Question: Amazon Linux 2 - Postfix package deletion consequences

"HellomWe have postfix package installed by default on our Amazon Linux 2 system that being launched from Amazon Linux 2 Images.For some reasons, we need to delete it from the system, is there any consequences for that?Please note that, we hasn't configured this package to be as mail agent before.Thanks.FollowComment"


Question: No score report displayed after SAA-C02 exam

"I have just finished the SAA-C02 this morning. However, it is very unusual that no exam result and score report was displayed after the exam. I took a few AWS exams before and the result was known immediately after the exam. Could you please advise?FollowComment"

Answer: "2Hello,I had the same experience. I contacted the provider and they logged a ticket on my behalf stating that immediately result SHOULD be displayed (and they wanted to investigate why the result wasn't displayed immediately) - but I had to wait nonetheless - anyway I got my result within 7-8 hours.Have a great rest of the day!CommentShareEXPERTNIRUPAM_danswered a year agoDavid Leal 10 months agoI had the same experience I din't get the result immediately after I finished the exam, I just got a black screen, then a day after (about 18 hours after I finished the exam) I got an email from Credly indicating that I had a new badge and then about 5 hours after this notification from Credly the final notification from AWS. That was curious, but it was a good news anyway, :-)Share1Hello, the exam results are not right away anymore from what I have heard. It can take 24hrs or more to get the result. Wish you all the best for the results tho!CommentShareTimothy_Manswered a year ago1It usually takes some days. but you can wait 24 hours or login to https://www.certmetrics.com/amazon/candidate/requirements.aspx or https://www.aws.training/certification/CommentShareossniperanswered a year ago"


Question: AWS server network out down to 0 automatically

"AWS server network out down to 0 automatically, when I restarted the server it started working again. Please let me know what it was the issue?FollowComment"

Answer: "0Accepted AnswerThere is important data missing here to address your concern. It sounds like your EC2-Instance netout metric in CloudWatch reported 0%, but restarting it brought it back to normal. It's possible that your machine locked up if it was consistently at 100% usage for another metric such as CPU utilization.CommentShareDavidanswered 14 days ago"


Question: Can you get custom claims using a User Pool authorizer and api gateway?

"Can you get custom claims in an API Gateway v2 proxy lambda?I created an API gateway configuration in CDK, using this as an authorizer:        this.authorizer = new HttpUserPoolAuthorizer(stack.config.apiAuthorizer, userPool, {            userPoolClients: [ userPoolCLient ]        });That works great.  Then in my lambda I'm trying to get custom claims like this:export function getAllCustomers(request: APIGatewayProxyEventV2WithJWTAuthorizer, context: Context): Promise<APIGatewayProxyResultV2<GetCustomersResponse>> {    const claims = request.requestContext.authorizer.jwt.claims;but here's what I get:{  "claims": {    "auth_time": "1675018035",    "client_id": "xxxxxx",    "event_id": "031bcda9-f10d-4132-abc7-xxxx",    "exp": "1675021635",    "iat": "1675018035",    "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-xxxxxx",    "jti": "1a6cf3b9-f809-412a-bc68-xxxx",    "origin_jti": "80bb0296-6acc-47f8-8963-e6a2d9f0a26c",    "scope": "aws.cognito.signin.user.admin",    "sub": "xxxxxx",    "token_use": "access",    "username": "xxxxxx"  },  "scopes": null}I expected that it would pass all the claims along, so I would get given_name, email, my custom user pool attributes.  Is there any way to do this short of creating a totally custom authorizer?  Or, is the raw token available somewhere, and I can just decode it?  It would be nice to not have to make a cognito call with the sub in order to retrieve all the attributes every time.UPDATE: I think I figured out what's going on.  The attributes I am looking for would be in the ID token, but what's used for the API request is the access token which doesn't have all those detailed claims in it.  I think this means I'm forced to look them up from the user id every time.  I don't think that's a cost issue (I don't see API call request pricing for cognito) but it's a delay, and if I'm decoding the access token myself I probably really ought to be using jwks to check the token, too.  At that point maybe I don't need to use an authorizer at all, since my lambda is going to be doing all the work.  Is there a better strategy here?  I already have a preauth trigger but again that seems to modify the id token not the access token.--CFollowComment"

Answer: "0Accepted AnswerI am going to answer my own question but I'm interested in whether or not people think this is good or bad.  If nothing else, this might serve as an example for somebody else who stumbles across this post trying to do the same thing.It looks like if you have an access token you can always call GetUser to get the ID.  The access token contains an issuer URL which must be how CognitoIdenttityProviderClient knows how to follow back to the correct user pool.  This seems to work fine.  it's not clear to me whether or not GetUser checks the validity of the token, but I suspect it must because it says the access token must be unexpired.  The docs don't explicitly say this, though.  (Can anybody confirm GetUser thoroughly validates the access token? Seems like It must.)export function getAllCustomers(request: APIGatewayProxyEventV2WithJWTAuthorizer, context: Context):         Promise<APIGatewayProxyResultV2<GetCustomersResponse>> {    /* get the authorization header from API gateway v2 proxy event */    const authHeader = request.headers['authorization'];    if (authHeader === undefined) {        return Promise.resolve({            body: "No bearer token",            statusCode: http2.constants.HTTP_STATUS_FORBIDDEN        })    }    /* See if it starts with Bearer implying it's an access token */    if(!authHeader.startsWith("Bearer ")) {        return Promise.resolve({            body: "Auth header is invalid",            statusCode: http2.constants.HTTP_STATUS_FORBIDDEN        })    }    const accessToken = authHeader.substring(7)    const cc = new CognitoIdentityProviderClient({})    const ccReq = new GetUserCommand({AccessToken: accessToken});    return cc.send<GetUserCommandInput, GetUserCommandOutput>(ccReq)        .then((result: GetUserCommandOutput) => {           /* do something useful now that we have the full ID */   ...CommentSharewz2banswered 4 months ago"


Question: TEXT columns from Source SQL Server database are not being replicated to target

2 Columns from a table in a source sql server database 2017 are not being replicated to the target.  Some of the other columns related to the same transaction are replicated but 2 others columns defined as TEXT columns are not.  Can someone point me in the direction of what could be wrong with these columns for them not be replicated.  ThanksFollowComment

Answer: "0To answer your question, we require details that are non-public information. Please open a support case with AWS using the following linkhttps://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERAjayanswered a year ago"


Question: Duplicate event fired

"Hello everyone,I am facing an odd situation here.I have some events since a few days that are fired 2 times in the same bus (default). They are exactly the same : content and id.And so they triggered some lambdas two times messing with our event process.I thought it should be impossible.I assume that if there are two logs in events/debug, there are two event fired.Look at the photo. You can see the same id in the JSON at the same hour.If you have any idea about what can cause that.Thanks for your help.EDIT 1 : The events are generated by a lambda using aws sdk for nodeJs  and method putEvents.FollowCommentRaphael EXPERT2 months agoWhat was the event source?Share"

Answer: "0Thanks for your response.I was aware that a rule could be triggered multiple times.But here it is more that the event is fired two times. (maybe it means the same for AWS, but I think there is slight difference)In any case make the lambdas idempotent should be the solution.As a best practice, for the unique id, is it better to use the id generated by event bridge or an id in the payload coming from our internal process ?ThanksCommentSharenewzaanswered 2 months agoRodney Lester 2 months agoI would recommend you make the idempotency in the payload of the message that can be identified by your internal systems.Share0This can happen in a large distributed system (which Amazon EventBridge is). See the documentation here: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-troubleshooting.html#eb-rule-triggered-more-than-onceA best practice is to make events idempotent, for more than this rare occurrence. You may need to replay events under some recovery scenarios. See the AWS Well-Architected Framework Best Practice, Make all responses idempotent.CommentShareRodney Lesteranswered 2 months ago"


Question: How to provide public but exclusive access to s3 objects

"Hi,I am building an application where users can upload and play audio files. I am storing them in an S3 bucket and made access public to it so that web page can access them to be played by users. However, this has a flaw that once user is logged in, other user's files are not protected and can be tried to access by changing/guessing s3url. Though I can use encryption but still urls have to be public which does not seem an ideal solution.Any suggestions will be appreciated.Regards,DeeptiFollowComment"

Answer: "0Accepted AnswerHi Deepti,You can use presigned URLs to generate a URL that can be used to access your Amazon S3 buckets. When you create a presigned URL, you associate it with a specific action. You can share the URL, and anyone with access to it can perform the action embedded in the URL as if they were the original signing user. The URL will expire and no longer work when it reaches its expiration time.For more information about this feature, please follow the link below:https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.htmlCommentSharecessch-AWSanswered 5 months agoEXPERTTushar_Jreviewed 5 months ago0Can have 2 optionsUse presigned url for uplod to S3 - https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.htmlUse Cognito for user authentication, once authenticated pass the token to API gateway and then using that create a Lambda function to generate a unique URL for that user. The 2nd options is more secure and can access only user assigned objects.CommentShareRajuanswered 5 months ago0Thanks for your help. I implemented presigned URLs and made the bucket private. It is working perfectly without exposing s3 resources.  I believe this is exactly what I needed to do in this scenario. Once again thank you.CommentSharerePost-User-8055548answered 5 months ago"


Question: Using-PCIe-Write-Combining example returns unexpected results

"Hi,I'm an F1 AWS user, and I'm trying to run the PCIE Write Combine example on a cl_dram_dma example design:https://github.com/awslabs/aws-fpga-app-notes/tree/master/Using-PCIe-Write-CombiningIn this example, I'm trying to experiment with the wc_perf.c example to write a single line (16 DWORDS) from the host to the DDRA. According to the above note, running the example with the below command:**$ sudo ./wc_perf**Followed by:**$ sudo fpga-describe-local-image -S 0 -C**outputs the below:DDR0**   write-count=16**   read-count=0While running with "-w" option,**$ sudo ./wc_perf -w**Followed by:**$ sudo fpga-describe-local-image -S 0 -C**outputs the below:DDR0**   write-count=1**   read-count=0meaning, that the write_count when we use the -w (Write Combine option), should have a write count that is reduced from 16 to 1. Quoting from the notes:"The -w option tells wc_perf to use WC, and the number of write data beats was reduced from 16 to 1. This is the reason why writing a WC region with small operations is faster, because they are accumulated into larger chunks using a 64 byte buffer located in the CPU core bus interface (BIU). This is also the reason why it cannot be used for all accesses."However, when I run the experiment I get different results than the ones described in the notes:When  I either run"sudo ./wc_perf -w"or"sudo ./wc_perf"followed by"sudo fpga-describe-local-image -S 0 -C"I get the same write_count of 1600:DDR0   write-count=1600   read-count=0DDR1While I understand why the count is 1600 and not 16 (num_of_passes is 100 in wc_perf.c), the count expect to be when using "-w" option is 100 and not 1600, which means 16 times less than without "-w". Am I doing anything wrong in the experiment?FollowComment"

Answer: "0Hello, thank you for your post. I was unable to reproduce this issue due to issues configuring a test environment. In order to better address your concern, please open an issue in the aws-fpga Github:https://github.com/aws/aws-fpga/issuesThese issues are monitored by the FPGA development team, and the comments on resolved issues are visible to the public.CommentShareSUPPORT ENGINEERAWS_SamManswered a year ago"


Question: FSx Launch Batch Script

"Hi,I'm using FSx for Windows, I need to launch a cleanup script every night on the FSx filesystem.I'm wondering what is the best solution do to that, the script is about 2 hours long.How would you implement this kind of stuf?ThanksRegardsFollowComment"

Answer: "0In addition to the Windows tasks scheduler suggestion:You could leverage this solution / blog to schedule a customized lambda that does the cleaning required if you can break up your cleaning steps (Lambda has a 15 minutes limit): https://aws.amazon.com/blogs/storage/enabling-smb-access-for-serverless-workloads/If you are running elaborate tasks, you could leverage a pre-configured ECS or Fargate image (fargate ain't supported after all): https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/run-event-driven-and-scheduled-workloads-at-scale-with-aws-fargate.htmlCommentShareJS-AWSanswered 3 months agoBrettski-AWS EXPERT3 months agoThe documentation mentions that it isn't supported.Share0One way to do this would be to use Windows Task Scheduler (presuming that you're running a Windows instance).CommentShareEXPERTBrettski-AWSanswered 3 months ago"


Question: One account data is missed (Quick Start) system manager -- multi-accounts

"HiI am using SSO with multi-accounts and try to set up System Manager by Quick Start in the main account.I found one account information is missing from the list of configuration details table but other data from the other two accounts are coming fine.As for the reference, I logged in a main account as a federated user with administrator access, but I found the same even I logged in as root user.What I missed here?Please advise meFollowComment"

Answer: "1Hello,Warm Greetings !Based on the above details, it seems you are trying to use "Quick Setup" feature of Systems Manager, where one of the account information is missing which is part of your Organization.However, after reviewing the details around the account used to create this post, I can see that there is only 1 account in this Organization and no member accounts are present. Hence, based on this,either the accounts have been removed from your Organization which is the reason they are not shownORelse you have opened this post from a different Organization than the one being used in above use-case.If the post is opened from an account which is part of different Organization, I will not be able to review your resources as we as AWS Support Engineers do not have access to Cross account resources as per the Security best practices.So, in order to confirm if all the accounts are shown, I would request you to first login into your Management account of Organization (i.e. the account used to create the Organization) and confirm the accounts which are shown as part of this Organization in the Organization console.This will confirm what accounts are part of your Organization and ideally all of them should be shown in the configuration page.CommentShareSUPPORT ENGINEERGurjot_Sanswered a month agorePost-User-3071465 a month agoHi. @Gurjot Thanks for the kind reply. I have posted this as an administrator from the management account of the organization. In addition to that, I can still see all other accounts at 0000000.awsapps.com/start#/ and I am able to switch over to other accounts . Therefore, neither cases of the conditions you mentioned above might not apply.SharerePost-User-5471206 a month agoHi @Gurjot...My bad! ^^ I was logged in as the root user....I was confused with the notification email and root user.Share"


Question: No instance with 8GiB RAM ?

"Hi,I wonder why there is no available instance with 8GiB RAM (us-east).There is a gap between 4GiB (db.t3.medium) and 16 GiB (db.r5.large) RAM.Do you plan to add an instance in between ? It would be quite useful.Thanks !FollowComment"

Answer: "0So probably never ?CommentShareThisNicknameIsNotAlreadyTakenanswered 3 years ago0It really depends on how much demand there is for this. Aurora performance is very heavily dependent on tuning for particular memory sizes as this is key to the level of asynchronous I/O Aurora performs. So supporting different memory sizes, in addition to different instance families, is very resource intensive. That also means each new release has to be re-checked on each instance type to make sure performance has not been degraded, making it an ongoing resource drain rather than a one time thing. As a result supporting instance types for which there is little apparent demand loses out to applying those resources to higher priority customer requirements. Bottom line, if they are hearing a lot of customer requests for 8GiB they'll do it, but otherwise probably not.Even if this is in the plans, AWS rarely publicly discloses those plans.CommentShareHalTempanswered 3 years ago"


Question: AWS SAM Templates - API Gateway with multiple stages and proxy to URI (NOT LAMBDA)

"I find different pieces of the puzzle I need to solve, but none of the examples I've found online show how to do multiple stages in a sam template (ie:  Deploy dev, prod, and test) at the same time.  And none show how to proxy to a URI that I've found.  All of them show the gateway going to lambda as a proxy.  But how do you do a standard http_proxy in the template?Sorry, new to SAM so trying to figure things out.  I need 1 API gateway with multiple stages that http_proxies to a URI.  Each stage goes to the same place, but different API keys used for each one as a stage variable.  And I need it to be private with two VPCE's so I have to attach a resource policy to it as well.  All in SAM :)FollowComment"


Question: API GW HTTP API: Cross Account Access via IAM

"Hi,I have an API-GW HTTP API (in account A) that uses IAM auth. I'm trying to invoke that API using an IAM role from another account (account B)I'm getting 403 responses when trying to invoke the API-GW from account B.I'm able to successfully invoke it from its own account (account A).The IAM role in account B has the following policy{    "Version": "2012-10-17",    "Statement": [        {            "Action": "execute-api:Invoke",            "Resource": [                "arn:aws:execute-api:*:ACCOUNT-A-ID:*"            ],            "Effect": "Allow"        }    ]}I have a "CrossAccountInvocationRole" in account Awith Policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "execute-api:*",            "Resource": "arn:aws:execute-api:*:ACCOUNT-A-ID:*/*/*/*"        }    ]}with Trusted Entities{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": [                    "arn:aws:iam::ACCOUNT-B-ID:role/role-name"                    ]            },            "Action": "sts:AssumeRole"        }    ]}My APIGW IAM Role  in Account A has the following Policy{    "Version": "2012-10-17",    "Statement": [        {            "Action": "sts:AssumeRole",            "Resource": "arn:aws:iam::ACCOUNT-A-ID:role/CrossAccountInvocationRole",            "Effect": "Allow"        }    ]}and Trusted entities    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "Service": "apigateway.amazonaws.com"            },            "Action": "sts:AssumeRole"        }    ]}I tried attaching the above policy to the Lambda that is invoked by API-GW as wellTo test, I used the AWS CLI sts assume-role to get credentials for the IAM role and then used those credentials in a Lambda in account B as well as the Postman application. Both gave me 403 errors.Question:Is it even possible to do cross account invocation on an API GW HTTP API with IAM?If yes, what an I doing wrong?FollowComment"

Answer: "0Hi,I understand you want to cross account invocation on an API GW HTTP API with IAM but you are getting an “403 error”. The 403 error means the caller isn't authorized to access an API that's using a Lambda authorizer. To answer your questions, yes you can do cross account invocation on an API GW HTTP API with IAM.  Firstly you will have to create a Lambda authorizer [1], you use a Lambda authorizer to use a Lambda function to control access to your HTTP API[2]. You will then configure a cross-account Lambda authorizer using the API Gateway console [3]. The methods you used before were meant for control access for invoking an API hence the reason you were successfully invoke it from its own account “(account A)”.Refer to the references[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#http-api-lambda-authorizer.example-create[2] https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html[3] https://docs.amazonaws.cn/en_us/apigateway/latest/developerguide/apigateway-lambda-authorizer-cross-account-lambda-authorizer.html[4] https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.htmlCommentShareLwazianswered a year ago"


Question: Specification of email address characters that can be specified in SES

"What is the specification of the characters that can be used for the email address specified as source and destination in SendMail and SendRawEmail of SES?For example, I would like to know the difference between SES and RFC 5322.FollowComment"


Question: Instance reachability check failed windows t3a instance

"Can someone please assist, after i've uninstalled latest windows update I did reboot and now I'm getting  reachability check failed. Ec2 console serial shows no output. Instance id i-0e4871da952a1d0ae. I tried stopping and running instance but no luck. Help really appreciated.FollowComment"

Answer: "0Accepted AnswerHi,This is Sean from AWS Premium Support here to help you today. I understand that after rolling back a windows update, your instance has become unreachable, and the EC2 Serial Console does not return the expected output.I took a look at the instance, and although I can't share any account-specific information here as this is a public forum, I would like to provide the following suggestions:In order to access a command line or gather meaningful data from the serial console, you must make several configurations, both at the account and instance level. Please double check that the following steps have been performed:a. Grant your account access to the serial console[1]b. enable serial console on your instance.[2]. Please note, if you have not done this step on your instance, you must apply these settings to the offline root volume of the instance, by attaching the root volume to another instance in the same AZ, and running the following commands. For this example, we will assume a secondary volume letter of E:, but make sure that you confirm the correct drive letter in your environment. Please also run all commands in CMD, not Powershell. bcdedit /store E:\Boot\BCD /ems {current} ON bcdedit /store E:\Boot\BCD /emssettings EMSPORT:1 EMSBAUDRATE:115200  bcdedit /store E:\Boot\BCD /set {bootmgr} displaybootmenu yes bcdedit /store E:\Boot\BCD /set {bootmgr} timeout 15 bcdedit /store E:\Boot\BCD /set {bootmgr} bootems yesc. (Before proceeding with this step, consider suggestion 2 as well.) Offline the volume in disk management, and reattach it to the original instance as /dev/sda1. Start the instance and attempt to connect to SACOn the offline volume of your instance, you can run EC2Rescue[3] in restore mode to perform a variety of tasks, including reverting to the Last Known Good Configuration.a. If this fails, you can then collect logs with EC2Rescue for further analysis. If you would like assistance reviewing these logs, this would involve sharing details that are non-public information, and would need to be sent to us through a support case with AWS using the following link[4]Let me know if you have further findings or observations that we can assist with.Reference:[1] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/configure-access-to-serial-console.html#sc-grant-account-access[2] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshooting-sac.html[3] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2rw-gui.html[4] https://console.aws.amazon.com/support/home#/case/createCommentShareSUPPORT ENGINEERSean_Sanswered 10 months agoEXPERTalatechreviewed a month ago"


Question: Is athena the best approach to connect to AWS Glue Catalog and fetch S3 data from .net client?

"Hi,We are exploring approaches that would allow us to fetch data from S3 via AWS Glue Catalog from a .net client.  We have already seen there is .net SDK available and it has athena client support.  But are there any other alternative approaches too for .net clients?  What are the pros and cons of this approach?We are thinking to use this as a reference https://davidpallmann.hashnode.dev/hello-athenaRegardsFollowComment"

Answer: "0Good day.From your case correspondence, I understand that you want to know Whether Amazon Athena is the best method for connecting to the AWS Glue Catalog and retrieving S3 data from a.Net  client.Amazon Athena is indeed a popular approach for querying data stored in Amazon S3 using standard SQL queries. It provides an interactive query service that allows you to analyze data directly from the AWS Glue Data Catalog, which acts as the metadata repository for your data assets.When it comes to connecting to the AWS Glue catalog and fetching S3 data from a .NET client, there are multiple options available, and the "best" approach depends on your specific requirements and preferences. Here are a few factors to consider when evaluating the best approach:Query Complexity: If your use case involves running complex SQL queries on large datasets, Amazon Athena's distributed and serverless nature can be beneficial. It automatically scales to handle large workloads and offers optimizations for query performance. However, if your requirements involve simple queries or data retrieval operations, using Athena might be overkill.Real-time Data Access: If you need real-time access to data or require frequent updates, Athena may not be the most suitable choice. It is designed for batch-style processing and works best with static or infrequently updated data. In such cases, considering other options like AWS Glue ETL jobs or direct S3 access might be more appropriate.Integration Complexity: Using the AWS SDK for .NET allows you to have more fine-grained control and flexibility in your application. You can utilize the SDK to interact with the Glue catalog, execute Athena queries, and retrieve results. However, this approach requires more development effort and knowledge of AWS services.In summary, Amazon Athena can be a suitable approach for connecting to the AWS Glue catalog and fetching S3 data, especially for complex querying scenarios. However, it's important to evaluate your specific requirements, such as query complexity, real-time data access, integration complexity, and developer preferences, to determine the most appropriate approach for your .NET client.I hope the above mentioned information serves helpful to you. Please let me know if you have any further queries related to the case. I will be more than happy to help.CommentSharerePost-User-1215922answered 6 days agorePost-User-4649993 5 days agoThanks for your detailed answer.  Our query to Athena/S3 will be directed from front-end so the response needs to be available fairly soon (possibly within few milliseconds).  However, I think the data catalog is well partitioned on date basis.  How soon can Athena return the response in this condition (I do understand it depends on amount of data but any rough estimates would be good)?Share"


Question: Accessing on-premise (site-to-site) resource from Lambda

"I'm trying to setup a lambda which would be able to access on premise/internal (site-on-site) service. I have setup VPN connection and configured the internal network to use the provided configuration and I can access the resource/service from EC2 instance, which uses the same subnet and routes (VPC). However, I can't access it from Lambda. Does anyone have experience setting it up? What can be a problem? There was small difference in setups between EC2 and lambda - where lambda were using NAT instead of IGM, however I reconfigured and it is still the same. Is there any additional logging which I can enable to see what is wrong? Is it even possible to setup lambda to connect via VPN to on-premise/internal service. Any help will be appreciated.Edited by: igorau on May 31, 2019 2:50 AMFollowComment"

Answer: "0providing some more details of what your test is and what the behavior/error is would be helpful.Fundamentally, if you are launching your Lambda in a VPC, into a subnet that you have already confirmed has access to the on-premise resource, this should work.It shouldn't matter if the lambda is in a public or a private subnet (using a IGW or NAT), but in either case, a route MUST be in that subnet for the on-premise ip address range.Additionally, you need to make sure the security group that the lambda function is using is correctly allowing the ports you want to access.Finally, you should rule out if there are any DNS resolution issues:  Out-of-the-box, resources in a VPC will not resolve to your on-premise DNS.  You should first rule this out by trying to hit the on-premise resource using an IP address instead of DNS.Hope that helps.  If it doesn't, try to submit details, which will help dig in further.CommentSharecloudbuttonanswered 4 years ago0Thank you for the quick response.I'm using the same security group for ec2 instance and lambda, so I would expect that it is not the security group settings.I don't use DNS, I'm trying to reach the service with ip address. I have even tried to access the router webservice by ip address, but it doesn't work via lambda as well.The same VPC is being used for EC2 and lambda, so I would expect that an ip address from the same subnet will be assigned to both ec2 and lambdas, am I wrong?Is there any way to use ping in lambda to be able to test that the on-premise ip addresses can be accessed?Is there any way to find out ip addresses assigned to a lambda for all network interfaces?Could you please elaborate which details I should provide for the troubleshooting?CommentShareigorauanswered 4 years ago0this really seems like it may be something in your lambda code.Are you running the EXACT same test on your EC2 as in your lambda?Can you provide the code (you can obfuscate the ip address), and the output from the lambda function.I would suggest doing a telnet test using tcp instead of a ping, assuming you are trying to hit something via tcp on premise..e.g. in Python 3.6:def lambda_handler (event,context):import telnetlibtn=telnetlib.Telnet('<ip addresss>',port)print(tn)CommentSharecloudbuttonanswered 4 years ago0Thank you for supporting me in this fight.So I was wrong, I could not access the server via EC2. I can ping the server, but I can't telnet to the server:ping 192.168.1.1PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=8.78 mstelnet 192.168.1.1 80Trying 192.168.1.1...telnet: Unable to connect to remote host: Connection timed outIf I do it from a local server I can access it:telnet 192.168.1.1 80Trying 192.168.1.1...Connected to 192.168.1.1.The same happens when I run the code in python.is there any way to figure out where the connection is being blocked?I can see from the flowlogs that it seems that it is going through:13:46:07 2 xxx eni-xxxxxxxxxxxx x.x.x.x 192.168.1.1 60912 80 6 6 360 1559533567 1559533569 ACCEPT OKThe problem that the router on-site doesn't have any logging, so I can't tell what is wrong on the on-premise side.Edited by: igorau on Jun 2, 2019 10:55 PMCommentShareigorauanswered 4 years ago0First of all, while you are running an active ping from the EC2 to on premise, run a netstat -an on your on premise systems and confirm you are seeing the IP of the ec2 in that list.  That will confirm you are indeed routing back there.Are you definitely running a web service on port 80 on the on premise server?  Netstat would also show you if the server is listening on 80.Rule you that you don't have NACLS in place on your EC2 subnets.  I'm guessing it's allowing all inbound and outbound, which would be the case if you accepted the defaults, but that should be ruled out.  You also need to confirm that the security group of the EC2 instance is allowing outbound, port 80 (guessing that's allowing all outbound).Check the local server firewall (e.g. iptables), and firewall logs, to see if any rules are in place and if anything is being blocked.  If you aren't sure how to read the configs, you should provide text or a screenshot.You need to review the ACLs of the on-premise firewall.  By default, it likely wouldn't allow port 80 traffic in from an outside network.  Given what you are describing, this is probably the most likely source of the problem, although it could be others.  Again if you aren't sure what you are looking at, you should provide the detail here to assist in troubleshooting.Seems a little odd that the on-site router doesn't have any logging:  That would be the first place I would go to review this, and it will likely provide very useful information.  Do you mean you don't have access to them?CommentSharecloudbuttonanswered 4 years ago0cloudbutton: thanks very much for your help. You suggestions helped me to analyze/dig deeper. And after a lot of retries and when I reset the router to factory settings and re-configured it again, it started to work! So potentially, there was some issue with the router. Now it is all working, appreciate your help!CommentShareigorauanswered 4 years ago"


Question: Organization could not be found

"Hi. Today I'm facing an issue when want to share the transit gateway to a specific organization with error message below:Organization o-abcdefghq could not be found. (Service: AWSRAM; Status Code: 400; Error Code: UnknownResourceException; Request ID: 70749448-e9101-48c2-918d-c8b40eq1aa32; Proxy: null)Is anyone able to help me, please? thank youFollowComment"

Answer: "0Accepted AnswerThe issue is now solved with the following steps:Login to your master AWS account as root userGo to the Organizations console and click 'Settings''Disable Access' for AWS Resource Access Manager from the 'Trusted access for AWS services' tabGo to the RAM console, and Click on Settings.Select  “Enable sharing within your AWS Organization”.Create the resource share again, remember uncheck "Allow external accounts" option, put the account ID again-->Save.CommentShareAnanda Dwi Rahmawatianswered 4 months ago"


Question: Security Group created under ELB with ICMP Protocol

"Hi Team,There is Application Load Balancer which is created and while its creation a security group is also created along with it, when checked in the cloudtrail it shows that it was invoked by "eks.amazonaws.com".Is there a way to avoid creation of this security group or particularly manage its inbound and outbound rules?As there is a ICMP Protocol that is being created in this security group which we do not want to be created.TIAFollowComment"

Answer: "0Sounds like AWS load balancer controller you can use this annotation to avoid the auto created security group - https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/#security-groups"alb.ingress.kubernetes.io/security-groups specifies the securityGroups you want to attach to LoadBalancer.When this annotation is not present, the controller will automatically create one security group, the security group will be attached to the LoadBalancer and allow access from inbound-cidrs to the listen-ports. Also, the securityGroups for Node/Pod will be modified to allow inbound traffic from this securityGroup.If you specify this annotation, you need to configure the security groups on your Node/Pod to allow inbound traffic from the load balancer. You could also set the manage-backend-security-group-rules if you want the controller to manage the access rules."CommentShareEXPERTThaddeus_Wanswered a month ago"


Question: Flutter ci-cd pipeline for ios

"we are trying aws ci-cd pipeline for flutter-ios in aws codebuild but there is only three images available (i.e linux,ubuntu,windows)my questions ishow to create ci-cd pipeline for flutter-ios in aws without Jenkins ?how to create custom image for iosFollowComment"

Answer: "1Hi.CodeBuild runs a custom container within AWS.And you need macOS to build Flutter iOS.Therefore, you cannot build iOS apps with CodeBuild alone.First, you need to have an external build server.If it supports Remote Build, prepare macOS on EC2 and prepare a mechanism (like Jenkins) to receive Remote Build instructions.Alternatively, you can use an external service as follows.https://blog.codemagic.io/how-to-develop-and-distribute-ios-apps-without-mac-with-flutter-codemagic_jpn/Send build instructions from CodeBuild or CodePipeline to an external server.CommentShareEXPERTiwasaanswered a year ago"


Question: aws ec2 Instance reachability check failed

"I am trying to start p2.xlarge instance in us-east-2. It shows Running. But in Status checks, Instance status check shows "Instance reachability check failed". The instance was working fine a few days back.I tried rebooting instance. It doesn't reboot. I start stop and start, that works and shows Running, but same instance status check issue. Sometimes it shows stopping for long time and I have to hit Force Stop instance.I tried rescue option mentioned in https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-boot-issues/, but still the same issue.Here is the system log - https://pastebin.com/SK8jFuRFFollowCommentAWS-User-5291433 a year agoDid you perform any os changes that corrupted the bootloader? I experienced an Instance reachability issue a few weeks ago. I then realized my Ansible hardening script modified RHEL OS grub.conf. I had to revert it with the help of AWS support. I also take daily backups. Try EC2 serial console or reach out to support or restore from backup.ShareJaccoPK a year agoWhat AMI are you using? The log shows some NVIDIA things not going well. It being a GPU machine makes me wonder if that matters.If I have trouble with an EC2 always use the Session Manager to log on to the machine to check some more logs. For getting the Session Manager to work you need set up a few things first.Share"

Answer: "0Hello!  I encourage you to create a new support case, so that an engineer can take a look at the instance as well as the underlying host from the infrastructure side. As JaccoPK mentioned, there are some references to NVIDIA, so you might have a driver issue. When you create the support case please be sure to mention which AMI you are using.CommentShareSUPPORT ENGINEERFrancisco_Lanswered a year ago"


Question: Why is there a long delay between CREATE_IN_PROGRESS event  for a Lambda-backed CloudFormation custom resource and the Lambda function invocation?

"I am deploying a CloudFormation stack with a number of Lambda-backed custom resources which load data into AWS. These Lambda functions take approximately 7 minutes to execute, and a number of them are run in parallel by having multiple customresources backed by the same Lambda function. The total time from the first CREATE_IN_PROGRESS event for these resources approximately matches the time it takes for the Lambda function to run, and they run successfully.There are further custom resources (using different Lambda functions) that run after the previously custom resources are complete.  However, we are seeing unusual behaviour for these custom resources, as there is a significant wait from the first CREATE_IN_PROGRESS event to the Lambda function actually being invoked (as seen in the logs for the Lambda function). This was has been from 10 minutes to over an hour, sometimes causing the custom resource to time out without the Lambda function ever being invoked. It appears that the events from CloudFormation which normally trigger the custom resource Lambda are being significantly delayed.Why might this be?FollowComment"

Answer: "1Accepted AnswerHello,Based on my understanding on your use-case, this could be related to concurrency limit  on Lambda function.You can refer to Managing Lambda concurrency  to understand more about types of concurrency controls available.Additionally, you can also refer to knowledge center  document if wish to request a concurrency limit increase for Lambda function.I hope above information was useful and help you to resolve the issue.CommentShareSUPPORT ENGINEERSatyam_Ganswered a year agoJoeMajor a year agoThis looks to have been the problem. Thanks for your help.Share"


Question: Cloudfront distribution access to private S3 bucket

"I have a static website deployed on an S3 bucket (with Static Website Hosting enabled), and with all public access enabled, as described in the tutorials.I have created a cloudfront distro pointing to that website/bucket.Is there a way to turn 'off' the public access to the S3 bucket so that the only access to the website is via the cloudfront distro?Do I useFollowComment"

Answer: "2Yes, you can do this by using CloudFront Origin Access Control: https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-cloudfront-introduces-origin-access-control-oac/CommentShareEXPERTBrettski-AWSanswered 20 days agoEXPERTalatechreviewed 19 days agoEXPERTTushar_Jreviewed 20 days ago"


Question: How to display images from S3 bucket in AWS Pinpoint email templates?

"Hello,So I am using AWS Pinpoint both programatically and via the AWS Console. To make email templates I use the AWS Console.I have several images in an S3 bucket and I hide those images behind a CloudFront distribution so that they are accessible only via that distribution while the bucket is private.I have an image in the email template and in the src of the image I put the URL of the image behind the distribution. Outside the template, I am able to see the image on that URL.Also, before sending the email template, the images are properly displayed on the template but once I send it to an email and I open the email, I see no images, only te alternative text I have put. Why is that?How can I fix it?EDIT:I found out the problem exists only in Outlook. Do you have any idea why that is?FollowComment"

Answer: "0Outlook has a few things in place to block images, do any other images that are not from your distribution load, or do all images have the same issue regardless of the source?Depending on what Outlook version you're using, you might want to check the Trust Center in your Outlook settings, there's also some settings related to loading remote images in the settings, but I don't recall the exact location, should be fairly obvious to find once you're in the settings.CommentSharekyageranswered a year agoAWS-User-2130413 a year agoHey @kyager,Thanks for your reply.I am using only images from my distriribution load and still have this issue.Even if I change it for my own Outlook email, I cannot change the settings of the users I sent the email to so I am not sure what to do.Share"


Question: why does using System Manager aws:runShellScript to execute "df -h" not show EFS mounts

When I run the df command on my servers the results displayed show my EFS mounts.  when I run the command using System Manager and doc aws:runShellScript the EFS mounts are not show but all non EFS mounts are shown.  Why is this ? Am I missing a parameter ?  These are RHEL 7.9.FollowComment

Answer: "1Hello there,Thank you for reaching out to us and posting your question in Re:Post. I tested AWS-RunShellScript Command document in a RHEL 7.9 instance to run df -h. I mounted EFS using both nfs4 and efs filesystem type. In either case the df -h command displayed the EFS mounts. You may check:If the EFS filesystem is mounted when the Systems Manager document executes.If you are using the latest Systems Manager agent. Ref: https://docs.aws.amazon.com/systems-manager/latest/userguide/agent-install-rhel.htmlIf this is reproducible, please feel free to open a Support case with us and we can investigate further.CommentShareSUPPORT ENGINEERAWS-User-8128162answered a year agoSumit a year agoEFS mount point is created in Instance via Bootstrap. when the same instance is Rebooted EFS does not Automatically Mounts HELP?Share"


Question: Any working AWS CodeGuru Workshop out there?

"Hi,I want to hands-on with CodeGuru, and find workshop here: https://catalog.us-east-1.prod.workshops.aws/workshops/1786241d-967f-4195-99ef-5716ef485201/en-US/introBut, the CloudFormation template is not working because the S3 bucket file is missing. Anyone know where I can find working CodeGuru workshop using AWS console for me to try?FollowComment"

Answer: "1Accepted AnswerHi there,Here are all public AWS CodeGuru related public workshops material you can try(I haven't tried by myself)Introduction to Amazon CodeGuru:(Not English) https://catalog.us-east-1.prod.workshops.aws/workshops/bd56c9e7-f266-4020-b956-b1d9781e4a5fAmazon CodeGuru Workshop (The one you posted in the thread) https://catalog.us-east-1.prod.workshops.aws/workshops/1786241d-967f-4195-99ef-5716ef485201Amazon CodeWhisperer https://catalog.us-east-1.prod.workshops.aws/workshops/a33a5d69-1417-4d5f-acc9-ae5c7fba665bCode Quality Workshop https://catalog.us-east-1.prod.workshops.aws/workshops/fa518794-acd4-4178-80d3-97fa62f9deffPerformance Tuning Workshop(Amazon CodeGuru, Amazon DevOps Guru, AWS X-Ray) https://catalog.us-east-1.prod.workshops.aws/workshops/388d9e00-5df9-47f4-89a0-42671c164c36Please accept the answer if that helps you and Thanks in advance!Have a good day!CommentShareRafaXuAWSanswered 2 months agoEXPERTalatechreviewed 2 months ago"


Question: Quicksight Dataset/Datasource changes not visible in Browser Console

"Nitpick about Quicksight in its current incarnation (currently on first-month trial, pay-per-session plan):Datasets added from the CLI don't show up in the Browser Console (even after adding permissions shown below)Also, datasets deleted from the CLI still show up in the list of datasets in Browser Console until you remove them (of course they don't really exist)Dashboards (and I'd assume Analyses) do, however, display correctly in the Browser Console when added or removed from the CLIIf this is by design, I'd request changing the design, as it breaks the whole automated CLI workflow process.Suggested fix: Quicksight should update its cached list of datasets every time the Datasets option is clicked in the browser console.Perms used:"quicksight:UpdateDataSourcePermissions","quicksight:DescribeDataSourcePermissions","quicksight:PassDataSource","quicksight:DescribeDataSource","quicksight:DeleteDataSource","quicksight:UpdateDataSource"FollowComment"

Answer: "2Hello,Greetings of the day.Thank you for reaching out with your concern in AWS re:Post.In order to confirm, I tried reproducing same on my test environment as follow:Creating dataset:aws quicksight create-data-set --aws-account-id 21*** --data-set-id asdf --name asdf --import-mode "DIRECT_QUERY" --physical-table-map file://file21.jsonFollowing are the contents of file21.json:{"test211": {"CustomSql": {"DataSourceArn": "arn:aws:quicksight:us-east-1:****:datasource/*****","Name": "New custom SQL","SqlQuery": "SELECT country FROM "spectrum-db"."sqlcontinentcountry" limit 10","Columns": [{"Name": "country","Type": "STRING"}]}}}I was successfully able to create a dataset and got the following output,{"Status": 201,"Arn": "arn:aws:quicksight:us-east-1:****:dataset/asdf","DataSetId": "asdf","RequestId": "8849dc98-1bef-44df-8a22-a40ba0d766c4"}Results: Could see this dataset on UI as well.Deleting dataset:aws quicksight delete-data-set --aws-account-id 215926120184 --data-set-id da337620-24ff-4181-88a4-74fc73781defI was successfully able to delete dataset and got the following output,{"Status": 200,"Arn": "arn:aws:quicksight:us-east-2:215926120184:dataset/da337620-24ff-4181-88a4-74fc73781def","DataSetId": "da337620-24ff-4181-88a4-74fc73781def","RequestId": "3f5b2796-ee2c-4ead-ae71-badd82f30fb4"}Results: Could see this dataset deleted from UI as well.However, I understand that you are not able to see similar results on UI and with this regards, I would like to inform you, this behaviour you are observing can appear due to 2 reasons:The Quicksight user in the UI console is checking the dataset in a region different from the actual region where the dataset resides.The dataset owner did not share the dataset to the user who is viewing them in QuickSight UI console. Here,  please try to verify if those datasets owned by the same QuickSight user through using the cli below . [1]aws quicksight describe-data-set-permissions --aws-account-id xxxx --data-set-id yyyyResolution:I understand you mentioned you have the correct permissions but please verify again if you have actually given permissions to the data source that was created via the CLI. To get data sources listed in the UI, you need to update data source permissions and provide permissions to the user from which you are currently logged in to QuickSight. In order to update the data source permissions you can run the following:aws quicksight update-data-source-permissions --aws-account-id <Account_Id> --data-source-id <Datasource_id> --grant-permissions file://permissions1.jsonYou must create a permissions1.json file and it should contain the following in order to share the Data Source with "User" permissions:[    {"Actions": ["quicksight:DescribeDataSource","quicksight:DescribeDataSourcePermissions","quicksight:PassDataSource"],"Principal": "arn:aws:quicksight:region:<Account_ID>:user/default/<UserName>"       //QuickSight UserARN or QuickSight GroupARN}]In order to share the Data source with the "Owner" permissions use the following in the permissions1.json file:[{"Actions": ["quicksight:DescribeDataSource","quicksight:DescribeDataSourcePermissions","quicksight:PassDataSource","quicksight:UpdateDataSource","quicksight:DeleteDataSource","quicksight:UpdateDataSourcePermissions"],"Principal": "arn:aws:quicksight:region:<Account_ID>:user/default/<UserName>"       //QuickSight UserARN or QuickSight GroupARN}]Also ensure that the QuickSight user in the UI console is not checking for the data source in a region that is different from the actual region the data source has been created.Try clearing cache of your browser or try viewing dataset from different browser in case Browser is causing the issue.I hope the above information is helpful to you.Thank you and have a great day ahead.References:[1]https://docs.aws.amazon.com/cli/latest/reference/quicksight/describe-data-set-permissions.html[2]https://awscli.amazonaws.com/v2/documentation/api/latest/reference/quicksight/update-data-set-permissions.htmlCommentSharePriya_sanswered 4 months agoEXPERTiwasareviewed 3 months agorePost-User-7844453 4 months agoThank you, that worked!The commands are so similar, I thought data-source was just a legacy version of data-set.Once I added the physical-table-map it worked.It might be a good idea to add that example to the standard CLI reference.In any case, thank you greatly for your detailed assistance!Share"


Question: How to automate  configuration of  core connnectioninfo (endpoints)?

"I am testing the greengrass docker image in ecs and I am trying to automate group deployment. I am using "CreateDeployment" API via Javascript SDK. The deployment is successful but the core endpoints    are not configured. When we deploy for the first time via console,  we can select "manual" or "automatic" core endpoint config. How to do the same thing via javascript SDK? I want to automate deployment and then when a device calls the discovery  API, it should get the core endpoint info. Please let me know what alternatives I have.UPDATE: I could see that when I add endpoints manually via aws console an API call is going from browser to "https://ap-northeast-1.console.aws.amazon.com/iot/api/greengrass/cores/groupname/connectivity/endpoints". If there is no SDK option to configure endpoints, can I call this API ? What are the authentication requirements to call this API?Edited by: KiranGopal on Aug 8, 2019 1:59 AMEdited by: KiranGopal on Aug 8, 2019 2:00 AMFollowComment"

Answer: 0I got the APIhttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Greengrass.html#updateConnectivityInfo-propertyCommentShareKiranGopalanswered 4 years ago0Happy coding!CommentShareKR-AWSanswered 4 years ago


Question: Whats the difference between AWS IoT Greengrass and AWS IoT Device Client?

"With the release of AWS IoT Device Client,  what is the difference between AWS IoT Greengrass and AWS IoT Device Client? When should customers use Device Client instead of Greengrass and vice-versa?FollowComment"

Answer: "0Accepted AnswerFrom the FAQ:In its purpose, the AWS IoT Device Client is similar to FreeRTOS, AWS IoT Greengrass, and the AWS IoT Device SDKs. However, you should choose the device software that is right for your IoT project – based on your hardware choice, software environment, and use case.If you employ highly constrained devices (typically microcontroller or microprocessor based devices with <16MB RAM),we recommend that you use FreeRTOS and the AWS IoT Device SDK for Embedded C.If you wish to use microprocessor powered IoT devices that are capable of running a Linux (Ubuntu / Debian / RHEL) distribution for simple IoT applications, have 100MHz+ compute and 64MB+ RAM, we recommend getting started withproofs of concept on your devices with the AWS IoT Device Client. The AWS IoT Device Client is a referenceimplementation that uses the AWS IoT C++ v2 SDK. You will be able to edit and optimize the IoT Device Client for youruse case using the support libraries in the AWS IoT v2 Device SDKs.AWS IoT Device SDKs enable you to build and customize your own IoT device code by providing support libraries,developer guides, and samples. You can also use the SDKs when you want to edit the AWS IoT Device Client to for youruse case, or when you are adding custom functionality to Greengrass devices.If you have microprocessor powered IoT devices, want to accelerate the development of your device applications usingpre-built processing and connectivity capabilities, and want to remotely deploy and manage device software at the edge,we recommend using AWS IoT Greengrass. The AWS IoT Greengrass v2 facilitates a “managed device” experience thatenables local processing, messaging, data management, and ML inference. It provides an open-source edge runtime thatruns on devices with microprocessors (1GHz+ compute, 96MB+ RAM, 60MB persistent memory) that run Linux, MacOS,or Windows. It supports advanced edge capabilities such as (1) prebuilt software components to accelerate and simplifysoftware development, deployment, and management across your device fleets, (2) choice of local executionenvironment such as Lambda functions, native OS processes, Docker containers and/or bring your own runtime , (3) localmessaging and connectivity of leaf devices over MQTT (in the case of a gateway deployment), and (4) support for offlineprocessing and communications in disconnected use cases.CommentShareEXPERTMassimilianoAWSanswered 2 years ago"


Question: IAM Policy that allows only access to "Switch Role"

"Hi,I am looking for a IAM policy with limited access that would allow a user to sign in to the AWS console. From there the user would only be able to press the button to switch to another role. The user should only be able to "Switch Role" and that's it. Not additional access is needed other than Switch Role.For example:[Main AWS Console Account] ----> (press the "Switch Role" button and enter AWS Account ID and Role) ----> [In New AWS Console Role]The idea is to use the main account as to jump onto other accounts but with limited permissions to the main account.FollowComment"

Answer: "1HiYou can create an IAM user with No permissions to the Main AWS account and assign inline policy to switch role to the Destination account.Here are the steps:Create IAM user in Main accountAssign policy to the IAM user in main account{    "Version": "2012-10-17",    "Statement": {        "Effect": "Allow",        "Action": "sts:AssumeRole",        "Resource": "arn:aws:iam::XXXXXXXXX:role/switch-role"    }}User can acess to main account but denied to acess any services because AWS have explicit deny, So The IAM user can switch to the destination account based on the role permissions configured in the destination.ThanksGKCommentShareGKanswered a year ago"


Question: psql client not connecting and not giving any feedback.

"I created a postgres database instance and to connect to it from my terminal,I followed this formula:psql -h <REMOTE HOST> -U <DB_USER> <DB_NAME>I inserted my specific info and pressed enter but nothing happened. I got no prompt, error or feedback.FollowComment"

Answer: "1You might check that you have network access from your terminal to the RDS resource. You can install this handy utility to determine if you can access your RDS database from your terminalhttps://code.google.com/archive/p/paping/./paping <REMOTE HOST> -p <PORT>CommentShareMODERATORphilawsanswered 5 months agogtrman97 5 months agoI downloaded it but when I try to open it I get "“paping” cannot be opened because it is from an unidentified developer."Share0Hi,If I assume the database is not production yet, sAnd if you want to access from your EC2 terminal, you can try to setup your database to be connected from EC2 easily by clicking this option "Connect to an EC2 compute resource" under "connectivity".If you want to connect from your local computer:a. Without VPN:set RDS public accessible to "Yes"set security group to allow inbound traffic from your local public IP addressBut highly recommended you setup client-vpn, software-base vpn such OpenVPN , so you can put your databse still in private network which more secure then put it on public subnet.CommentSharerePost-User-7694765answered 5 months ago"


Question: AWS Networking Internals

"I want to understand how AWS packet flow happens internally.Based on my little networking and AWS understanding, I prepared the following diagram.I know the above diagram is not correct.I prepared this to explain to you what I am expecting.How Virtual Lan is configured for the EC2 instance to connect to Physical NIC?How is the EC2 instance connected to Physical NIC, Physical Switch and Router?How does the Virtual router talk to the Physical router?How are SNAT, DNAT, and Port forwarding configured in the virtual router as well as physical routers if exist?Can you please provide the resource where can I find this information?FollowComment"

Answer: "1Accepted AnswerMy question to you would be: Why do you want to know? I get (being a networking person) that these things are very interesting. And in a lot of cases, really cool. But in order to use the services to you need to know how they work?In general, we (AWS) don't talk about how we build services - because that allows us to innovate and change the "how" to deliver a faster, less expensive and overall better service to you. So how we do it today might not be how we do it tomorrow.I would definitely watch Another Day, Another Billion Flows as it talks to a lot of the networking technology that you're asking about.  Then watch this other video which is from re:Invent 2022. If those don't answer all of your questions, reach out to your local AWS Solutions Architect and have a chat.CommentShareEXPERTBrettski-AWSanswered 5 months ago"


Question: How to list buckets only from a certain region using the CLI?

"I 'm able to list all the buckets using either:aws s3 lsaws s3api list-bucketsHowever, I can't find an efficient way to filter by region, something like aws s3api list-buckets --filter region=us-east-2. I'd like to achieve this in 1 API call/CLI command only, i.e., ideally not multiple round-trips to the AWS API. Use of jq would be acceptable.FollowComment"

Answer: "2My previous response was a fast question, the negative vote was unexpected.Based on what you mentioned before to another answer I was able to create a Powershell script that I hope could be useful in your case.  Assuming you define a variable name regionSet-Variable -name region -Value "us-west-2"Running the following script should give you the bucket names aws s3api list-buckets --output json |  jq .Buckets[].Name |  foreach-object {     Set-Variable -name bname -value $_    aws s3api get-bucket-location --bucket $_      } |  foreach-object{ if($region -eq $_) { Write-Output $bName } } Take care and stay safe,Best regards,IgvirCommentShareIgviranswered a year agoAWS-User-6474999 a year agoThis seems to be the only solution AFAIK. It's very unfortunate that we need to call get-bucket-location for each bucket. If only AWS could include the region in the list-buckets response this could be avoided.ShareIgvir a year agoI agree AWS could include the region in the list-buckets response.Share0Not possible with aws "aws s3 ls" or "aws s3api list-buckets"CommentShareDonLammeyanswered a year agoAWS-User-6474999 a year agoI'm open to any alternatives, as long as I don't have to query bucket-by-bucket for the region of each one.Share-1HelloAccording to the AWS Command Line Interface reference, you have the option to use global parameters.Did you try global parameter --region?aws s3api list-buckets  --region "us-east-2"CommentShareIgviranswered a year agoAWS-User-6474999 a year agoIt has the exact same output as without --region as S3 API is global (although buckets are regional).Share"


Question: cognito custom domain not working

"I have a cognito custom domain with reports.auth.<domain.org>In route 53 <domain.org> hosted zoneI added A record for auth.<domain.org> pointing to <domain.org> A recordI added A record for reports.auth.<domain.org> pointing to the cloudfront alias generated when i created a custom domain in CognitoI have my app deployed on Heroku with URL  xxx.herokuapp.comI have below in the hosted UI configuration Allowed callback URLshttps://xxx.herokuapp.com/login/oauth2/code/cognitoWhen i use the "View Hosted UI" button it takes to Cognito signin page and from there it redirects tohttps://xxx.herokuapp.com/login?errorWhen i click on the app link above, it takes me to my app pageFollowComment"

Answer: "0Hello,Thank you for posting on AWS re:Post!I see that you have added custom domain to user pool and added A record to Route53 hosted zone but when you use hosted UI you are getting sign in page but after that you are getting Invalid_Request error.Firstly, as per the information provided, you have added A record to the route 53 hosted zone and created the alias for the custom domain. It appears that you have followed the required steps for adding custom domain to user pool as mentioned in the below AWS reference document.https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.htmlSecondly, I would like to provide information that generally "invalid_request" would be returned from the user pool's Authorization endpoint. Since you have mentioned that when you use the "View Hosted UI" button it takes you to Cognito sign in page and from there it redirects to https://xxx.herokuapp.com/login?error so I assume that this error might be returned from the authorization end point. Here is the AWS reference document which has listed few reasons for invalid_request error. I would highly recommend checking below reference document.https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.htmlAdditionally, I would recommend capturing the network trace (HAR) in your browser developer tool that will provide you more insight and possible reason for the error.Thank you!CommentShareSUPPORT ENGINEERVishal_Janswered 13 days ago"


Question: Frustrating Experience using PSI Secure Browser for AWS SAA CO2

"Yesterday at 12:30 pm I was supposed to give my AWS SAA CO2 exam through PSI.I logged in 15min prior to the exam time, connected to the proctor around 12:30 and once all the checks and scans were done, the proctor stated that he will be launching the exam.But soon after, instead of a question, an error message was prompted on the screen stating "Unable to resume because the test was already completed". I immediately texted the proctor of the issue and he suggested to reach out to the tech support.From then on, for the next 2 hrs, I talked to 2 tech support officials who were unable to resolve the issue and so I was redirected to the customer support. I was hoping she would help me to atleast reschedule the exam but sadly that didn't happen. She told me she had escalated the issue and that I need to wait for the next 3-5 days for a response.Now I want you to understand why this is so frustrating:There is no guarantee if I will get a response hence reaching out on this platform.150$ is a huge amount for someone living in India. And losing this much money and not even getting to write the exam is just ridiculous.Appearing for an exam is already an extremely nerve wracking experience and the least you could have done is to make the process easy but alas! Highly highly disappointed.Infact, I would rather have a refund because really do not want to go through the process again. I really need the certification but I will take the exam when it is safe to go to an exam centre.I kindly request the concerned authorities to look into the issue and do the needful.Below are my details:Name of the Exam : AWS Certified Solutions Architect - AssociateName : Vidushi RaturiEmail Address : 1997vidushi@gmail.comExam Date :  22 May 2021Time Zone :  Asia/KolkataExam Start Time :  12:30 PM / 12:30FollowComment"

Answer: "0Just received an email from AWS Training & Certification stating that my result is now available for the SAA CO2 exam.Not a surprise that I failed with a score of 100. Reiterating the fact that I could not view a single question but instead got the following error message.: "Unable to resume because the test is already complete".Losing 150$ and not even getting to take the exam due to a technical error feels unfair and extremely disheartening.It would be really really helpful if someone could look into this. Please.CommentSharevidushianswered 2 years ago0vidushi,I am sorry to hear about your frustrating experience. I have reviewed your account and removed the "fail" grade. This also removes the 14-day retake policy so you can schedule the exam for as soon as today if you would like. I have also confirmed that there is an open case for you with the PSI customer support team. They will be reaching out soon with a resolution. If they confirm the technical issue, they will provide a voucher.We appreciate your patience!KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago0Hi Kim,Thank you for your response and the efforts, really appreciate it.Although I do hope PSI resolves the issue and provides a voucher since there is no doubt that it was a technical error. Otherwise, it would be saddening and unfair to have lost $150 for nothing.Hoping and waiting for the best.VidushiEdited by: vidushi on May 24, 2021 2:37 PMCommentSharevidushianswered 2 years ago0Update: Received a voucher from PSI.  Will schedule the exam as soon as it is safe to go to test centres. Again, thank you so so much!CommentSharevidushianswered 2 years ago"


Question: AWS IoT and Micro Services

"Hello, I am planning to use AWS IoT for my devices in the field to connect to my micro services in the cloud.Idea here is, the devices will publish to the topics that the micro-services will subscribe to. And the microservices will publish to the topics that the device subscribes to.So, for example, there are 2 devices d1 and d2. And 2 microservices ms1 and ms2.d1 will subscribe to devices/d1 topicd2 will subscribe to devices/d2 topicand,ms1 will subscribe to services/ms1 topicms2 will subscribe to services/ms2 topicWhen d1 wants to send information to ms1, then d1 will publish on to services/ms1 topic and to send information to ms2, d1 will publish on to services/ms2 topic etc.Similarly, when ms1 wants to send information to d1, ms1 will publish on to devices/d1 topic etcI attached an image on how I visualize it.My concern here is, a micro service can have multiple instances running at the same time. So all the instances of ms1 will subscribe to services/ms1 topic. And when a device publishes a message on to that topic, how do we make sure only one instance to process that message and not multiple instances?I understand one of the ways to handle this is to use Lambda, where the message gets passed to lambda, and Lambda can call a REST API on the microservice. However, Lambda might have limitations to the scale I would like to achieve (100,000 devices with 1000 messages each every hour).So, wanted to see if there is a better way of doing it.Edited by: yarch on Nov 1, 2019 3:59 PMFollowComment"

Answer: "0You can use Rules Engine to do the 'services' topic subscriptions for you (create a Topic Rule that subscribe to 'services/ms1' and another rule for 'services/ms2'; or one rule that subscribes to 'services/+'). When a message is published to services/ms1 or services/ms2 then only the subscribed Rule(s) will fire (versus all subscribed micro-services).The rule can be used to perform a Lambda Action or HTTP Action. If your services have an HTTPS endpoint, then HTTP Action would be my preference to get over the Lambda concurrency limitation. For more information on HTTP Action see https://aws.amazon.com/blogs/iot/route-data-directly-from-iot-core-to-your-web-services/To make sure only 1 micro-service fires to handle the request, you could use a load balancer (https://aws.amazon.com/elasticloadbalancing/) or target specific instance from the Rule.CommentShareAWS-User-9734230answered 3 years ago0Hi yarch,I recommend checking out the Well-Architected IoT Lens whitepaper: https://d1.awsstatic.com/whitepapers/architecture/AWS-IoT-Lens.pdf This might answer some of your current and future questions with some guidance on how to think about architecting IoT solutions on AWS.In addition to Artem's advice, I would recommend decoupling your devices from the microservices by using message queues. For example, devices report their state or make a query to a topic oriented around itself (like devices/d1/reported or devices/d1/query) and then using the rules engine to contextualize which message queues a given message should be added to. SQS is a great tool for designing application workloads where requests are processed by a single worker. Your microservice worker would then read messages off the queue, execute logic, then send a message back to IoT Core. It is more acceptable for the microservice to know about topic architecture and could publish to a topic like devices/d1/response. This kind of design simplifies your devices (they just know about themselves), makes your architecture more agile (cloud structure can evolve without needing an update on the device), and achieves the singular processing of device messages in your microservice architecture.Hope this helps,RyanCommentShareRyan_Banswered 3 years ago"


Question: Checking EC2 spot instance via boto3

"If an instance is running, and I have the ID plus region plus the usual info, is there a way to check whether the instance is spot or on-demand using boto3?FollowComment"

Answer: "2Accepted AnswerYes, you can use ec2.describe_instances() and check for the InstanceLifecycle value which for a spot instance will be 'spot'. There may also be a 'SpotInstanceRequestId' value.CommentShareAlex_Kanswered 4 months ago"


Question: Cannot find alexa-skill function when using lambda create funciton

"I follow the guide want to create lambda-alexa application.https://aws.amazon.com/cn/blogs/china/aws-iot-series-8/When I do the 'lambda->Blueprints' and search 'alexa-skill', nothing can find.I use free try version. And my region have been set Virginia.FollowCommentMikeV 5 months agoyoungluoyang,It appears that I may (or may not) have a question similar to yours...My name is Mike and I seek help.
Our family has created several Alexa skills - all the same type… ask “alexa, ask <skill name>” and she uses a random number to get a random line from a text file in lambda and then speaks the response.Our skills are listed at - http://vanvooren.us/Alexa/VanVooren_Alexa_Skills.html.I want to update some of the things in the text file that Alexa reads from… and I have no clue where to go any more.I remember logging into the Lambda Console (https://us-east-1.console.aws.amazon.com/console/home?nc2=h_ct&region=us-east-1&src=header-signin#?) and seeing a list of our skills, and I’d click one and I could edit the text.Do you know where I need to go to edit the text files in the lambda console - where to log in? where to click after we log in?Thanks, MikeShare"

Answer: "0I solved the problem following the guide:https://github.com/alexa/skill-sample-nodejs-hello-worldNow, close the topic.CommentShareyoungluoyanganswered 4 years ago"


Question: Update DNS attributes for VPC

"This page states that I should be able to edit the DNS configuration by going to the Actions drop-down and choosing either Edit DNS hostnames or Edit DNS resolution. Neither of those is available in the dropdown.I launched the VPC using this guide, except I chose t2.nano as the instance type. The instance launched without DNS supportFollowComment"

Answer: "0For a VPC you can edit whether the settings are enabled or not. You just highlight the VPC (mark the checkbox next to it) you want to edit and then go to the actions menu in order to choose edit DNS Hostname or DNS Resolution.CommentShareEXPERTRob_Hanswered a year ago0Hi!  Good question.When an instance is lauched into a VPC, it is typically provided with a private DNS hostname.  If the instance is configured with a public IPv4 address and the VPC DNS attributes are enabled, it will be provided with a public DNS hostname.Keep in mind that the format of the private DNS hostname depends on the configuration of the EC2 instance when it is launched.To change the DNS support provided for the VPC, you can follow along to do the following:Setting the enableDnsHostnames attribute or the enableDnsSupport attributehttps://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updatingConsole: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updatingCLI: modify-vpc-attribute to enable/disable dns hostnames or to enable/disable dns support.  Keep in mind these attributes cannot both be updated in the same request.  Thus to change both, 2 CLI commands will be needed.https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html#AmazonDNSCommentSharejsoncanswered a year ago"


Question: CloudFront returning header does not include settings

"HelloI have configured my CloudFront to use a custom response header CORS policy:Cross-origin resource sharing (CORS)InfoAccess-Control-Allow-CredentialstrueAccess-Control-Allow-Headerscontent-typeAccess-Control-Allow-MethodsGETOPTIONSAccess-Control-Allow-Originhttps://www.xxx.comAccess-Control-Expose-HeadersAccess-Control-Max-Age (seconds)600Origin overriderequest header:GET /index.m3u8 HTTP/2Host: cdn.xxx.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0Accept: /Accept-Language: zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflate, brOrigin: https://www.xxx.comConnection: keep-aliveCookie: CloudFront-Policy=xxx; CloudFront-Signature=xxx; CloudFront-Key-Pair-Id=xxx;Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-siteTE: trailersresponse header:HTTP/2 200 OKcontent-type: application/x-mpegURLdate: Mon, 07 Feb 2022 17:24:34 GMTlast-modified:etag:server: AmazonS3content-encoding: gzipvary: Accept-Encodingx-xss-protection: 1x-frame-options: SAMEORIGINreferrer-policy: strict-origin-when-cross-originx-content-type-options: nosniffstrict-transport-security: max-age=31536000access-control-allow-origin: https://www.xxx.comvary: Originx-cache: Hit from cloudfrontvia: cloudfront.net (CloudFront)x-amz-cf-pop: HKG62-C2x-amz-cf-id: 6K23FSOHSfGJli3mnSFRfs4nvYXgKw68Ul_s8b5PUsKLg1HrzLqL8w==age: 3929X-Firefox-Spdy: h2I try to use HLS request. The response include access-control-allow-origin:https://www.xxx.com. But not include Access-Control-Allow-Credentials.FollowComment"


Question: Amplify build failed because the bucket already exists

"Hi,I am trying to deploy an amplify app as per https://webapp.serverlessworkshops.io/staticwebhosting/deploy/ but the build is failing because of an existing bucketI am unable to see the bucket in S3. How can I delete the bucket? or how to resolve this issue?2022-02-25T03:31:32.457Z [INFO]: An error occurred when creating the CloudFormation stack2022-02-25T03:31:32.459Z [WARNING]: ✖ Root stack creation failed2022-02-25T03:31:32.464Z [INFO]: AlreadyExistsException: Stack [amplify-wildrydes-prod-32220] already exists                                 at Request.extractError (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/protocol/query.js:50:29)                                 at Request.callListeners (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:106:20)                                 at Request.emit (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:78:10)                                 at Request.emit (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:686:14)                                 at Request.transition (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:22:10)                                 at AcceptorStateMachine.runTo (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:14:12)                                 at /root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:26:10                                 at Request.<anonymous> (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:38:9)                                 at Request.<anonymous> (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:688:12)                                 at Request.callListeners (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:116:18)                                 at Request.emit (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:78:10)                                 at Request.emit (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:686:14)                                 at Request.transition (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:22:10)                                 at AcceptorStateMachine.runTo (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:14:12)                                 at /root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:26:10                                 at Request.<anonymous> (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:38:9)                                 at Request.<anonymous> (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:688:12)                                 at Request.callListeners (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:116:18)                                 at callNextListener (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:96:12)                                 at IncomingMessage.onEnd (/root/.nvm/versions/node/v14.18.1/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/event_listeners.js:335:13)                                 at IncomingMessage.emit (events.js:412:35)                                 at IncomingMessage.emit (domain.js:475:12)                                 at endReadableNT (internal/streams/readable.js:1334:12)                                 at processTicksAndRejections (internal/process/task_queues.js:82:21) {                                 code: 'AlreadyExistsException',                                 time: 2022-02-25T03:31:32.456Z,                                 requestId: '92bb3d71-1610-43c4-a385-54cb25e459cd',                                 statusCode: 400,                                 retryable: false,                                 retryDelay: 81.16703459454344                                 }2022-02-25T03:31:32.487Z [ERROR]: !!! Build failed2022-02-25T03:31:32.487Z [ERROR]: !!! Non-Zero Exit Code detected2022-02-25T03:31:32.488Z [INFO]: # Starting environment caching...2022-02-25T03:31:32.488Z [INFO]: # Environment caching completedTerminating logging...Thank youFollowComment"

Answer: "0Accepted AnswerHello Letty,I think this was an issue. I raised a github defect https://github.com/aws-amplify/amplify-cli/issues/10579which was resolved recentlyA few other people also seem to have had the same issue. I understand that the buckets names are unique, however we don't have the control on bucket name when we use amplifyCheersSriCommentShareSrianswered a year ago0Hi there!From the notes, I understand that you trying to deploy an amplify app and you are getting the error “Bucket Already Exists”, which causes your deployment to fail. Please correct me if I misunderstood.This error message indicates that another AWS account owns a bucket with the same name, which means you must use a different bucket name to create the bucket. Amazon S3 bucket names must be unique globally, please refer to [1] on bucket restrictions and limitations and bucket naming rules.I hope you find the above information helpful.Have a great day ahead!References:[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html#bucketnamingrulesCommentShareLettyanswered a year ago"


Question: How to upgrade CEDR to DRS

"I know the AWS Document to Upgrade from CEDR to DRS:https://docs.cloudendure.com/#Configuring_and_Running_Disaster_Recovery/Upgrade_CEDR_to_DRS/Upgrade_CEDR_to_DRS.htm#Upgrading_from_CEDR_to_AWS%C2%A0DRS%3FTocPath%3DNavigation%7CConfiguring%2520and%2520Running%2520Disaster%2520Recovery%7CUpgrading%2520from%2520CEDR%2520to%2520AWS%25C2%25A0DRS%7C_____0However after upgrading to DRS, unable to Start Reverse Replication:I am performing Failback in AWS Cross Regions.Please share the correct document or help me to resolve this error to move ahead.Your help is appreciated.Thank you.FollowComment"


Question: while doing the in-place upgrade from Windows Server 2012 to Windows Server 2019 -- the screen got stucks over here. (attached the image)Any suggestions to fix this issue or how to give the ctrl-alt

FollowComment

Answer: "0Accepted AnswerHi,My name is Sean from AWS Premium Support, and I'm happy to give some suggestions for this issue. From the screenshot, you have attempted to upgrade your Windows Server 2012 instance to 2019, but the instance is now stuck on a LogonUI.exe prompt which prompts for "Press Ctrl-Alt-Del to Unlock".First, please note that upgrading from Server 2012 (non-R2) to server 2019 is not a valid upgrade path, because Windows Server in-place upgrades can upgrade two server versions at a time[1]. Presumably you are trying to upgrade from Server 2012 R2 to 2019.That being said, it appears that you may have upgraded to a windows server version without Desktop Experience (Windows GUI). If you were following these steps[2] (recommended), you may have accidentally selected an install option which did not include desktop experience, aka server core. In this case, the quickest solution is likely to roll back via an AMI which you created prior to beginning the upgrade process, as you can no longer freely convert Windows Server between server core and desktop experience for the same version[3]If that is not possible, for example because you did not create an AMI prior to performing an in-place upgrade, you might want to attach this instance's root volume to a fresh server 2019 instance built from a public AMI, then copy data over to the new instance using a tool like robocopy.Finally, if you want to proceed with this instance, you may be able to enable Serial Console for your instance, and attempt to gain shell access that way, then proceed with further troubleshooting to make it reachable via RDP (not enabled by default in server Core). To do so, you must:Enable Serial console on your account[4]Enable serial console on the instance. Because you likely cannot access this instance to perform the OS-level commands, you will need to stop the instance, attach its root volume to a helper instance in the same AZ, and perform the associated bcdedit commands[5]  on the offline volume's driveletter with the bcdedit /store flag like so:(assume attached root volume drive letter of D:)bcdedit /store D:\boot\bcd  /set '{bootmgr}' displaybootmenu yesreattach the instance's root volume to the instance at mount point /dev/sda1 and start the instance.attempt to connect to the serial consolePlease let me know if you have any follow up questions here.References:[1] https://docs.microsoft.com/en-us/windows-server/get-started/upgrade-overview[2] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/os-inplaceupgrade.html[3] https://docs.microsoft.com/en-us/windows-server/get-started/install-options-server-core-desktop-experience[4] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/configure-access-to-serial-console.html#serial-console-account-access[5] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshooting-sac.html#configure-sac-bootmenuCommentShareSUPPORT ENGINEERSean_Sanswered 9 months ago"


Question: How users can reconnect to an active AppStream session

"Case Embedded: User connects to SPA and requests a new embedded AppStream session. This session is embedded as IFrame or as in the AWS sample example in a container. Initially, a request to Streaming URL is sent, then after authentication the URL changes to the URL I called Active Session URL in the example below. That's where the AppStream session is actually streamed at.If a user closes down the browser and wishes to come back to his active session (within Disconnect Timeout) - we cannot send a new create streaming url request because this will lead to an attempt to open a new instance of our app that's already running on this session and crashes it. It's essential to allow the app to be kept running - this case assumes that the user has a work in progress and wants to return to it.Case Redirect to AppStream: Testing shows that if a user is instead redirected to that Streaming URL the URL changes to Active Session URL, but at this point, the user has left SPA which isn't the desired outcome. Redirecting to the Streaming URL and connecting to the session within AppStream gives us access to parameters created by AppStream in localstorage such as sessionid, something that's not available while embedding.How can we get that user's active session URL? Neither iFrame nor the sample container contains that URL.Is there a way to store that URL used in iframe? And then use it to reconnect to the same session without passing a request to start one more app instance?FollowComment"

Answer: "0The AppID for the streaming URL isn't checked for validity. If you can confirm the user has a valid session, then just pass in an invalid appid, and the user will connect to an existing session. However, what would be better is a simple batchfile app launcher. If the app isn't running, it launches the app. If it is, it does nothing. Then just always pass this appidCommentShareJeremy_Sanswered 5 months ago"


Question: How do I successfully "Sign up for AWS GovCloud (US)"

"When I click on the "Sign up for AWS GovCloud (US)", I see questions for part of a second and then get the following message:Access to the AWS GovCloud (US) region has been denied because you did not meet one or more of the prerequisites. Please contact AWS Customer Support if you believe you received this message in error.I have tried with 3 different accounts and they all give the same error.FollowCommentrePost-User-1428584 8 days agoI see the same behavior.  Clearly would be helpful if the message told the user which of the prerequisites were not met.Share"

Answer: "0In order to obtain an AWS GovCloud (US) account, the account owner must first have an associated standard AWS account for billing and support purposes. The sign-up process also requires acceptance of the AWS GovCloud (US) Addendum to the Amazon Web Services Customer Agreement.Also, check out the pre-requisites using the link below and check if you meet all of them.Link- https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-sign-up.html -- [1]If still unable to do anything, please open a case with AWS Support & they should be able to check in to the same.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agorePost-User-8476315 2 months agoExactly what constitutes an "associated standard AWS account"? I have a basic (free) account. I, like the other guy who posted here, can see the addendum page for a split second and then it redirects to the error page that says "Access to the AWS GovCloud (US) region has been denied because you did not meet one or more of the prerequisites. Please contact AWS Customer Support if you believe you received this message in error."Share0I checked to make sure that the accounts have the required items in the list, but don't even get to the page to accept the addendum.  It flashes on the screen and then moves to the error message.CommentSharerePost-User-9559858answered 9 months ago"


Question: Transfer Savings Plan Across Organizations

"We have recently purchased a Savings Plan within an AWS Organization (A) and are looking to move several AWS accounts to another Organization.(B)The Savings Plan is assigned to the root of Organization (A) and we would like to transfer the Savings Plan along with several member accounts to Organization (B).The SP is only a few months into the one year commitment, so we do not want to cancel.Does you know if it's possible to transfer the SP to Organization B along when the accounts are migrated?FollowComment"

Answer: "1Hello,There are a few options here if you do not wish to cancel the Savings Plan. It is recommended that Savings Plans are held in the management account to allow member accounts to be able to fully utilize the plans. Savings Plans can not be transferred between Organizations directly. AWS Support can transfer Savings Plans from the management account to a member account or from a member account to the management account within a single Organization with an AWS Support Case.If Organization (A) is going to be fully moved under Organization (B), open an AWS Support Case once the management account for Organization (A) is a member account of Organization (B) and request the Savings Plans to be transferred.If only certain member accounts from Organization (A) will be moved to Organization (B), open a AWS Support Case to transfer the Savings Plans to a member account in Organization (A) and migrate that account to Organization (B). Then open another AWS Support Case to transfer the Savings Plan to the Organization (B) management account.I hope this answers you question for how to migrate a Savings Plan between two Organizations.CommentShareJoe Melfianswered 7 months agorePost-User-0529671 7 months ago@AWS-User-melfij  - Can you confirm where you obtained this information?We have raised the question with our AWS Technical Account Manager. He explained that is not the case. We would need to CANCEL the Savings Plan and repurchase.ThanksShareJoe Melfi 7 months ago@rePost-User-0529671 - It appears your AWS Technical Account Manager is referring to a process used normally for cancelling and exchanging Savings Plans or Reserved Instances at the same or higher amount. This would not work in your case in any way as it does not transfer the Savings Plan or Reserved Instances from the current AWS account.As your and your team desire to keep the current Savings Plans and are using AWS Organizations, it is possible to use AWS Support to transfer the Savings Plans between accounts that are within the SAME ORGANIZATION. For any Savings Plan to be transferred, the accounts MUST be in the same organization. You can see this accepted Re:Post answer which provides additional clarification on the transfer of a Savings Plan from one account to another: https://repost.aws/questions/QUQabLrEJvSGiYpdqpa2pMzw/transfer-ec-2-and-savings-plan-from-one-aws-account-to-anotherPlease be aware that this process takes time and changing where Savings Plans are in use will alter how your bill will be charged. If you have additional questions, you can always reach out directly to an AWS concierge specialist through AWS Support to through your TAM for engagement.Share"


Question: AWS Glue visual job

"HiI was trying to work on a simple problem where I am taking data from 3 csv files in s3(source) and after combining them, I am appending them to a table in postgre sql where my database is by establishing a connection in my glue catalog with that database.  But I am facing an error stating that this table already exist and the data is not getting attached to it. Kindly help me if there is anything wrong with this approachFollowComment"

Answer: "0Hello,There is not any issue in above approach. You can read the data from multiple sources and can perform transformation like join and then write to the existing relational database table without any issue.By default Glue dynamic frame use append mode and add the data to an existing table. Make sure that all the columns should be present in the database table before as job would not be able to add new column and can fail with column not found in schema.I would suggest please verify the schema of your data after join operation with the database table schema.If you still face any issue, we require your sample data and script. Hence Please feel free to reach out to AWS Premium Support with sample data and script and we will be happy to help.CommentShareShubham_Panswered a year ago"