Question: Immediate input swtich seems to be "fixed"

"Dear forum,We recently saw a change in the channel schedule options.It is now possible to set "IMMEDIATE" input switches but :From the web console, when creating an immediate schedule entry, then reopen it by clicking on the View entry link, it has been changed to a Fixed start typeThe timecode of the Fixed entry created is 8 secondes from now (approx)The API (through PHP SDK) does not accept calls without scheduleActionStartSettings as it's specified in the  https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-medialive-2017-10-14.html#batchupdateschedule documentationIt seems that it's not very clear for us between Immediate and Fixed from the above observationsCould you tell us more about this "Immediate" feature ?thanksFollowComment"

Answer: "0flvlefI see the same behavior in the Console, however, when I click on the Advanced JSON option at the bottom of the View Settings link I see the schedule type is Immediate:{"actionName": "My Switch Immediate Test","scheduleActionStartSettings": {"immediateModeScheduleActionStartSettings": {}},"scheduleActionSettings": {"inputSwitchSettings": {"inputAttachmentNameReference": "Static MP4 File","urlPath": []}}}I will inform the console team of the issue seen with Start Type showing as "Fixed"From https://docs.aws.amazon.com/medialive/latest/ug/ips-switch-types.htmlImmediate – The input switches start as soon as possible. This type of switch is more like a fixed switch than a follow switch because it interrupts the current input. The advantage of this switch over a fixed switch is that you don't have to calculate any buffer in the start time.Yes scheduleActionStartSettings is required in the schedule update json. However, only one of FixedModeScheduleActionStartSettings, FollowModeScheduleActionStartSettings or ImmediateModeScheduleActionStartSettings is required. Furthermore, ImmediateModeScheduleActionStartSettings is currently only supported for input switch schedule actions.CommentShareAWS-User-5437070answered 4 years ago0flvlefLooking at the json I see that the schedule action shows as an immediate switch up to the execution time, after which it shows as fixed with the time being set to the time the action was actually executed.Leading up to the switch event:{"actionName": "My Switch Immediate Test","scheduleActionStartSettings": {"immediateModeScheduleActionStartSettings": {}},"scheduleActionSettings": {"inputSwitchSettings": {"inputAttachmentNameReference": "Static MP4 File","urlPath": []}}}Once the action has occurred:{"actionName": "My Switch Immediate Test","scheduleActionStartSettings": {"fixedModeScheduleActionStartSettings": {"time": "2019-09-25T19:59:02.764Z"}},"scheduleActionSettings": {"inputSwitchSettings": {"inputAttachmentNameReference": "Static MP4 File","urlPath": [],"$ref": "#/definitions/InputSwitchScheduleActionSettings"}}}I have confirmed with engineering that this is the expected behavior wrt the immediate input switch action.Edited by: fxeataws on Sep 25, 2019 2:37 PMCommentShareAWS-User-5437070answered 4 years ago"


Question: Can Lambda automatically update layer configurations?

"According to announcement "The AWS Lambda console now supports bulk update of layers", I was under the impression that "This release (would) eliminate(s) the need to update one function at a time or utilize an external script to perform the update on multiple functions."I am currently using an external script to update multiple functions when lambda layers are updated. Is this notice implying an automatic way to update the layers? If so, how and where would I access this feature?I am familiar with accessing the AWS Lambda console and manually bulk updating all functions that use that particular layer.Any clarification would be appreciated! Thanks again!Click here for site.FollowComment"

Answer: "1This is a new console feature. This means it is only available via the console. The console runs a script to update the layers. There is no new API to do this.If you update the layers from a script, you will continue to use the script. Nothing changes.CommentShareEXPERTUrianswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: FS for Windows fails - NFS mounts on Linux fails at attach on EC2

"IHAC who is using FS and mounting it as an NFS drive on Linux EC2 (ECS), and using this setup for an AI/ML workload.They have reported an issue where they have observed that the mount-point stops reflecting on the EC2 instances during random reboots or when scaled.I found a PFR with a similar type of issue - LinkDo we know a workaround until this gets resolved by the product team?ThanksFollowComment"

Answer: "0Accepted AnswerPer the documentation, Linux clients do not support automatic DNS-based failover - which occurs during file system maintenance, infrastructure component replacement, and customer-initiated throughput scaling.As a workaround, you can connect directly to the secondary IP of the file system while it is in a failed-over state. (However, only one of the IPs will be active depending on whether the file system is on the primary or standby server. You will need to monitor both IPs to see which is returning traffic at any given time.)CommentShareNikhil Srivastavaanswered 10 months ago"


Question: Mouse Back Button Does Not Work In AWS Workspace

"When using my AWS WorkSpace, my mouse's back button does not work.  The button works fine outside of my AWS WorkSpace.Left click, right click, middle click, and scrolling do work.  I do not have other mouse buttons, such as forward, so I cannot test those.I am running AWS WorkSpace v4.0.6.2415, and I updated a few days ago.  The WorkSpace is running Windows Server 2019 Datacenter, Version 1809.  The PC that I'm running AWS WorkSpace from, is running Windows 10 Home, Version 21H2.I couldn't find an solution online.  Seems like this issue was reported on the AWS Developer Forums:https://forums.aws.amazon.com/thread.jspa?threadID=151445but I did not find the issue on re:Post.Does anyone have a solution to this?FollowComment"

Answer: "0Accepted AnswerThank you for the suggestions.  I was waiting for AWS Support to get back to me, since I've been corresponding with them about this issue as well. Unfortunately, they let me know today that Trackball mice are considered 3D mice by their Service Team, so they're affected by the compatibility issue with 3D mice as mentioned above.  I did not know that my mouse is considered a 3D mouse, because I could not find any information online that confirmed that it was.  Searches online for 3D mice also turned up mice that seemed more complex than mine.  Anyways, they have opened a feature request for this issue to be fixed, but stated that there is no timeline on when that request ticket will be worked.Until there's an official fix, I'm just working around the issue using AutoHotkey.  I installed that software on the PC that the AWS WorkSpaces client is being run from (not in the AWS environment itself). Then I created a script with the following code & ran it:#SingleInstance ForceXButton1::{    KeyWait, XButton1    Send !{Left}}    in case anyone needs the forward button functionality as well, this script should work for that:#SingleInstance ForceXButton2::{    KeyWait, XButton2    Send !{Right}}    Autohotkey is already approved software at my company, and I am more familiar with it.  I do appreciate the suggestions of the other software options though.CommentShareAWS-User-6072759answered 10 months agoFrancisco_L SUPPORT ENGINEER10 months agothank you for the Autohotkey script! If you can provide the case number, I' ll make sure to pass this information along (if you haven't included it in the case already)Share0Hello! Can you please provide the mouse make and model you are using? If your mouse is a 3D mouse, they are not supported by WorkSpaces at this time, as mentioned in our documentation https://docs.aws.amazon.com/workspaces/latest/userguide/peripheral_devices.html#devices-inputIf you would like a further analysis, please open a support case with us and provide us with the Advanced Logs from the Client. Connect to the Workspace while collecting the logs, click on the button, then close the client, zip the logs folder and attach to the case, following the steps in this link https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-troubleshooting.html#advanced-loggingCommentShareSUPPORT ENGINEERFrancisco_Lanswered a year agoAWS-User-6072759 a year agoHello.  My mouse is a Kensington Expert Wireless Trackball Mouse, SKU K72359, model M01286-M.  I don't think it is a 3D mouse.  It looks just like this:https://www.amazon.com/Kensington-Expert-Wireless-Trackball-K72359WW/dp/B01936N73II will also look into submitting a support case with logs.Share0While the standard forward/back mouse buttons do not work, you can map them to a 'Keystroke Assignment' and get them to work. For example, I have a Logitech mouse and OOTB the forward/back buttons do nothing in WorkSpaces. Then I went into Logitech options and mapped the forward/back buttons to the keyboard combination for forward and back navigation - On Windows:[ ALT + Left Arrow Key ]  = Back[ ALT + Right Arrow Key ]  = ForwardNow my navigation buttons work in WorkSpaces (in browsers and Windows Explorer).If your mouse does not come with software for remapping, then there are lots of freeware apps to do this like Mouse Manager or X-Mouse Button Control.NOTE: This hack can also work by remapping trackpad swipes to Keystroke Assignments (e.g. two-finger swipe = ALT+Left Arrow].CommentShareAWS-User-2427213answered a year ago"


Question: Do Elastic Beanstalk Web Server Environment Need A Public Elastic IP

I am very new to AWS so I appreciate any help in advance but was wondering if its required for a Elastic Beanstalk Environment to have a public ip / elastic ip address?  I have a loadbalancer that is set up to point to that elastic beanstalk instance but whenever I remove the elastic ip (I'm messing around seeing what does what) it starts to fail the health checks.  It will even fail if a specify IP address type target group and provide the private IP address.  The security groups look alright and allow traffic from the LB sec group to the instance sec group over the health check port.So I'm curious if you have to have your elastic beanstalk ec2 instance exposed with a public IP for the load balancer to register it or is there a way to keep all of that behind the curtain and just have the LB communicate with the instance via the instances private ip address?FollowComment

Answer: "0Hello Bansheebomb! Welcome to AWS services. It looks like you are trying to figure out whether or not it is required for your Elastic Beanstalk environment to have a static IP to allow outbound and inbound traffic from your instances. In order to route external traffic, your environment requires a public IP. This IP can either be a public IP assigned to your EC2 instances if placed in a public subnet, or an Elastic IP assigned to a NAT Gateway to route traffic from your instances in a private subnet. In order to have your instances communicate privately with the load balancer, you will need an internet gateway and a NAT gateway. The public subnet needs to have a default route to the internet gateway, which you can accomplish by editing the routing tables. Then, you will need to create a NAT gateway in the same public subnet and associate an elastic IP to it. Next, add a routing entry in your private subnet to direct traffic to the NAT gateway. Finally, you will need to associate your load balancer with the private subnets. To do this, enter your Beanstalk configuration presets, and navigate to load balancer settings. Ensure visibility is set to public and then edit the subnet tables. Delete any public subnets and add in the private subnets associated with the NAT gateway you created earlier. Your instances will now communicate privately with the load balancer and all traffic will go through the elastic IP. For more information, please view this documentation.Setting up a NAT Gateway in a private subnet: https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/Configure and attach an Internet Gateway (IGW) for use with Elastic Load Balancing: https://aws.amazon.com/premiumsupport/knowledge-center/attach-igw-elb/How do I assign a static source IP address for all instances in a load-balanced Elastic Beanstalk environment? https://aws.amazon.com/premiumsupport/knowledge-center/elastic-beanstalk-static-IP-address/CommentShareNolan_Sanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 9 months ago"


Question: Instance state stuck on initializing

Instance i-05e22582b14eb7490 our production db will not come back up stuck on initializing step.FollowComment

Answer: 0USER ERROR: caused by an issue with fstab still referencing a detached volumeCommentShareworkingatitanswered 4 years ago


Question: How can we run sql on mysql RDS and get the output on SNS?

How can we run sql on mysql RDS and get the output on SNS?FollowComment

Answer: "0What is your use case? One way to achieve that is by using Lambda that will execute the SQL and then publish to SNS topic but there are probably other ways to achieve that. Depending on what is your desired outcome and the specific use case.CommentShareNikoanswered 3 months agoKanhaiya Sharma 3 months agoHi Niko,I want to monitor the blocking session and locked tables in the database.Whenever blocking happens in database we should receive an alert with the details of sessions causing blocking. Also if the table is lock for more than defined time duration in my sql script then we should receive an email alert.ShareNiko 3 months agoThanks for proving more context. I am not a DB specialist but I found this article  - https://aws.amazon.com/premiumsupport/knowledge-center/rds-aurora-postgresql-query-blocked/ and it explains how to monitor blocked queries. As I mentioned before, you can use Lambda or other means to run a query against pg_stat_activity table to notify your admin about blocking. Hope this helps but if not let us knowShare0Thanks Niko. I will try to use lambda for this.CommentShareKanhaiya Sharmaanswered 3 months ago"


Question: Permission denied trying to import from another component

"I have a python component that is depended on another component. I set the path of the dependent in an environment variable in my recipe. At the beginning of my script, I add the path to my sys.path so I can find and import the module I needed. This all works fine during local deployment. But when I tried to deploy to another device (raspberry pi) from IoT console, the deployment failed. I get "PermissionError: [Errno 13] Permission denied: ..." on the file I am trying to import. I checked the files inside /greengrass/v2/packages, they are all under root with only read permissions (444). On my local machine, the files are also under root and with permission 644.  It seems that this should not make any difference. Any idea this is not working?  Thank you in advance!FollowComment"

Answer: "0Hi,Different components won't have permission to read each others artifacts because they might be running as different users. When deploying a component you get to select what user each components runs as, and if they aren't the same then it won't have permissions to read it. You can address this by setting the permissions on the artifact within the recipe file such that everyone is allowed to read it. https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.htmlCheers,Michael DombrowskiCommentShareEXPERTMichaelDombrowski-AWSanswered 2 years ago0Yeah, that was it. Thank you very much!CommentSharejcaianswered 2 years ago"


Question: Question about Route 53 Resolver mapping

From where does Route 53 Resolver get the value for a DNS query that it needs to resolve? Is this from the records that you define in a hosted zone?FollowComment

Answer: "1Hi ThereIt depends where the record  is hosted.A Route 53 Resolver automatically answers DNS queries for:Local VPC domain names for EC2 instances (for example, ec2-192-0-2-44.compute-1.amazonaws.com).Records in private hosted zones (for example, acme.example.com).For public domain names, Route 53 Resolver performs recursive lookups against public name servers on the internet.For other resources like on-prem:Through Resolver endpoints and conditional forwarding rules, you can resolve DNS queries between your on-premises resources and VPCs to create a hybrid cloud setup over VPN or Direct Connect (DX)See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.htmlCommentShareEXPERTMatt-Banswered 3 months agorePost-User-3324188 3 months agoThank you!ShareMatt-B EXPERT3 months agoNo Problem!  If my answer resolved your query, please consider marking it as "accepted".Share"


Question: How to customize NGINX configuration to modify the "client_max_body_size" in Elastic Beanstalk

I'm following the recommended steps:Create the client_max_body_size.conf file with the desired configuration;Allocate the file under the structure:--- .platform       -- nginx           -- conf.d                 -- client_max_body_size.confThe file client_max_body_size.conf has a path like this: my-app/.platform/nginx/conf.d/client_max_body_size.conf.Including the reference in the POM.xml file: <plugin>        <groupId>org.apache.maven.plugins</groupId>        <artifactId>maven-antrun-plugin</artifactId>        <version>1.8</version>        <executions>          <execution>            <id>prepare</id>            <phase>package</phase>            <configuration>              <tasks>                <copy todir="${project.build.directory}/${project.build.finalName}/"                  overwrite="false">                  <fileset dir="./" includes=".platform/**"/>                  <fileset dir="${project.build.directory}" includes="*.jar"/>                </copy>                <zip destfile="${project.build.directory}/${project.build.finalName}.zip"                  basedir="${project.build.directory}/${project.build.finalName}"/>              </tasks>            </configuration>            <goals>              <goal>run</goal>            </goals>          </execution>        </executions>      </plugin>But then checking nothing changed:[ec2-user@ip-XXXXXXX /]$ sudo nginx -T | egrep -i "client_max_body_size"nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successfulFollowComment

Answer: 0Accepted AnswerCan you please refer to a similar issue faced by another user that has resolution? Please ensure that the platform directory has the right file with right permissions?https://repost.aws/questions/QUuiSo8zUaQ9etlkDeJl5DTA/java-maven-deployed-in-elastic-bean-stalk-nginx-modification-not-workingCommentShareDhilipanswered 12 days agorePost-User-8086462 11 days agoWhich permission are talking about?I didn't see any article with the steps.Share


Question: Permanent access to WorkDocs for external parties

"Hi, I want to create a permanent link with acess to a WorkDocs folder to anyone (inc. external parties : selling partners/vendors) who has the link. They don't need any write permissions, just to download an Excel file we will share with them. Is WorkDocs the best tool to do that?Reason we are not using other tools e.g. media central is because the file is undergoing updates, and we want the latest version to be always be accessed via one single link. Alternative would be to create a link with access to a specific file (instead of a folder) as long as we can keep updating that fileThanksFollowComment"

Answer: 0You can create a link to a specific file and it will link to the latest version of that file. While you can't make the link "permanent" you can set an expiry date on the link far enough in the future that it should not be a problem.CommentShareEXPERTBrettski-AWSanswered 10 months ago


Question: free tier sagemaket domian creation fails with 2 errors about defaultSpaceSettings.executionRole

"free tier sagemaket domian creation fails with 2 errors about defaultSpaceSettings.executionRoleValidationException2 validation errors detected•Value '' at 'defaultSpaceSettings.executionRole' failed to satisfy constraint: Member must have length greater than or equal to 20•Value '' at 'defaultSpaceSettings.executionRole' failed to satisfy constraint: Member must satisfy regular expression pattern: ^arn:aws[a-z-]*:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@-_/]+$FollowCommentDurga_S 22 days agoHow are you creating the domain? Is it through console/API? You seem to be either missing the space default role, or providing it a value that doesn't follow the ARN format.Share"

Answer: "0I just encountered this when creating a new execution role at the same time as the domain. This appears to be a bug in the console that occurs when you try to create a domain and use the "create a new execution role" feature. It is not properly attaching the new role ARN to the new domain, so you get this error.The fix is to create the execution role and then create the domain. The domain wizard will have properly created it for you so:Once you see this error try clicking the create button again, then selecting the already existing role (the one it just created, do not create a second execution role) Make sure to fill out the rest of the domain fields again.Additionally if you have tried going through the wizard multiple times you are going to want to go to IAM and delete any duplicate execution roles. Make sure not to delete the one the domain is actually using!CommentShareDylan-9455736answered 4 hours ago"


Question: AWS CodePipeline historic logs

"Hi everyone,I've setup some Codepipeline infrastructure using CDK and would like to monitor the historic logs of codepipeline runs. But after a pipeline has run, the logs just disappear (From the CodePipeline dashboard, as well as cloudwatch). I can see the success or failed pipeline instances in the historic view, but I can't see the logs for each specific run. How can I keep the historic logs for a specific retention period?FollowComment"


Question: CodePipeline yaml template - problems with account number with leading zero

"Hi,I am experiencing a very strange problem in the template file for my pipeline. When I specify a configuration in a deploy stage, I use a parameter to specify the account number in the RoleArn - which works fine. However, when I do the exact same thing to specify the account number in the RoleArn for the action itself, the account number seems to get converted into a number and fails - because of the leading zero. Everything works fine for account numbers without a leading zero.Does anyone know why one works fine while the other fails? I have included part of the code below and shown which RoleArn works and which one fails. Then the error I get is at the bottom---AWSTemplateFormatVersion: 2010-09-09Parameters:  AccountNumber:    Type: String    Default: "012345678912"Resources:  CodeBuildProject:    ...  Pipeline    Type: AWS::CodePipeline::Pipeline    Properties:      ...      Stages:      ...      - Name: Deploy        Actions:          - Name: Create-ChangeSet            InputArtifacts:              - Name: BuildArtifact            ActionTypeId:              Category: Deploy              Owner: AWS              Version: "1"              Provider: CloudFormation            Configuration:              ActionMode: CHANGE_SET_REPLACE              ChangeSetName: service-name-changeset              # Works:              RoleArn: !Sub arn:aws:iam::${AccountNumber}:role/DeployerRole              Capabilities: CAPABILITY_IAM              StackName: service-name-stack              TemplatePath: BuildArtifact::output-service-name.yaml            RunOrder: 1            # Fails:            RoleArn: !Sub arn:aws:iam::${AccountNumber}:role/CloudFormationRole...This is the error I get:Value 'arn:aws:iam::1.2345678912E10:role/CloudFormationRole' at 'pipeline.stages.3.member.actions.1.member.roleArn' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:aws(-[\w]+)*:iam::[0-9]{12}:role/.*;FollowComment"

Answer: "0I found the issue quite quickly after posting. Unfortunately, every time I tried to post a reply, I got the error "Your message quota has been reached. Please try again later. " So now I'm posting after the weekend...The problem was that the first time I used the template, I did not have quotes around the AccountNumber variable. When I introduced quotes, the problem should have been fixed, but the old value remained in the pipeline. By simply renaming the variable, I was able to kick the pipeline into understanding that the variable has changed - which finally fixed the problem.It also turns out that the problem was the same with both RoleArn values; it's just that the RoleArn inside the Configuration block seems to have less validation and was happy to be defined with an invalid account number.CommentShareavidonanswered 4 years ago"


Question: Providing username values while importing users to Cognito

"I'm using Cognito user pool created with Amplify. It requires e-mail sign-in and sign-up. Username parameter is automatically filled with sub value.I'm using this username value as a unique id for Dynamo DB user table. I've selected username value as a unique id since sub values were assigned by Cognito system, we could not provide them.It's also explained in Cognito docs: "If your application doesn't require a user name, you don't need to ask users to provide one. Your app can create a unique username for users in the background. This can be useful if you want users to register and sign in with an email address and password." https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.htmlWhile importing users to new Cognito pool (same configuration with Amplify), I was hoping to copy the  username values to cognito:username attributes of newly created users. But it didn't work like that,  import job failed with "Username should be an email". Even when I provide email for username attribute, it's set as a random UUID.I do not understand, how these users were created with usernames keeping sub (UUID) values, if it's not allowed? If they could be created with these values, why they can't be imported to a new user pool having exactly the same config, any idea?FollowComment"


Question: Recommended Library for Redis Elasicache for ASP.NET 6?

"I have a REST API on ASP.NET 6 that I'm planning to migrate from Google Cloud Run to Elastic Beanstalk. On Google, I'm using Firestore and I'm switching that to Redis Elasticache. I found this tutorial on how to use Elasicache with .NET: https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/AutoDiscovery.Using.ModifyApp.DotNET.htmlIt appears that the library has been deprecated. Googling, I found the library "AWSSDK.ElastiCache" but it seems to be brand new; I cannot find any examples or documentation for how to use it. So, which client should I use for my project? Also, are there any examples on how to do a simple CRUD on an object?I just need to swap out a class that will store/update/read simple objects in key/value.Any help is appreciated.Thanks.FollowComment"

Answer: "0The AWS .NET SDK has the AWS API functionality. If you are looking for using Redis, Redis has a .NET SDK. I think you are looking for the latter.CommentShareRodney Lesteranswered 8 months ago"


Question: Code Storage -  Does it reuse a deployment package?

"Hello,I have several functions using same deployment package, like this:...    "DeleteDashuserLambdaFunction": {      "Type": "AWS::Lambda::Function",      "Properties": {        "Code": {          "S3Bucket": "dev.eu-west-1.serverless.deploys.em.com",          "S3Key": "serverless/user-service-ts/dev/1554451324595-2019-04-05T08:02:04.595Z/user-service-ts.zip"        },...    "InviteDashuserLambdaFunction": {      "Type": "AWS::Lambda::Function",      "Properties": {        "Code": {          "S3Bucket": "dev.eu-west-1.serverless.deploys.em.com",          "S3Key": "serverless/user-service-ts/dev/1554451324595-2019-04-05T08:02:04.595Z/user-service-ts.zip"        },...Will the lambda reuse the deployment package? What's more effective from the code storage perspective: use one zip (say 10MB) for several functions or split into smaller zips (10 packages 5 MB each)?FollowComment"

Answer: "0Accepted AnswerHi there!Will the lambda reuse the deployment package?Lambda will not reuse the same deployment package. When the Lambda function is deployed, it creates a copy of the code referenced in the S3 bucket for each function.What's more effective from the code storage perspective: use one zip (say 10MB) for several functions or split into smaller zips (10 packages 5 MB each)?It is always recommended to have a smaller deployment package for each Lambda function. While there is no direct advantage with respect to code storage, this provides multiple advantages such as reduced cold start times and the ability to edit code inline. More details can be found here:https://docs.aws.amazon.com/lambda/latest/dg/best-practices.htmlCommentShareAWS-User-2067776answered 4 years ago"


Question: Insecure HTTPS configuration

"I followed the steps here to set up https with a classic load balancer- https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.htmlHowever when I try to connect via https in FireFox it's telling me "Server not found". Clicking on the (i) marker the the left in the url field gives me the message "Connection not secure" -> "Your messages are not private". In MS edge it tells me "Your connection is not encrypted".So somehow I think my HTTPS socket is set up without a cipher. What do I need to do to fix this?Edited by: TJ78 on Nov 27, 2019 6:01 AMFollowComment"

Answer: "0I switched back to single instance (no load balancer), then back to my load balancer (classic). HTTPS is now working. I think now it's possible that I just didn't test the right way.CommentShareTJ78answered 4 years ago"


Question: AWS Go SDK not finding the credentials file at C:/###/.aws/credential.

"I am using Amazon Kinesis and the Go SDK for AWS, but I'm getting an error.This is my code:package mainimport ("math/rand""strings""github.com/aws/aws-sdk-go/aws""github.com/aws/aws-sdk-go/aws/session"_kinesis "github.com/aws/aws-sdk-go/service/kinesis")func main() {session, err := session.NewSession(&aws.Config{Region: aws.String("us-east-1"),})handleErr(err)kinesis := _kinesis.New(session)laugh := strings.Builder{}laughingSounds := []string{"haha", "hoho", "hehe", "hehehe", "*snicker*"}for i := 0; i < 10; i++ {laugh.WriteString(laughingSounds[rand.Intn(len(laughingSounds))])}_, err = kinesis.PutRecord(&_kinesis.PutRecordInput{Data:         []byte(laugh.String()),PartitionKey: aws.String("laughs"),StreamName:   aws.String("laughs"),})handleErr(err)}func handleErr(err error) {      if err != nil {             panic(err)      }}However, when I run this I get an error:panic: UnrecognizedClientException: The security token included in the request is invalid.        status code: 400, request id: dc139793-cd38-fb30-86a3-f92b6410e1c7goroutine 1 [running]:main.handleErr(...)        C:/Users/####/----/main.go:5main.main()        C:/Users/####/----/main.go:34 +0x3acexit status 2I have run aws configure:$ aws configureAWS Access Key ID [None]:  ####AWS Secret Access Key [None]: ####Default region name [None]: us-east-1Default output format [None]: and the C:/users/####/.aws/credentials file is created with the correct configuration. But my program still wouldn't execute successfully.When that didn't work, I also set an environment variable like this:$ $env:aws_access_key_id="####"It still doesn't work.Version info:$ pwsh -vPowerShell 7.2.2$ aws -vaws-cli/2.4.27 Python/3.8.8 Windows/10 exe/AMD64 prompt/offOS: Windows 11 (version 21H2).Thanks in advance!FollowComment"

Answer: "0In your case, you are using a credentials file. Please take a look at the example from the AWS SDK for GO (v1) documentation. You will need to use credentials.NewSharedCredentials to refer to an AWS credentials profile.sess, err := session.NewSession(&aws.Config{    Region:      aws.String("us-west-2"),    Credentials: credentials.NewSharedCredentials("", "test-account"),})CommentShareTaka_Manswered 7 months ago"


Question: EMR serverless job spark UI not accessible after application restart

EMR serverless job Spark UI/history server is not accessible once application restart.Application is configured with below options to reduce cost.[Auto start application-Automatically starts on job submission.Auto stop application-Automatically stops after application is idle for 1 mins.]FollowComment

Answer: "0I understand that you are unable to access the application UI on EMR Serverless, I just did quick test and I was able to view the Application UI with no issue for running and completed jobs, However will not be able view the Application UI for the cancelled job. I see that the behavior is expected in the EMR Serverless/Studio consoleYou could also see if Job run 00fxxxxxx09 for applicationId 00xxxxx09 is not in RUNNING state. You can view the Spark History Server for completed jobs from Studio.Referenced in link [1] describes monitoring EMR Serverless applications and jobs, feel free to peruse it.  If you would like to get more details and troubleshooting the issue please reach out to AWS Premium support for better understanding and resolution.References:[1] https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/metrics.html  : Monitoring EMR Serverless applications and jobsCommentSharerePost-User-4869158answered 3 months ago"


Question: Getting error GENERIC_INTERNAL_ERROR: com.facebook.presto.sql.tree.CreateView cannot be cast to com.facebook.presto.sql.tree.Query

"Hi! I created a presto view from a data catalog using CfnTable syntax and it is generating the correct CVAS query. However, when I query the view I get the following error.GENERIC_INTERNAL_ERROR: com.facebook.presto.sql.tree.CreateView cannot be cast to com.facebook.presto.sql.tree.QueryHere is the generated CVAS query,create or replace view fiber_span_geojson_vw as select userIdentity.principalId as service_principal, eventName, eventTime, cast(json_extract(requestParameters, '$.key') as varchar) as requested_file from "cloudtraildbtest"."perfecttablecreated" where eventName = 'GetObject' and cast(json_extract(requestParameters, '$.key') as varchar) LIKE '%fiber_span_geojson/%'When I manually execute the query, it is a success and I'm able to see the data. Can someone help me understand why the DDL query is failing internally to generate the view?FollowCommentEman 9 months agoMost likely a parsing exception on your query. Share the steps to reproduce the one query that fails.Share"


Question: Migration of SLES12 SP5 to SLES15 SP1

"Hello,By using https://documentation.suse.com/suse-distribution-migration-system/15/single-html/distribution-migration-system/index.html#_run_the_migration, I have migrated EC2 Instance which is running on SLES12 SP3 --> SLES12 SP4 --> SLES12 SP5 to SLES15 SP1.Now we would like to migrate from SLES15 SP1 to SLES15 SP2 and then to SLES15 SP3.To do so when we fire command "zypper migration", below mentioned error is occurring:Can't get available migrations from server: SUSE::Connect::ApiError: The requested products 'HPC Module 12 x86_64' are not activated on the system.'/usr/lib/zypper/commands/zypper-migration' exited with status 1'All repositories are of SLES15 SP1 in the output of "zypper repos". However SUSE Registration status shows, the product 'HPC Module 12 x86_64' as not registered.Please guide me to fix the issue and migrate from SLES15 SP1 to SLES15 SP2.FollowComment"

Answer: "0Accepted AnswerHi,Sorry about the trouble. In the SLE 12 series of releases HPC was a module but not a Product. In SLE 15 HPC became a product and as such the HPC module is no longer part of SLES. If you remove the HPC module before migration the migration will work.zypper rm sle-module-hpc-release-POOL sle-module-hpc-releasefrom https://www.suse.com/c/major-distro-upgrade-in-the-public-cloud-made-easy/CommentShareAWS-User-7085311answered a year agoAWS-User-2560483 a year agoThank you. It did work.Share"


Question: Accessing via API data of type FILE in QuickSight

"Hello,I would like to update a Row Level Security rule by adding a new username using the Quicksight API. All RLS rules were initially created using the console and by uploading a file. Is it possible to update that file using the API? The datasource is set as FILE and i'm wondering if I can access and update that file via API. IF i can't, can I linked a RLS rule to a S3 file which i can update using the S3 api.thank you!G.FollowComment"

Answer: "0Hi, @gm0x45.Unfortunately it is not currently supported.You need to use UpdateDataSet for updates, but its API doesn't support file type datasets.https://docs.aws.amazon.com/cli/latest/reference/quicksight/update-data-set.htmlI also need to use the DescribeDataSet to get the RowLevelPermission information in order to copy the rule to another dataset, but this API also doesn't support file type datasets.https://docs.aws.amazon.com/cli/latest/reference/quicksight/describe-data-set.htmlCommentShareEXPERTiwasaanswered a year ago"


Question: German T-Online.de provider blocked AMAZON SES IPs

"We have an urgent issue. I already wrote to T-Online support and the just respond that AMAZON has to contact them. So please Amazon support Team solve this issue. Some of your SES servers are blocked from the German provider @t-online.de421 IP=69.169.224.8 - No more parallel connections from your address allowedThe error message quoted here is addressed to the operator of the dispatch system().of the shipping system() and he should, if necessary, contact us - gladly incontact us to clarify the cause of the problem.clarify the cause of the problem.In this context, the chosen contact route via you is unfortunate,because you can neither change the unfortunate situation nor are you authorisedentitled to receive information about the reasons for the rejection.For this reason, it is imperative that the responsibleadministrator of the system in question contact us himself.(*)"69.169.224.8" resolves to "b224-8.smtp-out.eu-central-1.amazonses.com"in the network with the name "AMAZO-22" and is according to whois in theAmazon Web Services, Inc.".Translated with www.DeepL.com/Translator (free version)FollowComment"


Question: RHEL ARM64 Repos out of sync?

"Firing up new RHEL 9 EC2 ARM64 instance, and immediately trying to do a yum update and it can't.  It appears the BaseOS is out of sync (older) with the updated Appstream repo.  None of my 12 Reserved Instances, running RHEL9, can yum update either.  If I disable BaseOS, it doesn't complain.   I can't contact RHEL, since RedHAT says AWS handles RedHAT support.    I've tried US-EAST-1, US-EAST-2, and US-WEST-2.The Appstream Repo, which provides all of the -devel rpms, has newer, updated rpms, which is complaining about older rpms in the BaseOS.As you can see it wants differing packages for -devel and base versions, which can't happen.   Please fix.Thanks!Red Hat Enterprise Linux 9 for aarch64 - AppStream from RHUI (RPMs)                                                                                27 MB/s |  13 MB     00:00Red Hat Enterprise Linux 9 for aarch64 - BaseOS from RHUI (RPMs)                                                                                40 MB/s | 6.0 MB     00:00Red Hat Enterprise Linux 9 Client Configuration                                                                                18 kB/s | 1.8 kB     00:00Error:Problem 1: package authselect-compat-1.2.5-1.el9.aarch64 requires authselect(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedcannot install both authselect-1.2.5-2.el9_1.aarch64 and authselect-1.2.5-1.el9.aarch64cannot install the best update candidate for package authselect-compat-1.2.5-1.el9.aarch64cannot install the best update candidate for package authselect-1.2.5-1.el9.aarch64Problem 2: package glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedcannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-40.el9.aarch64cannot install the best update candidate for package glibc-devel-2.34-40.el9.aarch64cannot install the best update candidate for package glibc-2.34-40.el9.aarch64Problem 3: package zlib-devel-1.2.11-34.el9.aarch64 requires zlib(aarch-64) = 1.2.11-34.el9, but none of the providers can be installedcannot install both zlib-1.2.11-35.el9_1.aarch64 and zlib-1.2.11-34.el9.aarch64cannot install the best update candidate for package zlib-devel-1.2.11-34.el9.aarch64cannot install the best update candidate for package zlib-1.2.11-34.el9.aarch64Problem 4: package libxcrypt-devel-4.4.18-3.el9.aarch64 requires glibc-devel(aarch-64) >= 2.27, but none of the providers can be installedpackage glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.aarch64 requires glibc = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.2.aarch64 requires glibc = 2.34-28.el9_0.2, but none of the providers can be installedpackage glibc-2.34-40.el9.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-40.el9 if redhat-rpm-config), but none of the providers can be installedpackage glibc-2.34-28.el9_0.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-28.el9_0 if redhat-rpm-config), but none of the providers can be installedpackage glibc-2.34-28.el9_0.2.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-28.el9_0.2 if redhat-rpm-config), but none of the providers can be installedcannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-40.el9.aarch64cannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-28.el9_0.aarch64cannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-28.el9_0.2.aarch64cannot install the best update candidate for package redhat-rpm-config-196-1.el9.noarchcannot install the best update candidate for package libxcrypt-devel-4.4.18-3.el9.aarch64cannot install the best update candidate for package glibc-gconv-extra-2.34-40.el9.aarch64Problem 5: problem with installed package authselect-compat-1.2.5-1.el9.aarch64package authselect-compat-1.2.5-1.el9.aarch64 requires authselect(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedpackage authselect-1.2.5-1.el9.aarch64 requires authselect-libs(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedcannot install both authselect-libs-1.2.5-2.el9_1.aarch64 and authselect-libs-1.2.5-1.el9.aarch64cannot install the best update candidate for package authselect-libs-1.2.5-1.el9.aarch64Problem 6: package gcc-11.3.1-2.1.el9.aarch64 requires glibc-devel >= 2.2.90-12, but none of the providers can be installedpackage glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.aarch64 requires glibc = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.2.aarch64 requires glibc = 2.34-28.el9_0.2, but none of the providers can be installedpackage glibc-2.34-40.el9.aarch64 requires glibc-common = 2.34-40.el9, but none of the providers can be installedpackage glibc-2.34-28.el9_0.aarch64 requires glibc-common = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-2.34-28.el9_0.2.aarch64 requires glibc-common = 2.34-28.el9_0.2, but none of the providers can be installedcannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-40.el9.aarch64cannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-28.el9_0.aarch64cannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-28.el9_0.2.aarch64cannot install the best update candidate for package glibc-common-2.34-40.el9.aarch64cannot install the best update candidate for package gcc-11.3.1-2.1.el9.aarch64Problem 7: problem with installed package glibc-devel-2.34-40.el9.aarch64package glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedcannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-40.el9.aarch64package glibc-langpack-en-2.34-40.el9_1.1.aarch64 requires glibc = 2.34-40.el9_1.1, but none of the providers can be installedcannot install the best update candidate for package glibc-langpack-en-2.34-40.el9.aarch64You can even take the AMI Image directly from RHEL, https://access.redhat.com/solutions/15356 and try and do a yum update, on install and get: [root@ip-172-30-3-97 ~]# yum update Updating Subscription Management repositories. Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Red Hat Enterprise Linux 9 for aarch64 - AppStream from RHUI (RPMs) 65 MB/s | 13 MB 00:00Red Hat Enterprise Linux 9 for aarch64 - BaseOS from RHUI (RPMs) 35 MB/s | 6.0 MB 00:00Red Hat Enterprise Linux 9 Client Configuration 19 kB/s | 1.8 kB 00:00Error: Problem 1: package authselect-compat-1.2.5-1.el9.aarch64 requires authselect(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedcannot install both authselect-1.2.5-2.el9_1.aarch64 and authselect-1.2.5-1.el9.aarch64cannot install the best update candidate for package authselect-compat-1.2.3-7.el9.aarch64cannot install the best update candidate for package authselect-1.2.3-7.el9.aarch64 Problem 2: problem with installed package authselect-compat-1.2.3-7.el9.aarch64package authselect-compat-1.2.3-7.el9.aarch64 requires authselect(aarch-64) = 1.2.3-7.el9, but none of the providers can be installedpackage authselect-compat-1.2.5-1.el9.aarch64 requires authselect(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedpackage authselect-1.2.3-7.el9.aarch64 requires authselect-libs(aarch-64) = 1.2.3-7.el9, but none of the providers can be installedpackage authselect-1.2.5-1.el9.aarch64 requires authselect-libs(aarch-64) = 1.2.5-1.el9, but none of the providers can be installedcannot install both authselect-libs-1.2.5-2.el9_1.aarch64 and authselect-libs-1.2.3-7.el9.aarch64cannot install both authselect-libs-1.2.5-2.el9_1.aarch64 and authselect-libs-1.2.5-1.el9.aarch64cannot install the best update candidate for package authselect-libs-1.2.3-7.el9.aarch64 (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)If you add --allowerasing, and let it remove authselect-compat on this initial update, then do a: yum group install "development tools", and let it install all the -devel rpms, now you're in for a world of hurt. Any yum updates after that, and with repos out of sync, yum can't update: [root@ip-172-30-3-97 ~]# yum update Updating Subscription Management repositories. Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Last metadata expiration check: 0:03:07 ago on Thu 26 Jan 2023 09:17:10 PM UTC. Error: Problem 1: package glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedcannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-40.el9.aarch64cannot install the best update candidate for package glibc-devel-2.34-40.el9.aarch64cannot install the best update candidate for package glibc-2.34-40.el9.aarch64 Problem 2: package zlib-devel-1.2.11-34.el9.aarch64 requires zlib(aarch-64) = 1.2.11-34.el9, but none of the providers can be installedcannot install both zlib-1.2.11-35.el9_1.aarch64 and zlib-1.2.11-34.el9.aarch64cannot install the best update candidate for package zlib-devel-1.2.11-34.el9.aarch64cannot install the best update candidate for package zlib-1.2.11-34.el9.aarch64 Problem 3: package libxcrypt-devel-4.4.18-3.el9.aarch64 requires glibc-devel(aarch-64) >= 2.27, but none of the providers can be installedpackage glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.aarch64 requires glibc = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.2.aarch64 requires glibc = 2.34-28.el9_0.2, but none of the providers can be installedpackage glibc-2.34-40.el9.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-40.el9 if redhat-rpm-config), but none of the providers can be installedpackage glibc-2.34-28.el9_0.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-28.el9_0 if redhat-rpm-config), but none of the providers can be installedpackage glibc-2.34-28.el9_0.2.aarch64 requires (glibc-gconv-extra(aarch-64) = 2.34-28.el9_0.2 if redhat-rpm-config), but none of the providers can be installedcannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-40.el9.aarch64cannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-28.el9_0.aarch64cannot install both glibc-gconv-extra-2.34-40.el9_1.1.aarch64 and glibc-gconv-extra-2.34-28.el9_0.2.aarch64cannot install the best update candidate for package redhat-rpm-config-196-1.el9.noarchcannot install the best update candidate for package libxcrypt-devel-4.4.18-3.el9.aarch64cannot install the best update candidate for package glibc-gconv-extra-2.34-40.el9.aarch64 Problem 4: package gcc-11.3.1-2.1.el9.aarch64 requires glibc-devel >= 2.2.90-12, but none of the providers can be installedpackage glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.aarch64 requires glibc = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.2.aarch64 requires glibc = 2.34-28.el9_0.2, but none of the providers can be installedpackage glibc-2.34-40.el9.aarch64 requires glibc-common = 2.34-40.el9, but none of the providers can be installedpackage glibc-2.34-28.el9_0.aarch64 requires glibc-common = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-2.34-28.el9_0.2.aarch64 requires glibc-common = 2.34-28.el9_0.2, but none of the providers can be installedcannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-40.el9.aarch64cannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-28.el9_0.aarch64cannot install both glibc-common-2.34-40.el9_1.1.aarch64 and glibc-common-2.34-28.el9_0.2.aarch64cannot install the best update candidate for package glibc-common-2.34-40.el9.aarch64cannot install the best update candidate for package gcc-11.3.1-2.1.el9.aarch64 Problem 5: problem with installed package glibc-devel-2.34-40.el9.aarch64package glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedcannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-40.el9.aarch64package glibc-langpack-en-2.34-40.el9_1.1.aarch64 requires glibc = 2.34-40.el9_1.1, but none of the providers can be installedcannot install the best update candidate for package glibc-langpack-en-2.34-40.el9.aarch64 Problem 6: package annobin-10.73-3.el9.aarch64 requires (gcc >= 11 with gcc < 12), but none of the providers can be installedpackage gcc-11.3.1-2.1.el9.aarch64 requires glibc-devel >= 2.2.90-12, but none of the providers can be installedpackage glibc-devel-2.34-40.el9.aarch64 requires glibc = 2.34-40.el9, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.aarch64 requires glibc = 2.34-28.el9_0, but none of the providers can be installedpackage glibc-devel-2.34-28.el9_0.2.aarch64 requires glibc = 2.34-28.el9_0.2, but none of the providers can be installedcannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-40.el9.aarch64cannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-28.el9_0.aarch64cannot install both glibc-2.34-40.el9_1.1.aarch64 and glibc-2.34-28.el9_0.2.aarch64package gcc-11.2.1-9.4.el9.aarch64 requires cpp = 11.2.1-9.4.el9, but none of the providers can be installedpackage glibc-minimal-langpack-2.34-40.el9_1.1.aarch64 requires glibc = 2.34-40.el9_1.1, but none of the providers can be installedcannot install both cpp-11.2.1-9.4.el9.aarch64 and cpp-11.3.1-2.1.el9.aarch64cannot install the best update candidate for package glibc-minimal-langpack-2.34-40.el9.aarch64cannot install the best update candidate for package cpp-11.3.1-2.1.el9.aarch64cannot install the best update candidate for package annobin-10.73-3.el9.aarch64 (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest'FollowComment"

Answer: "0Contacted RHEL Customer Service, they created Support Ticket over the weekend.  Called RHEL 1/31/2023, explained situation, why we don't have a support contract with RHEL, we're AWS customer, but RHEL maintains repos, and they're broken.  Escalated to emergency, was notified it'd be looked at first thing 2/1, and by 2/1, AARCH64 repos are working again in AWS.  Yay!Posts on re:Post, & emails to AWS rep trying to get them to escalate to support, since we don't have premium support, went nowhere.   Pay for premium RHEL reserved instances EC2s on AWS, better have a backup premium account at RHEL, otherwise, you might be dead for awhile.   Zero way to contact anyone about critical infrastructure issues that are easily identifiable.  Maybe AWS should setup a cloudwatch alarm for something like that?  Hint hint....CommentSharerePost-User-2918011answered 4 months ago"


Question: how to get a server

"Hi I have very strange question but I dont know how to resolve it, I need to get this :  t4g.large with 2 vCPUs, 8 GiB Memory and 200 GB SSD storage and I really dont know how :) any one who knows ?FollowComment"

Answer: "1You'll probably want to start at the Launch Instance wizard in the EC2 console.From there, select an Amazon Machine Image and select Arm in the architecture dropdown (required for the t4g family). You can then select the t4g.large instance type in the dropdown below. Below that is a section to configure the amount and type of storage you want.Additional guidance can be found here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-instance-wizard.htmlCommentShareEdanswered 7 months agoEXPERTChris_Greviewed 7 months ago"


Question: Migrating Application from EC2 to Containers on AWS

"Hi,I am looking for a prescriptive guide or a methodology white paper that discusses the steps in migrating existing EC2 application workload to ECS/EKS.FollowComment"

Answer: "3Accepted AnswerI'd recommend looking into our EC2 Image Builder. You can take an existing golden EC2 image and create an image pipeline for Docker, including an output to our Elastic Container Registry. ECR not only does security and vulnerability checks on your images, but also integrates nicely with Amazon ECS. Once the Docker image has been created from EC2 Image Builder and is stored in ECR, you'd create an ECS cluster (either using EC2 or Fargate), configure your tasks and scaling policies, as well as a load balancer, target group, etc. in front of ECS, and that's the vast majority of the work. We have some good tutorials for common tasks with ECS you can reference.If you want a detailed walk through of moving an EC2 application over to ECS, we also have an Introduction to ECS Workshop. This workshop includes a section dedicated to migrating an application from EC2 over to ECS. I personally would start with the EC2 Image Builder approach as the Workshop uses a lot of third-party CLI tools which can be difficult to follow, whereas the documentation for EC2 Image Builder seems much more straightforward.CommentShareChris_Wanswered a year ago1There are numerous resources available, i.e. AWS modern-app portal with multiple use-cases and guides,  this white paper which leans toward EKS/k8s, etc. Overall it is a very broad question, options would depend on the current platform (windows/linux), framework/language used (i.e. we have app2container migration tool for .Net and Java apps), application architecture (monolith or not, stateful or stateless, horisontally scalable or not, etc).CommentShareRuslan_Kanswered 2 years ago"


Question: "Textract analyze.Expense throwing an error, "not a function""

"Hello People,Really will appreciate any help right now. Attempting to use the recently announced Textract invoices and receipts API.Using the AWS SDK in Lambda running on Node 12. Textract executed fine, when I was using AnalyzeDocument, with the announcement I  converted my script to use analyzeExpense.executing the code below:textract.analyzeExpense(invoiceParams, function(err, data) {if (err) console.log(err, err.stack);else     console.log(data);});Getting the error:"errorType": "TypeError","errorMessage": "textract.analyzeExpense is not a function","code": "TypeError","message": "textract.analyzeExpense is not a function"Not sure what the challenge is, could it be that this function doesn't exist in the SDK yet?FollowComment"

Answer: "0Most likely your local AWS SDK is old/not updated. Another possibility - since this function has been relatively recently added, if you are relying on AWS SDK Lambda image (that is, you don't ship your own AWS SDK as shared layer) then you could see the same problem.Try adding your own AWS SDK (make sure the Expense function is in your SDK) as shared layer to your Lambda, redeploy and try again.Regards,AlbertCommentShareAlbertKanswered 2 years ago0Hi,Thanks for using our service! As we launch AnalyzeExpense recently, you probably need to get the latest SDK before calling AnalyzeExpense API. You can download the SDK from https://github.com/aws and make sure you are available to see AnalyzeExpense API locally. If the issue is still there after installing the latest SDK, please don't hesitate to let us know.Thanks,ShayneCommentShareaws-shemengqanswered 2 years ago0Did anyone manage to fix this issue? We're getting the same error in production (works fine locally) with the correct SDK version and settings. I'm not sure if it's because we've deployed it on a Lambda or if there's some other issue.CommentSharedavid-tiganswered 2 years ago0I ended up fixing this error by using the v3 SDK instead of v2.965.0.Really quite strange since Textract is supposed to be supported in v2.965.0 - I even took a peek at the code myself to confirm. If anyone else is having similar issues but still relies on some v2 functionality like we do (because v3 S3 is broken for us, go figure) - you can just install @aws-sdk/client-textract and use that separately.Hope this helps someone in the future!CommentSharedavid-tiganswered 2 years ago"


Question: Scaling an AWS Amplify Application for better experience  for users in all regions

"Application : AndroidBackend : AWS AmplifyIssue : AWS Amplify Scaling and GraphQL PaginationIn Splash Screen, i am  getting the userID using Amplify.Auth?.currentUser?.userId and using that userID, I am fetching User information saved in User table using amplify-framework GraphQLRequest(ModelQuery.list)So,  the issue is for the users around the selected AWS region for the amplify, the Splash page loading is fine. However, for the users who are far, the experience on Splash and others sections of the App is not good while loading the data (which i think is currently it due to the pagination thing in the GraphQL API)So my questions are :What can i do better to reduce the API calls using GraphQL API in context of AWS amplifyHow can i deploy the AWS amplify application/backend in multiple AWS regions.FollowComment"


Question: Issue with Kendra query API

"We are trying to execute kendra query API, but its return error like this,"Output": {    "__type": "com.amazon.coral.service#UnknownOperationException"},"Version": "1.0"Please help us to solve this.POST: https://kendra.us-east-1.amazonaws.comRequest Body :{"IndexId": "xxxx-xxxx-xxxx-xxxx","QueryText": "string","QueryResultTypeFilter": "QUESTION_ANSWER"}FollowComment"

Answer: "0Hi there, if you have still not resolved this issue you may want to ask in the Machine Learning & AI topic.CommentShareSierra Washingtonanswered 9 months ago"


Question: Adding or passing custom value to Helm chart addon on EKS cluster Via Cloud Formation

"Team I Building  a cloudformation stack in which we are creating AWS-EKS cluster and post creation of EKS cluster by using "Custom::Helm" resource type we are deploying Fluentbit in the cluster.AWSTemplateFormatVersion: "2010-09-09"Parameters:  pEKSClusterName:    Description: Name of the EKS Cluster    Type: String    Default: EKSCluster  VPCID:    Description: VPC ID    Type: AWS::EC2::VPC::Id    AllowedPattern: ".+"   Resources:   fluentbitagent:    Type: "AWSQS::Kubernetes::Helm"    Properties:      TimeOut: 10      ClusterID: !Ref pEKSClusterName      Name: fluent-bit      Namespace: aws-cloudwatch      Repository: https://aws.github.io/eks-charts      Chart: eks/aws-for-fluent-bit      Values:        image.repository: !FindInMap [RegionMap, !Ref "AWS::Region", cwrepo]      ValueYaml:        !Sub        - |          clusterName: ${ClusterName}          serviceAccount:            create: false            name: aws-logs          region: ${AWS::Region}          vpcId: ${VPCID}        - ClusterName: !Ref pEKSClusterName          VPCID: !Ref VPCID          Mappings:  RegionMap:    us-east-1:      cwrepo: public.ecr.aws/aws-observability/aws-for-fluent-bitI wanted to pass custom value to helm values for Fluentbit, for example i wanted to pass FluentBitHttpPort='2020', TIA:-)FollowComment"

Answer: "0You can pass custom values to the Helm chart by adding them to the "Values" property in the "fluentbitagent" resource. For example, you can add the following line under the "Values" property:Values:...FluentBitHttpPort: 2020This will pass the value "2020" for the "FluentBitHttpPort" parameter in the Helm chart. Make sure the parameter is defined in the chart's values.yaml file, otherwise it will not take effect.CommentShareDivyam Chauhananswered 4 months ago0Try this      ValueYaml: !Sub |        service:          extraService: |            HTTP_PORT    2020CommentShareOleksii Bebychanswered 4 months ago"


Question: Limit which IAM roles can be attached to an EC2 instance by different IAM users

"Hi!Im trying to figure out if this is possible. I have 2 IAM users. I would like each one to be able to start/stop the same EC2 instance but have each IAM user be able to attach a different IAM role to this one EC2 instance. In other words, user1 should only be able to attach role1 to this ec2 instance, while user2 should only be able to attach role2 to this same EC2 instance. They would be using the ec2 instance at different times.I'm using the aws ec2 associate-iam-instance-profile command to attach the IAM profile to the EC2 instance before starting it up and then detaching the profile once I shut it down. I would like for each IAM user to be able to attach only a specific IAM role to this one EC2 instance.Is this possible? Any ideas or examples? Thank you!FollowCommentRodney Lester a year agoI'd also like to point out that IAM Users have two drawbacks: 1) They don't scale as you grow larger than the maximum number of users and 2) You will require multiple authentication methods between your company and your AWS account, which can contribute to potential loss of credentials as well as lack of revocation when an employee leaves (higher management). We recommend you use a central identity provider, for example, AWS SSO if you don't have another.Share"

Answer: "2Hi,You can use tags attached to each of IAM role and then assign permission of accessing IAM roles based on those tags. Follow this link to know more about the same.However, you also need to build a mechanism by which you can disassociate one IAM role when other user shutdown the machine or logs off. Since if user1 leave machine with their role attached to the machine it will be available in the same state to user2.CommentShareirshadanswered a year ago1You can also do this specifying the instance id as the resource and using conditions keys for the InstanceProfile ARN in your policy for each user (different ARN's in each policy).  See the documentation here:https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.htmlSome good examples are here (including using tag keys/values as was previously suggested)https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-iam-rolesHope this helps.CommentShareJeff_Sanswered a year ago0Here is the solution that worked for me.I have two IAM users: deploy-staging and deploy-production.I have a single EC2 instance that can deploy to a staging environment or a production environment depending on the IAM role it has assumed.The deploy-staging IAM user has the following IAM policy attached. This policy will allow this user to start/stop the EC2 instance that is used to deploy code to staging and attach/detach the correct IAM role (deploy-role-staging) to that EC2 instance so it can have the correct permissions to deploy to staging. That is the ONLY IAM role that this user will be able to attach to this EC2 instance.    {      "Version": "2012-10-17",      "Statement": [          {              "Sid": "VisualEditor0",              "Effect": "Allow",              "Action": [                  "ec2:StartInstances",                  "ec2:DisassociateIamInstanceProfile",                  "ec2:ModifySecurityGroupRules",                  "ec2:StopInstances",                  "ec2:AssociateIamInstanceProfile",                  "ec2:ReplaceIamInstanceProfileAssociation"              ],              "Resource": [                  "arn:aws:ec2:*:account-id:security-group/sg-xxxxxxxxxxxxxx",                  "arn:aws:ec2:us-east-1:account-id:instance/i-xxxxxxxxxxxxxx",                  "arn:aws:ec2:*:account-id:security-group-rule/sgr-xxxxxxxxxxxxxx"              ]          },          {              "Sid": "VisualEditor1",              "Effect": "Allow",              "Action": [                  "ec2:DescribeInstances",                  "ec2:DescribeIamInstanceProfileAssociations"              ],              "Resource": "*"          },          {              "Sid": "VisualEditor2",              "Effect": "Allow",              "Action": "iam:PassRole",              "Resource": "arn:aws:iam::account-id:role/deploy-role-staging"          }      ]    }The deploy-production IAM user has the following IAM policy attached. This policy will allow this user to start/stop the EC2 instance that is used to deploy code to production and attach/detach the correct IAM role (deploy-role-production) to that EC2 instance so it can have the correct permissions to deploy to production. That is the ONLY IAM role that this user will be able to attach to this EC2 instance.    {      "Version": "2012-10-17",      "Statement": [          {              "Sid": "VisualEditor0",              "Effect": "Allow",              "Action": [                  "ec2:StartInstances",                  "ec2:DisassociateIamInstanceProfile",                  "ec2:ModifySecurityGroupRules",                  "ec2:StopInstances",                  "ec2:AssociateIamInstanceProfile",                  "ec2:ReplaceIamInstanceProfileAssociation"              ],              "Resource": [                  "arn:aws:ec2:*:account-id:security-group/sg-xxxxxxxxxxxxxx",                  "arn:aws:ec2:us-east-1:account-id:instance/i-xxxxxxxxxxxxxx",                  "arn:aws:ec2:*:account-id:security-group-rule/sgr-xxxxxxxxxxxxxx"              ]          },          {              "Sid": "VisualEditor1",              "Effect": "Allow",              "Action": [                  "ec2:DescribeInstances",                  "ec2:DescribeIamInstanceProfileAssociations"              ],              "Resource": "*"          },          {              "Sid": "VisualEditor2",              "Effect": "Allow",              "Action": "iam:PassRole",              "Resource": "arn:aws:iam::account-id:role/deploy-role-production"          }      ]    }The deploy-role-staging IAM role has policies attached to it that allow it to update the S3 buckets for staging and the Cloudfront distribution for staging.    {      "Version": "2012-10-17",      "Statement": [          {              "Sid": "VisualEditor0",              "Effect": "Allow",              "Action": [                  "cloudfront:GetInvalidation",                  "cloudfront:CreateInvalidation"              ],              "Resource": [                  "arn:aws:cloudfront::account-id:distribution/XXXXXXXXXXXXX"              ]          }      ]    }    {      "Version": "2012-10-17",      "Statement": [          {              "Sid": "VisualEditor0",              "Effect": "Allow",              "Action": [                  "s3:PutObject",                  "s3:ListBucket",                  "s3:DeleteObject",                  "s3:PutObjectAcl"              ],              "Resource": [                  "arn:aws:s3:::stagingXXX.example.com",                  "arn:aws:s3:::stagingXXX.example.com/*"              ]          }      ]    }The deploy-role-production IAM role has policies attached to it that allow it to update the S3 buckets for production and the Cloudfront distribution for production.    They're the same as for staging, except the ID of Cloudfront distribution and the S3 bucket names are different.In Summary: Each user will only be able to have the EC2 instance assume a particular role, thus giving that EC2 instance access to different resources.Do not forget to write the code to actually start/stop the EC2 instance, attach/detach the IAM role using these CLI command samples (via /bin/bash):    # Get the current IAM role association for the EC2 instance.    EC2_IAM_ROLE_ASSOCIATION_ID=`aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=XXXXXXXXXXXX --query 'IamInstanceProfileAssociations[*].AssociationId' --output text --profile XXXX`    # Only disassociate an IAM role if one is attached to the EC2 instance.    if [ "$EC2_IAM_ROLE_ASSOCIATION_ID" ]; then      # Disassociate any IAM role from the EC2 instance.      aws ec2 disassociate-iam-instance-profile --association-id $EC2_IAM_ROLE_ASSOCIATION_ID --profile XXXX    fi    # Attach the correct IAM Role to the EC2 instance.    EC2_IAM_ROLE_ASSOCIATION_ID=`aws ec2 associate-iam-instance-profile --instance-id XXXXXXXXXXXX --iam-instance-profile Name="$IAM_ROLE" --query 'IamInstanceProfileAssociation.AssociationId' --output text --profile XXXX`    # Disassociate any IAM Role from the EC2 instance.    aws ec2 disassociate-iam-instance-profile --association-id $EC2_IAM_ROLE_ASSOCIATION_ID --query 'IamInstanceProfileAssociation.State' --output text --profile XXXXCommentShareAWS-User-7869536answered a year ago"


Question: AWS ICA Change - Will our Leaf Certificates be automatically renewed and will the public key change?

"Hello,Upon reviewing the advisory (link below) around AWS' changing of the intermediate CA's in ACM, we use certificate pinning of the Leaf Certificates in various applications.To understand how we can manage this, could anyone help us understand:Will all Leaf Certificates be automatically renewed on 7th/11th October 2022, or, will this change only come into effect at the expected renewal of each certificates?If renewed before the expected date, will this change the public key(s) of the leaf certificates?Link: https://aws.amazon.com/blogs/security/amazon-introduces-dynamic-intermediate-certificate-authorities/Many thanks in advance,BenFollowComment"

Answer: "1Accepted AnswerHi Ben,Thanks for your question. Based on public information from the ACM team, the change will come into effect at the expected renewal time of your individual leaf certificates. Additionally, any manual renewals before certificate expiration and after October 11, 2022, at 9:00 AM Pacific Time will utilize the new signing behavior described in this blog post.Also, per the guidance in the blog post announcing this functionality change, please keep in mind that, If you use intermediate CA information through certificate pinning, you will need to make changes and pin to an Amazon Trust Services root CA instead of an intermediate CA or leaf certificate.CommentShareawsendoanswered 8 months agoKaye 3 months agoThere is a new server certificate we integrate with that has a different expiry date than what is in this blog.Recommendation: Starfield Services Root Certificate Authority - G2 (December 31, 2037)New Certificate: Starfield Services Root Certificate Authority - G2 (June 28, 2034)This caused our integration with an AWS endpoint to fail. What is the advise on this scenario? What is the reason for the new certificate root to change expiry?Share0Hello,In our applications, leaf certificate got expired in Oct 2022 but there was no impact as the application has not dependency on it. We are using Root + ICA 2 in application.Certificate chaining in Oct 2022(Root )--- Starfield Services Root Certificate Authority - G2  ||(ICA 2)-- Amazon Root  CA 1    ||(ICA 1)--  Amazon    ||(Leaf )- ClientBut ACM does the renewal in Feb 2023 and application stopped working. and We found the ICA 1 was different.Certificate chaining in Feb 2023Root --- Starfield Services Root Certificate Authority - G2    ||ICA 2-- Amazon Root  CA 1       ||ICA 1--  Amazon  RSA 2048 M02    ||Leaf - ClientPlease help in knowing if the expired cert pinning was the reason or Pinning of ICA2 was the reason. We had no where pinned ICA1 which actually got change in Feb 2023CommentSharerePost-User-1824674answered 3 months ago"


Question: "Websocket response error, but successfull Post to connections"

"Hey all,I'm having an issue with websockets. After I send my sendmessage action, which in turn just retrives the list of connections from dynamodb and uses the api gateway management api to post the message to said connections, the original sender of the message receiveds this error: {"message": "Internal server error", "connectionId":"fP6kAdMGvHcCE0g=", "requestId":"fP60AHLfvHcFfSA="}I initially had the same return type as my REST endpoints (APIGatewayProxyResponse and error), then I change it to just be a string, then I changed it to not return anything at all. All three of these attempts didn't work.Any ideas? I can't find a response structure for api gateway websockets anywhere on the interwebz.Edited by: AustinK on Aug 30, 2019 12:13 PMFollowComment"

Answer: "0It sounds your Lambda function for sendmessage doesn't complete correctly after invoking postToConnection. By default, API Gateway invokes Lambda synchronously, and will wait until your Lambda sends a response. Eventually it will be timed out(either on Lambda's task timeout or API Gateway's integration time out), then API Gateway will let the original sender know the message wasn't completed correctly. You could confirm it by checking API Gateway's execution log and Lambda's log.If you're using Lambda non-proxy integration, you can invoke it asynchronously.https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-integration-async.htmlIf you're using Lambda proxy integration, invoke a second lambda asynchronously from the first synchronous lambda then return a response immediately.CommentShareAWS-User-3921561answered 4 years ago0So I'm using the golang example that they aws created.https://aws.amazon.com/blogs/compute/announcing-websocket-apis-in-amazon-api-gateway/The intergration type is AWS_PROXY, invoking a lambda function directly. So I'm assuming I'm using proxy integration? The example doesn't have anything invoking a second method to return a response.I'm not sure where to go from here. I think I need a bit more hand holding.NOTE: There were no error logs in cloudwatch.Edited by: AustinK on Aug 30, 2019 1:37 PMCommentShareAustinKanswered 4 years ago0So the issue was an error with how I was handling channels for my goroutine. Just wanted to say that so the thread isn't left unanswered.CommentShareAustinKanswered 4 years ago"


Question: "WAF Managed Group Rules (notifications, etc)"

Is there any release cadence for changes to an aws managed rule?Is there any notification that an ACL is being changed/updated?How can you get information on what particular part of a request is specifically triggering the count/block?Can we add a custom 403 page on our WAF?FollowComment

Answer: "1Accepted AnswerThere is no release cadence for changes to AWS (Marketplace) Managed rules, they are automatically updated by AWS (or the marketplace seller) when new vulnerabilities and threats emerge.No notification is sent when an AWS (or marketplace) managed rule is updated. Every time an AWS (or marketplace) managed web ACL is updated, you have a CloudTrail UpdateWebACL API call in your account, you can setup an event to trigger off of CloudTrail when the UpdateWebACL API is called. The easiest way to do this would be to subscribe to an SNS topic and then Create a CloudWatch Event rule to trigger this. Keep in mind that the RuleGroup within the WebACL is owned and managed by the vendor, you will not be able to see/know what changes were made. "Each AWS Marketplace rule group provides a comprehensive description of the types of attacks and vulnerabilities that it's designed to protect against. To protect the intellectual property of the rule group providers, you can't view the individual rules within a rule group. This restriction also helps to keep malicious users from designing threats that specifically circumvent published rules." - https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups.htmlYou can have more information from WAF logs (https://docs.aws.amazon.com/waf/latest/developerguide/logging.html)Currently AWS does not provide a way to add a custom error page to WAF. If they're using WAF with CloudFront, they can use Lambda@Edge to differentiate 403s generated by WAF to those generated by the origin of the distribution, I wrote a blog post on this a few months ago: https://aws.amazon.com/blogs/networking-and-content-delivery/generating-dynamic-error-responses-in-amazon-cloudfront-with-lambdaedge/CommentShareJibril-AWSanswered 3 years ago"


Question: Problem inserting in Aurora Serverless (via Data API) with foreign key

I'm using Aurora Serverless with Data API (AWS.RDSDataService class for node.js).When I'm trying to insert two related (one-to-many) records in a single transaction I'm getting "Cannot add or update a child row: a foreign key constraint fails".I'm sure I'm doing it in a single transaction and parent record is inserted first. But it looks like it's not there when I insert child record.FollowComment

Answer: 0Sorry it was my mistake. Marking as answered :)CommentSharepwalczys1answered 4 years ago


Question: AccessDeniedException when retrieving AWS Parameters from Lambda

"I am attempting to access system parameters from a Lambda developed using C#I have added the required lambda layer as per https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html#ps-integration-lambda-extensions-sample-commandsThe lambda execution role has the following in the IAM definition (???????? replacing actual account id){    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "ssm:*"            ],            "Resource": "arn:aws:ssm:*:???????????:parameter/*"        }    ]}As per the AWS page reference above I made a HTTP GET request to http://localhost:2773/systemsmanager/parameters/get/?name=/ClinMod/SyncfusionKey&version=1This is failing with the following response{    "Version": "1.1",    "Content": {        "Headers": [            {                "Key": "Content-Type",                "Value": [                    "text/plain"                ]            },            {                "Key": "Content-Length",                "Value": [                    "31"                ]            }        ]    },    "StatusCode": 401,    "ReasonPhrase": "Unauthorized",    "Headers": [        {            "Key": "X-Amzn-Errortype",            "Value": [                "AccessDeniedException"            ]        },        {            "Key": "Date",            "Value": [                "Thu, 01 Dec 2022 12:16:59 GMT"            ]        }    ],    "TrailingHeaders": [],    "RequestMessage": {        "Version": "1.1",        "VersionPolicy": 0,        "Content": null,        "Method": {            "Method": "GET"        },        "RequestUri": "http://localhost:2773/systemsmanager/parameters/get/?name=/ClinMod/SyncfusionKey&version=1",        "Headers": [],        "Properties": {},        "Options": {}    },    "IsSuccessStatusCode": false}Any clues where I am going wrong?FollowComment"

Answer: "0Accepted AnswerHi Richard,Are you adding the X-Aws-Parameters-Secrets-Token header with the AWS_SESSION_TOKEN to you request?CommentShareBryan Hogan AWSanswered 6 months agoRichard Kavanagh 6 months agoThanks Bryan that seems to have moved me one step closer. I was not using the header so have now added it.It still fails but not it spits out an error to give me some cluesThe error I get is :[AWS Parameters and Secrets Lambda Extension] 2022/12/02 18:10:11 ERROR GetParameter request encountered an error: operation error SSM: GetParameter, https response error StatusCode: 400, RequestID: ed0638c4-6118-4bfa-ae43-5c1530fce5fb, api error AccessDeniedException: User: arn:aws:sts::??????????:assumed-role/FCKM-lambda-standard/ClinMod_S3_StepFunctionLaunch is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:eu-west-2:??????????:* because no identity-based policy allows the ssm:GetParameter actionThis is puzzling as the execution role does have that permission - well at least 'FCKM-lambda-standard' does.The role 'FCKM-lambda-standard/ClinMod_S3_StepFunctionLaunch' does not actually exist I assume it inherits from 'FCKM-lambda-standard'ShareRichard Kavanagh 6 months agoLooking at the code again I had a typo in the parameter name - once fixed it works fine.Thanks for your helpShare0Not sure if it's the final solution but from what I'm reading I see SSM parameter path, as any other value in query string, should be URL encoded, so changing / to %2F you'll get:http://localhost:2773/systemsmanager/parameters/get/?name=%2FClinMod%2FSyncfusionKey&version=1PLS: give it a try!CommentSharemassimoselvianswered 6 months agoRichard Kavanagh 6 months agoThe URL was already getting encoded - thanks for responding though.Share"


Question: Black Screen when entering my account

"I have an account for LightSail virtual machine. I did not enter this machine for about 3 weeks, but when I tried to enter it using my account, it gave a blank screen.https://lightsail.aws.amazon.com/ls/webapp/home/instances?#Please advise!FollowComment"

Answer: "0I just want to clarify. Are you having the black screen when you access Lightsail console or you're having black screen when you try to ssh/rdp to the instance using Lightsail console?CommentShareAWS-User-2776000answered 3 months agorePost-User-6342612 3 months agoThe problem is partially solved:I used to log to the virtual machine through the following link in firefox:https://lightsail.aws.amazon.com/ls/webapp/home/instancesThen I will add the username and password and then I will get to the VM. But last time it gave me a blank screen.I used Chrome and it gave me the same Blank Screen.Then I went to https://aws.amazon.com/lightsail/ in firefox and logged to my account then clicked on Lightsail. This gave me also a Blank Screen.Then I went to the same link (https://aws.amazon.com/lightsail/) in chrome and logged in, and then clicked at lighsail and I was able to enter my virtual machine.So, it seems there are two problems, one in the first link and the other in firefox.But at least I was able finally to enter to the VM by the second link in chrome.Share0Hi,I am sorry that you are running into this issue. I'm curious if you have tried running in incognito mode in Firefox. Sometimes, if you have some extensions running, it could prevent javascript from running on the page, which would result in Lightsail being unable to load correctly.CommentShareAWS-Leslieanswered 3 months ago"


Question: I can not invoke a Lambda function from AWS Lex

"Hello,I would like to invoke a lambda function from AWS Lex v2, after the intent has been fulfilled. The needed resources (bot, lambda, rol, etc) must be defined using Cloudformation. This is apparently an easy task, just by defining a code hook on the Cloudformation template. But AFAIK it does not work, and the lambda is never invoked. I validate the lambda invocation using Cloudwatch logs.If you would like to reproduce the environment, here you can find the Cloudformation template: https://pastebin.com/i9mzZMZE  Just deploy the template (lambda code is embedded).What am I missing?Thanks in advance.Roberto.FollowComment"

Answer: "0Hi Roberto,Lex v2 requires a specific response format from the lambda function.https://docs.aws.amazon.com/lexv2/latest/dg/lambda.html#lambda-response-formatAdd a response in the lambda code to indicate success, such as:  intent = event['sessionState']['intent']['name']  # if success and completed, send fulfilled response  return {                "sessionState": {                    "dialogAction": {                        "type": "Close"                    },                    "intent": {                        "name": intent,                        "state": 'Fulfilled'                    }                },                'sessionId': event['sessionId']            } CommentShareAWS-TimGanswered 7 months agoRoberto 7 months agoHi TimG,Thanks a lot for the answer, but it is not exactly my case.In my case, I do not having problems with the format of the response - this will probably come later - but I don't get an answer at all, that is, the lambda is not invoked after the intent has been fulfilled.To reproduce the issue, please deploy the CloudFormation template included in the above ticket and fulfill an intent. You should see no lambda execution on CloudWatch.Thanks!ShareAWS-TimG 7 months agoThe CloudFormation worked fine and the lambda does run for me, although Lex will return a failure since its not in the format.  Can you run the lambda function manually without any issue?ShareRoberto 7 months agoHi AWS-TimG,The CloudFormation is working fine - it has always been working fine, no problem there.The lambda can be executed by hand. It will log an issue on CloudWatch.The real problem is that, when deployed using CloudFormation, Lex V2 is not executing the lambda function (that is, you can not see log messages on CloudWatch) and it's always returning a message of 'FailureResponse' - you assume that the failure is coming from the wrong return data from lambda, but the reality is that the FailureResponse is returned from Lex V2 without any lambda invocation.Could you please confirm this by executing an intent, and then validating the lambda's log messages on CloudWatch?? Thanks for the help!ShareAWS-TimG 7 months agoYes, when I execute an intent from the deployed CloudFormation Lex, lambda does run and logs the event in CW logs (also can be seen in CloudWatch invocations), even though I get a failure result in Lex.  I wasn't able to re-produce the issue that you are seeing with the provided template.Does CW metrics show invocations/errors for the function (even though CW logs not showing anything)?ShareRoberto 6 months agoHi TimG,Just to be aligned with your tests, I've reinstalled the Cloudformation Stack from the beginning. I confirm I cannot see the execution logs in CloudWatch nor the invocations errors on the lambda function. All the invocations show the "Esto es FailureResponse" message, indicating it's a failure, but no trace at all on CW logs. Any idea where to go from here?Share"


Question: Redshift unload problem with Parquet and negative numbers

"Looks like there's a problem unloading negative numbers from Redshift to Parquet.For example, my table has a column that's numeric(19,6), and a row with a value of -2237.430000.  When I unload to a Parquet file and read it back with a Python program, the value is 18446744071472.121616 (which is the 2's complement).Can anyone confirm?  Should be easy enough to reproduce.Let me know if there's a fix.Thanks.-LPFollowComment"

Answer: "0Accepted AnswerJust for curiosities sake what's the unloaded number when read back in from Redshift Spectrum or in Athena?CommentShareklarsonanswered 3 years ago0I just read the Parquet file back into Redshift, and the value was inserted correctly into the new table as a negative number.COPY my_tableFROM 's3://my_bucket/my_parquet_file'IAM_ROLE 'arn:aws:iam::...'FORMAT AS PARQUET;So looks like Redshift is doing it correctly, and the problem I'm encountering points to PyArrow.Thanks.Edited by: lp2020 on Jan 7, 2020 8:53 AMCommentSharelp2020answered 3 years ago0Marking as not answered -- see previous reply.Edited by: lp2020 on Jan 7, 2020 11:36 AMCommentSharelp2020answered 3 years ago0Actually, I'm seeing the incorrect value when I read the Parquet file in multiple readers.  For example, this web site shows me the two's complement number when I upload the Parquet file.http://parquet-viewer-online.com/Therefore, it seems like Redshift is not off the hook.  Perhaps Redshift can read the Parquet file back and correctly convert to a negative number, but it looks like others are not reading it back as a negative number.  This includes:Azure Data Factory (the original place that I encountered this problem)PyArrow (read_table() and to_pandas() functions)Pandas (pd.read_parquet() function)parquet-viewer-online.com web site (however they're doing it)Can someone else please confirm / try to reproduce this problem?Thanks.-LPEdited by: lp2020 on Jan 7, 2020 11:37 AMEdited by: lp2020 on Jan 7, 2020 11:37 AMCommentSharelp2020answered 3 years ago0It certainly seems like Redshift coercion of the number from Parquet back to Redshift is behaving differently than the other Parquet readers you cite.  That alone feels like there's basis for a Redshift support case on the reading side regardless if there's a separate problem on the writing side.CommentShareklarsonanswered 3 years ago0Is the Redshift support case something I need to submit?  Or will someone from the Redshift team pick it up from this thread?CommentSharelp2020answered 3 years ago0Hi lp2020,If you have AWS Enterprise support I'd recommend that you submit a support case via the Support Center link in the upper left "Support" drop down on any AWS Console page.Regards,-KurtCommentShareklarsonanswered 3 years ago0Hi,We have fixed this Unload issue in the next version of Amazon Redshift Patch Release. This patch will automatically be deployed to your Cluster if the track is set to CURRENT. If this is an urgent issue, please file a support case for us to generate a private patch and deploy to your cluster.RegardsAWS Redshift TeamCommentSharesrikay-AWSanswered 3 years ago0Thank you very much!!CommentSharelp2020answered 3 years ago0Hi lp2020,Were you able to see where the problem was in the Parquet data type or the Parquet metadata in the unloaded files?If so could you please share what the issue was?  So other customers, myself included, can see if any of the data we have unloaded to Parquet also sufferers from this problem.If not it would be next best if you could retain an unloaded Parquet file from unloaded data that has this problem and then compare it to another unload of the same data after the fix.  Then it should be possible to identify the fingerprint of the defect with a diff of the metadata in a bad and a good Parquet file.Thanks,-KurtCommentShareklarsonanswered 3 years ago0Hi lp2020,I'm looking for a quicker more direct way to determine if other Redshift customers like me already have artifacts of this problem in data we have also unloaded to Parquet.   You said you saw the problem reading the unloaded data with the following tools:Azure Data FactoryPyArrowPandasparquet-viewer-online.com web siteDid you or can you also see the problem with some of these other tools that can more quickly be used to check existing unloaded data that part of external partitioned tables that are in the Glue Data Catalog?Redshift Spectrum (using the Glue Data Catalog)Athena (uses the Glue Data Catalog by definition)EMR Presto (using the Glue Data Catalog)EMR Spark SQL (using the Glue Data Catalog)Basically I'm looking for quick low cost way to identify the problem in unloaded data already sitting in S3.  So, we can either rule out the problem or turn our focus to remediating problem Redshift has created for us with this bug.Thanks,-KurtCommentShareklarsonanswered 3 years ago0@klarson if that can help we also noticed that issue and that what we could find out :It seems to be impacting only NUMERIC datatypes, casting those to double precision while unloading would produce "correct" negative values.The issue can be seen using Athena as well as S3 Select.I haven't checked since the last update if this is fixed or not but it could be easily done with the mentioned services.CommentSharekevinv-dhanswered 3 years ago0Hi kevinv-dh,Thanks so much for replying to my ask so quickly.  We can immediately use Athena to check an awful lot of data we have already unloaded to Parquet to see if it has the symptom.  I strongly suspect that we will see the symptom.Do you know of any other solutions to remediate the bad data in Parquet other than loading it back into Redshift and then reunloading it with the cast to double precision?  I suspect the clock may be ticking on using Redshift to do that because once we're patched with the fix I don't think we should expect that to work because as reported by lp2020 Redshift currently can COPY the Parquet data back in to undo what UNLOAD did.  So, it looks like there was a symetric bug in both UNLOAD and COPY.Thanks,-KurtCommentShareklarsonanswered 3 years ago0Small update, so far the issue remains for us (Frankfurt).I haven't found a way to correct that data outside of Redshift,  best is probably to get in touch with the support about it to see whether it is an actual bug or some compatibility issue. In any case, I think if you need to recover data at some point and Redshift is the only option, probably the support would be able to downgrade a cluster to a version with the potentially bugged COPY so you can recover.CommentSharekevinv-dhanswered 3 years ago0Hi kevinv-dh,You're probably correct about being able to get Redshift to downgrade a cluster to a version that has the bug.  That is as long as the patch with the fix doesn't span an OS patch as well.  The last release cycle that we just got in us-east-1 this week (on the trailing track) included an OS patch too.  You can see this coming ahead of time in what the Redshift events are telling you when you clusters will get patched,  2026 events that contain the words "system maintenance" mean an OS patch, and 2025 events that contain the words "database maintenence" mean Redshift software version upgrade.However, we're trying to get this fixed sooner than we'll the bug fix which in this thread seems like it may be in the next release cycle's current track release.  So, we'll have to wait 2 release cycles, i.e. ~6 weeks, because we're on the trailing track.We'll try reloading the data with COPY and then re-export it with UNLOAD using the cast to double precision that you mentioned.  We'll verify it as a workaround and I'll post back the results.Thanks for your help,-KurtCommentShareklarsonanswered 3 years ago"


Question: botocore ReadTimeoutError while calling QBSolv on D-Wave's Quantum Annealer

"Hello,I submitted a QUBO to the Quantum Annealer from D-Wave via Amazon Braket. I used the QBSolv solver and my local Python IDE. Unfortunately, I received the "botocore ReadTimeoutError". Is there a way to increase the boto reading time within my local Python script to avoid this error?Thank you.FollowComment"

Answer: "0Can you share the script you are using to check if we can reproduce the error on our end?Thank You!CommentShareVirajanswered a year agoAWS-User-5461241 a year agoI cannot share everything, since it is part of an ongoing research project, but here are the main parts. The error occurred during the execution of "QBSolv().sample_qubo(...)".choose a D-Wave Advantage systemsystem = BraketDWaveSampler(s3_folder, device_arn='arn:aws:braket:::device/qpu/d-wave/Advantage_system4')use the FixedEmbeddingComposite() method with a fixed embeddingsolver_QA = FixedEmbeddingComposite(system, embedding)Initialize the QUBO matrixQUBO = defaultdict(int)Update the QUBO matrix based on the problem at handfor k in qubo_matrix_quadratic_dict:QUBO[(k[0], k[1])] += qubo_matrix_quadratic_dict[k]sampler = solver_QAresponse = QBSolv().sample_qubo(QUBO,solver=sampler,num_repeats=config_dict["num_repeats"],solver_limit=config_dict["solver_limit"],num_reads=config_dict["number_of_reads"],verbosity=1)Share0Hello,Thank you for using Braket!Have you tried submitting the circuit again? I believe this is a boto api transient error.In order for us to reproduce the issue on our end can you provide us with the following information:This error was received immediately or after a certain period of time after submitting the circuit?Are you using any of the Braket example notebooks or a different script for this?CommentShareVirajanswered a year ago0Thank you for your response.The error appeared after a certain period of time after submitting the circuit, I actually received some solutions without any errors, but after approx. one hour, the error message was shown.I did not use one of the example notebooks, I am using my own script within my local Python IDE (PyCharm).CommentShareAWS-User-5461241answered a year ago0Hello, you could use the following to configure the read timeouts:from botocore.config import Configfrom braket.aws import AwsSessionconfig = Config(read_timeout=300)session = AwsSession(config=config)and then supply this session to the BraketDWaveSampler as:system = BraketDWaveSampler(s3_destination_folder=s3_folder,                             device_arn='arn:aws:braket:::device/qpu/d-wave/Advantage_system4',                             aws_session=session)CommentShareKshitij Canswered a year ago"


Question: SAP HANA on AWS & EC2 Placement Groups

"Hello,Is there any guidance that we (or SAP) provide regarding EC2 Placement Groups for SAP HANA on AWS deployments (i.e. cluster placement groups for latency or partition placement groups for availability, etc) for single-AZ deployments?Doesn't appear to be any specific guidance that I've found so far on this topic.Thanks,AnthonyFollowComment"

Answer: "1Accepted AnswerHi,Cluster placement groups are only recommended for SAP HANA scale-out deployments.This is because the certification requirement for >9Gbps single tcp flow. This is a part of the HANA inter-node network requirement.Otherwise you don't need or are not required to use placement groups with SAP HANA in AWS (i.e. you're not required to have a PG between HANA and the SAP App server or HANA and other SAP systems it may talk to).I hope that helps.CommentShareAWS-User-5248721answered 3 years ago"