Question: event_scheduler is OFF in Aurora MySQL Serverless DB despite being set in the parameter group

"We're using an aurora-mysql5.7 Serverless database, and have created a new DB cluster parameter group with event_scheduler set to ON. After switching the cluster's parameter group and confirming the cluster was rescaled in the logs, the change hasn't taken effect in MySQL.SHOW VARIABLES LIKE "event_scheduler"; outputs OFF, and SELECT LAST_EXECUTED FROM INFORMATION_SCHEMA.EVENTS; returns null for the event I created, despite it being well over the interval.I can't find anywhere in the documentation about this parameter not being compatible with Aurora Serverless, so not sure why this doesn't seem to be working.FollowComment"

Answer: "1Accepted AnswerHello Bhollier,I understand that you are trying to set the event_scheduler of your aurora-mysql5.7 serverless database to on and the change do not take effect.Please always make sure to reboot your instance after applying the changes to your parameter groups, see reference [1] for more information on rebooting database instances.You can also check if the specific property modification is supported by the Serverless engine or not by running this command:aws rds describe-db-cluster-parameters --db-cluster-parameter-group-name <param-group-name>If the parameter group is supported, the output of the command will show:"SupportedEngineModes": [            "provisioned",            "serverless"]If you are using Aurora Serverless v2, please refer to reference [2] for the parameter groups configuration.If you are using Aurora Serverless v1, please refer to reference [3]: (Modifying parameter values for Aurora Serverless v1) for the parameter groups configuration.Please also note that unlike provisioned Aurora DB clusters, an Aurora Serverless v1 DB cluster has a single read/write DB instance that's configured with a DB cluster parameter group only—it doesn't have a separate DB parameter group. During autoscaling, Aurora Serverless v1 needs to be able to change parameters for the cluster to work best for the increased or decreased capacity. Thus, with an Aurora Serverless v1 DB cluster, some of the changes that you might make to parameters for a particular DB engine type might not apply and therefore the event_scheduler parameter may not be modifiable in Aurora Serverless. For more information on this, please refer to reference [3].You can get a list of default values for the default parameter groups for the various Aurora DB engines by following the information on reference [4].For more information on Aurora MySQL configuration parameters, please see reference [5].References:[1] https://docs.aws.amazon.com/cli/latest/reference/rds/reboot-db-instance.html[2] https://docs.amazonaws.cn/en_us/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.setting-capacity.html#aurora-serverless-v2.parameter-groups[3] https://docs.amazonaws.cn/en_us/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v1.how-it-works.html[4] https://docs.aws.amazon.com/cli/latest/reference/rds/describe-engine-default-cluster-parameters.html[5] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.html#AuroraMySQL.Reference.Parameters.InstanceI hope this helps.CommentShareAsenathianswered a year ago"


Question: How can I add a fleet of wireless devices to AWS IoT Core for LoRaWAN similar to JITR

I want to be bale to add a lot of devices automatically when they first activate and not one by one using the console or the API.I think I need to use OTAA but it is not clear to me how I can automate this process.I read this  but did not understand how to scale this.ThanksFollowComment

Answer: "0Hi. For OTAA to work, the device needs to be already created in AICL. This is because the join request carries the App/Join EUI and Dev EUI. AICL uses this information to find the right device in the registry, and find the right root keys for the device, to then create the session keys.At this time, AICL does not have an equivalent to JITP/JITR. However, you can use the CLI/API/SDKs to build something similar to Bulk Registration. More or less a loop around CreateWirelessDevice iterating over your list of devices (containing the App/Join EUI, Dev EUI and root keys of each device).https://docs.aws.amazon.com/cli/latest/reference/iotwireless/create-wireless-device.htmlhttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iotwireless.html#IoTWireless.Client.create_wireless_devicehttps://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IoTWireless.html#createWirelessDevice-propertyCommentShareEXPERTGreg_Banswered a year agoGreg_B EXPERTa year agoNew code sample: https://github.com/aws-samples/aws-iot-core-lorawan/tree/main/automation/batchregistrationShare"


Question: DataSync Agent on EC2 VM

"HelloI would like to ask about DataSync Agent deployed on EC2 VM. We have EC2 machine with DataSync Agent installed and we noticed that both the machine kernel and the agent itself are outdated.According to FAQ (https://aws.amazon.com/datasync/faqs/):A: Updates to the agent VM, including both the underlying operating system and the AWS DataSync software packages, are automatically applied by AWS once the agent is activated. Updates are applied non-disruptively when the agent is idle and not executing a data transfer task.But it doesn't seem to be working for us. So the question is how to fix the automatic update or update the machine and agent manually?I would appreciate any help on this topic.Best regardsFollowComment"

Answer: "0Accepted AnswerHello,You are correct that updates to the DataSync agent are managed directly by AWS.  Agent updates occur on an ongoing basis while the agent is actively connected and activated to the AWS DataSync service.   Verify you have opened the correct ports outbound from your agent to AWS.  These ports can differ depending on if you activated your agent over a public of private endpoint.https://docs.aws.amazon.com/datasync/latest/userguide/datasync-network.html#using-vpc-endpoint3If the agent is not updated after verifying outbound ports please open a support case.ThanksCommentShareDarryl_Dioanswered a year ago"


Question: Cloud9 - AWS Resources vs AWS Toolkit - API Gateway -> Lambda Testing

"AWS Toolkit is replacing the old AWS Resources part of Cloud9.I use this to develop Lambda functions invoked via API Gateway, using CloudFormation/SAM templates.With AWS Resources, I can test via "Run API Gateway Local" right in my Cloud9 IDE.From what I can tell, this is not possible with AWS Toolkit, and I would have to test the Lambda directly (w/o mimicking the request as coming from API Gateway).Can anybody tell me how I can accomplish the equivalent of "Run API Gateway Local" with AWS Toolkit?Or is this a great feature that is just being taken away?Thanks.FollowComment"

Answer: "0Thank you @oyku. I did figure that out. However, there are 3 things about the new AWS Toolkit that are just not good:It takes about 40s to run a single test (every time)AWS Toolkit somehow loses credentials pretty often - perhaps every 5 or 10 minutes. This causes any DynamoDB/other AWS requests to fail with security issues.A browser refresh fixes this, but it is extremely annoying.AWS CLI, etc. all continue to work fine. So the issue seems to be specific with AWS Toolkit.Every time I use AWS Toolkit to run/test, it creates a ~500MB directory in /tmp/aws-toolkit-vscode . If I leave my instance running for a long time, this quickly fills up disk space and I have to manually remove all of these temp files.Do you have any insight or advice to work around or fix these issues?Thanks!CommentSharejohn_pkanswered a year agoBanning 8 months agowere you ever able to get this to run any better?Share-1Hi @john_pk, you can follow "Running and debugging local Amazon API Gateway resources" section in this Running and debugging serverless applications guide. You will need to create a new launch configuration as stated. Please let us know if that doesn't work for you.CommentShareoykuanswered a year ago"


Question: Any solutions to upgrade RDS Oracle zerodowntime

"Dear guysI checked the document, it looks like it requires the downtime when we upgrade RDS Oracle.Do we have any solutions to avoid the downtime when we upgrade DB?FollowComment"

Answer: "0When you upgrade an RDS for Oracle DB instance, this is an in-place upgrade and requires downtime for your applications during the upgrade process. The duration of the outage varies based on your engine version and the DB instance class. If the duration of the outage isn’t desirable for your application, an alternative approach is to use logical replication with AWS Database Migration Service (AWS DMS) to minimize downtime during the upgrade process. AWS DMS makes it easy to migrate data from a source data store to a target data store and replicate ongoing changes to keep sources and targets in sync. You can do a POC for the same.References :https://aws.amazon.com/blogs/database/upgrading-amazon-rds-for-oracle-database-engine-with-minimal-downtime-using-aws-dms/https://aws.amazon.com/blogs/database/achieve-minimal-downtime-for-major-and-minor-version-upgrades-of-amazon-rds-for-oracle-using-oracle-goldengate/https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-for-oracle-db-instances-from-12c-to-19c/CommentShareEXPERTAWS-User-Nitinanswered 5 months ago"


Question: Assign an ARN to a Trust Anchor?

"Is it possible in TypeScript to assign an ARN to a Roles Anywhere trust anchor?An "attrTrustAnchorArn" property is shown associated with the CfnTrustAnchor class, but is it settable?Thanks in advance.FollowComment"

Answer: "0Hello, the properties specified in "Construct Props" section are the values that you can define/set for a resource.The properties specified in "Properties" sections of the documentation : https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-rolesanywhere.CfnTrustAnchor.html are the ones that can be extracted from the resource created. Thus "attrTrustAnchorArn" is the property that we get from the resource that is created, we do not set it.CommentShareAWS-User-113answered 2 months agoDave Clark 2 months agoThank you for your reply.  So, understanding that attrTrustAnchorArn is read-only ... is there any way to assign an ARN to a trust anchor?Share"


Question: aws gamelift cli how to wait for active fleet before changing alias.

"Hi, I want to automate my pipeline so every build generates a new fleet and in turn our alias points to that fleet. However if I do that I get some down time between one fleet and the other. Is there a way to say cli to activate the fleet and wait for it to be active?FollowComment"

Answer: "2Hey!While I don't think there's an inbuilt mechanism via the AWS CLI to do this, you should be able to write a command line script that polls periodically on the fleet status using the describe-fleet-attributes command.  Note that this API has low call limits per second, so you should additionally ensure you have appropriate backoff and retry mechanisms in place to avoid getting throttled.Thanks!CommentShareShashankJ_AWSanswered 8 months agoEXPERTToni_Sreviewed 8 months ago"


Question: s3 bucket policy

Hello.I have an s3 bucket. it's open for getObject for everyone.I want to allow putObject method only for s3 signed url and cloudfront signed url.How should I adjust my policy?FollowComment

Answer: "0Accepted AnswerHello, you can adjust the bucket policy to include a condition that checks for the presence of a specific query string parameter that is included in the signed URLs. below is example for this:{    "Version": "2012-10-17",    "Id": "S3PolicyId1",    "Statement": [        {            "Sid": "Allow-put-object-only-with-signed-url",            "Effect": "Allow",            "Principal": "*",            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::bucket-name/*",            "Condition": {                "StringLike": {                    "aws:url-param": "URL-signature=*"                }            }        }    ]}This gonna allows putObject for S3 signed URLs that include "url singature" query string parameter. As for the CloudFront signed URLs, you can use cloudfront:signedUrl in the Principal field, and also include a condition that checks the presence of the CloudFront-Signature query string parameter.{    "Version": "2012-10-17",    "Id": "CloudFrontPolicyId1",    "Statement": [        {            "Sid": "Allow-put-object-only-with-signed-url",            "Effect": "Allow",            "Principal": {"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity"},            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::bucket-name/*",            "Condition": {                "StringLike": {                    "aws:url-param": "CloudFront-Signature=*"                }            }        }    ]}CommentShareOlwi Mamdouhanswered 5 months agorePost-User-2739165 5 months agothank you for answerShare"


Question: Unexpected Bill

I am using aws as learning. But i have no knowledge about billing. suddenly i saw aws billing dashboard Amount USD 118 is charge please remove this amount because i am a student. I have no money to pay this amountFollowComment

Answer: "0You will need to open a support case via the console: https://support.console.aws.amazon.com/support/home#/case/create.I would also recommend that you will check in the bill to see where the charges are coming from and stop the relevant services.CommentShareEXPERTUrianswered 7 days agoEXPERTsdtslmnreviewed 7 days ago0You have to login AWS console and then go to support center, open a support case under Account&Billing category.Support team will guide you how to stop unexpected billing.https://support.console.aws.amazon.com/support/CommentShareHyeonanswered 7 days ago"


Question: MSK cluster with SCRAM-SHA-512 suddenly throws authentication error

"Hi,I have an MSK with SASL SCRAM-SHA-512 and all pubs/subs connected to it never had a problem until now - Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512; I see this message in the logs and there is obviously a problem publishing messages right now.The applications(NestJS using Kafkajs under the hood) are retrieving the secret associated with the cluster at runtime plus the list of brokers and they used to connect successfully:https://kafka.js.org/docs/1.10.0/configuration#sasl                              ssl: true,                                sasl: {                                    mechanism: KAFKA_SASL_MECHANISM,                                    username,                                    password,                                },Nothing in the cluster s configuration has changed - the security group is the same, and the cluster configuration. Cluster doesn't have any ACLs.Any ideas would be appreciated.FollowComment"

Answer: "0Hello.I think it would be good to check the two links below for your inquiry.https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-msk.html#pipes-msk-cluster-permissionshttps://docs.aws.amazon.com/msk/latest/developerguide/limits.htmlIf there is no change in setting, please check the phrase below."Limits on TCP connections. A cluster that uses IAM access control can accept new connections at a rate of up to 20 TCP connections per broker per second for all broker types, except for the type kafka.t3.small. Brokers of type kafka.t3.small are limited to 4 TCP connections per broker per second."Thank you.CommentShareAWS-User-6847632answered 2 months ago"


Question: VPC Peering between govcloud and commercial account

Asking on behalf of a customer: Do you have any documentation that clearly explains if it's possible or not to use VPC peering between a govcloud account and a commercial account?My guess is it's not possible but having a reference would be super helpful.FollowComment

Answer: 2The AWS GovCloud (US) Regions are physically isolated and have logical network isolation from all other AWS Regions therefore you will not be able to peer a standard and a GovCloud VPC.https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-differences.htmlCommentShareEXPERTTushar_Janswered 6 months agoEXPERTBrettski-AWSreviewed 6 months ago


Question: Create a shortcut to directly open an Appstream URL

"Created a shortcut using the instructions here: https://repost.aws/questions/QU1fRwlNPySpKH9BBjyFkZcA/appstream-windows-client-prompts-user-for-starturlAnd here: https://repost.aws/questions/QULcr96nLrQ8SZhW4pCYYynQ/trying-to-set-up-a-shortcut-to-directly-open-an-appstream-urlRan powershell command to convert URL into a Base64 encoded URL for use in the shortcut: [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("URL"))The URL is listed in the registry under the Trusted Domains string in HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\AppStream ClientThe shortcut opens the Appstream client with the correct URL pre populated, but it doesn't connect automatically and I can't connect because the connect button is greyed out.FollowComment"

Answer: "0Thank you for your question. With regards to the connect button being greyed out. It appears that the trusted domain configured in Registry location "HKLM:\Software\Amazon\AppStream Client" for TrustedDomains is not properly defined. And this is why the connect button is greyed out. Please ensure that the trusted URL meets the required trusted domains formatting. Please refer here for more information on the format mentioned here [1]. In addition, to connect to appstream, the user will need to initiate connection by clicking the connect button.Reference[1] https://docs.aws.amazon.com/appstream2/latest/developerguide/install-client-configure-settings.html#set-trusted-domains-registry-valueCommentShareSUPPORT ENGINEEREse_Aanswered 13 days agoEddie Vev 12 days agoAdded the following in this key: HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\AppStream Client Start URL: https://vanguardesf.oktapreview.com/home/amazon_appstream/0oa1bx5l2brIlL9dX0h8/aln9q1lsu36TfGB4x0h7 TrustedDomains: vanguardesf.oktapreview.com, vanguardesf.okta.com, appstream2.us-east-1.aws.amazon.com, appstream2.us-west-2.aws.amazon.com, appstream2.ap-southeast-2.aws.amazon.com, appstream2.eu-central-1.aws.amazon.com, appstream2.eu-west-2.aws.amazon.comWhen I click the installed Appstream Icon, I get the correct start URL, and the connect button is blue: https://vanguardesf.oktapreview.com/home/amazon_appstream/0oa1bx5l2brIlL9dX0h8/aln9q1lsu36TfGB4x0h7When I click the homemade shortcut, I get the desired start URL for the shortcut, but the Connect button is grey: https://vanguardesf.oktapreview.com/home/amazon_appstream/0oa1jmmwp5hZRSmul0h8/aln9q1lsu36TfGB4x0h7Share"


Question: IAM Policy - AWS Transfer Family

"Hello,This question may seem a bit long-winded since I will be describing the relevant background information to hopefully avoid back and forth, and ultimately arrive at a resolution. I appreciate your patience.I have a Lambda function that is authenticating users via Okta for SFTP file transfers, and the Lambda function is called through an API Gateway. My company has many different clients, so we chose this route for authentication rather than creating user accounts for them in AWS. Everything has been working fine during my testing process except for one key piece of functionality.Since we have many customers, we don't want them to be able to interact or even see another customer's folder within the dedicated S3 bucket. The directory structure has the main S3 bucket at the top level and within that bucket resides each customer's folder. From there, they can create subfolders, upload files, etc. I have created the IAM policy - which is an inline policy as part of an assumed role - as described in this document: https://docs.aws.amazon.com/transfer/latest/userguide/users-policies.html. My IAM policy looks exactly like the one shown in the "Creating a session policy for an Amazon S3 bucket" section of the documentation.The "transfer" variables are defined in the Lambda function. Unfortunately, those "transfer" variables do not seem to be getting passed to the IAM policy. When I look at the Transfer Family endpoint log, it is showing access denied after successfully connecting (confidential information is redacted):<user>.39e979320fffb078 CONNECTED SourceIP=<source_ip> User=<user> HomeDir=/<s3_bucket>/<customer_folder>/ Client="SSH-2.0-Cyberduck/8.3.3.37544 (Mac OS X/12.4) (x86_64)" Role=arn:aws:iam::<account_id>:role/TransferS3AccessRole Kex=diffie-hellman-group-exchange-sha256 Ciphers=aes128-ctr,aes128-ctr<user>.39e979320fffb078 ERROR Message="Access denied"However, if I change the "transfer" variables in the Lambda function to include the actual bucket name and update the IAM policy accordingly, everything works as expected; well, almost everything. With this change, I am not able to restrict access and, thus, any customer could interact with any other customer's folders and files. Having the ability to restrict access by using the "transfer" variables is an integral piece of functionality. I've searched around the internet - including this forum - and cannot seem to find the answer to this problem.Likely, I have overlooked something and hopefully it is an easy fix. Looking forward to getting this resolved. Thank you very much in advance!FollowComment"

Answer: "1Accepted AnswerHello,Thank you for sharing additional details.I would like to mention ${transfer:*} variables are not supported within policies attached to IAM Roles. Therefore, if you have them there, I would suggest you remove them as they won't be substituted. And as they are not substituted, S3 considers them as is which leads to Access Denied errors. Those variables are only applicable to Session Policies associated directly to the Transfer User or as part of their HomeDirectory configuration (Only ${transfer:Username} for this case).To your use-case, the ask is to have some sort of dynamic mapping based on the UserName, specifically the domain section to a similar named prefix in S3. In this case, I would suggest the Logical Directories approach and eliminate Session Policy troubles. Please refer the following workflow -Client connects to the server and Lambda eventually receives a request for the same.Lambda performs the necessary authentication checks with Okta and then starts to build up the response back to the server. [Assuming authentication succeeded]Within this response, you build the Logical Directory based off the domain within the Username section. Lambda should have access to the Username as it received authentication request. [Attaching a reference snippet below]Server receives the User configuration and maps the User to the Logical Directory.Sample reference code snippet:# parsing domain from Usernameusername = 'abc@xyz.com'domain = username.split('@')[-1]# building logical directory structure# e = Entry - represents what the client sees when they login # t = Target - represents the actual map in S3e = '/' + domain  t = '/bucket/' + domainh = '[{"Entry":"' + e + '", "Target":"' + t + '"}]'print(h)'[{"Entry":"/xyz.com", "Target":"/bucket/xyz.com"}]'# Include h as HomeDirectoryDetails within User Configuration as part of response to the serverConsidering permissions with above use-case, the IAM Role associated to the User would need permissions with explicitly defined resources i.e - actual bucket names and paths (Only the Access Policy section from this document). With Logical Directories in place, even if you define permissions for the entire bucket, the User would only have visibility for the Logical Directory defined.References:[1] https://docs.aws.amazon.com/transfer/latest/userguide/users-policies.html[2] https://docs.aws.amazon.com/transfer/latest/userguide/logical-dir-mappings.html[3] https://aws.amazon.com/blogs/storage/simplify-your-aws-sftp-structure-with-chroot-and-logical-directories/Let me know if you have further questions.-- SagarCommentShareEXPERTsagarb-awsanswered a year ago0All set, your solution worked! I will go ahead and it as accepted. I am working on cleaning up the code by attempting to have the request URLs in an array, but that is not working. It appears to be a limitation with urllib; anyway, that's another story for another day. Thanks a lot for all your help!CommentSharerePost-User-0945539answered a year agosagarb-aws EXPERTa year agoGlad to hear that things are working. Do reach out if you have follow-ups.Share0Hello,Thank you for sharing all details. To your question on Transfer variables not substituting, I have a few follow up questions -Do your transfer variables reside within the policy attached to the IAM Role associated with the Transfer User?If so, this is not supported. The Policy attached to the IAM Role should be explicit in terms of defining resources. What you want to do is to create a stand-alone policy with the variables and associate it directly with the User rather than the IAM role.There are 2 policies within the documentation that you linked - [1]. The Access policy is what defines access to the back-end storage - S3 in your case. This policy is required and without it, your Users wouldn't be able to access S3 resources. Here, you have to define permissions to the bucket resources based on your requirements and attach it to the IAM Role. You cannot use Transfer variables for this policy.The second policy is the Session policy which is associated to the Transfer user directly and is evaluated real-time when the User logs in. This is where you can assign Transfer variables such as ${transfer:HomeBucket}, ${transfer:HomeDirectory} and others to restrict further access on top of the Access policy.Does your setup potentially include double substitution? As in - You have defined your HomeDirectory value as - /bucket/${transfer:Username}.  And then within the Policy field, you define permissions to the resource as arn:aws:s3:::${transfer:HomeDirectory}.In this scenario, when policy evaluation takes place, the Resource section is substituted to - arn:aws:s3:::bucket/${transfer:UserName}, however it then doesn't go ahead and substitute it further to the Username used during the session (ex - arn:aws:s3:::bucket/abc). As the policy is now incorrect, S3 will then expectedly throw errors when the User tries to access objects.The resolution to this would be to avoid the double substitution scenario. It would be to use a combination of variables to achieve the use-case. Example - arn:aws:s3:::${transfer:HomeBucket}/${transfer:UserName}. Therefore, when this is evaluated, it translates to - arn:aws:s3:::bucket/abc.And, adding to your ask of restricting Users to their HomeDirectory, I would suggest using Logical Directories as the way to move forward. Logical Directories provide chroot functionality which allows you to map your Users to a particular directory and keeps them isolated. Also, utilizing Logical Directories would eliminate the requirement of using Session policies. [2]References:[1] https://docs.aws.amazon.com/transfer/latest/userguide/users-policies.html[2] https://docs.aws.amazon.com/transfer/latest/userguide/logical-dir-mappings.htmlLet me know if you have questions.-- SagarCommentShareEXPERTsagarb-awsanswered a year ago0Hi Sagar. Thank you very much for responding! Yes, I currently have the transfer variables residing within the policy attached of the IAM Role. I also tried this with Logical Directories and ran into the same issue; my apologies, I should have mentioned that in the original post.Based on your response, I am not exactly sure how this can be scalable. Essentially, I need the directories - or folders within the S3 bucket - to be dynamic for each user that is associated with a particular company based on the domain in their email address (and the folder name will match their domain). As an example, a user with domain 'xyz' in their email address will have access only to the 'xyz' folder within the S3 bucket.We are leaving it up to the clients to set up their own users for SFTP transfers, so we don't know who those users will be ahead of time, and they can also add/subtract users as time goes on. That is why I was hoping to rely on the IAM Role with the attached inline Policy to decide which users should have access to which folders based on the Transfer Family variables within the Policy.So I guess the question now is, how can I make this scalable for our situation? It looks like one method is to utilize ${transfer:UserName}, but I really don't care about their username since I don't want each user to have their own folder; instead, I would just like all of the users within that company to have access to their own company folder and no other company's folder.I hope this clarifies the problem that I am facing, and please let me know if there are any additional details that I can provide. Hopefully there is a sensible solution to this. Thanks again for all your help!CommentSharerePost-User-0945539answered a year ago0Thanks again, Sagar! I will give your suggestion a try and get back to you. Please allow me a few days to respond, as I am currently out of the office. Your responses are greatly appreciated, and I will follow up in the near future with the outcome!CommentSharerePost-User-0945539answered a year ago0Sagar, I haven't forgotten about this. I got pulled onto another project, so this one is on hold for the moment (hopefully not for too much longer). I will definitely circle back as soon as I can. Thank you!CommentSharerePost-User-0945539answered a year ago0Hi Sagar. The other project is now complete, so I will be jumping back to this one. I will follow up once I've had a chance to follow your instructions. Thanks a lot!CommentSharerePost-User-0945539answered a year ago"


Question: Rails Cloud9 public preview w/ elastic ip not working with https

"Hi there!I followed all steps available at https://docs.aws.amazon.com/cloud9/latest/user-guide/app-preview.html for sharing a Running Application over the Internet.It worked well at port 8080.It happens that my application has many interactions with Slack, that enforces the use of https.After having configured the ACL and Security Group inbound rules to accept http and https ports (80,8080,8081,8082,443) I'm still unable to access it via https.When using the preview url (ex: https://12a34567b8cd9012345ef67abcd890e1.vfs.cloud9.us-east-2.amazonaws.com/) it works in https, but this address is only reachable from my browser.Also, port 80 maps to Apache, not rails.And when I try to run rails s -p 80 or 443, I get this error:Permission denied - bind(2) for "0.0.0.0" port 80 (Errno::EACCES)How can I map the requests from all http/https ports for rails, as cloud9 used to do?FollowComment"

Answer: "0I've managed to solve with this apache2 conf. And buying a SSL certificate.Yes, It's just a shame I had to buy a SSL certificate in order to receive api requests in my dev environment, just because AWS won't let the public address be accessed outside my browser :/The whole Cloud9 migration for AWS was an awful experience.001-cloud9.conf:<VirtualHost *:80>        ServerName domain.com     Redirect permanent / https://domain.com/     </VirtualHost><VirtualHost *:8080>        ServerName domain.com     Redirect permanent / https://domain.com/     </VirtualHost><VirtualHost *:8081>        ServerName domain.com    Redirect permanent / https://domain.com/     </VirtualHost><VirtualHost *:8082>        ServerName domain.com    Redirect permanent / https://domain.com/     </VirtualHost><IfModule mod_ssl.c><VirtualHost _default_:443>        ServerName domain.com                DocumentRoot /home/ubuntu/environment        ProxyPreserveHost On            ProxyPass / http://127.0.0.1:3000/        ProxyPassReverse / http://127.0.0.1:3000/SSLEngine onSSLCertificateFile /etc/ssl/certs/cert.crtSSLCertificateKeyFile /etc/ssl/certs/cert.keySSLCertificateChainFile /etc/ssl/certs/cert.crt<FilesMatch "\.(cgi|shtml|phtml|php)$">SSLOptions +StdEnvVars</FilesMatch><Directory /usr/lib/cgi-bin>SSLOptions +StdEnvVars</Directory>BrowserMatch "MSIE [2-6]" \nokeepalive ssl-unclean-shutdown \downgrade-1.0 force-response-1.0BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown</VirtualHost></IfModule>CommentSharemknarcisoanswered 4 years ago"


Question: "How to change default Windows resolution? (Autologon resolution without active rdp session, e.g. for UI test automation with selenium)"

"Hello,I search for a solution on AWS EC2 Windows Instance to change the default resolution, to have a specific resolution, even if **no **active RDP session is connected.For Autologin after instance is started, I use official MS Sysintenals Autologon: https://docs.microsoft.com/en-us/sysinternals/downloads/autologonEverything is working fine with Autologon without RDP. I can simply reboot the instance or start new instanced, Autologon is happening, and also scripts (and UI test automation) is starting and running fine. But changing resolution of apps, e.g. the browser, is not working, this seems to be related to windows resolution itself. Because when I connect with RDP to the machine, all changes to app/browser windows sizes are working fine, with exactly the same scripts.But without an active RDP session, just with Autologon after reboot, resolution changes on app/browser are not done, this seems to be related because Windows resolution is too small without active RDP session.I found a lot of topics and tried all solutions:This one: https://superuser.com/questions/853252/how-to-change-the-default-resolution-in-windows-for-automatic-logon.Or using PowerShell command itself, e.g.: “Set-DisplayResolution -Width 1920 -Height 1080 -Force”But now one fix the problem.Someone have a solution to set a specific windows resolution for a session with**out **active RDP connection (e.g. session per Autologon)?Thanks a lotFollowComment"

Answer: "0Hello Seb,I understand you are having problems with performing UI tests on a EC2 Instance via Selenium.I did some research on the articles you linked in your post. It seems that some users experienced mixed results from the solutions posted.I did some general research on Selenium and how others have tried tackling the problem outside of AWS. Other people are experiencing the same frustrations as you, and are also experiencing mixed results. Because of this, I do not think this is an AWS-specific issue.I looked for a definitive answer and seem to have found one in a Stack Overflow article [1], which uses an Azure VM. This is what I found:This is a limitation with Windows since it uses RDP (or VNC, etc) to set the screen resolution.It is not currently possible to change the resolution of a Windows instance unless you use RDP or a test agent.This is likely due to a device <-> driver issue on windowsThere are workarounds available.I found an article that some users were using for workarounds to perform their UI tests. It suggests automating RDP sessions to set the resolution (in your case, an EC2 instance) for the UI test [2].[1] Increase the screen resolution on Test Agent - Stack Overflow (https://stackoverflow.com/questions/45829787/increase-the-screen-resolution-on-test-agent)[2] Automate your remote desktop sessions - OutOfMemoryException (https://outofmemoryexception.wordpress.com/2016/03/29/automate-your-remote-desktop-sessions/)Please let me know if this response helps or if you have any other questions. If the above steps do not resolve your issue, I strongly encourage you to contact an AWS support engineer who will be able to assist you.CommentShareJoshua_Banswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: problem about credit card

i am facing problem when i create an account to use AWS but when i enter my visa card my account is not authenticated resulting i cant use AWS servicesFollowComment

Answer: "0Sorry to hear you're having issues creating your account,This doc will guide you through the steps to ensure your payment is verified: https://docs.aws.amazon.com/accounts/latest/reference/troubleshooting_create-account.html.If the errors continue, reach out to our Accounts and Billing team using this form: go.aws/account-support. Our agents there have the tools and visibility to get this resolved with you.- RandiCommentShareEXPERTAWS Support - Randianswered 3 months ago0I am sharing here a guide on creating and activating an AWS account.https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/It looks like your issue relates to adding a payment method when signing up for a new AWS account. You might need to note that you also have to enter an OTP (one-time password) depending on your bank. Cheers.CommentShareJunieanswered 3 months ago"


Question: AWS Cloudformation  Which is Better? Terraform does have advantages over CloudFormation.

"When resource services grow more and managing them and maintaining them becomes an tedious work, IaC solves they problems.  But terraform is an open-source, cloud-agnostic infrastructure management tool developed by HashiCorp that enables modular configuration of infrastructure, thereby allowing you to use AWS modules and third-party modules in the same infrastructure.  Where should my time and resources but priorities for learning?FollowComment"

Answer: "2Hi Wycliffe,Adoption of IaC tooling depend on many factors. One of the most important to me is how your organization is structured and who is gonna provision the infra.If software engineers are going to be responsible, maybe CDK is more suitable.I have been using terraform, and true, you can use modules to reuse components, but project structure has some limitations as you cannot produce Stacks, is hard to structure code as folders and you may need to rely on third parties (terragrunt) to overcome some limit.Of course CloudFormation is another option, but it becomes super verbose and learning curve is slightly higher.Depending on your choice you can look at AWS workshops for cdk https://cdkworkshop.com/20-typescript.html or certifications https://www.hashicorp.com/certification/terraform-associateHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago0+1 with @alatech's answers.There are many considerations when choosing tooling of any type. For Infrastructure as Code tooling, you would consider your/teams current skillset, if you have any existing assets you want to reuse, personal preference, etc.Cloud Development Kit (CDK) is an open-source project created and maintained by AWS, and is targeted at folks who write software in .Net, Java, Go, Python, Node/TypeScript. CDK provides you the ability to declare your infrastructure using the programming language that you already know (if supported*). CDK will synthesize Cloud Assembly files which will be processed by AWS CloudFormation.CDK does have a module reuse, we call them Constructs. There are Level 1, 2, and 3 constructs for CDK.Terraform is an open source project created and maintained by APN Partner Hashicorp. It has it's own language (HCL), and allows you to create you infrastructure using declarative blocks of resources. Terraform operates directly against the AWS Public APIs.CommentShareawstyleranswered 2 months ago"


Question: Lambda Best Practices?

"Customer has a question about using Lambda:"Do you have any best practice/recommendations/online material for using Lambda and specifically how one can manage it through their landscape. At the moment, we manually turn the Lambda functions off before a release and then back on manually."Is there a recommendation on how they can optimize this?FollowComment"

Answer: "1Accepted AnswerHello,We have best practices documented hereOn top of that I would recommend looking at the Well Architected Serverless Lens, which has a lot of recommendations for running production grade serverless apps.There are many services, tools, and frameworks that can help you deploy your apps / functions. To start off with I recommend taking a look at features such as:Stages for API GatewayVersions and Aliases for LambdaUsing SAM and Safe DeploymentsAWS Step Functions: Workflows for development and testingServerless CICD reference deploymentServerlessLand also has a ton of resources.CommentShareMODERATORAWS-User-3724512answered 3 years ago"


Question: Lambda gets runtime error while another Lambda is working fine

"I'm trying to do edge ML using Docker container in Jetson nano. GG Core runs in the Docker container(aarch64/ubuntuOS based).I deployed GGG with 2 Lambda functions. One just sends 'Hello' MQTT message to IoT Core, another does inference using local ML model. Both Lambda functions are deployed with same UID/GID(0), and same container configuration(Use group default (currently: No container)), and both on-demand.I succeeded the deployment, and Hello Lambda works fine, but the inference Lambda gives me a runtime error like below. I don't know why only one Lambda gives me a runtime error. I also made sure the '<python file name>.<function name>' syntax of Lambda. Plus both runtime are set as Python3.7.Thank you in advance.########################################################################[2021-06-04T18:33:40.833+09:00][INFO]-phone_home.py:126,[2021-06-04T18:33:40.837+09:00][WARN]-ipc_client.py:163,deprecated arg port=8000 will be ignored[2021-06-04T18:33:40.868+09:00][ERROR]-init.py:1028,2021-06-04 18:33:40,839 INFO Could not find libdlr.so in model artifact. Using dlr from /usr/local/lib/python3.7/dist-packages/dlr-1.6.0-py3.7.egg/dlr/libdlr.so[2021-06-04T18:33:40.897+09:00][FATAL]-lambda_runtime.py:142,Failed to import handler function "inference.handler" due to exception:[2021-06-04T18:33:42.293+09:00][INFO]- You acknowledge and agree that DLR collects the following metrics to help improve its performance.[2021-06-04T18:33:42.293+09:00][INFO]- You acknowledge and agree that DLR collects the following metrics to help improve its performance.[2021-06-04T18:33:42.293+09:00][INFO]- CALL HOME FEATURE ENABLED[2021-06-04T18:33:43.093+09:00][INFO]-[2021-06-04T18:33:43.225+09:00][INFO]-phone_home.py:126,[2021-06-04T18:33:43.228+09:00][WARN]-ipc_client.py:163,deprecated arg port=8000 will be ignored[2021-06-04T18:33:43.26+09:00][ERROR]-init.py:1028,2021-06-04 18:33:43,230 INFO Could not find libdlr.so in model artifact. Using dlr from /usr/local/lib/python3.7/dist-packages/dlr-1.6.0-py3.7.egg/dlr/libdlr.so[2021-06-04T18:33:43.29+09:00][FATAL]-lambda_runtime.py:142,Failed to import handler function "inference.handler" due to exception:[2021-06-04T18:33:44.294+09:00][INFO]- CALL HOME FEATURE ENABLED[2021-06-04T18:33:45.543+09:00][INFO]-phone_home.py:126,[2021-06-04T18:33:45.546+09:00][WARN]-ipc_client.py:163,deprecated arg port=8000 will be ignored[2021-06-04T18:33:45.578+09:00][ERROR]-init.py:1028,2021-06-04 18:33:45,549 INFO Could not find libdlr.so in model artifact. Using dlr from /usr/local/lib/python3.7/dist-packages/dlr-1.6.0-py3.7.egg/dlr/libdlr.so[2021-06-04T18:33:45.611+09:00][FATAL]-lambda_runtime.py:142,Failed to import handler function "inference.handler" due to exception:[2021-06-04T18:33:46.31+09:00][INFO]- record_type: <enum, internal record status, such as model_loaded, model_>,Edited by: hdmn54321 on Jun 4, 2021 4:08 AMEdited by: hdmn54321 on Jun 4, 2021 4:13 AMFollowComment"

Answer: "0Hi,Are you able to run the same python code outside of greengrass using python 3.7?CommentSharesushantAtAWSanswered 2 years ago0The problem was solved. I had 2 reasons below.I downloaded wrong DLR ML model (It's for x86_64. It' supposed to be aarch64)The default Lambda script is wrongIn the default Lambda, it's basicallysynset_path = 'synset.txt'So I changed it tosynset_path = model_resource_path + '/synset.txt'and it worked.Thanks as always:)HMCommentSharehdmn54321answered 2 years ago"


Question: What's the best way to send real-time data to Amazon Redshift?

"I need an analysis tool for a product that sends logs or data about advertisements on the product's website. The product sends around 100,000 events per minute or more. All of the data is important for the analysis, and therefore, I can't afford the loss of data.What is the best way to send this data to Amazon Redshift, considering factors, such as performance efficiency, data consistency, and cost optimization?FollowComment"

Answer: "0Accepted AnswerIf the data is streamed through Amazon Kinesis Data Streams (KDS) , choose one of the following options:Kinesis Data Streams --> Lambda using the Redshift Data API --> RedshiftKinesis Data Streams --> Kinesis Firehose --> RedshiftKinesis Data Streams --> Kinesis Firehose --> Amazon S3 (partitioned) <-- Redshift Spectrum (run AWS Glue crawler periodically)With all of these options, the data can be queried as soon as it's received. However, you might have to occasionally wait for a considerable amount of time before querying the data.For a more cost-effective approach, do the following:First, write the data to Amazon S3 through Kinesis Data Streams --> Kinesis Firehose --> S3 --> Lambda --> S3 (optimized to Parquet or ORC). Then, run the AWS Glue crawler at periodic intervals (example: every hour) to refresh the AWS Glue Data Catalog. Query the data from Redshift with Amazon Spectrum Spectrum using the AWS Glue Data Catalog.CommentShareKunal_Ganswered 2 years ago0Alternate approach, use Redshift federated query feature to access, analyze and join real-time data from operational / transactional DB such as, Amazon Aurora or Amazon RDS PostgreSQL and MySQL DB with data warehouse and data lake dataset.  For more details, refer to the documentation https://docs.aws.amazon.com/redshift/latest/dg/federated-overview.html.CommentSharesudhiganswered 2 years ago"


Question: Billing appear in March

I think that I deleted my all AWS services last month and purchase my billing in FebruaryAnd why in this march there are several services that still activecan you help me to shut down all my services?FollowComment

Answer: "1You can go to your account and click bills which will show you the resources you used, the duration and the associated costs. You can also check cost explorer and click monthly or daily view.If you can't find the resources then check out this linkhttps://aws.amazon.com/premiumsupport/knowledge-center/resources-unexpected-charges/.Once you found out the resources, you need to terminate them all manually yourself. I don't think there is any shortcut to terminate all resources generating those charges.CommentShareSandeepVudataanswered a year ago"


Question: NLB Distribution unevenly with wildfly and pgBouncer

"Hello community,I cannot seem to find the answer for my current problem.The setup is that I have a number of wildfly server running connecting to an NLB where 2 instances of pgBouncer are running.We recently had a traffic spike and I noticed that one of the 2 pgBouncer instances had a lot more "packages out" than the other (10x more). From that point it seems that the second instance was almost not hit at all.The postgres in the background seems to confirm this as the maximum number of connections was as high as configured by a single pgBouncer instance and the second did not seem to establish any connection. (or only very few)The pgBouncer are working fine, my suspicion is the NLB. I read about long lasting connections leading to problems in the load distribution.Is the NLB the correct Load balancer for this scenario or should we move to the ALB? Is there anything I could configure/test for this scenario? I do not know where I even should start investing the issue further.Thanks!FollowComment"

Answer: "0NLB distributes connections using flow hash algorithm based on the protocol, source IP address, source port, destination IP address, destination port, and TCP sequence number. That means for example if you have a single long lived TCP connection, it will always be routed to same target. The balance becomes evident as you open more connections, that should be routed to the other targets.I am mentioning this because DB connections from Application to Database tend to be long lived, and if you don't have many clients (as in, the application that connects to the NLB) you might experience an non optimal balance.A few things to check:If multi-az, are your clients connecting to both NLB IP's? You can either check this on the clients or using the VPC flow logs.Check in your client connecting to NLB, if there are DNS options you can modify (such as avoid DNS caching)Have you enabled Cross-zone balancing in your NLB? This can help in case your clients are favoring one NLB node (IP).Lastly, ALB only supports HTTP/HTTPS, so it will not work for PostgreSQL database connections.CommentShareLucas_Ranswered a year ago"


Question: Cron jobs on Ubuntu EC2 Instance

"Help please, I can't seem to get cron jobs to run. I've always done crontab -e to schedule jobs but it doesn't seem to work on my EC2 instance running Ubuntu. I also tried sudo vi /etc/crontab and that doens't work either. I tried to schedule the job /usr/bin/echo "test" > /home/ubuntu/crontest.txt in /etc/crontab as root and as ubuntu but I never see the test file written. I googled and there are a few StackOverflow posts from people who had trouble with cron.  But it seems many of them are able to get it to work after editing the /etc/crontab file.  Can someone help me figure out why I can't get my jobs to run in cron?Any help or pointers would be greatly appreciated. Thank you.FollowComment"

Answer: "0Thank you Sri for your detailed response! For your local crontab -e example, I don't think you want to specify the user. After seeing your post, I tried crontab -e again and installed a * * * * * test script to echo the date into a test file and it worked. I was able to see the test file and the date written inside was updated every minute.Unfortunately, when I change it specify the hour and minute, the scheduled job does not run. I suspect this is due to time zone issue so I added a CRON_TZ=America/Los_Angeles in my crontab for PST time zone. That didn't work either. Then I tried scheduling using UTC time and that worked....So, how do I change the time zone for crontab? My system time is already set to PST. I see it when I type date in the shell. The man page for cron says "The daemon will use, if present, the definition from /etc/timezone for the timezone." when I cat /etc/timezone it says "America/Los_Angeles".I'm not sure why there's a time zone mismatch.CommentShareAWS-User-3081066answered a year agoSri a year agoI haven't personally verified these but you are welcome to try them. There are lots of comments but not all of them workhttps://askubuntu.com/questions/54364/how-do-you-set-the-timezone-for-crontabShare0Hi, Good QuestionI was curious about this, so I have setup a Ubuntu 20.04 and I was able to use crontab.crontab's are generally setup per user. when you login, you would be logging in as a ec2-user.Let's assume that you have logged in as ec2-user, so you could check if there is a crontab by running crontab -l. If there is no crontab then you would see something like the followingcrontab -lno crontab for ubuntuto add a crontab, you could use crontab -e, use the editor of your choice and add a line like17 ** * *root    cd / && run-parts --report /etc/cron.hourlythen restart sudo service cron restartNext you can check sudo service cron status and then crontab -l returns17 ** * *root    cd / && run-parts --report /etc/cron.hourlyIf you need to setup crontab for root, you can use sudo crontab -e or if it's for another user then crontab -uAlso check if you have this filecat /etc/crontab # /etc/crontab: system-wide crontab# Unlike any other crontab you don't have to run the `crontab'# command to install the new version when you edit this file# and files in /etc/cron.d. These files also have username fields,# that none of the other crontabs do.SHELL=/bin/shPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin# Example of job definition:# .---------------- minute (0 - 59)# |  .------------- hour (0 - 23)# |  |  .---------- day of month (1 - 31)# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat# |  |  |  |  |# *  *  *  *  * user-name command to be executed17 ** * *root    cd / && run-parts --report /etc/cron.hourly25 6* * *roottest -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )47 6* * 7roottest -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )52 61 * *roottest -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )#CommentShareSrianswered a year ago"


Question: What is the best practice to load data to redshift with aws glue ?

"Hi,We are using Glue and Redshift for our ETL purposes.Our source is AWS RDS and we are using Redshift as our data warehouse.For ETL we are using Glue. We write scripts in pyspark (Not using crawlers. We directly make connection to RDS in pyspark script)Currently, we first create a job which writes DataFrame to s3 as json. After this we write another job which reads json from s3 as DynamicFrame and then writes to redshift.Also, for pyspark etl script, we create our dimension and fact tables as SQL queries which are then used in spark.sql().What is the best practice that we should follow ?Should we remove the step of writing data to s3, convert our DataFrame to  DynamicFrame and directly write to Redshift ?Also, we read data from source as a df using spark.read.format("jdbc").options(url=, driver=, dbtable=, user=, password=,). Is this a good practice if we have to use job scheduling and job bookmarking ?FollowComment"

Answer: "0Hi TiwaryShashwat,Depending on how complex (or not) the transforms in your Glue jobs are it might be easier to just export or unload the source data from your RDS instance to S3 in a format compatible to load into Redshift with a COPY command.  You can do most lightweight transforms in the select portion of your unload or export and even partly in your COPY command.Another option is to export or unload from RDS into an external table compatible key structure in S3 and just map an external table definition on top of it in the Glue Data Catalog.  That way with a simple CREATE EXTERNAL SCHEMA ... declaration in Redshift you can query the data in S3 directly using Redshift Spectrum.  If you choose this route I'd suggest that you consider some form to time based partitioning of that external table to both make data management in S3 easier and your Redshift Spectrum queries faster where you can use a time based filter predicate on the partitioning column.While the route you're going now using dataframes in Glue Spark can work, depending on your budget for scaling the Glue job and the amount of data you're operating on, you may likely run into scaling problems where you have to have the whole dataframe in memory on the Glue Spark cluster to perform your current process.Please let me know if this helps.-KurtCommentShareklarsonanswered 3 years ago"


Question: 【AWS S3 CLI FILTER EXPRESSIONS】Unexpected filtered files when using "--include" filter

"I was trying to copy some files from s3://arxiv/src to my local machine for test. And I tried to use following command to copy the src dump files of January, 2015:aws s3 cp s3://arxiv/src . --recursive --include "arXiv_src_1501_*.tar" --request-payer requesterHowever, I got files likedownload: s3://arxiv/src/arXiv_src_0003_001.tar to ./arXiv_src_0003_001.tar        download: s3://arxiv/src/arXiv_src_0005_001.tar to ./arXiv_src_0005_001.tar        download: s3://arxiv/src/arXiv_src_0007_001.tar to ./arXiv_src_0007_001.tar         download: s3://arxiv/src/arXiv_src_0006_001.tar to ./arXiv_src_0006_001.tar         download: s3://arxiv/src/arXiv_src_0009_001.tar to ./arXiv_src_0009_001.tar         download: s3://arxiv/src/arXiv_src_0008_001.tar to ./arXiv_src_0008_001.tar         download: s3://arxiv/src/arXiv_src_0010_001.tar to ./arXiv_src_0010_001.tar         download: s3://arxiv/src/arXiv_src_0011_001.tar to ./arXiv_src_0011_001.tar         download: s3://arxiv/src/arXiv_src_0012_001.tar to ./arXiv_src_0012_001.tar         download: s3://arxiv/src/arXiv_src_0101_001.tar to ./arXiv_src_0101_001.tar         download: s3://arxiv/src/arXiv_src_0102_001.tar to ./arXiv_src_0102_001.tar         download: s3://arxiv/src/arXiv_src_0103_001.tar to ./arXiv_src_0103_001.tar         download: s3://arxiv/src/arXiv_src_0105_001.tar to ./arXiv_src_0105_001.tar         download: s3://arxiv/src/arXiv_src_0104_001.tar to ./arXiv_src_0104_001.tar         download: s3://arxiv/src/arXiv_src_0106_001.tar to ./arXiv_src_0106_001.tar         download: s3://arxiv/src/arXiv_src_0107_001.tar to ./arXiv_src_0107_001.tar         download: s3://arxiv/src/arXiv_src_0108_001.tar to ./arXiv_src_0108_001.tarI am confused about this match pattern. Appreciate anyone that helps.FollowCommentNeil Kuan a month agotry this way.aws s3 cp s3://arxiv/src/ . --recursive --exclude "*.tar" --include "arXiv_src_1501_*.tar" --exclude "arXiv_src_1501_?.tar" --request-payer requestersource: https://docs.aws.amazon.com/zh_tw/cli/latest/userguide/cli-services-s3-commands.html#using-s3-commands-managing-objects-moveSharerePost-User-5784502 a month agoYeah, it did work! Thanks a lot for your help!Share"


Question: AppSync support in Hong Kong region?

"Hello,Is there any plans on supporting AppSync in the Hong Kong region?FollowComment"

Answer: 0AppSync support for all AWS regions is on the roadmap. We cannot comment on any availability date at this point but I will +1 Hong Kong on your behalf.CommentShareAWS-User-0691748answered 4 years ago


Question: Using ant with CodeBuild - build.xml does not exist and other questions for

"I am trying to switch over to using CodeBuild to build my code so I can then easily push it to my EC2 instances instead of manually building and copying.I can manually run ant on my station and all will build as it should.I am now trying to use the AWS CodeBuild console to try this.I zipped up my source code files and put it in an S3 bucket and put its location in the source fields of AWS CodeBuild. I have the build.xml in this same bucket and I also put the build.xml in the base of the codes zip file. In the build commands I put "ant".I assume that the build.xml needs to go somewhere else?Do I need more then just "ant" in the build commands? That is all I use when i manually build the project.From what I have read i should be able to zip up my code , put it in the S3 location and CodeBuild will extract it and build it correct?Also, under "Environment: How to Build" - what is the "Output files" section for? It's not for the artifacts that are built correct?Any other tips or tricks? I am very new to all of this so any help is appreciated! I just learned about ant this week. This is building a rather large project with many classes being built - Will this cause an issue? Like I stated earlier - I do have it building file if I run it manually on my system.Here is the error I get when I build through Code Build:[Container] 2019/03/21 15:32:27 Entering phase BUILD[Container] 2019/03/21 15:32:27 Running command antBuildfile: build.xml does not exist!Build failedFollowComment"

Answer: "0Accepted AnswerI have it working! I will post my findings for others going that might be struggling -So I figured out that the "Outputs" means what are all the files and/or directories that you want to go into your final artifact after all is built.I have two directories that I want in the final jar artifact. One is WebContent and the other is build. They both have multiple sub-directories. I put "WebContent/,build/" in the output files field. It gave  me a jar artifact but when I open the jar it did not have any sub-directories. In order to get it to include all sub-directories I had to make the output files field with  "WebContent//,build//". All sub-directories are now in the zip and it appears as if the build was successful.Hopefully this can help others out.Now on to creating a script for this and also getting this to work from GitLab.Edited by: ernievd on Mar 22, 2019 6:32 AMCommentShareernievdanswered 4 years ago0Hi ernievd,This could be a misconfiguration of the build source. Can you PM me a build ARN for a failing build? I'd be happy to look into this for you.CommentShareAWS-User-6139167answered 4 years ago0Thanks Joseph! Any help is appreciated!!I figured out my issue - I zipped the build files from the folder level and not the root level. I re-zipped and it can now see the build.xml.The next issue I have is that in my original build.xml it was getting the tomcat library files from my local computer - <fileset dir="/usr/local/tomcat/lib">To overcome this I manually copied the files in that lib directory, put them in a new location in the zip file and then updated the build.xml to look at the new location. Is there any way to tell CodeBuild to look for files on the local computer or do i always have to have these tomcat files in the zipped file?I built again with these changes and it looks like I am close! It failed for the following -[Container] 2019/03/21 20:57:13 Phase complete: BUILD Success: true[Container] 2019/03/21 20:57:13 Phase context status code:  Message:[Container] 2019/03/21 20:57:13 Entering phase POST_BUILD[Container] 2019/03/21 20:57:13 Phase complete: POST_BUILD Success: true[Container] 2019/03/21 20:57:13 Phase context status code:  Message:[Container] 2019/03/21 20:57:13 Expanding base directory path: .[Container] 2019/03/21 20:57:13 Assembling file list[Container] 2019/03/21 20:57:13 Expanding .[Container] 2019/03/21 20:57:13 Expanding artifact file paths for base directory .[Container] 2019/03/21 20:57:13 Assembling file list[Container] 2019/03/21 20:57:13 Expanding myapp.jar[Container] 2019/03/21 20:57:13 Skipping invalid artifact path myapp.jar[Container] 2019/03/21 20:57:13 Phase complete: UPLOAD_ARTIFACTS Success: false[Container] 2019/03/21 20:57:13 Phase context status code: CLIENT_ERROR Message: no matching artifact paths foundThe arn is -arn:aws:codebuild:us-east-1:499000881936:build/TroveBuild:db1f5206-228d-46aa-9450-82407546ad17CommentShareernievdanswered 4 years ago0Hi ernievd,You could build a customer docker image that has these files in the same area as you desktop. If you don't want to do this then putting them in your zip is a great solution.Looks like your running into an issue where we can't find the artifact file that you specified named myapp.jar. I would do anlsand see if that file is in your base directory or if its somewhere else likebin/myapp.jar.JohnCommentShareAWS-User-8407687answered 4 years ago0Isn't bin/myapp.jar what the build is creating?I am very confused as to what the Artifact/name should be - isn't this what is being created from the build? It is asking for an ARN - how can there be an ARN for it when it is not created?Also very confused as to what the Environment/Output files is? It is required but I have no idea what should go in this field? It states that output files can not be empty. Does this mean it wants all the class files that are being built? If so then this build is creating over 30 class files in multiple locations - that is a ton to list.ThanksErnieCommentShareernievdanswered 4 years ago0Hi ernievd,You'll need the artifacts' files: section of your buildspec.yml to include the path to your jar. This is how CodeBuild determines which files should be considered artifacts. From your logs, it looks like the path may not be correct.The Project configuration and artifact path/namespace/name tells CodeBuild where you want these artifacts to go after the build, and how you want them (re)named and packaged.CommentShareAWS-User-6139167answered 4 years ago"


Question: fleet hub restricting access

"I would like to use fleet hub as my primary front end for small number of end customers that will manage fleet of their devices registered on iot core. for that purpose I need to restrict each user to only be able to see and manage his own devices, is it possible or fleet hub will always show all devices connected to IoT Core ?FollowComment"

Answer: "0Hi. Currently this is not possible. At this time, a Fleet Hub application will allow a user to see all the registered Things in the account.CommentShareEXPERTGreg_Banswered 10 months ago"


Question: Specifying a stream name when creating a MediaLive Input with the PHP SDK?

"I tried creating a MediaLive Input using the PHP SDK and it all works fine but when I went to check my newly created Input on the console, the stream name is looking a little weird. On the application name field, it's showing the IP MediaLive auto-generated for me and on the application instance field is the random string I specified and the url ended up looking like this: rtmp://some_ip/MnFiYLkqYRFw1gamkJb64Z4hEAXTtWEr, what I was hoping to see was something similar to when I create an Input with the console like this: rtmp://some_ip/application_name/application_instanceSo, I guess my question is how do I properly specify the application name and instance when using the PHP SDK? Because when I checked the docs the only parameter it accepts is a StreamName, I'd really appreciate the helpFollowComment"

Answer: "0Accepted AnswerI just figured it out, all you really need to do is specify it like so:'StreamName' => 'application_name/application_instance'CommentSharealexyapanswered 3 years ago"


Question: How do I enable WAF with Amazon LightSail?

How do I enable a WAF rule for an website hosted in LightSail ?FollowComment

Answer: "0Accepted AnswerIn Amazon Lightsail, AWS WAF requires you to use an Application Load Balancer:AWS WAF is tightly integrated with Amazon CloudFront and the Application Load Balancer (ALB), services that AWS customers commonly use to deliver content for their websites and applications.If you're not using one of these technologies AWS WAF will not work for you.Please refer toLightsail with other AWS ServicesAWS WAF FAQCommentSharesimonanswered 3 months agoEXPERTTushar_Jreviewed 3 months ago"


Question: Cannot access AWS Lambda console with the error saying 'You do not have sufficient permission. Access denied.

We are currently getting this error on the AWS Lambda page: You do not have sufficient permission. Access denied.FollowComment

Answer: "1I'm root ,after create functions in lambda ,no msg error and no function listmy region is singapore , I already access enable singaporemy account id 610613825790CommentSharerePost-User-3668335answered 7 months agorePost-User-2251510 a month agoI have the same account id: 485738210514Share1Hi - You may have to work with support but you can look into the followinghttps://docs.aws.amazon.com/lambda/latest/dg/security-iam.htmlhttps://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.htmlhttps://docs.aws.amazon.com/lambda/latest/dg/security_iam_troubleshoot.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/lambda-permissions-issues/~ThanksCommentShareutkarsh-awsanswered 7 months ago0Bunch of questions about your context:Are you using a root account?Are you a part of an organization on AWS - there might be Service Control Policies applied?Are you using a role to try and access Lambda?Are you trying this in the correct region for your account - you might not be allowed to access services in some regions?You might need to reach your AWS administrators to request permissions to access the Lambda service.CommentShareMlandaTanswered 7 months ago"


Question: Move AWS Amazon Lightsail Instance From One Account to Another ??

"I had a protracted conversation with Amazon's customer support a few months ago asking them to PLEASE help me move my Amazon Lightsail Windows service from one Amazon account to another Amazon account. After a numbers of days/weeks of to and from and various different parties and escalations, I got told, NO, THIS IS NOT POSSIBLE.Now I have been trying to figure out, in the tangled mess of 100s of AWS documents, what on earth I am supposed to do? I am so frustrated because I've read pages and pages of documentation but it seems simply moving from one account to another is a highly technical, complex, possibly error prone, and difficult and convoluted process. Requiring down time. Some of the various documents I've read are here:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/prepare-windows-based-instance-and-create-snapshothttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-exporting-snapshotshttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-ec2-instances-from-exported-snapshotshttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-exporting-snapshots-to-amazon-ec2I don't know if Amazon is trying to punish me, make me some kind of documentation freak, or just hurt me.Anyway, is there someone that can give me 5 or 10 "easy" steps what on this earth I should be doing??For example:Must I make a backup snapshot?Then make another snapshot?Then use SysDiff or something?Then export? But where? To where? Which button?Then how do I make an AMI?How do I share an AMI?How do I import an AMI into Lightsail?Am I even supposed to use AMIs?Seriously guys, I'm just longing for something that allows me to perform a single action, but at this stage it looks like many many  hours will be spent and possibly it's going to be better to outsource this highly convoluted and technical action.Tagged as: death-by-amazon-documentationFollowComment"

Answer: "0Well, you can't transfer a LIGHTSAIL instance from one account to another.  It would be nice, but it's just not possible currently.As far as I can tell, the only thing you could do is export your LS instance to EC2 and transfer that instance using the instructions here: https://aws.amazon.com/premiumsupport/knowledge-center/account-transfer-ec2-instance.  Unfortunately, this means your instance is now in EC2 and you don't have the ease of use benefits of Lightsail.CommentShareDavid Ganswered 3 years ago0Hi,Thanks for using Lightsail. Unfortunately Lightsail currently does not support transferring a instance to another account in Lightsail. Only option you have is to export Lightsail instance to EC2 following https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-exporting-snapshots-to-amazon-ec2 which EC2 support such operations.Please feel free to let us know if any further help needed.CommentShareAWS-User-3138555answered 3 years ago0@MichaelZAtAWS:Please make sure the product managers are aware that this capability would be very nice to have, especially for those of us who are helping people deploy applications on Lightsail.CommentShareDavid Ganswered 3 years ago0It would be very helpful to be able to transfer a lightsail instance from one AWS account to another... please?CommentSharedwissinganswered 3 years ago"


Question: Code whisperer auth invalid

When i try to sign in using AWS Builder ID I just get-> TypeError: Cannot destructure property 'id' of 'undefined' as it is undefined.2023-05-04 13:55:18 [WARN]: auth: failed to logout of connection "6c7a9da0-be3a-4a99-add7-cc59da2a*****": Error: getaddrinfo EAI_AGAIN portal.sso.us-east-1.amazonaws.com [EAI_AGAIN]then2023-05-04 13:55:04 [ERROR]: aws.codeWhisperer.reconnect: Error: Unable to authenticate connectionFollowComment

Answer: "0I was able to make Code Whisperer work by going to the extension in the left sidebar in VS Code, expanding the Developer Tools panel and hit |> Start under Code Whisperer. It prompted me to grant access to it by login in to my Builder ID account.According to this Github Issue, this is bound to happen every now and thenCommentShareJuan Carlos Espinozaanswered a month ago"


Question: Changing the Greengrass V2 core device IAM role after install

"See: https://docs.aws.amazon.com/greengrass/v2/developerguide/device-service-role.htmlIs it possible to change the device service role after the device has been installed ? I have a number of devices with the default 'GreengrassV2TokenExchangeRoleAccess' IAM policy. Is it possible to point them to a new policy, without re-installing greengrass v2 on the core device ?FollowComment"

Answer: "0The linked documentation tells you how to edit: https://docs.aws.amazon.com/greengrass/v2/developerguide/device-service-role.html#device-service-role-access-s3-bucket.It is just an IAM role, so you can easily edit the policy and add and remove policies as needed.CommentShareEXPERTMichaelDombrowski-AWSanswered 5 months agoscriobhneoir 5 months agoThanks for the link. I should have specified in my question - rather than adding/removing permissions from the role, is it possible to change the core device service role itself ?Example:I create a gg v2 core device with the default role.Later on I create a new role called MyCustomRole. I now want to change the core device service role to MyCustomRole, without re-running the install script. Is this possible ?Share0AWS IoT Greengrass uses AWS IoT Role Aliases. To change the role associated to the role alias configured for the Greengrass core device you can use the following API: https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateRoleAlias.html.You can also perform the operation from the console https://console.aws.amazon.com/iot/home?#/rolealiashubCommentShareEXPERTMassimilianoAWSanswered 5 months agoscriobhneoir 5 months agoIn my case, the IoT Role Alias has also changed. Is it possible to change the IoT Role Alias (as in the example above, meaning to associate a device with a totally different role alias, a different ARN) after the greengrass core v2 device has been setup ?Share"


Question: API gateway URL reverting status code 0 and 503 intermittently

"Hi All,We are using AWS ECS Fargate ALB & API gateway to serve our API, mostly its is always healthy, but at time it throws status code 0 or 503, sharing the error message that is accompanied with these statuses. We have 1 task always active and trigger another one on 80% CPU load. But we always see 2 tasks active though it barely uses .25 CPU and 512 Memory system. We are not sure what is the issue here and why we keep getting these errors. Not sure if it has anything to do with the size of the payload received. Timeout is set to 15 secs at API gateway level. Not sure where we are going wrong. Any help here is much appreciated.Error Status & MessageStatus 0:"responseBody":".execute-api.ap-south-1.amazonaws.com: Temporary failure in name resolution"Status 503:"responseBody":" <title>503 Service Temporarily Unavailable</title>
503 Service Temporarily Unavailable
   "FollowComment"

Answer: "0I would be looking closer at your applicaiton. Perhaps the web server is too busy to respond to requests, perhaps you have a threading issues where it has run out of threadsJust because the CPU is fine, you may stil have some performance tuning of your applicaiton/underlying listeners in your container to perform. I would ensure your application is sending enough log information to review and you could even test connecting directly to your application when you experience the 503 errors.You could connect into the container also during the time it has issues if its logging locallyIf this answers your question, please be sure to accept so that this helps others and helps meCommentShareGary Mcleananswered 2 months agosuchit 2 months agoHi @Gary Mclean,Thanks for your inputs, the 503 was some aws outage is not happening since then. Also we use threading and the API handles multiple request without a challenge. However, we still are getting Error Status Code 0 in our app, wondering how the Name is Resolved other times expect very few (maybe 2-3 time a day). This is quite puzzling.Status 0:"responseBody":".execute-api.ap-south-1.amazonaws.com: Temporary failure in name resolution"Share"


Question: Can't SSH to EC2 instance

Can't SSH to my ec2 instanceGetting error : shell request failed on channel 0I have already checked the following:Network connectivity and internet access on our end.Security group rules and firewall configurations.Server instance status and health checks.Key pair authentication and SSH access.FollowComment

Answer: "0Hi, what is your ssh client ? Hezner?CommentShareDidier_AWSanswered 9 days ago"


Question: Redshift Spectrum: no way to glance at tables with nested data

"Hi,I'm enjoying working with Redshift Spectrum, but I find it difficult to quickly scan a table with nested fields. By that I mean something along the lines of "select * from table limit 100"This is impossible if the table has nested fields, because Spectrum doesn't allow "*" queries on these."Query 1 ERROR: ERROR:  Nested tables do not support '*' in the SELECT clause."But there are few alternatives for me - say I have dozens of columns in my table, do I need to enumerate them while somehow deducing which ones are nested and thus to be avoided?There is a related issue that I can't do "select nested_field from table" either, presumably because Spectrum can't serialize the field in any way.These two issues require me to know the schema of all my tables before writing my queries, which is quite user unfriendly. It would be really nice if Spectrum supported displaying string representations of nested fields, if only for these simple selects, they are crucial for exploratory work. (I also use Presto, Hive, and Spark, neither of those has a problem with this.)Thanks!FollowComment"

Answer: "0Hi ondrejj,If you're sure Presto readily allows you to query this external data in an exploratory way, then I respectfully suggest that you use Athena, that uses Presto as it's query engine, to do your exploratory SQL and Redshift Spectrum for actual analysis.Assuming you are using the Glue data catalog for your external table catalog then Athena and Redshift can directly share the same table definitions.  If you've already done the DDL in Redshift Spectrum then should be able to use it in Athena as is with little to no setup, nothing to provision or spin up, and the only cost would be the Athena scan costs.I hope this helps,-KurtCommentShareklarsonanswered 4 years ago0We'd love to use Athena, but we're not using Glue and we're not currently planning on doing so.We also like to query Redshift at the same time as S3 (which both Spectrum and Presto allow), so that's another deal breaker.Last but not least, we don't want to use multiple tools (like Athena + Spectrum), rather one that supports all our workloads - currently Presto leads the way, but we like Spectrum's simplicity in terms of ops.CommentShareondrejjanswered 4 years ago0Thank you for for this feature suggestion. We have definitely heard requests for this feature and it will be considered for our roadmap.We do not comment on the timing of new features until they are announced but new feature releases are noted in our regular maintenance announcements at the top of this forum and on our What's New page. https://aws.amazon.com/redshift/whats-new/CommentShareAWS-User-2965899answered 4 years ago"


Question: Tradeoffs Of Enabling & Disabling Source Encryption in Encrypt.tcl

"Hey everyone,I've recently bumped to a newer AMI which brings in Vivado 2020.2, I was previously on 2018.4. I've noticed that Vivado has gotten much more strict about hiding the names of cells in reports and checkpoints. This makes timing reports for designs that fail to meet timing unusable as debugging tools.Since we can't afford to rerun the flow on timing failures, to work around this i've removed the calls that encrypt sources in encrypt.tcl. The uploaded DCP is still encrypted, so AGFI generation seems to work OK.Given this, why is it suggested that we encrypt RTL sources? Does this change if we are not sharing AGFIs outside of our institution?FollowComment"

Answer: "0Dear customerThank you so much for contacting AWS. The "source encrypt.tcl" which encrypts RTL source files is only a recommended step and not required for AWS F1 work flow. This is enabled by default so that all the intermediate dcp files in the build process (for example, post-synth dcp, post place dcp etc) are also encrypted to enable any sharing with others. But this is totally optional and can be removed from the flow, if not required, and is not required for the aws f1 build flow. Please feel free to contact aws if you have further questions on this.ThanksCommentShareAWS-User-7905434answered 2 years ago0So to confirm if i'm not sharing DCPs outside my organization there's no downside to turning this off? If i do need to share checkpoints with support (for instance) i can always re-enable it.Thanks!CommentShareBiancolinanswered 2 years ago0correct, if you do not need your intermediate DCPs encrypted you do not need thisCommentShareAWS-User-7905434answered 2 years ago"


Question: Enhanced Fan-Out + Consumer + Lambda

"I have a Kinesis Data Stream with 3 shards: 0001, 0002 and 0003.I have registered a Consumer in the data stream.I have 2 shard subscriptions, one for consumer 1 and shard 0001, and the other for consumer 2 and shard 0002.I have 2 lambda functions, one has as a trigger the data stream with consumer 1, and the other has as a trigger the data stream with consumer 2.Accordinghttps://docs.aws.amazon.com/streams/latest/dev/enhanced-consumers.htmlsays: "If you use the API to build a consumer that uses enhanced fan-out, then you can subscribe to individual shards."When the lambda functions run, they read records from all the shards, not the one that is assigned to the consumer.How I can use EFO + consumers + shard subscription + lambda function to read records from a particular shard?Any clue?FollowCommentvtjean 10 days agoIs there a specific reason to assign a specific shard to a lambda function?Share"


Question: DMA registers

"Hello,I was unable to locate the documentation for configuration registers in the shell which XDMA driver uses to control DMA operation.Can you please provide the pointer?ThanksFollowComment"

Answer: "0Hello,The DMA registers are accessible on PF0 BAR2 and we use the Xilinx XDMA IP, so you can refer to the XDMA IP Product Guide for details: https://www.xilinx.com/support/documentation/ip_documentation/xdma/v4_1/pg195-pcie-dma.pdf#page=42The Bar mapping is listed here: https://github.com/aws/aws-fpga/blob/master/hdk/docs/AWS_Fpga_Pcie_Memory_Map.md#memory-map-per-slotLet us know if you need any further information and we'd be happy to help.-DeepCommentShareDeep_Panswered 2 years ago0ThanksCommentShareAWS-agdpanswered 2 years ago0the sh_ddr.sv does not have any interface to program the registers in DDR controllers.I believe there should be one.Is this done with the same interface as for data read/write?CommentShareAWS-agdpanswered 2 years ago0Hi,All the DDR Controllers are managed entirely by the Shell. Customers are required to connect the "stats" interface exposed by sh_ddr.sv to the corresponding interface from the Shell in cl_ports.vh.https://github.com/aws/aws-fpga/blob/master/hdk/docs/AWS_Shell_Interface_Specification.md#ddr4-axi states:WARNING: If the stats interfaces are not connected, the DDR controllers will not function. However, the CL developer should not otherwise use them since they are specific to Shell management functions. If the DDR controllers are not used by the CL, then the interfaces should be left unconnected.An example of such connection is shown below:https://github.com/aws/aws-fpga/blob/master/hdk/cl/examples/cl_dram_dma/design/cl_dram_dma.sv#L643-L665Hope this helps. Please reach us if you have any questions.Thanks!ChakraCommentShareawschakraanswered 2 years ago"


Question: Random deployment failure in Elastic Beanstalk Docker running on 64bit Amazon Linux 2/3.5.4 with 100% EC2 usage?

"We have a couple of Beanstalk applications with multiple environments.  The beanstalk applications are based on Docker running on 64bit Amazon Linux 2/3.5.4 and runs Django inside docker. Most of the environment uses a t2.micro EC2 which if perfect for our scenario.Lately we have been seeing a multiple random (not event without a config/code change) elastic beanstalk deployment failure where the deployment runs for over 10 minutes and fails with log below:Upon investigation, it was found that every time there is a deployment failure, we see unprecedented rise in CPU usage, usually up to 100% (begins to rise after deployment initiation). Our baseline CPU usage is generally about 30% and this happens even if it's a dry deployment with no any config or code change. The problem is resolved on itself after 30–40 minutes. If we try to redeploy before that same issue is seen even after EC2/service restart.Syslog of EC2 gives me following errors in CloudFormation, possibly during deployment).[eb-cfn-init]: 2023-02-20 10:07:51,762 [INFO] -----------------------Build complete-----------------------[eb-cfn-init]: [2023-02-20T10:09:24.623Z] Tailing /var/log/cfn-hup.log[eb-cfn-init]: ******************* cfn-hup taillog *******************[eb-cfn-init]:   File "/usr/lib64/python3.7/http/client.py", line 1036, in _send_output[eb-cfn-init]:     self.send(msg)[eb-cfn-init]:   File "/usr/lib64/python3.7/http/client.py", line 976, in send[eb-cfn-init]:     self.connect()[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/packages/urllib3/connection.py", line 200, in connect[eb-cfn-init]:     conn = self._new_conn()[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/packages/urllib3/connection.py", line 182, in _new_conn[eb-cfn-init]:     self, "Failed to establish a new connection: %s" % e[eb-cfn-init]: cfnbootstrap.packages.requests.packages.urllib3.exceptions.NewConnectionError: <cfnbootstrap.packages.requests.packages.urllib3.connection.HTTPConnection object at 0x7f7b60e24990>: Failed to establish a new connection: [Errno 101] Network is unreachable[eb-cfn-init]: During handling of the above exception, another exception occurred:[eb-cfn-init]: Traceback (most recent call last):[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/adapters.py", line 499, in send[eb-cfn-init]:     timeout=timeout,[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/packages/urllib3/connectionpool.py", line 756, in urlopen[eb-cfn-init]:     method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2][eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/packages/urllib3/util/retry.py", line 573, in increment[eb-cfn-init]:     raise MaxRetryError(_pool, url, error or ResponseError(cause))[eb-cfn-init]: cfnbootstrap.packages.requests.packages.urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='169.254.169.254', port=80): Max retries exceeded with url: /latest/api/token (Caused by NewConnectionError('<cfnbootstrap.packages.requests.packages.urllib3.connection.HTTPConnection object at 0x7f7b60e24990>: Failed to establish a new connection: [Errno 101] Network is unreachable'))[eb-cfn-init]: During handling of the above exception, another exception occurred:[eb-cfn-init]: Traceback (most recent call last):[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/util.py", line 193, in _retry[eb-cfn-init]:     return f(*args, **kwargs)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/util.py", line 329, in _fetch_instance_id[eb-cfn-init]:     token = _get_session_token()[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/util.py", line 293, in _get_session_token[eb-cfn-init]:     timeout=REQUEST_TIMEOUT)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/api.py", line 130, in put[eb-cfn-init]:     return request("put", url, data=data, **kwargs)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/api.py", line 59, in request[eb-cfn-init]:     return session.request(method=method, url=url, **kwargs)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/sessions.py", line 586, in request[eb-cfn-init]:     resp = self.send(prep, **send_kwargs)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/sessions.py", line 700, in send[eb-cfn-init]:     r = adapter.send(request, **kwargs)[eb-cfn-init]:   File "/usr/lib/python3.7/site-packages/cfnbootstrap/packages/requests/adapters.py", line 565, in send[eb-cfn-init]:     raise ConnectionError(e, request=request)[eb-cfn-init]: cfnbootstrap.packages.requests.exceptions.ConnectionError: HTTPConnectionPool(host='169.254.169.254', port=80): Max retries exceeded with url: /latest/api/token (Caused by NewConnectionError('<cfnbootstrap.packages.requests.packages.urllib3.connection.HTTPConnection object at 0x7f7b60e24990>: Failed to establish a new connection: [Errno 101] Network is unreachable'))[eb-cfn-init]: 2023-02-20 10:07:15,409 [DEBUG] Sleeping for 2.047560 seconds before retryingMy take on the issue.Sometime during the deployment (internally CloudFormation is doing the work) the egress network (public internet) becomes unavailable, mostly during the IMDS (metadata service) polling phase, and internally CloudFormation keeps on retrying to get the metadata resulting in a spike in CPU usage. Thus, the EC2 becomes unresponsive due to 100% CPU usage caused due to retry (maybe) and deployment fails. The main culprit here is the network availability which is a total weird because this resolves on its own the networking is configured correctly.FollowComment"


Question: Api Gateway mTls ( 2 Way SSL) exception

I have enabled the mTls for my api-gateway.And updated the trust store with the public cert provided by the client.Client try to request the url and get  javax.net.ssl.SSLHandshakeException exceptionCould you please advise why this exception happens on the client side?FollowComment

Answer: "0Hi,You mentioned updating your trust store with the public cert provided by the client.However, kindly note that your trust store must contain at least the following keys and certificates [1]:root CA private keyroot CA public key)client certificate signing requestclient certificate private keyclient certificate public keyWith that being said there are multiple variants of errors which fall under the javax.net.ssl.SSLHandshakeException.Depending on the additional information found in the error message, the answer will be different.Could I kindly ask that you provide the full error message from the client?For example it would look something like this:"javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:unable to find valid certification path to requested target"I would however, highly recommend ensuring and validating that the steps provided at [1] are correct as that would help isolate the issue.Also, is it only a specific client having trouble connecting to your API? Or are other clients able to send requests to your API-GW successfully?References:[1] https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/CommentShareSUPPORT ENGINEERKobus_Canswered 4 months ago"


Question: GameLift in 2020 - Major GameLift FleetIQ update now available in General Availability

"Calling all game developers! In April, we released a GameLift FleetIQ update into Preview to enhance the flexibility in how you can adopt GameLift’s low-cost game server hosts by allowing you to use your own game server management layer. Since then, N3TWORK, Gameloft, and other developers have used GameLift FleetIQ to incrementally migrate live games, burst in-game events, or deploy containerized games onto AWS while saving up to 70% on infrastructure cost compared to existing on-premises deployments.Today, we’re excited to release this GameLift FleetIQ update into general availability! With three APIs, you can set up an Auto Scaling group in your own AWS account and let GameLift FleetIQ automatically manage Spot instances to avoid game session interruption. This unlocks low-cost game servers that you can add alongside your existing capacity (on-premises or cloud) to host your live games. Because these instances run in your AWS account, you have flexibility to use containers or integrate your FleetIQ-managed instances with other AWS services such as AWS Shield and Amazon Elastic Kubernetes Service.As part of general availability, we are also adding On-Demand-Only Mode and a new API to check the status of your instances. We can’t wait to see what you build with the updated GameLift FleetIQ! To learn more, check out our blog, developer guide, and new training.FollowComment"


Question: How to use LastEvaluatedKey in ExecuteStatement request?

"According to the documentation for ExecuteStatement:If LastEvaluatedKey is present in the response, you need to paginate the result set.How can I use LastEvaluatedKey if ExecuteStatement request has no ExclusiveStartKey parameter as Scan and Query.I cannot use NextToken because it is not returned when Limit is specified.FollowComment"

Answer: "2Accepted AnswerThis is something the team are currently working on. When you use Limit you are not returned a NextToken, but a LastEvaluatedKey, and due to the lack of ExclusiveStartKey it cannot be used for Pagination. Unfortunately I do not have an ETA on the fix, but it is being worked on priority.For now, if you are using Query you can alter your request to add the SK of the LastEvaluatedKey:SELECT * FROM mytable WHERE PK='x' AND SK > {SK returned in LEK}Hope that helpsCommentShareEXPERTLeeroy Hannigananswered a year agoAWS-User-810139049822 a year ago@Leeroy,Also running into this issue with first ExecuteStatement. But I do get a "NextToken" returned but when we fed it into the next "ExecuteStatement" as part of input, we keep getting an error "NextToken does not match request".Is this the same issue quoted?if so, do we have any estimated timeline?Share"


Question: Kinesis video stream sdk cpp crashes and timeouts when internet connection goes off

"Hello! Kinesis video stream sdk cpp works well. However, due to internet distruptions sometimes the stream crashes and just hangs(Timeout).curlCompleteSync(): HTTP Error 0 : Response: (null)curlCompleteSync(): curl perform failed for url https://kinesisvideo.us-east-1.amazonaws.com/describeStream with result Could not resolve host name :Could not resolve host:kinesisvideo.us-east-1.amazonaws.comThen I get a error code 0x0000000fThe operation timed out. Could someone help me how to prevent the stream from timing out when there is internet distruption and reconnect when internet comes backFollowComment"


Question: GENERIC_INTERNAL_ERROR: Unsupported partition transform: 1000: device_id: void(1)

"Hi,I am getting this below error when writing data to iceberg table where I'm partitioning the table on a column called device_id.The device_id has a set of guids which is stored as a string.I tried to check if the below error is because of device_id being null for some records but that is not the case.Any help provided will be greatly appreciated.GENERIC_INTERNAL_ERROR: Unsupported partition transform: 1000: device_id: void(1)FollowComment"


Question: SES With Multiple Domains

"When signing up for SES you must specify your website and use case. Let's say for that matter I have five websites, I send transactional emails from all of those (password resets, email confirmations, etc) and when I submitted SES account for review I used the domain example.tld.Am I allowed to use othersite.tld which is completely unrelated to example.tld but still has the same use case (transactional emails)?It doesn't make much sense that each website will need it's own SES region. I'd love some clarification.FollowComment"

Answer: "0Hello,SES like many other services is a region-specific service and each SES region that you get access to is mutually exclusive of all the other regions. What this means is that you can have the SAME domain/email-address identities verified in multiple SES regions without the sending of these regions being effected individually.Now, about your actual query, that at the time of requesting Production Access, the domain provided was "example.tld". But now you want to add a non-related domain "othersite.tld" to your verified identities, having the same use case in general, which is to send transactional emails for another of your websites.Once you have been granted Production Access for an SES region, SES trusts you to know the best practices keeping your sending clean and rich. Therefore, then onward you can feel free to verify multiple other domains (of course under SES quota limits) in your regions, even if they were not mentioned by you at the time of requesting Production Access.The only expectation here is that you will keep your sending clean and reputation high.Thanks.CommentShareSUPPORT ENGINEERRuhisar_Tanswered a year agoMonica_Lluis SUPPORT ENGINEERa year agoThank you for the answer, ruhisarAtAWS.AWS-User-1057253, let us know if this answers your question. If this solved your issue, please remember to click on the "Accept" button to let the community know that your question is resolved. This helps everyone. Thank you in advance.Share"


Question: Websocket manager error when creating new chat Session

"I am trying to create a customer chat session from a custom agent control panel with amazon connect. If the agent  has no current contacts this works fine. However, if the agent has customer already in their contacts, I get the following error:TypeError: this.websocketManager.closeWebSocket is not a functioncode:var initiateChatRequest = {            ParticipantDetails: {                DisplayName: 'John Doe'            },            ContactFlowId: contactFlowId,            InstanceId: instanceId        };// get the connection token / ids        const apiDetails = await fetch(apiGatewayEndpoint, {            method: 'POST',            body: JSON.stringify(initiateChatRequest)        }).then((response)=> {            if(response.ok){                return response.json()            }            return Promise.reject(response)          })        const chatDetails =   apiDetails.data.startChatResult        // create the chat session        createChatSession = await connect.ChatSession.create({            chatDetails: chatDetails,            type: "CUSTOMER",           // websocketManager: connect.core.getWebSocketManager()        });        // connect the chat session        await createChatSession.connect().then((response) => {            console.log("Successful connection: " + JSON.stringify(response));            return response;        }, (error) => {            console.log("Unsuccessful connection " + JSON.stringify(error));            return Promise.reject(error);        });Should I be creating the new chat session in a different way?FollowComment"

Answer: "0Hello, I'm unsure on this question.  Have you already resolved it?  I know it's been a while since you asked.  If not, do you mind opening an AWS support case so we can help you dive into the issue and get it resolved?CommentShareAWS-User-9371299answered 6 months ago"


Question: How to mount workdocs on Ubuntu

How to mount workdocs on Ubuntu，thank youFollowComment

Answer: "0unfortunately Workdoc drive is only supported for Windows, Mac and Amazon WorkSpaces client.https://aws.amazon.com/workdocs/faq/(under Amazon WorkDocs Drive)CommentShareEXPERTSheng Chenanswered a year ago0You can mount Workdocs drive in Ubuntu running inside Windows Subsystem for Linux. The code snippet below can be found in Amazon WorkDocs User Guide.$ sudo mkdir /mnt/w$ sudo mount -t drvfs W: /mnt/w$ cd /mnt/w$ ls  CommentShareKamanswered a year ago"