setup Auto Scaling for a Node Group?EKS docs show settings up either the Kubernetes Auto Scaler, or Karpenter.https://docs.aws.amazon.com/eks/latest/userguide/autoscaling.htmlBut, being on EC2, there is the EC2 Auto Scaling.https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.htmlDo i need just one, where either option will suffice? Do I need both? Or, will only the EKS options work for EKS nodes (that are EC2 nodes)?A couple more items i found in re:Post:https://repost.aws/knowledge-center/amazon-eks-troubleshoot-autoscalerhttps://repost.aws/questions/QUAWIKBZyOStO4jv_kvYRb2A/difference-between-ec2-s-with-a-auto-scaling-and-ecs-or-eks-cluster-managed-ec2-machinesFollowComment"

Answer: "2Accepted AnswerYou only need to setup Kubernetes Cluster Autoscaler and it will use EC2 Auto Scaling feature to launch additional instances and join them into the cluster. You don't have to configure both separately. EC2 Auto Scaling alone would not suffice at it won't have the visibility into what's happening with pods within the cluster.I would advice to explore Karpenter as it's a more comprehensive way of scaling K8S cluster, here is a link to the blog which goes into details - https://aws.amazon.com/blogs/aws/introducing-karpenter-an-open-source-high-performance-kubernetes-cluster-autoscaler/CommentShareJaroslav-AWSanswered 2 months agojefferyp 2 months agoThank you, this is the answer I was looking for.Share"