Question: greengrass ml component

"HelloI am studying Greengrass machine learning components.I have a question.I'm going to distribute Greengrass custom machine learning components to Raspberry Pi now.The artifacts associated with the recipe in this component contain inference codes uploaded to S3.And this inference code has a function of determining who is by photographing the user's face in real time.I'm curious.If the components are distributed well in Raspberry Pi, will the inference code continue to run? Or, do I have to deploy components every time I try to run an inference?Thank you.FollowCommentMassimilianoAWS EXPERT7 months agoWhich component are you deploying? One of the public ones or a custom component?Sharehyorim 7 months agocustom ml componenti wrote recipe on my ownShare"


Question: Cannot update .com.au domain contacts

"For my .com.au domain I have three required contacts (admin, registrant, tech). I need to update some details urgently for the contacts, but  I cannot as any change I make fails with an error message "Privacy Protection The privacy protection setting must be the same for all contacts"I cannot change privacy protection as privacy protection is not available for.com.au domains and the radio button to enable/disable protection is greyed out. Despite this, it shows privacy as 'enabled' for the admin and tech contacts but disabled for the registrant contact. -no idea how that came aboutThere is just no way this can be changed as far as I can see, can I get some help/advice pleaseFollowComment"

Answer: "1Well I resolved this, by moving the domain to crazydomains. Its laughable for AWS to claim customer obsession when they demand money to even register a bug that renders their product unusable. CrazyDomains were really super helpful and went above and beyond to get a good outcome.AWS are a substandard registrar.CommentShareApemanCanaryanswered 2 years ago"


Question: I got an email of notifying that 'AWS Certificate Manager (ACM) has completed the renewal of an SSL/TLS certificate that certificate includes the primary domain ~ and a total of 1 domains.

"To solve this problem,I logged into domain you mentioned in email,and moved toAWS Certificate Manager (ACM)andI want to resend the validation email. However, the option is unavailable,How do I solve this issue ?FollowComment"

Answer: "1ACM can auto-renew certificates and has the option of notifying you of these renewals. From your post, it sounds like the renewal happened and everything went fine so you have no action to take.CommentShareC Mencarellianswered 5 months ago"


Question: AWS Encryption SDK for Go?

"Hi, is there a Golang equivalent for https://github.com/aws/aws-encryption-sdk-javascript?FollowComment"

Answer: "0As of today, the supported languages for the AWS Encryption SDK are C, Java, JavaScript, and Python. See the documentation for details.CommentShareEXPERTMichael_Fanswered a year ago"


Question: Latency based routing not working for us-east-1 Virginia Region. giving 404

"Hi,I have setup latency based routing for my app https://staging.wavel.ai. I have setup 3 regions signapore, Australia and US.Each region also assigned different subdomains like https://us.wavel.ai similar sg.wavel.ai au.wavel.aiWhen I access https://staging.wavel.ai from US region, it's giving 404 nginx error. same working fine with https://us.wavel.aiI could able to see the same results in https://geopeeker.com/fetch/?url=staging.wavel.aiI am unable to understand the issue. i have setup the dns same as other regionsEdited by: sankarsuda on Sep 25, 2020 8:00 AMSorry, it's my bad, there was mis configuration in nginx for that regionFollowComment"

Answer: "0Sorry, it's my bad, there was mis configuration in nginx for that regionCommentSharesankarsudaanswered 3 years ago"


Question: Does Route53 Health checks Charge hourly also?

I have a doubt to regarding route53 aws health check pricing  for non aws endpoint charge which is $0.75/Month but what if i use it for hourly. Will it charge hourly also ?orDoes it charged basis on hours also?Suppose i have used it for 1 day only then deleted the health check. How AWS will calculate the price for this?FollowComment

Answer: "0Accepted AnswerHiI understand you want to  know if it is possible to be charged basis on hours regarding route53 aws health check pricing for non aws endpoint charge which is $0.75/month.yes it is possible , meaning  you will be charged 0.75 divided by the time you use it. The monthly health check prices listed above are prorated for partial months[1].  the health check would have to be stopped to stop the cost.for example take 0.75 divided by 30 days or 31 days to get the cost per day. then  divide that by 24 hours to get cost per hour. then i multiply that by 10 hoursReference link1.AWS Documentation - https://aws.amazon.com/route53/pricing/CommentSharestevenanswered a year agotanpreet19 a year agoThanks Steven for your reply.I have raised case with AWS support and got reply like below:"09:20:36 AM Charne: So you will be charged $0.75 per health check / month, it is charged per health check and not hourly".."09:27:21 AM tanpreet19: So that means if i use only for 10 hours in a month or if i use for whole month in either AWS will charge me $0.75 . Is it right?09:29:34 AM Charne: Yes you will be charges for each health check, it doesn't depend on the hours"https://us-east-1.console.aws.amazon.com/support/home#/case/?displayId=10241067981&language=enCase ID 10241067981Share"


Question: EC2 instance fails to start after changing instance type from t2 to t3

"I tried to update an EC2 instance from t2 to t3. Since the AZ I was running the instance in did not support t3 instances. I stopped the instance, created an image, and then tried to create an instance from that image in us-east-1c.The instance is running RockyOS v. 8.5.The instance did not start.Using the serial console, it appears as though the EBS volume was not detected.I verified that the ENA and NMVE drivers were installed.I tried a series of experiments, where I created new instances from the original AMI and I was able to create t2 instances, stopped them, created images, and then created new t3 instances without issue.The main difference of course is that the production instance has a lot more data on it, has been updated via dnf update, etc.I suppose I could just create a brand new t3 instance and migrate the data over, but I would like to understand why I wasn't able to convert the instance from t2 to t3.Some more information:The reason that the experiments worked, was because the original AMI was based on RockyOS v. 8.4. This version allows me to migrate between t2 and t3 versions without any issues.The production instance was updated at some point to version 8.5 and for some reason this version does not boot on t3 (nitro) instance types.I repeated my experiment, and launched the original AMI in a t2, did an upgrade, then after changing the instance type to t3, the instance does not boot.While this doesn't provide a solution to the problem, at least not it is reproducible.So, what is it about Rocky OS v. 8.5 that prevents the migration to a nitro instance?The modinfo ena and modinfo nvme both show the drivers are presentFollowComment"

Answer: "1I was able to resolve my issue by explicitly added the ena and nvme drivers to the dracut configuration and re-running dracut:echo 'add_drivers+=" ena "' >> /etc/dracut.conf.d/ena.confecho 'add_drivers+=" nvme "' >> /etc/dracut.conf.d/ena.confdracut -f -vvvvThis was not needed for Rocky OS v. 8.4, but is needed for v. 8.5.CommentShareAWS-User-4761960answered a year ago0It didn't even occurred to me that one should be able to do that, I generally consider instances to be disposable. Anyway, this doesn't answer your question.This seems to suggest you can't use an EBS in us-east-1a for an instance in us-east-1c (eg, the volume needs to be in the same az as the instance). They also suggest that you can make a snapshot across regions (eg, snapshot your existing volume in the zone you want to "move" your instance). This could help with the "volume was not detected" problem. (you will be starting the new instance with the snapshot, not the original volume).For future proofing, I would (resources permitting) rework the system and split the instance in 2 parts: one volume for the software that should be disposable (you should have an automated way to deploy the software and configuration) and one separate volume for the data (and this is the one you backup and snapshot and babysit :) )CommentSharePetruBanswered a year ago"


Question: Service account support in AWS AppStream

"We would like to use a service account in AWS AppStream, and we would not like to synchronize the users from our custom homegrown user management solution to AppStream. Is there a way to use AppStream with a service account, so that every app stream instance shall be unique with a different session.Any suggestion/direction on the same is appreciatedFollowCommentArpit a year agoYou might be able to create a streaming URL dynamically which will be unique for each user and still able to audit who accessed it without synchronizing the users.  Ref - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/appstream/create-streaming-url.htmlShare"

Answer: "0The NameID that is authenticated is passed through uniquely, so one name means on unique session. Therefore one account would never have multiple unique concurrent sessions, only one.CommentShareEXPERTStevieStetsanswered a year ago0I think there's two parts to your question: 1/ how to use a homegrown user management solution to access AppStream 2.0, and 2/ using a service account within AppStream 2.0.For 1/ - AppStream 2.0 supports 3 different access modes: 1/ User Pools, intended for proof of concepts and evaluations, 2/ SAML2.0 IdP-initiated federation when a customer has their own identity provider/user management solution that supports SAML2.0 federation, and 3/ Custom solutions through the use of the StreamingURL API. If your IdP doesn't support SAML2.0 federation, you can use the CreateStreamingURL API to generate a shortlived URL that users can use to access after authenticating them with your user management solution. Note that the CreateStreamingURL doesn't support accessing fleets that are joined to Active Directory Domains. AppStream 2.0 has a workshop that can help you visualize and deploy this workflow: https://aws.amazon.com/appstream2/getting-started/isv-workshops/. Specifically: Create a SaaS Portal with Amazon AppStream 2.0 (though replace Cognito with your user management solution.)For 2/ - can you provide more details on what you mean by service account? Do you mean an Active Directory service account, or something else? AppStream 2.0 identifies users based on the NameID that is provided with the streaming URL or SAML (and automatically uses email address when using User Pools). Multiple users with the same NameID means they will all connect to the same instances, and have the same S3 home folder and app settings persistence, which is not supported. Providing unique nameid values gives every user their own instance when they connect with their own S3 home folder and app settings persistence.Hope this helps.MuraliCommentShareEXPERTMuraliAtAWSanswered a year ago"


Question: Reading QR and Barcodes?

"Textract seems not yet supporting the decoding of barcodes and QR codes. Anyone is using/is aware of any robust alternative solution, preferably in AWS, no Marketplace?Note: Rekognition can detect a QR code, but is not able to decode it.Thanks.FollowComment"

Answer: "0Hi!While the Service Team implements this feature, here you have a workaround using zbar and lambda.I'm still working on making the content available in aws-samples so the cloudformation template is not working right now. But you can configure your lambda functions in the "Deploying in Additional Regions"!Here is the repo!Hope this helps!CommentShareDani Manswered a year agoJames 7 months agoAny update on when this might be released?Also the link to the repo does not work :(Share0Thank you for your feedback. Amazon Textract does not support QR and bar codes currently. We have taken note of your request and added this feature to our backlog. Various factors affect feature releases, and we are unable to provide specific release times at this point.CommentShareAWS-User-2262479answered 3 years ago0+1 !!!CommentSharelbethancourtanswered 2 years ago0+1 to requestCommentShareenasikanswered 2 years ago0+1CommentSharesldsianswered 2 years ago0+1CommentSharesctmyranswered 2 years ago0+1CommentShareTipoanswered 2 years ago"


Question: Stuck on Loading next hit - Failed to execute 'postMessage' on 'DOMWindow'

"I use externalQuestion post my HITs. My webapp is hosted on s3 and served with a domain name and https using route 53, acm and cloudfront:  https://movietitlecamp.com/?taskId=3I tested the HIT with sandbox and everything works correctly. I can submit the hit successfully, load the next hit and retrieve the answer on sandbox. However, when I push it on production, workers cannot submit hit. After they answer, they got stuck in a page said "Loading next HIT...". I got this err:console.log("The following error (Failed to execute 'postMessage' on 'DOMWindow') is expected, please do not report");['https://worker.mturk.com',].forEach(function(domain) {parent.postMessage('{"assignmentId":"35GMH2SV3HA8EOV182JRDPV5F1QOEL","answer":{"taskId":"3","media_selection":"0","transcription":"Kingsman"}}', domain);});I'm sure my submit URL is correct. I appended the answer to the submit url as followed: https://www.mturk.com/mturk/externalSubmit/?assignmentId=35GMH2SV3HA8EOV182JRDPV5F1QOEL&taskId=3&media_selection=0&transcription=KingsmanHITTypeId: 3EP32X463BXG5DPRWRT1ISC729P1HCHITId: 3M7OI89LV0G1507PMCM0HHEM2CTC6HPlease help. I read most of the forum discussions but I could not figure out the problem!Edited by: trinity19 on Jul 16, 2019 10:31 AMFollowComment"

Answer: "0Hello,Thanks for your patience while we looked into this. I have some information from our engineering team that may help you resolve this issue.Your webapp seems to be down at the moment, so we were unable to look at the exact code that's causing the problem.However, you seem to be submitting to /externalSubmit with query parameters (parameters appended to the URL with a question mark).We only support form submissions, not submissions with query parameters.If you're using a <form/>, you'll need to have <input/> elements (or a similar submittable element) for all your questions.I hope that helps! If you have any other questions or concerns please don't hesitate to contact us at mturk-requester-support@amazon.com.-Adam JCommentShareSammieJ-AWSanswered 4 years ago0Thank you very much. I was able to solve the problemCommentSharetrinity19answered 4 years ago"


Question: How to Start the UiCanvas Ebus connect in lua?

I'm now sure if this tutorial is still working on Ui but Its not working. How to make the UI buttons work.Follow

Answer: "0Accepted AnswerThis tutorial Answered my question >> https://s3.amazonaws.com/gamedev-tutorials/Tutorials/How-to-Interact-with-UI-Using-Lua_1.9.pdfSharerePost-User-7620461answered 5 years ago0For UI buttons, I have this code:   function someClass:OnActivate()self.buttonConnection = UiButtonNotificationBus.Connect(self, self.entityId)endfunction someClass:OnDeactivate()self.buttonConnection:Disconnect()endfunction someClass:OnButtonClick()Debug.Log("SomeClass Button pressed")--Do actual stuff in your codeendWithout seeing the Lua code / UI you have, I can't really help you further. Is the UI showing up, but no buttons? Are the buttons receiving hover events, but not doing anything when you press them? Are the buttons active to start?SharerePost-User-5780922answered 5 years ago0Thank you for your help Roosevelt Boyland This is the best community I've been apart. Everyone's been a big help.SharerePost-User-7620461answered 5 years ago"


Question: Athena Error-  HIVE_BAD_DATA: Not valid Parquet file: s3://deng-utube-raw-us-east-1-dev/youtube/raw_stats_reference_data/FR_category_id.json expected magic number: PAR1 got: ] }

"Not able to display paruqet file in athena , which json is converted into parquet using lambda functionFollowComment"

Answer: "0You are trying to read json files in a table defined as parquet format.If that json file is there by mistake then delete any json files, otherwise recreate the table to be a json one.CommentShareGonzalo Herrerosanswered 3 months agorePost-User-2028403 3 months agoI have figured it out...the problem lied in the location of destination bucket. Thankyou for the response.Share"


Question: AWS IoT Analytics Datasets returning column names but no rows

"Hi there,I have setup an ETL pipeline in AWS IoT Analytics (channels, pipeline, data store) and now want to create IoT Analytics Datasets. When creating the dataset, the query does not return any data, except for the column names. For testing purposes, I am using the default select query: SELECT * FROM my_data_store LIMIT 10.The datastore contains data, e.g., I ran a Glue Crawler over the data in the data store, queried it with Athena and got correct results. I also manually downloaded the data from S3, and the data can be queried locally. But the Datasets CSV keeps being empty (except for all the column names). The Datasets content view in the AWS Console also only displays the Column Names.To be on the safe side, I further added full S3 permissions to my IAM Roles, but without any success.What is the problem here? Is the dataset functionality working for any of you?Best,JonFollowComment"

Answer: "1Accepted AnswerAre you using your own S3 bucket for storing/managing the data then you must grant AWS IoT Analytics permission to perform these actions on your Amazon S3 bucket for you. If you use the data store as a source for an SQL query dataset, set up an Amazon S3 bucket policy that grants AWS IoT Analytics permission to invoke Amazon Athena queries on the contents of your bucket. Please refer to the https://docs.aws.amazon.com/iotanalytics/latest/userguide/policy.html link for more details.If you update the options or permissions of your customer managed data store, you might need to reprocess channel data to ensure that any previously ingested data is included in dataset contents. For more information, see https://docs.aws.amazon.com/iotanalytics/latest/userguide/reprocessing.html#aws-iot-analytics-reprocessing.s3:GetBucketLocations3:PutObjects3:DeleteObjectCommentShareDhilipanswered 13 days agorePost-User-0943733 12 days agoThank you! That solved it. I somehow overlooked this part in the docs.ShareDhilip 12 days agoGlad this worked.Share"


Question: How AWS confirm secret_key??

"We are currently conducting a test to simulate AWS' IAM on the Go server.However, I want to make JWT using access_key and Secret_key in Terraform, and to check if the signature part here is correct, I want to make the same signature through the request received from Golang and calculate them ==, but the desired signature is not made.https://docs.aws.amazon.com/ko_kr/general/latest/gr/sigv4-create-canonical-request.htmlI made the same logic as the reference, and if you put the test character, it will be printed properly, but I wonder how you make the signature when you make the signature through receiving communication on AWS.Thank you!FollowComment"


Question: Help with appstream CLI to list running/paused instances in fleet.

"I am familiar with the commands below but what I want to do is see a listing of all instances running in a given fleet that shows their IP, Computer name and which Image they are using.  Knowing the image for each instance is important as when we replace the image in a fleet we need to see who is using new/old image for support reasons in the interim while users gradually receive the new image.aws appstream describe-fleetsaws appstream describe-sessions --stack-name "MyStackName" --fleet-name "MyFleetName"  --query "Sessions[*].[UserId,Id,State,ConnectionState,StartTime]" --output tableAlso, we are only  publishing desktops - is there a way to get through the image builder app on the desktop without having to publish an app.  I had to publish calculator just to get to the end where an image can be created.FollowComment"

Answer: "0Accepted AnswerHello, thank you for reaching out!At this time, there is no API to query information about the underlying instances. If you run the describe-sessions API, it will only return the information from sessions that have been created. This would mean that IP's from instances that are just waiting for an incoming session would not be listed.The closest query you can perform to answer your question is to list the Elastic Network Interfaces (ENIs) that currently exist in your account associated to your fleet. To that effect, you can run aws ec2 describe-network-interfaces --filters "Name=description,Values='AppStream 2.0 - fleet:<fleetname>'" [1]This API will return the AttachTime timestamp in UTC format. You can then compare this time with the time when you called the UpdateFleetAPI and that will tell you which ENIs are using the new image. If you would rather get the list of the instances that are using the previous image, then you would do the query when the ENI creation date is older than the UpdateFleet API call date.Another workaround is to schedule image replacements in the off hours, so you can stop a fleet entirely, replace the image and start them back. Using this approach (if possible) would effectively mean that all instances always use the latest image.For your other question, Appstream originally only supported the Application view, which meant that you would need to add at least one app to the catalog to create an image. You can continue to add the Calculator or any other built in app like Notepad.[1] https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-network-interfaces.htmlCommentShareSUPPORT ENGINEERFrancisco_Lanswered 9 days agorePost-User-1579460 9 days agoThis is a help but reveals some basic features that appstream is missing.  Don't get me started on trying to white-list the appstream portal IP ranges for a given region.  I don't mean the URL ones, I mean the ones that need UDP QUIC 8443.  Corporations are willing to allow wide QUIC access because packets can't be inspected.Share"


Question: I can't remove my ec2 subscription

"I can't remove a AWS marketplace subscription because, when i write the name of the subscription on the delete page, it doesn't make the button accessible. Am i doing something wrong?FollowComment"

Answer: "0Hi, I understand that you subscribed to a marketplace AMI. Correct?If yes, you should follow https://docs.aws.amazon.com/marketplace/latest/buyerguide/cancel-subscription.html#cancel-ami-subscriptionCommentShareDidier_AWSanswered 13 days ago0To cancel a subscription to an AWS Marketplace product, you must first ensure that you have terminated all software and instances that are associated with that product. Here's a step-by-step guide:Terminate all associated resources: Go to the EC2 Dashboard in the AWS Management Console. In the navigation pane, choose "Instances". Select the instances associated with the product and choose "Actions", then "Instance State", and finally "Terminate". Confirm that you want to terminate the instances when prompted. Please note that terminating an instance effectively deletes it, and you can't connect to or restart an instance after you've terminated it.Unsubscribe from the product: After you've terminated all instances associated with the product, you can cancel the subscription. Go to the AWS Marketplace website, click on "Your Software" in the upper right corner, then "Manage Subscriptions". Click "Cancel Subscription" next to the product you want to cancel.CommentShareEXPERTsedat_salmananswered 13 days ago"


Question: TIG_SRAI clock constraints in pnr_user.xdc

"Hey guys,I was wondering about the provenance of these three constraints that appear in some but not all of the example designs. Under what circumstances are they required? In my designs, now based off cl_dram_dma, (which has them commented out)https://github.com/aws/aws-fpga/blob/v1.4.20/hdk/cl/examples/cl_dram_dma/build/constraints/cl_pnr_user.xdc#L64), only the latter two correctly resolve.set_clock_groups -name TIG_SRAI_1 -asynchronous -group \[get_clocks -of_objects \[get_pins static_sh/SH_DEBUG_BRIDGE/inst/bsip/inst/USE_SOFTBSCAN.U_TAP_TCKBUFG/O]] -group \[get_clocks -of_objects \[get_pins SH/kernel_clks_i/clkwiz_sys_clk/inst/CLK_CORE_DRP_I/clk_inst/mmcme3_adv_inst/CLKOUT0]]set_clock_groups -name TIG_SRAI_2 -asynchronous -group \[get_clocks -of_objects \[get_pins static_sh/SH_DEBUG_BRIDGE/inst/bsip/inst/USE_SOFTBSCAN.U_TAP_TCKBUFG/O]] -group \[get_clocks drck]set_clock_groups -name TIG_SRAI_3 -asynchronous -group \[get_clocks -of_objects \[get_pins static_sh/SH_DEBUG_BRIDGE/inst/bsip/inst/USE_SOFTBSCAN.U_TAP_TCKBUFG/O]] -group \[get_clocks -of_objects \[get_pins static_sh/pcie_inst/inst/gt_top_i/diablo_gt.diablo_gt_phy_wrapper/phy_clk_i/bufg_gt_userclk/O]]Can i safely remove all three?FollowComment"

Answer: "0Hello,Thanks for bringing this to our attention. We will look into this issue and confirm the correct action.-ChakraCommentShareawschakraanswered 2 years ago0Hey Chakra, any word on this?CommentShareBiancolinanswered 2 years ago0Hello,Yes, we verified that it is safe to remove these three constraints from cl_pnr_user.xdc.We will soon update the github page reflecting this change for all the CLs. In the mean time please remove these constraints for your CL builds.Thanks!Chakra.CommentShareawschakraanswered 2 years ago"


Question: Upgrade Windows SQL standard edition to 15

We should upgrade the standard Microsoft sql server instance from 2017 version to 2019 version.What is the best procedure to follow in order not to lose dataFollowComment

Answer: "0If you are running SQL Server on EC2 then the recommended way is to launch a new SQL Server instance and migrate the databases to it. This can be as simple as detaching the data volumes from the old instance and re-attaching to the new instance.  There are many considerations around High Availability, SQL Agent, Clustering etc which need to be taken into account when designing your upgrade path.   This article from Microsoft does a good job of explaining the different methodologies i.e. in-place vs new instance vs rolling upgrade:https://learn.microsoft.com/en-us/sql/database-engine/install-windows/choose-a-database-engine-upgrade-method?view=sql-server-ver15CommentShareAlan-Cranfield-awsanswered 3 months ago"


Question: AWS SES configuring for laravel cpanel domain

"Hello,I have a cpanel domain in which a laravel site is hosted and I have also verified aws ses domain verification.But mail didn't work.I need help to configuring .env file for this smtp credentials.Also is there any other steps that need to do for completing this setup.Please help me ASAP,it is urgent.Thank youFollowComment"

Answer: 0SMTP credentials for using SES can be setup using the following guide https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-console.Your account will need to be out of the SES sandbox for emails to be sent to addresses other than what you have verified as per https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlIf the above has already been done for your account are you seeing any errors in the logs for your application?CommentSharelp901answered 9 months ago


Question: Error on Dashboard "An error occurred" and unable to create instance due to "Error loading AMI data".

I am unable to create an instance. Getting "Error loading AMI data" while creating instance. Also in dashboard getting error "An error occurred retrieving ..."Also I see the below error on EC2 Dashboard.Supported platformsAn error occurredAn error occurred retrieving supported platformsDefault VPCAn error occurredAn error occurred checking for a default VPCService healthAn error occurredAn error occurred retrieving service health informationScheduled eventsAn error occurredThere was an error while checking for scheduled eventsFollowComment

Answer: "0Hello,When your ec2 instances fail to launch due to issues with our AMI, it could be either:The AMI ID does not existThe AMI might have been deleted after creating the launch template of configurationSolution would be to create a new launch template using a valid AMIAMI might have been created by taking a snapshot of a running instance or any other way and it might not be available yetSolution would be to wait for your AMI to be available before creating a launch templateThe AMI used to launch the instance doesn't support the selected instance type.Solution would be to check the AMI descriptions in the AWS documentation before selecting the instance type or family, see reference [1].Please do make sure that the AMI you are trying to use is available in the region where you want to launch your instance and make sure that the service you are using to launch the instance has neccessary access permissions to the AMI.If none of the above factors are the cause of the problem, then more details of the ami and how you launch the instance will be needed in order to dive deep and find the root of the problem.References:[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.htmlCommentShareAsenathianswered a year ago"


Question: Operation cloudfront prompts access denied

"I can't operate my cloudfront, when I disable, create rules it tells me that access is deniedI visited the address generated by cloudfront and it prompted me that my IP address could not be found, so I logged on to https://console.aws.amazon.com/    and went to the cloudfront page, and on the cloudfront interface, I saw that my domain name, status were normal. Then I tried to select one of the domains and tried to disable it (I tried to restart the service). But it tells me that Access is deniedFollowComment"

Answer: "0HelloPlease find the information below from AWS docs: Look at here Deleting a distributionIf you disable a distribution that has an alternate domain name associated with it, CloudFront **stops accepting traffic **for that domain name (such as www.example.com), even if another distribution has an alternate domain name with a wildcard (*) that matches the same domain (such as *.example.com).Thank YouGKCommentShareGKanswered a year agoAWS-User-6630873 a year agoI can't stop any of the instances, and every instance I try to stop tells me that access is deniedShareGK a year agoI think your IAM permission to stop Ec2 instances has been removed, Are you using IAM User account can you check permission ThanksShare"


Question: What is the maximum size for a lambda docker image ?

I know we have a maximum of 250MB for all layers in a standard lambda. But what is the maximum in a docker image size ?FollowComment

Answer: 1Accepted AnswerIt can be up to 10G in size.CommentShareCarlos_Sanswered 2 years ago


Question: URL to Delete Workspaces isn't working?

"I have a workspace that I can start and use so I can get the name and id of the work space.  I go the AWS login page and select "Root User", put in my email, get past the security check, and enter my password.  I then go to [Workspaces console](WorkSpaces console) as described here but the page says "Get Started Now" as if I have no Workspaces.  I want to delete things so I don't get charged for them later.  Similar things happen if I try and follow the Delete the directory for your WorkSpacesFollowComment"

Answer: 0Accepted AnswerIs it possible your looking at a different region in the console than your workspace is in?CommentShareEXPERTskinsmananswered a year agopedz a year agoGenius!!! 👍Share


Question: Pinpoint not receiving SMS

"We have a few departmental accounts that force 2FA via phone number with other vendors.  I was hoping to use a Pinpoint phone number to receive these 2FA texts and then send them by email to authorized users via SNS.I have it working for 2FA SMS messages coming from one vendor, but there are 2 other vendors whose text messages don't get received by Pinpoint.  If I use my USA phone number to receives the 2FA SMS messages then I receive them, but when I switch the phone number to the AWS pinpoint number the SMS messages never get received.  Are certain phone numbers blocked by Pinpoint?  The text messages are coming from US numbers to an AWS US number.  One of the failed 2FA SMS messages is coming from a "short code" number, but the other failed 2FA SMS message is coming from a regular full US phone number.  Any help would be appreciated.FollowComment"

Answer: 0Have you enabled logs and checked the logs? There might be some information there about why you are having problems.CommentShareAnaAtAWSanswered a year ago


Question: CloudTrail LookupEvent StartTime throwing SerializationException

"Hi,Im trying to use CloudTrail LookupEvent via Postman and per HTTP API it wants StartTime/EndTime as numerics (timestamp)https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.htmlBut its throwing error :{"__type": "SerializationException"}Data Scenario:URL - https://cloudtrail.us-east-1.amazonaws.com/Region: us-east-1ServiceName: cloudtrailAWS accesskey and seckey : xxx xxxSetup with additional http header:x-amz-target = com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.LookupEventsContent-Type = application/x-amz-json-1.1Note: Using LookupEvents as x-amz-target return all result ignoring the json body requestusing HTTP POST with JSON body as seen below:{"LookupAttributes": [{"AttributeKey": "EventSource","AttributeValue": "ec2.amazonaws.com"}],"MaxResults": 5,"StartTime" : 2021-05-18T01:03:34,"EndTime" : 2021-05-19T01:03:34}Also i did tried the unix timestamp but its return an empty Events[], although using just StartTime return a data.Appreciate if anyone from support team provide some insight.ThanksFollowComment"

Answer: 0posted to correct forumCommentSharejmer28answered 2 years ago


Question: How can I use the same domain name in different AWS accounts?

"I want to use the same domain name in different AWS account. The domain is hosted by AWS.I have two accounts: Account A and Account B. In Account A, I have created a certificate with AWS Certificate Manager to have a custom domain name like example.com. What I want to achieve is using the same domain name in Account B. In order to do that I have created a new certificate with the same domain name in Account B and then in Route53 I have created a new hosted zone with the same domain name. The certificate is issued via email validation for Account B. I have created a S3 static website hosting and created CloudFront distribution with this domain name in Account B. I have followed all the steps to create static website hosting from this url: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/ When I call the link example.com instead of navigating to the static website it gives the following error: example.com’s server IP address could not be found. ERR_NAME_NOT_RESOLVEDMy question is what should I do to use the same domain name in different AWS accounts.FollowComment"

Answer: 0I have come up with a solution. It seems that the record set in Account B does not work and requests the address to hosted zone in Account A so creating the record set in Account A and using the CNAME of the distribution in Account B is the solution. The request goes to the record set in Account A and then it routes to the distribution in Account B.The below link has the diagram presents the solution:https://i.stack.imgur.com/1e8Pv.pngCommentShareholition-adminanswered 4 years ago0I also ran into this and a "cleaner" option seems to be with using delegating responsibility for a subdomain to a hosted zonehttps://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-routing-traffic-for-subdomains.htmlCommentShareHarinSanswered 2 years ago


Question: Create new branch when commit id is not available

"Hello,I am interested in creating a new branch in newly created repository programatically (using CLI/boto3/API call).Alas, I cannot do that because initial commit id is required, but there is none available at that point of time.On the other hand, I can do the same action using console and all I need to specify is a branch to point to. In my case it is default branch “main” and that’s all. So, if I can do it from console, then it should be possible to do programatically.Could you please advise how I can do it without initial commit id or maybe there are any workarounds available?Thank you.FollowComment"

Answer: 0Wrong question.CommentSharekkravetsanswered 2 years ago


Question: AWS VPN service outage due to DNS not resolve

"Hi,We have three AWS accounts that have AWS VPN Client services configured. Two of them are not working. The issue started happening suddenly on January 14 2022 (with no known changes to our configurations).I have sanity checked our OVPN configurations. Booting up my Wireshark on my laptop, it seems that the reason why I could not connect is likely due tofailure to resolve DNS A records related AWS VPN related services.I saw the following DNS names got queried (all of which the DNS servers responded with "Standard query response, No such name"):For the first account, DNS A record queries that failed:ed-<REDACTED>.cvpn-endpoint-0a<REDACTED>..prod.clientvpn.us-east-1.amazonaws.com00-<REDACTED>.cvpn-endpoint-0a<REDACTED>..prod.clientvpn.us-east-1.amazonaws.com.cv-<REDACTED>-0a<REDACTED>..prod.clientvpn.us-east-1.amazonaws.coma4-<REDACTED>.cvpn-endpoint-0a<REDACTED>..prod.clientvpn.us-east-1.amazonaws.com82-<DREDACTED>.cvpn-endpoint-0a<REDACTED>..prod.clientvpn.us-east-1.amazonaws.comFor the second account, DNS A record queries that failed:12-<REDACTED>.cvpn-endpoint-0c-<REDACTED>.prod.clientvpn.us-east-1.amazonaws.comDNS servers (mine and some others on the Internet) could not resolve those. So, it's unlikely just my DNS servers as I checked it against multiple DNS servers.Is AWS Client VPN currently experiencing outage? Is it just more widespread than issues in my two accounts? Or is my configuration wrong somewhere?Thanks,RobFollowComment"

Answer: 0Accepted AnswerWe managed to get them "resolved"; at least whatever seemingly irrelevant things I did managed not to trigger this bug.I went to the Client VPN endpoint settings and found that there were some lingering security group associations that show up in GuI but the underlying SG is already gone.I deleted those SGs.Turn logging settings off and then back on againThose actions do not seem to be directly related to AWS not being able to resolve VPN endpoint DNS -- but somehow correlated with the fixes.CommentShareAWS-User-8733268answered a year ago


Question: Access point policy is not restricting the access to bucket

"I have a bucket which restricts access to it only through access policy. I see that it is not working as expected. Here is the bucket policy -{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Deny",            "Principal": {                "AWS": "*"            },            "Action": [                "s3:GetObject",                "s3:ListBucket",                "s3:PutObject"            ],            "Resource": [                "arn:aws:s3:::admin-only-bucket",                "arn:aws:s3:::admin-only-bucket/*"            ],            "Condition": {                "StringNotEquals": {                    "s3:DataAccessPointAccount": "xxxxxxxxxxxx"                }            }        }    ]}The access point has the following policy -{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam:: xxxxxxxxxxxx:user/admin"            },            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3:us-east-1: xxxxxxxxxxxx:accesspoint/admin-only-accesspoint"        }    ]}My intent is to restrict the bucket only to the admin user.  When I list the objects in the bucket 'admin-only-accesspoint', it is working fine.aws s3api list-objects --bucket arn:aws:s3:us-east-1: xxxxxxxxxxxx:accesspoint/admin-only-accesspoint --profile admin But I am also able to do list objects with another user 'staff'.aws s3api list-objects --bucket arn:aws:s3:us-east-1: xxxxxxxxxxxx:accesspoint/admin-only-accesspoint --profile staff Just wondering why the access is not restricted to admin user.FollowComment"

Answer: "1You've answered this yourself but for others reading along, this is explained in a lot of detail in the documentation.A common thing that has tripped me up in the past is that if the IAM policy for the role I'm using allows access to a S3 bucket; and the S3 bucket policy doesn't include my identity specifically and doesn't deny me access then I'm allowed access - because (as you point out) there isn't an explicit deny. If my IAM policy did not allow me access in the first place then I wouldn't have access because the implicit deny would stop me.CommentShareEXPERTBrettski-AWSanswered 4 months ago0Accepted AnswerI see that it is working as expected if I change the policy as{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Deny",            "NotPrincipal": {                "AWS": "arn:aws:iam:: xxxxxxxxxxxx:user/admin"            },            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3:us-east-1: xxxxxxxxxxxx:accesspoint/admin-only-accesspoint"        }    ]}Apparently, the access point policy allows everything by default unless there is a deny.Better solution is this one -{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam:: xxxxxxxxxxxx:user/admin"            },            "Action": "s3:ListBucket",            "Resource": "arn:aws:s3:us-east-1: xxxxxxxxxxxx:accesspoint/admin-only-accesspoint"        }    ]}The issue was that all the users I was trying had all the permissions for S3. So, I removed the all the S3 permissions for users and allowed them access only through the bucket and access point policy which resolved the issue.So if the identity has permission to access S3, bucket and access point has no impact unless there is explicit denyCommentShareganesh-for-awsanswered 4 months ago0Try using the following policies:IAM Policy:{   "Version":"2012-10-17",   "Statement":[      {         "Sid":"IAMPolicyForS3BucketAccess",         "Effect":"Allow",         "Action":[            "s3:ListBucket",            "s3:GetObject",            "s3:PutObject"         ],         "Resource":[            "arn:aws:s3:::my-bucket",            "arn:aws:s3:::my-bucket/*"         ]      }   ]}Bucket Policy:{   "Id":"Policy1585661668608",   "Version":"2012-10-17",   "Statement":[      {         "Sid":"DenyRequestThatDoNotUseTheAccessPointAccount",         "Effect":"Deny",         "Principal":{            "AWS":[               "arn:aws:iam::111111111111:root"            ]         },         "Action":[            "s3:GetObject",            "s3:ListBucket",            "s3:PutObject"         ],         "Resource":[            "arn:aws:s3:::admin-only-bucket",            "arn:aws:s3:::admin-only-bucket/*"         ],         "Condition":{            "StringNotEquals":{               "s3:DataAccessPointAccount":"111111111111"            }         }      }   ]}Access Point Policy:{   "Version":"2008-10-17",   "Statement":[      {         "Effect":"Allow",         "Principal":{            "AWS":"arn:aws:iam::111111111111:user/admin"         },         "Action":"s3:ListBucket",         "Resource":"arn:aws:s3:us-east-1:111111111111:accesspoint/admin-only-accesspoint"      }   ]}CommentShareAWS SA Neilanswered 4 months agoganesh-for-aws 4 months agoIt is not clear how this is going to solve the issue.Share"


Question: Burrow monitoring for MSK

"Is Burrow still useful for MSK clusters?In the past I have used Burrow to monitor consumer lag.  Various blogs have instructions to install Burrow for MSK, but any references to that seem to have disappeared lately.   Have the client lag metrics in recent MSK versions mostly obviated the need for tools such as Burrow?FollowComment"

Answer: "0Hi there, with consumer lag metrics now available in cloudwatch (1) it is currently the recommended way to monitor the consumer lag even though burrow is still an option. It is true that consumer lag metrics in cloudwatch obviated the need for tools such as Burrow.(1) https://docs.aws.amazon.com/msk/latest/developerguide/consumer-lag.htmlCommentShareSUPPORT ENGINEERHarshith_Manswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Sync DynamoDB to S3

"What is the best way to sync my DynamoDB tables to S3, so that I can perform serverless 'big data' queries using Athena? The data must be kept in sync without any intervention. The frequency of sync would depend on the cost, ideally daily but perhaps weekly.I have had this question a long time. I will cover what I have considered, and why I don't like the options.AWS Glue Elastic Views. Sounds like this will do the job with no code, but it was announced 18 months ago and there have been no updates since. Its not generally available, and there is not information on when it might be.Use dynamodb native backup following this blog https://aws.amazon.com/blogs/aws/new-export-amazon-dynamodb-table-data-to-data-lake-amazon-s3/. I actually already use this method for 'one-off' data transfers that I kick-off manually and then configure in Athena. I have two issues with this option. The first is that, to my knowledge, the export cannot be scheduled natively. The blog suggests using the CLI to kick off exports, and I assume the writer intends that the CLI would need scheduling on a cron job somewhere. I don't run any servers for this. I imagine I could do it via a scheduled Lambda with an SDK. The second issue is that the export path in S3 always includes a unique export ID. This means I can't configure the Athena table to point to a static location for the data and just switch over the new data after a scheduled export. Perhaps I could write another lambda to move the data around to a static location after the export has finished, but it seems a shame to have to do so much work and I've not seen that covered anywhere before.I can use data pipeline as described in https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. This post is more about backing data up than making it accessible to Athena.I feel like this use case must be so common, and yet none of the ideas I've seen online are really complete. I was wondering if anyone had any ideas or experiences that would be useful here?FollowComment"

Answer: "2There is several options available to you. You can use:DynamoDB Streams >> Lambda >> S3but this lacks in partitioning and aggregation, which can be fixed by introducing firehose on the next pointDynamoDB Streams >> Lambda >> Firehose >> S3This allows you to aggregate and partition the data with keys of your choice but is not as native as the next point, removing LambdaKinesis Data Streams >> Firehose >> S3Provides you the ability to have aggregated and partitioned data, as well as data retention up to 1 year. This blog and this blog are useful, and would be my preferred approach.Depending on how often you read the data, you could also use DynamoDB Athena Connector, which will allow you to run Athena SQL queries directly against your table.CommentShareEXPERTLeeroy Hannigananswered a year agoEXPERTFabrizio@AWSreviewed a year ago0The simplest way is to use DynamoDB Streams into Kinesis Firehose. On the S3 folders, you can run AWS Glue crawler, and then define a View in Athena to simplify the access to the Item object you get in from the crawler.See here for some details and this blog post.You can extend this flow to allow real-time processing with Kinesis Analytics.CommentShareMLGuyanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Transfer existing consolidated billing account into newly deployed Control Tower Landing Zone

"Hello,My current organization has about 7 different OUs with a consolidated billing account using SSO.  We are looking to implement Control Tower.  From my understanding, a new consolidated billing account gets created when configuring Control Tower.  Is it possible to transfer the existing consolidated billing account into a newly deployed Control Tower environment?  Are there any other concerns we may have when implementing Control Tower?  Any assistance would helpful.Thank you!FollowComment"

Answer: "2You can bring an existing organization into AWS Control Tower, it's called registering the organization, or extending governance to the organization. Similarity you can also register the 7 OU into control tower.For details, please refers to the documentation at:https://docs.aws.amazon.com/controltower/latest/userguide/existing-orgs.htmlCommentShareronald_lanswered 4 months ago0No, there doesn't seem to be a way to transfer an existing consolidated billing account with Control Tower. The management account is the billing account in a Control Tower-managed environment, as specified in the docs https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html.You might be able to enable Control Tower in your existing environment (and use your existing consolidated billing account), but I'm not sure if that's guaranteed to work. You might be able to get clarity from your account manager, or via logging a AWS Support ticket.CommentSharerowanuanswered 4 months ago"


Question: Error running python selenium webdriver for chrome browser on aws ec2

"from selenium import webdriverfrom selenium.webdriver.chrome.options import Optionsoptions = Options()options.add_argument("--headless")driver = webdriver.Chrome(options=options, executable_path=r'/usr/bin/chromedriver')driver.get("http://google.com/")print ("Headless Chrome Initialized")driver.quit()ErrorFollowComment"

Answer: 0Not very sure which ec2 machine (along with OS) + Chrome versions being used but from the exception "selenium. common. exceptions. SessionNotCreatedException: Message: session not created: This version of ChromeDriver only supports Chrome version 80" it looks you may have to revisit/check your installation and its version of Chrome and its driver.CommentShareEXPERTAWS-User-Nitinanswered 7 months ago


Question: Application Load Balancer & AZ routing

"I was using NLB (in 3 AZ) to rout traffic to a targets (ECS Fargate tasks).Then I've switched to Application Load Balancer with 3 AZ as well.Soon I discovered increased cross AZ traffic. After investigating my VPC flow logs, I've found that ALB is sending data from it's ENI on AZ1 to a target's ENI in AZ2. In it happens in all combinations. In contrast, NLB never did this way.My question is: is it done by design of ALB or I did something wrong in setting it up?FollowCommentSmotrov a year agoFor me it is now clear that ALB is unacceptable in my scenario.  I receive 60-70TB of data per month over HTTP to my ELB.ALB is very good, but it generates pretty significant cost for EU-DataTransfer-Regional-Bytes. BTW this cost are relates to a service which stand behind of ALB (Like EC2 or ECS). However NLB produces zero of such costs when cross-zone load balancing is disabled.It is a pity, because I like ALB for it's features related to HTTP :-(ShareEvgeny-At-AWS EXPERTa year agoKeep in mind that ALB doesn't generate a charge for cross-zone traffic between ALB nodes and targets. (as per FAQ: "No. Since cross-zone load balancing is always on with Application Load Balancer, you are not charged for this type of regional data transfer.").ShareJason_S a year agoWould you be concerned about the ELB data processing cost and/or the extra hop? Or the benefits of a managed L7 LB outweigh some of the above concerns?ShareJason_S a year agoAlso just curious here considering what Evgeny pointed out, are the applications able to resolve the endpoints through private IP, or they are talking through public IPs?Share"

Answer: "5Accepted AnswerThis is the expected behavior of cross-zone load balancing.  Cross-Zone load balancing is disabled by default on NLBs and always enabled for ALBs.Edit 12/6/22: Cross-zone load balancing can now be turned off for ALBs: https://aws.amazon.com/about-aws/whats-new/2022/11/elastic-load-balancing-capabilities-application-availability/CommentShareNoah_Lanswered a year agoEXPERTsedat_salmanreviewed 13 days agoEXPERTHernitoreviewed a year agoSmotrov a year agoThank you for quick reaction :-)I know about Cross Zone load balancing in NLB. But didn't found such setting in ALB. Is ALB doing cross-zone by default?ShareGiorgio@AWS a year agoYes - on ALB it's always on, you can't turn it off!ShareSmotrov a year agoThank you Giorgio@AWS!Never saw it anywhere in documentation. Thank you again!ShareSmotrov a year agoFor me it is now clear that ALB is unacceptable in my scenario.  I receive 60-70TB of data per month over HTTP to my ELB.ALB is very good, but it generates pretty significant cost for EU-DataTransfer-Regional-Bytes. BTW this cost are relates to a service which stand behind of ALB (Like EC2 or ECS). However NLB produces zero of such costs when cross-zone load balancing is disabled.It is a pity, because I like ALB for it's features related to HTTP :-(ShareNoah_L 6 months agoALB now supports the ability to turn off cross-zone load balancing (https://aws.amazon.com/about-aws/whats-new/2022/11/elastic-load-balancing-capabilities-application-availability/)Share2This is by design if you have enabled cross-zone load balancing (it's always on for ALB).  For NLB, it's turned off by default, which is why you see that behavior.  With cross zone load balancing, the load balancer will send traffic across AZs to all registered targets.  See: https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.htmlCommentShareAdrian_Manswered a year agoEXPERTHernitoreviewed a year agoSmotrov a year agoThank you!Missed the line in documentation "With Application Load Balancers, cross-zone load balancing is always enabled."Share0I do believe this question is more relevant to ECS networking.I would also recommend that you consider using service discovery and service mesh for inner-service communications of your container.You can find more details of different patterns, including using ELB, hereCommentShareJason_Sanswered a year ago0For further details, a page that is simple to look at and understand the differences between NLB and ALB attributes:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-loadbalancer-loadbalancerattributes.htmlNLB cross-AZ by default is turned off. ALB is not.However, say you have a VPC in 3 tiers, and only use 2AZ for your ALB, sending traffic to tasks that are spread in 3 AZs, the ALB won't send traffic to tasks in that 3rd AZ.CommentShareJohnPrestonanswered a year ago"


Question: Inconsistent ability to connect to Jupyter application running within a Docker container on a Ubuntu host in EC2

"I have set up a Ubuntu server on EC2 running Docker with a container running JupyterHub. I am running the container with docker run -p 8888:8888 <container name>After building the server, I can connect fine from a Windows AppStream instance's Chrome browser using http://<Ubuntu private IP>:8888If I switch the Ubuntu server off then on/reboot. I can no longer connect to Jupyter after running the container again in the same way. I also cannot connect using Test-NetConnection from Powershell with the Ubuntu Private IP and port 8888.I tried setting up a simple Python3 web server to serve a HTML file. This is accessible from Chrome on the Windows client before and after a Ubuntu reboot consistently, as long as I run the web server. SSH access from the Windows client is also consistent.If I SSH onto the Ubuntu box after a Ubuntu reboot, it behaves consistently trying to  interface with Jupyter as before a reboot:curl http://localhost:8888 from the Ubuntu server returns blank output but the container shows a GET requestexec onto the container lets me interact with Jupyter.FollowComment"

Answer: "0It sounds like the Jupyter container might not be starting up properly after the Ubuntu server reboots. Here are a few things you can check:Check the container logs: After running the container, try running docker logs <container name> to see if there are any error messages that might indicate why Jupyter is not starting up properly.Check the Jupyter configuration: Make sure that the Jupyter configuration file is set up correctly, and that the correct IP address and port are specified. You can check the configuration file by exec'ing into the container and running jupyter notebook --generate-config.Check the firewall settings: It's possible that the firewall settings on the Ubuntu server are blocking incoming connections on port 8888. You can check the firewall settings by running sudo ufw status.Check the Docker network configuration: Make sure that the Docker network is set up correctly and that the container is attached to the correct network. You can check the Docker network settings by running docker network inspect <network name>.Try using a different port: It's possible that there is a conflict with another service running on port 8888. Try using a different port, like 8889, and see if you can connect to Jupyter on that port.Hopefully one of these suggestions will help you diagnose the issue!CommentSharehashanswered a month agorePost-User-7652614 a month agoHi there. Many thanks for your guidance. For each step I compared a fresh EC2 Ubuntu instance where Jupyter is still accessible from a remote client browser against an instance which has been rebooted and where Jupyter is no longer accessible from a remote client browser. Results of each step:SharerePost-User-7652614 a month agoThe logs just show the typical output returned when Jupyter boots. The only material difference I could see was the functional instance loaded the nbdime package. Looking this up it does not seem related - other packages e.g. nbconvert were loaded by both instances.Jupyter config files match.ufw status disabled on bothDocker network connection matches.Tried on 8889, and 8000, both running with docker run -p 8889:8888 and docker run -p 8889:8889, for example.SharerePost-User-7652614 a month agoI wonder if there is a Docker or Ubuntu process/service that needs to be re-run after a server reboot? I have tried sudo service docker restart to no avail as well as restarting the container after running.Share"


Question: SQS TLS 1.2 and boto 1.9b

I have had a notification of TLS 1.2 updates for SQS June 28.Does boto1.9b work with this please?(OS Python 2.4)FollowComment


Question: vivado crush

"Hey,I'm connecting to my F1 instance using SSH when trying to start vivado I get:***** Vivado v2020.1 (64-bit)**** SW Build 2902540 on Wed May 27 19:54:35 MDT 2020**** IP Build 2902112 on Wed May 27 22:43:36 MDT 2020** Copyright 1986-2020 Xilinx, Inc. All Rights Reserved.start_guiException in thread "main" java.lang.UnsatisfiedLinkError: /opt/Xilinx/Vivado/2020.1/tps/lnx64/jre9.0.4/lib/libawt_xawt.so: libXtst.so.6: cannot open shared object file: No such file or directoryat java.base/java.lang.ClassLoader$NativeLibrary.load(Native Method)at java.base/java.lang.ClassLoader.loadLibrary0(Unknown Source)at java.base/java.lang.ClassLoader.loadLibrary(Unknown Source)at java.base/java.lang.Runtime.load0(Unknown Source)at java.base/java.lang.System.load(Unknown Source)at java.base/java.lang.ClassLoader$NativeLibrary.load(Native Method)at java.base/java.lang.ClassLoader.loadLibrary0(Unknown Source)at java.base/java.lang.ClassLoader.loadLibrary(Unknown Source)at java.base/java.lang.Runtime.loadLibrary0(Unknown Source)at java.base/java.lang.System.loadLibrary(Unknown Source)at java.desktop/java.awt.Toolkit$3.run(Unknown Source)at java.desktop/java.awt.Toolkit$3.run(Unknown Source)at java.base/java.security.AccessController.doPrivileged(Native Method)at java.desktop/java.awt.Toolkit.loadLibraries(Unknown Source)at java.desktop/java.awt.Toolkit.<clinit>(Unknown Source)at java.desktop/sun.awt.AppContext$2.run(Unknown Source)at java.desktop/sun.awt.AppContext$2.run(Unknown Source)at java.base/java.security.AccessController.doPrivileged(Native Method)at java.desktop/sun.awt.AppContext.initMainAppContext(Unknown Source)at java.desktop/sun.awt.AppContext.access$400(Unknown Source)at java.desktop/sun.awt.AppContext$3.run(Unknown Source)at java.desktop/sun.awt.AppContext$3.run(Unknown Source)at java.base/java.security.AccessController.doPrivileged(Native Method)at java.desktop/sun.awt.AppContext.getAppContext(Unknown Source)at java.desktop/javax.swing.SwingUtilities.appContextGet(Unknown Source)at java.desktop/javax.swing.UIManager.getLAFState(Unknown Source)at java.desktop/javax.swing.UIManager.maybeInitialize(Unknown Source)at java.desktop/javax.swing.UIManager.getDefaults(Unknown Source)at java.desktop/javax.swing.UIManager.put(Unknown Source)at ui.PlanAhead.<clinit>(SourceFile:169)ERROR: [Common 17-70] Application Exception: JVM: Can't find class: ui/PlanAheadERROR: [Common 17-211] Error loading jvm.is there a way to fix that?ThanksFollowComment"

Answer: "0Hi ynacson,Seems like you are trying to start Vivado in GUI mode. Could you let me know what steps you took to setup a GUI Desktop on your instance to help out further?Thanks,DeepCommentShareDeep_Panswered 2 years ago0Hey Deep,All I did is to install the Xauth package so the X11 forwarding to my linux machine would work over SSH.Are there any other steps I should follow?Thanks,YuvalCommentShareynacsonanswered 2 years ago0Seems like installing just xauth does not suffice. If you just plan to forward X from your instance, I was able to get all packages installed by running:sudo  yum groupinstall "X Window System"Let me know if that doesn't work for you.-DeepCommentShareDeep_Panswered 2 years ago0Works!!!Thank youCommentShareynacsonanswered 2 years ago0Works!!!Thank youCommentShareynacsonanswered 2 years ago"


Question: Custom Rule Not Being Evaluated

"I have a custom error page as HTTP Response when a page is blocked, for labels generated in SQLi Ruleset. It works.But, when I add another Rule in the same Rule Group for CommonRuleSet (CrossSiteScripting), it is not getting evaluated. Everything for this is similar to the one that is working, but it is still not getting evaluted!I followed the Priority and also the COUNT setting for the Rules that I need to have Label generated.Anyone came across this scenario?FollowComment"

Answer: "0It is possible that there's a slight misconfiguration after you add new statements/ modify the Label match rule. It would be good to share the rule configuration that you are using.In my understanding the rule would look something like this:{  "Name": "Label_Match",  "Priority": 0,  "Action": {    "Block": {      "CustomResponse": {        "ResponseCode": "200"      }    }  },  "VisibilityConfig": {    "SampledRequestsEnabled": true,    "CloudWatchMetricsEnabled": true,    "MetricName": "Label_Match"  },  "Statement": {    "OrStatement": {      "Statements": [        {          "LabelMatchStatement": {            "Scope": "LABEL",            "Key": "awswaf:managed:aws:sql-database:SQLi_Body"          }        },        {          "LabelMatchStatement": {            "Scope": "LABEL",            "Key": "awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body"          }        }      ]    }  }}CommentShareAWS-User-3413787answered a month ago"


Question: Recommended Lambda function size

"What is the best recommended memory size of the lambda function if we have to respond to 50,000 users at the same time ?In my case, right now lambda function uses maximum of 80 to 100MB of memory for single request.Edited by: awsIsg on Feb 26, 2019 5:09 AMFollowComment"

Answer: "0Accepted AnswerThe concurrency of the function is not related to the memory size of the function. The Lambda infrastructure will create multiple instances of your function to handle multiple requests, and each instance will have a seperate block of memory of the configured size.If you're aiming for 50,000 though, you will have other problems, the first of which being the default concurrency limit in lambda being 1000 (https://docs.aws.amazon.com/lambda/latest/dg/limits.html).CommentShareEllisonanswered 4 years ago0Thanks Ellison, it's really useful.CommentShareawsIsganswered 4 years ago"


Question: Redshift auto-copy interval and streaming ingestion storage

"Hi,I was testing Redshift's new features - auto copy from s3 and streaming ingestion.I have a few questions regarding these features.I understand that Redshift automatically decides the number of files to upload on Redshift in a batch. I wonder how often Redshift detects the file and try to upload the file. Does it decide the timing to upload files based on a specific file size or a specific time interval?When streaming data is transferred to Redshift from Kinesis data streams with streaming ingestion features, where will the data be stored? Will data be stored in Kinesis queue for 24 hours or not stored in anywhere?Thanks.FollowCommentSeanSi 5 months agoRedshift does not automatically detect and upload files to itself. Instead, you will need to use a separate tool or process to load data into Redshift from external sources.COPY command: You can use the COPY command to load data from Amazon S3, Amazon EMR, or other sources into Redshift. The COPY command is designed to efficiently load large amounts of data in parallel from multiple files. It can automatically detect the number of files to load in a batch and will divide the workload among the nodes in your Redshift cluster.ShareSeanSi 5 months agoRedshift Data Transfer Task: You can use the Redshift Data Transfer Task to schedule data loads into Redshift from a variety of sources, including Amazon S3, Amazon RDS, and Amazon DynamoDB. The Data Transfer Task can be configured to load data at specific intervals or on a one-time basis.Third-party tools: There are also several third-party tools and services available that can be used to load data into Redshift, such as Talend, Fivetran, and Stitch. These tools typically offer a range of features and configuration options,ShareSeanSi 5 months agoIn general, Redshift does not have a specific file size or time interval that it uses to determine when to load data. Instead, the decision of how and when to load data into Redshift will depend on the specific requirements of your application and the tools or processes that you are using to load the data.ShareSeanSi 5 months agoWhen you use the streaming ingestion feature of Amazon Redshift to load data from an Amazon Kinesis data stream, the data is not stored in the Kinesis data stream or in any other intermediate location. Instead, the data is transferred directly from the Kinesis data stream to Redshift and stored in the designated table within Redshift.By default, the streaming ingestion feature of Redshift loads data from the Kinesis data stream in real-time, as the data becomes available in the stream.ShareSeanSi 5 months agoIt is also worth noting that Kinesis data streams retain data for a configurable period of time, known as the retention period. By default, the retention period is 24 hours, but it can be set to a maximum of 7 days. This means that data that is added to the Kinesis data stream will be retained in the stream for up to the retention period, even if it has already been processed and transferred to Redshift. However, once the retention period has expired, the data is deleted from the Kinesis data stream and is no longer available.Share"

Answer: "0The auto-copy feature tries to balance out between incoming data velocity and the ingestion performance. There is not set threshold for N files or after N seconds, for the auto-copy to process the files. If the files are coming in rapidly then Redshift might wait a while and process a bunch of these files as a single batch. If the files are coming in slowly then its possible that Redshift might trigger the load even for a single file.In the streaming ingestion feature the data is stored in target Redshift Materialized View (MV).  New data from Kinesis is pulled into Redshift on refresh of this MV.CommentShareMilindOkeanswered 11 days ago"


Question: Importing an stack output in CDK gives an error

"I have a CDK stack that's exporting a value with the export name "wn:s3-static".  It shows up as I would expect in the CloudFormation console under 'outputs'.When I go to import it into a second stack, it's fairly straight forward:const staticBucketArn = cdk.Fn.importValue("wn:s3-static");The actual string returned by importValue is ${Token[TOKEN.366]} which is a token that presumabyl will get resolved at the time of deployment.  However, when I go to add this line:const staticBucket = Bucket.fromBucketArn(scope, "my-static-bucket", staticBucketArn);things go completely haywire and the stack won't even synthesize:Error: App at '' should be created in the scope of a Stack, but no Stack foundIt seems almost as if the .fromBucketArn() can't tolerate the .importValue() actually being a token.  I have read a ton of examples on this and seems like it should work.As an experiment, I tried this:const staticBucketArn = cdk.Fn.importValue("wn:s3-static");stack.tags.setTag("static-bucket", staticBucketArn)When deploying that stack, it sets the tag as you'd hope but look at the value from describe-stacks:            "Tags": [                {                    "Key": "static-bucket",                    "Value": "${Token[TOKEN.349]}"                }            ],I confirmed this by fetching the deployed stack's template.  So I think what it looks like is going wrong, in part, is just that these tokens get declared but never expanded.Any idea what I'm missing?FollowComment"

Answer: "1Accepted AnswerCouple of thoughts,Firstly, if you could provide more context in the second code snippet, it would be appreciated. As personally when passing the scope parameter I believe usingthis is more appropriate than scope. Assuming that the resource you want to build is attaching itself to the stack that you're defining it in. I believe passing the local scope parameter could lead to some weird dependency issues.Secondly, I would go to the CloudFormation console and find the export and verify its value. If the bucket is contained in another CDK stack, the token may be a token for the build process of that stack and not the stack you're deploying. In which case the cause of the issue is the method for exporting the ARN that is being used in the stack that builds the bucket. Not you referencing it.CommentShareDakota Lewallenanswered 4 months agowz2b 4 months agoThanks, your comments on this were extremely helpful.  The first problem I was having was with 'scope' ... you're right, and that's what that error message was telling me (I just did not understand it).  I needed to pass the stack in there, not the scope or construct.  The second part is harder.  Ultimately it's not a tag I want to put this into, it's environment vars for lambdas so they know how to find things they need.  What you said about that importValue() being used by the stack, not me, sounds like what's going on with my 'tag' example - I'm putting a literal string (the token) in there, there's probably no substitution to be done there.  I may end up having to use System Manager parameters for the runtime resolution of these resources.Share0I'm looking at how this actually works and I think I misunderstood a few things, but it's working now.  Here is an example.const staticBucketArn = cdk.Fn.importValue("arn-of-static-bucket-from-other-stack");stack.tags.setTag("static-bucket-1", staticBucketArn)cdk.Tags.of(stack).add("static-bucket-2", staticBucketArn);      Tags:        - Key: static-bucket-1          Value:            Fn::ImportValue: arn-of-static-bucket-from-other-stack        - Key: static-bucket-2          Value:            Fn::ImportValue: arn-of-static-bucket-from-other-stackwhich is exactly what you would hope it would do.  But trying to do anything at runtime with staticBucketArn yields the value of the token which makes no sense outside of to CloudFormation when the stack is processed.  I did not understand that when I split my stack; I thought the CDK was resolving those imports rather than just putting the ImportValue function call in the stack template.CommentSharewz2banswered 4 months ago0Unfortunately, you cannot use an imported value while synthesizing the CDK stack as you are trying to do with Bucket.fromBucketArn. The method Bucket.fromBucketArn is executed when you run cdk synth and expects an ARN that is already available at this time. However, the value returned by the Fn.importValue method will be only resolved when CloudFormation will deploy the synthesized stack (using the CloudFormation's Fn::ImportValue intrinsic function).You might want to use the bucket name instead of bucket ARN for your task. Just export the bucket name in the other stack instead of bucket ARN. With this trick, the bucket ARN will not be required at synth time, so it can be resolved later at deployment time.const staticBucketName = cdk.Fn.importValue("wn:s3-static");const staticBucket = Bucket.fromBucketName(this, "staticBucket", staticBucketName);CommentShareDmitry Balabanovanswered 4 months ago"


Question: OperationalError: SCRAM authentication requires libpq version 10 or above

"Glue is throwing this error when trying to work with psycopg2. How can I update libpq version on glue? This is a C library thats typically sym linked in the environment, this is not installed via python.FollowComment"

Answer: "0The version of libpq used by AWS Glue is managed by AWS and cannot be updated by users. However, you can try using an older version of psycopg2 that is compatible with the version of libpq used by AWS Glue.You can also try using the pure Python implementation of PostgreSQL client library, psycopg2-binary, which does not have any dependency on libpq. You can install it by running the following command:pip install psycopg2-binaryOnce you have installed psycopg2-binary, you can import it in your Glue job and use it instead of psycopg2. For example:import psycopg2_binary as psycopg2# use psycopg2 in your code as usualThis should allow you to use PostgreSQL with AWS Glue without encountering the SCRAM authentication requires libpq version 10 or above error.CommentShareEXPERTsedat_salmananswered 2 months ago0A temporary solution until libraries are updated is to revert the databases back to password encryption as MD5 after the database upgrade.  This is accomplished by creating DB cluster custom parameter group, changing the parameter 'password_encryption' to MD5, and applying it to the cluster. Take note all nodes will need to be restarted.You can see what password encryption is set to by running:CREATE EXTENSION rds_tools;SELECT * FROMrds_tools.role_password_encryption_type();This will solve the problem quickly allowing for time to get all the libraries upgraded and tested.CommentShareTim Seyfriedanswered 2 months ago"


Question: Real time speech to text converters

I have a use case to validate audio output from microphone using python for which I am thinking of using Real time speech to text converters.I have come across SpeechRecognition. I can see clients like Google Cloud Speech is working good but i am looking for aws solution for doing this.I have come across Amazon Transcribe.Also there is Real-time transcription from web.Is it possible to do Real time speech to text converters similar to this code .FollowComment

Answer: 0Amazon Transcribe has the ability to use a Python SDK for real time speech to text.https://docs.aws.amazon.com/transcribe/latest/dg/getting-started-sdk.htmlThere is a Python SDK which you can use:https://github.com/awslabs/amazon-transcribe-streaming-sdkCommentShareAWS-User-2184908answered a year ago


Question: I am user unable to access the Instance

"HiWe added I AM users using Elastic BeanStalk with Full EC2Access but they are unable to see the running instances. What are we missing? Also they could create an instance, but I as a root user do not see it. Why is this?Please help.FollowComment"

Answer: "1Accepted AnswerIf there are EC2 instances running that you can't see in the console as root, you're probably looking at the wrong Region.CommentShareEXPERTskinsmananswered 4 months agorePost-User-1387960 4 months agoThanks, that's very useful. Will try and check this, we are in different timezones so this could definitely be the issue.Share"


Question: Access files only through one site

"I wanted to configure my Buckets on Amazon S3, so that the files can only be accessed by a site of my choice.For example, I want the images that are hosted here to only be accessed through my blog that I have.FollowComment"

Answer: "1Hi,It is not possible to restrict it by plain domain. Even if you add aws:referer as condition in your bucket policy, then clients can still add it and by pass it.Instead, do it by restricting source ip: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-IPFinally, If you have CloudFront in front of the bucket, a more advanced way is to use WAF. https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-ip-conditions.htmlHope it helps ;)CommentShareEXPERTalatechanswered a month agorePost-User-5631830 a month agoSo does this mean that it is not possible to do hotlink protection?Share0You can setup custom bucket policy or else you can just paste the URL of the S3 image inside your blog and if you didn't share that URL with anyone, who is going to access itCommentShareJasper Samuelanswered a month ago"


Question: AWS account Hierarchy

"When we start with control tower, 2 accounts within security OU, i.e. log archive and audit accounts are created. On this structure I have a few questions:I read detective guardrails are implemented by AWS config. But why can't I see those under config rules of AWS Config service.I understand that Audit account has power to access other accounts programmatically. I thought this is the reason why security services like security hub, aws config and other security related services are hosted here. But in my project, security services are hosted in a separate account rather than audit account. If so, what is the purpose of audit account. Also, is it necessary for the account which holds centralized aws config aggregator, security hub etc. to have a programmatic access on other accounts?By default, does log archive account just collects cloudtrails from all other accounts. Under AWS best practices, I see that audit account holds all the security services and also acts as a AWS config aggregator. At the same time, all logging (including DNS, VPC etc.) happens under Log archive account. If so, do we need to explicitly send aggregator logs in audit account to centralized s3 bucket under archive account.FollowComment"

Answer: "0AWS Control Tower Guardrails and AWS Config Rules:Control Tower uses AWS Config for guardrails, but they don't show up as regular AWS Config rules. They are managed by Control Tower itself.Purpose of the Audit Account:The Audit Account is used to grant read-only access for auditing purposes. Security services can be hosted in a separate account, and the Audit Account can be granted read-only access to them.Programmatic Access for Security Services Account:Yes, the account hosting centralized security services like AWS Config Aggregator and Security Hub should have programmatic access to other accounts to collect and analyze data.Log Archive Account:By default, the Log Archive Account collects CloudTrail logs. If you want to centralize other logs like DNS or VPC logs, you need to set up forwarding from the Audit Account to the Log Archive Account. This ensures that all logs are in one place for analysis and long-term storage.CommentShareEXPERTsedat_salmananswered 2 months agoEXPERTBrettski-AWSreviewed 2 months agonishan 2 months agoOn your last point, if audit account is hosting the aws config aggregator but I still want to centralize aws config logs to S3 in archive account. Is it possible to send config aggregator logs to s3 in other accountShare"


Question: Issue with App Runner service quota

"I am trying to create an App Runner service using container image from ECR from AWS Console for us-east-1 region. When I submit my service creation request, I receive the following error, saying it's exceeding my service quota which is zero. I have seen another post where it says that the issue has been resolved and rolled out to all regions. But since it occurred again, wanted to check if this is an ongoing issue?FollowComment"


Question: [Bug] [CodeArtifact] 409 status when publishing multiple versions of the same artifacts at the same time

"I frequently get errors such as the following:Caused by: java.io.IOException: Server returned HTTP response code: 409 for URL: https://-.d.codeartifact.us-east-1.amazonaws.com/maven/releases/<redacted>This seems to be happening when performing concurrent releases of the same artifacts (different branches, different versions).FollowComment"


Question: Can I attach a VPC to two different TGW's in the same region?

Can I attach a VPC to two different TGW's in the same region?FollowComment

Answer: "0Accepted AnswerYup https://aws.amazon.com/transit-gateway/faqs/#Performance_and_limits A VPC can be connected to up to 5 TGWs. What's the use case though? Most customers really only need 1 and can use route table on TGW to segregate traffic.CommentShareAWS-James-Devineanswered 3 years ago0Yes, you can attach up to 5 TGWs per VPC but all those TGW must be in the same region as VPC.CommentShareAWS-User-787786answered a year ago"


Question: Changing HTTP response code on API Gateway with DynamoDB integration

"When integrating API Gateway directly to DynamoDB, is it possible to modify the HTTP Status code (not the response body, which can be transformed) from an HTTP 200 OK to an HTTP 4xx Error if there is no record found?FollowComment"

Answer: "1I had the same issue as the poster here. The accepted answer seems to me not to be the answer the to question, as it only covers cases where DDB return a 400 error. The ResourceNotFoundException will only be triggered if the query is against an Index og table that does not exists. But my issue (and I believe the original post) was how to get API Gateway to return 404 when No Rows are found based on the query. In that case DDB will return a HTTP 200 code, so the only way to determine this is to look at the response body from DDB which is empy.I solved this in the integration mapping response template. There you can check the Count attribute in the DDB response, and modify the response code. This worked for me:#set($inputRoot = $input.path('$'))#if($inputRoot.Count == 0)  #set($context.responseOverride.status = 404)#else    #foreach($elem in $inputRoot.Items) {        "progress": "$elem.progress.S",        "content_id": "$elem.content_id.S",        "updated": "$elem.updated.S"    }#if($foreach.hasNext),#end    #end #endCommentShareKetilanswered a year ago-1Accepted AnswerYes, it can be achieved by adding HTTP 4xx in the method response, and map the corresponding response from DDB (DynamoDB) to it in the integration response. Without this, all the response status code will be mapped to 200.In your case, DDB should return HTTP 400 (ResourceNotFoundException) if no items found, as can be seen in the API reference hereYou can then define a 404 in the method response, and in the integration response defining a Regex to map 400 from DDB to the 404 in method response.To elaborate a bit more, for AWS/HTTP(s) backend integrations, API Gateway uses the HTTP status code from the backend to match against the Regex defined in each HTTP response in the integration response to determine which status code to return to the client. In case of Lambda backend, it is looking for the "errorMessage" in the response as detailed in this blog.CommentShareAWS-User-3984110answered 6 years ago"


Question: Microservices with shared database

"Hi there,As is not recommended by "Database per service" design pattern, every integration between microservices should be done with any messaging system?We have an application where users can upload videos.The API is available using GraphQL, and we have federation to route the video uploads to a cluster of servers responsible to create the video in the database (RDS).Once the video is uploaded to S3, a service that is triggered by a S3 event start a MediaConvert job to create a HLS profile.Once completed, we need to mark the video as available to viewers (updating the table).What is the best practice to do this?The convert service should connect to the database and update the record?Execute a service API to update the record?Send a SQS message that will be handle in the cluster that is connected to the database?FollowCommentalatech EXPERT4 months agoIf below helps, please upvote/accepted. It would be appreciated!Share"

Answer: "0The answer is it depends.  This is due to number of users, throughput request/seconds and other values.A suggestion could be to send the S3 event notification to an SQS queue or an SNS Topic. Then the consumer could be a Step Function that has 2 states:the Media converter.update of the database. This could be a lambda function which has an RDS proxy integration in front of the RDS database.In this serverless way, you could retry, keep an eye on the flow, ensure the converter does not get overwhelmed by requests.CommentShareEXPERTalatechanswered 4 months agoLuciano 4 months agoGreat suggestion, thanks!My concern still on the 2nd state of the step function. So would the step function connect to RDS (proxy or not) and not use another service that perform operations in the table?Sharealatech EXPERT4 months agoIn this scenario I would have the second step using a Lambda or container that connects directly to RDS via using an RDS proxy.I see your point of abstracting the db layer by having it responsible to handle db interactions. In my experience it just felt a bit over engineering as it would have pretty much the same role as an RDSProxy, but if you want to create an api that is used as api layer that then calls rds proxy, the there may be more latency and be potentially a bottleneck, but up to you.Hope the answer makes good sense and helps you!Share"


Question: Interact from a cloud to AWS Directory

"I have a cloud service for managing company's users, now I have an attempt to manage AWS Directory, exploring AWS APIs I find some, but not for managing, for that I'm using domain controller to getting LDAP users and after deleting, the solution is working fine if you put in the same network. Now, my cloud service it's not in the internal network, and I have a problem with the connection, I'm searching for connecting externally as a trusted machine to my AWS Directory, without a VPN or using an AWS service, in AWS documentation I find some definitions as trusted network, but no any precision solution and my questions stand to: Is it possible to connect to AWS Directory externally as a trusted network by IP and port for managing it? If yes, how? Thank you!FollowComment"

Answer: 1AWS Managed AD is not a publicly accessible service. It is never a good idea to make Active Directory publicly routable as you are opening the directory up to attack. With that said. you could put a load balancer in front of the ENIs for the service and make the LB accessible. This is an unsupported AWS configuration and not recommend Microsoft either. (https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/support-for-active-directory-over-nat)CommentShareEXPERTJeremy_Ganswered a year agoEXPERTRob_Hreviewed 2 months ago


Question: ""login successful... connection problem, giving up" after reboot"

"My:i-0a962b3f00a12bb6cUbuntu c5.large instance had been running for 237 days without hitch, but the disk got full while I was trying to update something and despite deleting ~450Mb of data the program was still stuck with a disk write error, so I shut it down, waited for it to finish, then started it back up again.Now when I try to connect via windows remote desktop like I always do, I put in my name and password and it shows:connecting to sesman ip ...sesman connect oksending login info to seesion manager, please wait...login successful for display 10started connectingconnection problem, giving upsome problemCan anyone point me towards sorting this out? I "deleted" the ~450Mb, not moved them using [rm -rf] not just moved them to the trash bin, and looked in the trash bin to make sure all was well... Maybe something to do with the disk still thinking it's full though? Maybe to do with these e-mails?:"We are writing to inform you that Canonical Group Limited has added a new version to Ubuntu 18.04 LTS - Bionic on AWS Marketplace. As an existing customer, your subscription to the product, any running instances and access to previous versions are unaffected. However, Canonical Group Limited does recommend you to update to the latest version, Ubuntu 18.04 LTS - Bionic/Ubuntu 18.04 20210623 by visiting"Thank you.FollowComment"

Answer: "0I was able to connect through PuTTy and free up some disk space, resolving the issue.CommentShareMalkereanswered 2 years ago0I was able to connect through PuTTy and free up some disk space, resolving the issue.CommentShareMalkereanswered 2 years ago"


Question: Amazon Kinesis Video Streams RTSP demo application shutting down after some time (producer-cpp) using docker

"Hi team,I have setup two RTSP cameras on my network and I have followed the RTSP demo application (https://github.com/aws-samples/amazon-kinesis-video-streams-demos/tree/master/producer-cpp/docker-rtsp) that uses docker desktop on Windows to send both streams to Amazon Kinesis Video. I was successfully able to see each video feed on amazon console for each stream. However after I left the sample to run for some time. After some time the process shuts down and the stream is stopped. I can see some warnings before the error "Error received from element source: Could not read from resource." is thrown. Seems the first warning that is thrown is " curlCompleteSync(): curl perform failed for url https://xxxxxxxxxxxxxx.us-west-2.amazonaws.com/putMedia with result Failure when receiving data from the peer: OpenSSL SSL_read: Connection reset by peer, errno 104".I have seen some suggestions on threads on this site which suggested to turn down the camera stream "Frame Size", "Max Bit Rate", "Target Quality" and finally "Intra Frame Period". When I was running at ("Frame Size" = "1920 1080") sometimes it would stop stream after about 20-30 mins. But since I have turned it down to ("Frame Size" = "640 360", "Target Quality" = "Medium", "Max Bit Rate" = "1 MBps" and "Intra Frame Period" = "1s") and it actually ran for about 2.5 hours before shutting down with the same issue. Not sure if this is related by I figured I should share it.I have blacked out all the keys and credentials and attached two screen shots to this message. They contain all the warnings and the error that is thrown before the process is shut down. We plan to use architecture for a client and we will be adding many more cameras to the network.Can you please guide me to what can be causing this issue and ways to improve this so the process does not shut down. Right now I'm not sure if this could be related to network, security camera or the code.  Also please let me know if you need anything else.Thanks for your timeFollowComment"

Answer: "0I have a member of my team having this problem before,the possible reasons areNetwork connectivity: Make sure that the machine running the RTSP producer has a stable and reliable network connection.RTSP camera configuration: Check the settings on the RTSP cameras and make sure they are configured correctly. In particular, try reducing the frame size, bit rate, and target quality to see if this helps improve the stability of the stream.RTSP producer configuration: Make sure that the RTSP producer is configured correctly. In particular, try increasing the retry count and retry interval to see if this helps improve the stability of the stream.AWS Region: Make sure that you are using the correct AWS Region for the Amazon Kinesis Video Streams service.The exact reason will need some divide and conquering by you @seekrisCommentShareSeanSianswered 5 months agoshervinmirsaeidi 5 months agoHi Sean,Thank you for your response.Here where I have got so farThere is no issue with networkAs mentioned in my post above I have tried to turn down  bitsize, bitrate and target quility and I noticed some improvement. The process ran for longer but still ran into same issue after some time.The region I have always used for my POC has always been the same which is  US West (Oregon). I have not had any issuesThe one thing I think could maybe solve my problem is your third suggestion with configuration of the RTSP producer. The issue here is that the way we set the docker up is we execute the command to create a container from an image than start and run it. I cannot access any of the code to be able to change any configuration on it. Can you maybe elaborate more on this? Like how would I configure the RTSP producer to increase the retry count and interval using the docker method from here (https://github.com/aws-samples/amazon-kinesis-video-streams-demos/tree/master/producer-cpp/docker-rtsp)These are the steps I have followed to get the sample running1.Downloaded the docker file on machine on my network2. Ran the command "docker build -t rtspdockertest ." on windows command prompt3. Ran the command "docker run -it <IMAGE_ID> /bin/bash"  on windows command prompt4. Ran the command "AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID> AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY> ./kvs_gstreamer_sample <STREAM_NAME> <RTSP_URL>"  on windows command promptShare"


Question: lex bot web integration

"dealing with lex web ui integration; I'm using lex apiurl = https://runtime-v2-lex.us-east-1.amazonaws.com/bots/botid/botAliases/botaliasid/botLocales/en_US/sessions/Session23_/textthis api work fine on postman, I typed a simple python script and it's works fine also.But when I tried to integrate this api with necessery authorizations into a web page using html/jsI got this error :caught ReferenceError: AWSRequestsAuth is not definedI even tried to reinstall AWSRequestsAuth with the command below but in vain:pip install aws-requests-auth** HTML page script : **<!DOCTYPE html><title>Chatbot Example</title>
Chatbot Example
<form>Input:<input type="text" id="input" name="input"><button type="submit">Send</button></form>

FollowComment"

Answer: "0Hi,it could be related that you are missing some script that expose the missing component.Try to look here: https://github.com/aws-samples/aws-lex-web-ui/blob/master/src/README.md as it could be the aws-lex loader the culprit.Hope it help ;)CommentShareEXPERTalatechanswered a month agoayoub a month agothanks for responding; I don't think so because the problem is related to the AWSRequestsAuth library  that is not running  correctly, although I already install it,this is what I got with pip list command :Package            Versionaws-requests-auth  0.4.3Share0There is an opensource web UI for Lex that you could either use, or perhaps look at the code for inspiration.https://github.com/aws-samples/aws-lex-web-uiCommentShareThomas_Ranswered a month agoayoub a month agothank you for your response, but this is not realy what I want,you can refer to this question that I passed it earlier :https://repost.aws/questions/QU2xpXzP-8RAK4zCI-hpgrSA/aws-lex-bot-apiI want simply to integrate le lex enpoint into a simple web page that takes the input of the api from the user then display the response into the web pageShare"


Question: One of my instances is stuck at login screen (viewed on system logs) after restarting or stop then start! Can't SSH to it!

"I have 4 instances on EC2 and there is only one of them that I can't connect to in SSH even if I restart or stop then start it. After long minutes of initialisation, the instance console tells me that "1/2 verifications succeed" and when I check the System Logs, I see that the instance is stuck at the login screen. It show "Ubunutu 20.4 LTS <my_instance name> login :". I really need this instance, it's very important!PS : how can I attached pictures to my question?FollowComment"

Answer: "0What if you try the take a snapshot of the instance and then try recreating it?CommentSharefw-spbelanianswered a year ago0For troubleshooting, you might want to see if the EC2 Serial Console can help.When the instance is shut down (not terminated!) you can attach the EBS volume to a working instance to change the filesystem - but that may only help if you know what is wrong.Finally, the AWS EC2 support team are there to help - raise a support ticket with them if you are stuck; the challenge with re:Post is that we don't have access to your environment; we can supply information and suggestions only.CommentShareEXPERTBrettski-AWSanswered a year ago-1Hi, you could try this Troubleshoot instances with failed status checksre:Post doesn't cater attachments at this stage, you could use something like https://puush.me/CommentShareSrianswered a year agoThoms R a year agoHi, thanks for your reply, I already tried the contents that concerned my problems and none of them help me to resolve this login screen problem...ShareSri a year agoPlease don't dislike the answer, I am trying my best to help with the info that was provided.There were no log messages to help you further. Appreciate that someone has taken time to research and respond. There was no mention of you going through the link that was provided.ThanksShare"


Question: Monitoring Amazon Managed Prometheus (AMP)

"Hello,We would like to see metrics like prometheus_tsdb_head_series or similar that show how many samples we have in AMP.Also, we want to see a count of queries as AWS will begin billing for queries in June.Is there any way to monitor AMP usage? Preferably with metrics available via AMP, but we'd be happy to have access to that information in any form.Thank you!FollowComment"

Answer: "0Hello,I am looking for the same thing. For now the only useful piece of information I could find is from the Cost Explorer.CommentShareAWS-User-8719920answered a year ago0We would like to see metrics like prometheus_tsdb_head_series or similar that show how many samples we have in AMP.This is already possible:awscurl --service="aps" \  --region="us-east-1" \  "https://aps-workspaces.us-east-1.amazonaws.com/workspaces/${WORSKPACE_ID}/api/v1/query?query=prometheus_tsdb_head_series"CommentShareUser2229answered 8 months ago"