Question: Mikrotik CHR sever connection lost

"I have created a server using the Mikrotik created AMI for their CHR software. I keep losing connection to the server entirely; no Winbox, no SSH, no console connect from the Instances page. I keep having to spin up a new server and rebuild my work. No other AWS server (mostly Ubuntu AMI's) on our account has had this issue. I am assuming there is something about the CHR AMI that I am missing which is causing this issue.I am attempting to set up a VPN using OpenVPN to connect the field devices my employer creates. A previous VPN project was run last year and that server was up for nearly the full year and we could still connect to it, until I removed the PPTP setup and replaced it with the Mikrotik built-in OpenVPN server.Here is the config export for the CHR.# mar/31/2022 17:55:47 by RouterOS 6.44.3# software id = ###/interface bridgeadd arp=local-proxy-arp fast-forward=no name=afads priority=0x8192 \    transmit-hold-count=1/interface ethernetset [ find default-name=ether1 ] disable-running-check=no/interface wireless security-profilesset [ find default=yes ] supplicant-identity=MikroTik/ip pooladd name=afadpool ranges=10.8.0.1-10.8.127.255/ppp profileset *0 bridge=afads change-tcp-mss=default local-address=10.8.0.1 only-one=\    yes use-encryption=yesadd bridge=afads local-address=10.8.0.1 name=SmartFlaggerL3 only-one=yes \    remote-address=afadpool use-encryption=yes/interface bridge portadd bridge=afads hw=no interface=ether1add bridge=afads interface=*F005C9add bridge=afads interface=*F004E9add bridge=afads interface=dynamic/interface ovpn-server serverset auth=sha1 certificate=[ServerCertName] cipher=aes256 default-profile=\    SmartFlaggerL3 enabled=yes keepalive-timeout=30 netmask=17/ip firewall address-listadd address=10.8.40.1 list=undeployed[Removed approx 4000 lines, similar to the one above]/ip firewall filteradd action=accept chain=forward comment=\    "Allows units in the Test group to communicate." dst-address-list=test \    src-address-list=testadd action=accept chain=forward comment=\    "Allows all traffic from Internal Trusted Servers to units." \    dst-address-list=!InternalTrustedServers src-address=0.0.0.0 \    src-address-list=InternalTrustedServersadd action=accept chain=forward comment=\    "Allows all traffic from units to Internal Trusted Servers." \    dst-address-list=InternalTrustedServersadd action=accept chain=forward comment="Test of unit to unit communication" \    disabled=yes dst-address-list=test src-address-list=testadd action=accept chain=forward comment=\    "Accept Forward for Established and Related Connections" \    connection-state=established,related,untrackedadd action=accept chain=forward comment="Allow Forwarding by OVPN Clients" \    src-address=192.168.22.128/25add action=accept chain=input comment=\    "Accept Input for Established and Related Connections" connection-state=\    established,related,untrackedadd action=accept chain=input comment="Allow OpenVPN Connection" dst-port=\    1194 protocol=tcpadd action=accept chain=input comment="Allow Input by OVPN Clients" \    in-interface=all-pppadd action=accept chain=input comment="Allow Winbox Input" dst-port=8291 \    protocol=tcpadd action=accept chain=input comment="Allow HTTPS Input" dst-port=443 \    protocol=tcpadd action=drop chain=input comment="Input drop for all other connection" \    disabled=yesadd action=drop chain=forward comment="Forward drop for all other connection" \    disabled=yesadd action=drop chain=forward comment="Invalid drop for all other connection" \    connection-state=invalid disabled=yesadd action=drop chain=forward comment="PREVENT ALL TALK BETWEEN UNITS." \    disabled=yes src-address=!10.8.0.5/ip firewall natadd action=masquerade chain=srcnat out-interface=all-ppp/ip serviceset telnet disabled=yesset ftp disabled=yesset www disabled=yesset api-ssl disabled=yes/ppp secretadd name=AFD0001 password=[Redacted] profile=SmartFlaggerL3 remote-address=\    10.8.80.1 service=ovpn[Removed nearly 4000 lines, similar to the one above] /system identityset namep[AWS instance auto-generated name]/system loggingadd topics=ovpnadd topics=debugFollowComment"


Question: How can you define the resource's location in CloudFormation?

I need to define multiple resources in multiple regions using one single CloudFormation template. is it possible?FollowComment

Answer: 0Accepted AnswerI think you are looking for the functionality that AWS CloudFormation StackSets provides: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html.CommentShareJesus Bernalanswered 3 years ago


Question: The Connection is Not Private

I get this error but only on Safari.Did I install something wrong on Amazon Lightsail using Wordpress?FollowComment

Answer: "1Generally this means that the certificate on your server doesn't match the DNS name for that server. Or that the certificate isn't signed by an authority that the browser recognises - this could be because it is a self-signed certificate. There's more information available when you click "Show Details" which should identify the cause.CommentShareEXPERTBrettski-AWSanswered 5 months agorePost-User-7153718 5 months agoWebsites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for www.nobody.chat. The certificate is only valid for nobody.chat.Error code: SSL_ERROR_BAD_CERT_DOMAINThe DNS matches the domain name from what I can see so I don't know what the issue is...ShareBrettski-AWS EXPERT5 months agoBut the DNS name doesn't match the certificate name. The certificate is for nobody.chat whereas the DNS name being used is www.nobody.chat - they aren't the same.Share0Hi,Thanks for using Lightsail. I'm adding a doc which may help you with this process.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/verify-tls-ssl-certificate-using-dns-cname-httpshttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-tutorial-launching-and-configuring-wordpress#tutorial-launching-and-configuring-wordpress-creating-a-dns-zoneCommentShareAWS-Leslieanswered 4 months ago"


Question: AWS EMR issue in Running NodeJs streaming program

how to solve this issue subprocess failed with code 127 ?FollowComment

Answer: "0Hi,Thank you for writing to re:Post.From the information provided, I can see that a NodeJs streaming job is failing with Exit code 127Generally Exit code: 127 corresponds to application specific issues.Are you also facing other exceptions apart form this ? Please share an error snippet if possible.CommentShareSujay_Manswered 10 months ago"


Question: RDS: Unable to restore MySQL 5.6 snapshot

"I have a snapshot of a MySQL 5.6.35 instance that I want to restore, but it seems like this is no longer possible, I just get the following message when trying to restore the snapshot from the AWS console  :RDS does not support creating a DB instance with the following combination: DBInstanceClass=db.m6i.large, Engine=mysql, EngineVersion=5.6.35, LicenseModel=general-public-license. For supported combinations of instance class and database engine version, see the documentation.Is there any other way to retrieve the database contents from the snapshot? Or is there a way to upgrade the snapshot itself to MySQL 5.7?FollowComment"

Answer: "1Unfortunatly RDS does not support your following configuration, however you could upgrade to MySQL 5.7 (You can use the AWS CLI or SDK to upgrade the snapshot to MySQL 5.7. After upgrading, you can create a new RDS instance with the upgraded snapshot). or upload your snapshot to an EC2 instance (which may take a few more steps)CommentShareAWS_Guyanswered 3 months agorePost-User-3880764 3 months agoThanks for the answer, I will give it a go from the CLI then ...SharerePost-User-3880764 3 months agoHmm, it doesn't seem to work from the CLI either :C:\WINDOWS\system32>aws rds modify-db-snapshot --db-snapshot-identifier mysqldb5635-snapshot --engine-version 5.7.38 --profile dbadminAn error occurred (InvalidParameterCombination) when calling the ModifyDBSnapshot operation: You can't upgrade the DB snapshot from the engine version 5.6.35 to 5.7.38.Share0Accepted AnswerOk, seems like in my case the answer was to choose a bigger machine to restore it to, i.e. db.m5.xlarge instead of db.m5.largeCommentSharerePost-User-3880764answered 3 months ago"


Question: EMR reconfig question - Change custom AMI

"My customer would like to know if this announcement https://aws.amazon.com/about-aws/whats-new/2019/05/amazon-emr-announces-support-for-reconfiguring-applications-on-running-emr-clusters/  includes the ability to swap in a new custom AMI for future nodes.  My reading of the docs would suggest no but need to confirm.Your customer could deploy a single node EMR cluster (only 1 master), and configure what your customer want inside this ec2 machine, then build AMI from this master node and deploy other EMR clusters by selecting this AMI.FollowComment"

Answer: 0Accepted AnswerThere is no option to change Custom AMI for a running EMR cluster. The announcement is for more application configuration.CommentShareEXPERTSerhatanswered 4 years ago


Question: How do I get a purchase order number to reflect on my AWS invoice?

"I have a purchase order set up, but the monthly invoice from AWS does not reflect it. I need the purchase order number to appear on the invoice.How do I get the PO to show on the invoice?FollowComment"

Answer: "0Hello,I'm sorry to hear you've hit this roadblock. I was able to locate these instructions that explain how to add a Purchase Order to your invoice:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/adding-po.htmlIf it still doesn't appear after following those instructions I would suggest opening a billing case from the Console:https://docs.aws.amazon.com/awssupport/latest/user/case-management.html- Brian D.CommentShareEXPERTAWS Support - Briananswered 2 months ago0Thanks, I followed those steps previous and got the purchase order to show in the email subject line, but not the invoice itself. Have modified one small element so hopefully that works.CommentSharerePost-User-6252972answered 2 months ago"


Question: DataSync with EFS Source fails when policy requires encryption in transit.

"We have been using data sync with no issues with an EFS drive which does not require encryption in transit.  For compliance reasons, we have moved to a drive which requires encryption in transit.  DataSync to the new drive fails.  When I remove the policy, the task completes.  When I restore the policy, the task fails.  Now what?FollowCommentAWS-VG a year agoCan you please elaborate? Where is the policy being set? Are you introducing encryption in transit in 1, 2 or 3 as per the diagram in https://docs.aws.amazon.com/datasync/latest/userguide/encryption-in-transit.html?ShareNathan Zook--Carrum Health a year agoOur data is on an EFS drive.  That diagram relates to data sitting on on-prem servers, so it is not clear how it applies to the situation in question.  The policy was created through the website by checking the "Enforce in-transit encryption for all clients" box on the "File System Policy" tab for the EFS drive in question.Share"

Answer: "1Accepted AnswerHi Nathan,DataSync recently released support for EFS TLS 1.2 and utilizing IAM roles for DataSync within EFS file system policies.  Now, when creating your EFS location you can specify TLS 1.2 and optionally specify an IAM role as part of the location to be used as a principal inside an EFS file system policy.The DataSync docs have details on how to accomplish this.https://docs.aws.amazon.com/datasync/latest/userguide/create-efs-location.htmlCommentShareDarryl_Dioanswered a year ago"


Question: Kinesis data streams limits

"Hi everyone!Could someone explain me this related to kinesis DS limits found in the documentation:https://docs.aws.amazon.com/streams/latest/dev/service-sizes-and-limits.htmlGetRecords can retrieve up to 10 MiB of data per call from a single shard, and up to 10,000 records per call. Each call to GetRecords is counted as one read transaction.Each shard can support up to five read transactions per second. Each read transaction can provide up to 10,000 records with an upper limit of 10 MiB per transaction.Each shard can support up to a maximum total data read rate of 2 MiB per second via GetRecords. If a call to GetRecords returns 10 MiB, subsequent calls made within the next 5 seconds throw an exception.I find these points not very consistent and maybe contradictory. Did I miss something?I appreciate your help.FollowComment"

Answer: "0Accepted AnswerI think the points are clearer if you go from top to bottom, by first looking at the broader concept of Kinesis Streams and then look at the average read capacity that is available for you.The first thing you need to understand is a Shard. Each Shard can support a maximum of 1 MB write or 2 MB read per second (on Average). The key word here is the 'Average'. Which means that if one read call returns a 10MB result, the next 5 calls on the shard will be throttled. On the other hand, if the read call returns a less than 2 MB, you can make additional read calls, up to a total number of 5 calls per second.What happens if:Your first read call (getRecords) returns 10MB and you issue another read call over the next 5 seconds? Answer: You will get a ProvisionedThroughputExceededException.You have made 5 calls within the second returning 1 MB of data in total. You issue a 6th read call. You will get a Provisioned Throughput Exceeded exception even though you have only read 1MB of data. This is because you have exceeded the number of Reads that you can during one second interval.You might be getting confused by the upper limit of Read capacity per Shard which is 2MB. I believe you should treat it as an "average" read capacity rather than a hard read capacity, but the average is from the point you make a call that over-consumes the 2MB limit. Hence while you can make a call which reads 10 MB (Hence getRecords 10Mb limit), but then this would mean that you have used up 5 seconds of the capacity for the remaining 5 minutes.Please read the following:https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.htmlPara 5:The size of the data returned by GetRecords varies depending on the utilisation of the shard. The maximum size of data that GetRecords can return is 10 MiB. If a call returns this amount of data, subsequent calls made within the next 5 seconds throw ProvisionedThroughputExceededException. If there is insufficient provisioned throughput on the stream, subsequent calls made within the next 1 second throw ProvisionedThroughputExceededException. GetRecords doesn't return any data when it throws an exception. For this reason, we recommend that you wait 1 second between calls to GetRecords. However, it's possible that the application will get exceptions for longer than 1 second.I hope that helps!CommentShareMODERATORAWS-User-7681406answered 4 years ago"


Question: OAuth2.0 on AWS API Gateway

HiWe would like to protect our APIs developed on AWS API Gateway with OAuth2.0. I am not able to find enough documentation on this. Does anybody guide me on how to implement OAuth2.0 on AWS API Gateway for authentication and authorization?FollowComment

Answer: "0You can achieve this by integrating Amazon API Gateway Rest API with Amazon Cognito User Pools. First, set up Cogito User Pools and OAuth 2.0 scopes and then use it as an Authoriser in the Rest API.https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.htmlAlso this blog might help with step by step instructions.https://aws.amazon.com/premiumsupport/knowledge-center/cognito-custom-scopes-api-gateway/Hope this helps.CommentSharesimonanswered 3 months agosimon 2 months agoHi there Kareem - I'd love to know how you got on implementing this and whether the answer met your needs. Please let me know by Accepting the answer or providing additional comments. Thanks!Share"


Question: Unable to delete my VPC

"Hi,I am unable to delete a VPC which has one public subnet, one routing table, one internet gateway, nat gateway and it comes with few network interfaces as well.I deleted nat gateway and that delete one network interfaceWhen I try to delete VPC, I get this error:Unable to delete this VPC:The VPC contains one or more in-use network interfaces, and cannot be deleted until those network interfaces have been deleted.View in-use network interfaces in the VPCWhen I try to detach network interfaces I get this error:Error detaching network interfaceYou do not have permission to access the specified resourceWhen I try to delete subnet I get this error:Note that the following subnets cannot be deleted:The following subnets contain one or more network interfaces, and cannot be deleted until those network interfaces have been deleted. Click here to view your network interfacesWhen I try to detach internet gateway get this error:Network vpc has some mapped public address(es). Please unmap those public address(es) before detaching the gatewayI need help with how I can delete these components in VPC.Edited by: Harry1805 on May 11, 2020 12:28 AMFollowComment"

Answer: 0I deleted the ELB and it allowed me to delete this VPC and other components in VPC.CommentShareHarry1805answered 3 years ago


Question: Updating adb and running it throws socket address error

"Hi, I'm wondering how it's possible to update adb without killing the existing adb server.Running adb kill-server in install phase gives me this output: adb kill-server is not permitted.If I don't kill, then running adb devices after downloading new adb gives me:adb server version (39) doesn't match this client (41); killing...ADB server didn't ACKFull server startup log: /tmp/adb.1019.logServer had pid: 2591--- adb starting (pid 2591) ---adb I 01-02 18:12:22  2591  2591 main.cpp:63] Android Debug Bridge version 1.0.41adb I 01-02 18:12:22  2591  2591 main.cpp:63] Version 33.0.3-8952118adb I 01-02 18:12:22  2591  2591 main.cpp:63] Installed as /home/device-farm/android-sdk-linux-new/platform-tools/adbadb I 01-02 18:12:22  2591  2591 main.cpp:63] adb F 01-02 18:12:22  2591  2591 main.cpp:167] could not install *smartsocket* listener: Address already in usePlease suggest - how do I proceed here?Custom env YAML for updating ADB:version: 0.1phases:  install:    commands:      - mkdir -p /home/device-farm/android-sdk-linux-new/      - curl -L "https://dl.google.com/android/repository/platform-tools-latest-linux.zip" -o /tmp/new_build_tools_2.zip      - unzip /tmp/new_build_tools_2.zip -d /home/device-farm/android-sdk-linux-new      - export ANDROID_HOME=/home/device-farm/android-sdk-linux-new      - export PATH="/home/device-farm/android-sdk-linux-new/platform-tools":"$PATH"FollowComment"


Question: Boto3 resource association on creation

"Hopefully a easy one and I'm just missing something.I can create the resource using the followinghttps://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/greengrass.html#Greengrass.Client.create_resource_definition_versionSo this creates my resource, but how do I have it also associate a lambda function with the resource with out manually going into the console and associate said resource with a lambda.abrv but works fine        res_def = rinse(self._gg.create_resource_definition(            Name=self.name,            InitialVersion={'Resources': res}        ))FollowComment"

Answer: 0sorry create it when you create the lambda with https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/greengrass.html#Greengrass.Client.create_function_definitionCommentSharedoopanswered 3 years ago


Question: Cloudfront S3 MRAP

"Hello All,I've been trying to setup a Multi-region access point for S3.The basic problem is that I have users in Asia that I'm trying to get better performance for.The simple part. I've created two buckets, I've put an html file in each of them with a simple name of us-east-1 and ap-south-1.Initially those were private access only but for the purpose of getting anything working they are now public.They are setup in an mrap which for now is not replicating.I setup a cloudfront distribution and pointed it at the mrap but only ever get errors.https://corridor-ap-south-1.s3.ap-south-1.amazonaws.com/test/region-test/region.html - ap-south-1 htmlhttps://corridor-cdn.s3.amazonaws.com/test/region-test/region.html - us-east-1 htmlmrap alias: mbzcc59bo9dy4.mrapmrap access point? https://mbzcc59bo9dy4.mrap.accesspoint.s3-global.amazonaws.com/test/region-test/region.htmlThe errors are: The authorization mechanism you have provided is not supported. Please use Signature Version 4.I hope I'm wrong, but is there a ridiculously stupid world where I have to put a signature on my object request?This seems like it would be a complete waste of money to setup a lambda to do this for all my object requests.FollowComment"

Answer: "0It sounds like you are encountering an authentication issue when accessing your multi-region access point. By default, Amazon S3 requires that requests are signed using Signature Version 4 (SigV4) to ensure that the request is authorized and secure.When you access your S3 buckets through a multi-region access point, you need to include the region-specific endpoint in the request URL. The endpoint will be in the format https://<mrap-name>.s3-accesspoint.<region>.amazonaws.com. The <region> placeholder should be replaced with the region code where the access point is located (e.g., ap-south-1 or us-east-1 in your case).To sign your requests with SigV4, you can use the AWS SDKs or the AWS CLI. The SDKs and CLI automatically sign the requests for you, so you don't need to write a separate Lambda function to do this.To use the AWS CLI, you can configure your AWS credentials by running the aws configure command. Once your credentials are configured, you can use the aws s3 command to interact with your S3 buckets. For example, to list the contents of a bucket in a specific region through a multi-region access point, you can run the following command:aws s3 ls s3://<mrap-name> --region <region> --endpoint-url https://<mrap-name>.s3-accesspoint.<region>.amazonaws.comYou can also use the SDKs to interact with S3 and sign your requests with SigV4. The specific steps for signing your requests will depend on the SDK you are using, but there are SDKs available for most programming languages.By signing your requests with SigV4 and including the region-specific endpoint in the request URL, you should be able to access your multi-region access point without encountering the "authorization mechanism not supported" error.hope this helpsCommentSharemishdaneanswered 2 months ago0You cannot use a Multi-Region Access Point as the distribution origin for Amazon CloudFront. However, you can configure Multi-Region Access Points as a custom distribution origin with Amazon CloudFront. For more information, see Building an active-active, proximity-based application across multiple Regions on the AWS Storage Blog.https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRestrictions.htmlMulti-Region Access Point's require SigV4A authentication and Amazon CloudFront does not support this currently when using the S3 Distribution Origin.  Multi-Region Access Point's also do not support unauthenticated (anonymous) access.As a workaround, you can generate SigV4A authentication via a Lambda@Edge function.You might also consider CloudFront Origin Failover, and this solution to perform Geo based routing.CommentShareAWS-User-5738042answered 2 months ago"


Question: CORS/HTTPS issues with Elastic Beanstalk and load balancer

"We have a springboot backend api running on elastic beanstalk. Our domain is on route53 and uses the Certificate Manager to run as https.To make an api request we send the request to a subdomain url (https://api.SomeWebsite.com ). In Route53 we direct that subdomain to an EC2 load balancer, which then points that at the beanstalk instance. Our beanstalk should be in http - we are using the LB as an SSL terminator.We have listeners for incoming traffic on the LB as:HTTP , Port 80 -> Redirect to HTTPSHTTPS, Port 443 -> Redirect to Target, HTTP, OurBeanstalkENV.I have triple checked that the https port points to the correct EB instance, and it does note http on the target selection. +The Issue: we keep getting either preflight failed due to no Access-Control-Allow-Origin (it's in the request header) or a timeout error error when make the requests. When we look at beanstalk logs, our springboot server has an error: java.lang.IllegalArgumentException: Invalid character found in method name... HTTP method names must be tokens...Based on this error Springboot is receiving httpS requests, even though it should be receiving http via the load balancer. Does anyone know what could be wrong here?FollowComment"

Answer: "0Make sure  you are also configuring the redirection rule for the HTTP listener, see this guide for a step-by-step: https://aws.amazon.com/premiumsupport/knowledge-center/elb-redirect-http-to-https-using-alb/CommentShareLucas_Ranswered a year agoAWS-User-6671149 a year agoIf I have single instance environment, then how to do redirection from http to https without using load balancer, and certificate will be from Let's encrypt.Share"


Question: Lambda access denied

"A client has created an IAM user for me and I made sure I had all the correct permissions to finish the work. Everything was going well, I had requested a lambda concurrency limit increase (was set at 50 with an AWS default of 1000) to 500. a few days later I'm locked out of lambda even though I have lambda full access permissions set on my user. Any idea on what could be happening?FollowComment"

Answer: "1First, ask your client if they changed something. For example with Service Control Policies you can block Lambda Access in an Account and with that in place also with full Access on you IAM user you will not access any Lambda.Also check if you have any DENY in you resulting policy. DENY always wins over ALLOW.CommentShareMarcoanswered a year agoPronoy_C a year agoAlso, reach out to support if it's critical.Share"


Question: questions for F1 during STA

"Hello.I have a few of questions during checking STA for implementing FPGA design for F1 instance.During STA, there are some violation points that I cannot understand. I uploaded a image to give you an example start-end points.this example points violate hold timing.the start point of FF updates data at rising of clock DRCK ( @ 3.125Mhz),and the destination point updates data at rising of clock TCK. (@ 3.125Mhz).I think if those two FF has synchronous relationship, the clock relationship should be defined as same clock groups.But my timing reports indicate that those two clock groups are defined as inter-clock relationship. (I think this causes high hold slack during implementation)Could you please explain me for this case? (which means can I set those clocks as same clock groups by myself)thanksSteven.FollowComment"

Answer: "0Accepted AnswerHello,Thank you for reaching out on this topic. We have reviewed the timing path and confirm the following:•The timing path shown between Source and Destination is a real path and should not be treated as a CDC false_path or multi_cycle_path.•The destination clock is created by the debug_bridge_0 IP’s constraints and needs to be timed with the source clock as reported in the timing path. Since the clock divider circuit is being generated through logic, a create_generated_clock constraint is being made in the IP.•The hold violation is fixed by the tool during routing but not during placement. It is possible that the vivado tool compromises on TNS in order to fix the hold violations. Therefore, we strongly recommend doing hold timing analysis based on a routed DCP.•If the design fails to close timing (setup or hold) in post route, we recommend running placement/route using multiple directives and/or reduce design congestion. Also, phys_opt_design has switches to assist with hold timing when necessary.Please reach out to us if you have any additional questions.Thanks!ChakraCommentShareawschakraanswered 5 months ago0Hello, thank you for reaching us on this topic. Would you be able to share the full timing report for the violating path?Thanks!ChakraCommentShareawschakraanswered 5 months agoStevenKim 5 months agoHello Chakrathe timing report is linked at https://drive.google.com/file/d/1AwDqmTfShyKL9xtA3sON1pdFywq2b1Dq/view?usp=share_linkHowever, I cannot provide some DCPs or others because the design on CL is for commercial use.Also, Please ignore setup violation, caused by congestion, I handle the violation points.Special Thanks.Steven.Share0Hello Steven,Thank you for sharing timing report, as we only need the timing path between the following Source/Destination:Slack (VIOLATED) :        -0.939ns  (arrival time - required time)  Source:                 dbg_hub/inst/BSCANID.u_xsdbm_id/SWITCH_EXT_BSCAN.bscan_switch/state_reg[2]/C                            (rising edge-triggered cell FDRE clocked by drck  {rise@0.000ns fall@16.000ns period=32.000ns})  Destination:            WRAPPER_INST/CL/debug_bridge_0/inst/xsdbm/inst/BSCANID.u_xsdbm_id/EXT_BSCAN.id_state_reg[1]/D                            (rising edge-triggered cell FDRE clocked by tck  {rise@0.000ns fall@16.000ns period=32.000ns})One more question -- could you also confirm if you are using AWS provided cl_debug_bridge.xci for the WRAPPER_INST/CL/debug_bridge_0/ instantiation, and followed guidelines described in the following link?https://github.com/aws/aws-fpga/blob/master/hdk/docs/Virtual_JTAG_XVC.md#embedding-debug-cores-in-the-clWe will continue investigating this issue on our end and keep you posted.Thanks!ChakraCommentShareawschakraanswered 5 months agoStevenKim 5 months agoHello Chakra.I didn't instiantiate the modules using xci, but using aws's vitis platform image, "xilinx_aws-vu9p-f1_shell-v04261818_201920_2".I always create my xclbin with vitis project, and in every synth and implementation xilinx_aws-vu9p-f1_shell-v04261818_201920_2 is used.This path is always resolved in post route phase -- hold fix. But during hold fix, Total negative slack is massively increased.As my analysis for the path, each PLL (or MMCM) provides clock sources to each FF cell, but one passes through a clock gate cell, I thought your design team didn't add clock constraints because the clock frequencies of 2 PLL are same ( timing could be met by controlling phase).If my assumption is true, we need to consider sharing those clock sources with one PLL or clock domain crossing. As you know, CDC can be one of issues depite of same clock frequencies.Thank you.Steven.Share0Hello Chakra.Thank you for your deep analysis for shown violation path and your kind response for my question.I have one more question.Since the clock divider circuit is being generated through logic, a create_generated_clock constraint is being made in the IP.I agreed with your opinion and the violation path is always resolved by a tool after post route step.I would like to ask you if each output of each FF meets drived by each clock(free running clock and divided clock) each other, how should we consider the clock relationship between those clocks.Because I thought the relationship between a clock (create_clock) and another clock(create_generated_clock) should be synchronous. -->Do we need to define it as sync? (set_clock_groups -async -clock {drck tcl} ... )Thank youstevenCommentShareStevenKimanswered 5 months ago"


Question: AWS Active MQ Custom Plugin Support

"Is is possible to configure a custom plugin in the Active MQ broker?According to this https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/permitted-collections.html, the plugin element just allows as children some Active MQ official pluginsIs there any way that we provide a configuration with our custom plugin and also a way to put the plugin jar file in the CLASSPATH for ActiveMQ to use it?ThanksFollowComment"

Answer: 0Amazon MQ doesn't currently support custom plugins for ActiveMQ.CommentShareTrevor_Danswered 7 months ago


Question: "Since Gmail doesn't provide complaint data to SES, wouldn't resending to gmail users who marked a previous email as spam hurt our reputation and deliverability?"

"Per the docs:https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html - Gmail doesn't provide complaint data to SES.From what I've read, emailing people again who've marked you as spam damages your sender reputation, and more of your emails will then end up in spam.Due to Gmail not providing complaint data to SES, it seems this is unavoidable? And emailing gmail users will eventually mostly end up in spam?FollowComment"


Question: How can I change the delimiter in Query Editor?

Running the following command in Query Editor produces a syntax error. Why?delimiter //You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'delimiter //' at line 1I recognize that 'delimiter' is a feature of the client and not the mysql server but how else is one to create a multiline stored procedure such as this?delimiter //CREATE PROCEDURE simpleproc (OUT param1 INT)BEGIN   SELECT COUNT(*) INTO param1 FROM t;END//delimiter ;FollowComment

Answer: "1I spent a day trying to figure this out so hopefully this helps someone out there...DELIMITER is a feature of the client, not the mysql server. The RDS Query Editor is a client but it does not support changing the delimiter so attempting to run a multiline script won't work since the first time it sees a semicolon it will interpret that as the end of the command and fail with a syntax error. It also does not support BEGIN and END commands used when creating multiline functions and procedures.So, how do you create something like a stored procedure that has multiple statements and semicolons in it? You must create it as an .sql file and send it using the Data API from either a Lambda function or the CLI.First, create your script in a .sql file without any DELIMITER commands or alternate delimiters.For example: function.sqlCREATE PROCEDURE simpleproc (OUT param1 INT)BEGIN   SELECT COUNT(*) INTO param1 FROM t;ENDThen, run the script using the CLI like this:cat function.sql | xargs -0 aws rds-data execute-statement \    --resource-arn arn:aws:rds:eu-west-1:xxx:cluster:cluster-name \    --secret-arn arn:aws:secretsmanager:eu-west-1:xxx:secret:secret-name-xxx \    --database "database_name" \    --sqlAlternatively, you can create a Lambda function that reads the file and uses rds_client.execute_statement() to send the script to the server via the Data API. But again, do NOT use the DELIMITER statement. The server sees the BEGIN and END lines and acts accordingly without the need to change the delimiter.CommentSharekristingreenanswered 3 years ago"


Question: Single Interface VPC Endpoint for S3 (Route 53 zone s3.$region.amazonaws.com) + ECR: thats impossible?

"I would like to use VPC endpoint by dafault in a specific VPC for S3 service. However, on workloads that use ECR, images cannot be pulled because apparently it is not possible to communicate with an internal AWS bucket that stores ECR images.I find this issue here:https://github.com/aws/containers-roadmap/issues/1691Possible architecture impacted:https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.htmlFollowCommentGary Mclean a month agoThe question isn’t clear at this timeShareevairmarinho a month agoUpdated, providing more info.Share"

Answer: 0It’s still not fully clear. You can have a vpc endpoint for Ecr and an s3 gateway endpoint. This means you can pull images without an issue. The link you provided was for a different issue I think.Or are you looking for a central vpc for all endpoints? If so create routes using s3 prefix list and route all traffic to this central vpcDoes that answer the question? Can add more if neededCommentShareGary Mcleananswered a month ago


Question: S3 Intelligent-Tiering requires Async Storage in AWS S3 Console

"I have a number of buckets with tons of files.  My roadblock is that I can't use the AWS S3 console to get S3 Intelligent-Tiering configured without objects eventually ending up in an Asynchronous Access Tier.Go to AWS Console > S3 > {bucket} > Properties > Intelligent-Tiering Archive configurations > Create configuration.  Add a name, say all objects in bucket, Enable, Create, you get this error:"At least one transition should be selected."However, at https://aws.amazon.com/s3/cost-optimization/"Amazon S3 Intelligent-Tiering""Opt-in asynchronous archive capabilities for objects that become rarely accessed"This states that asynchronous access tiers are an option, NOT a requirement.  This is not so on the AWS Console.  I don't want to have a delay of 3-5, or up to 12 hours delay to access my files, particularly when I'm only going to save an additional 10% or so.  Yes, I can choose 730 days delay before objects are moved to Archive, but I don't want them to go there at all.Finally "No operational overhead, no lifecycle charges" meaning that I'm only going to be charged for storage and access of my objects.  There will be no extra charges from AWS to scan my buckets to see how they need to be moved to a different tier, right?PeterFollowComment"

Answer: "0Please refer to this document that explains the different tiers in S3 Intelligent Tiering - https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering-overview.htmlThe Archive Access Tier and the Deep Archive Access Tier are optional and therefore when creating the Intelligent Tiering configuration on the AWS console, those two are shown as check-boxes.If you want instant retrieval of documents then you should not be using these two tiers. The remaining three tiers are not optional.There is a monitoring charge with S3 Intelligent Tiering, as mentioned in the same document -For a low monthly object monitoring and automation charge, S3 Intelligent-Tiering monitors access patterns and automatically moves objects to the Infrequent Access tier when they have not been accessed for 30 consecutive days. After 90 days of no access, the objects are moved to the Archive Instant Access tier without performance impact or operational overhead.The pricing information can be found on this page - https://aws.amazon.com/s3/pricing/CommentShareEXPERTIndranil Banerjee AWSanswered 8 months agorePost-User-8265448-peter 8 months agoThank you for responding.Please re-read my post carefully.  Did you try the steps out outlined?  I agree that the documentation says it should work, but if the AWS S3 Console does not allow you to do so, it's doesn't matter.The monitoring charge is for objects greater than 128KB, correct?  I won't be charged for scanning every file in the bucket.Share0The AWS UI is confusing, this section is actually called "Intelligent-Tiering Archive configurations" therefore requires you to select one or two options.To enable Intelligent-Tiering  is there : https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-intelligent-tiering.htmlCommentSharerePost-User-6352146answered 2 months ago"


Question: Amazon Mq goes idle

"our application is constructed using containers. we have implemented amazon mq services to connect these containers. our application will be used once or twice in a week, when ever we start using the application, Amazon MQ server which is deployed to connect the containers are going to idle state and we need to restart the server to get it up and running everytime. we need to understand how to avoid server going into idle state if its not been used.FollowComment"


Question: Custom hosts file on Lambda image

"I need to add an entry into /etc/hosts file when running a lambda function using an ECR image. In ECS I can use the HostEntry property, but I can't found any similar option on Lambda. Is there any way to modify this file?Thank you!FollowComment"

Answer: "0Lambda filesystem is read-only, except /tmpSo you cannot change the content of /etc/hosts at runtimeInstead, you can change the content during image build-time if you know the value upfront.CommentShareRichardFananswered a year ago"


Question: Access error : Spark query from AWS EMR with AWS Lake Formation

"I am trying to integrate EMR with Lake Formation. The EMR cluster has been created with Default Roles for both EMR and EC2 instances. In addition to the default permissions created in those Roles, I have also provided full access on Lake formation and Glue to the Default roles . I selected the default Service linked Role for all s3 buckets registered with this Lake formation.After creating Jupyter notebook, which uses the above created cluster, I tried runningspark.sql ("show databases") and spark.sql("use <database>")to get the following errorAn error was encountered:org.apache.spark.sql.catalyst.analysis.AccessControlException: Unable to verify existence of default database: com.amazonaws.services.glue.model.AccessDeniedException: Insufficient Lake Formation permission(s) on default (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: .....; Proxy: null);I think i have tried everything with permissions and not able to understand the root cause for the error. Appreciate any pointers which would help understand / resolve the error. Many Thanks.FollowComment"

Answer: "2I was able to resolve this error - When spark tries connecting to Lake formation, it checks if 'default' database exists. Since my Lake formation did not have a database named 'default', hence the error.Creating a database named 'default' and granting permission on Database to the default EMR_EC2_DefaultRole resolved the errorCommentShareAWS-User-0620047answered a year ago"


Question: IoT Greengrass dependency checker does not recognize Java8

"I am about to Install AWS Greengrass Core on a Raspberry Pi 3. I follow the instructions under https://docs.aws.amazon.com/greengrass/v1/developerguide/module1.htmlWhen runningsudo ./check_ggc_dependencies | morethe checker complains about Java 8 not being installed but I did run sudo apt install openjdk-8-jdk before.I tried various things like adding JAVA_HOME to /etc/environment, renaming binary,.... without success.Anybody got an idea what to do here?FollowComment"

Answer: "1Accepted AnswerHi Marco,Please note you are using Greengrass v1 dependency checker. You should not install Greengrass V1 on devices as that version is EOL. Please install Greengrass v2 and use the following tester https://docs.aws.amazon.com/greengrass/v2/developerguide/device-tester-for-greengrass-ug.htmlCheersMassimilianoCommentShareEXPERTMassimilianoAWSanswered 8 months ago"


Question: My AWS organization is a total mess - as owner I've lost control

"As the owner of the organization I've lost control over my AWS environment.What I can do:login as Root Userlogin as IAM Useraccess services from IAM (Dynamo DB, S3 end else)What I cannot do:delete rights or users on IAM leveldelete rights or users in Rootactivate access credentials from consoleWhat confuses me:There is no IAM user when I look at my organisation from rootThere is no organisation when I look at it from IAMWhat I am not familiar with:CLI (whatever we find, it should be done on AWS console)Thank you in advance.FollowComment"

Answer: "1It looks like you might be logging into a member of the AWS Organization, not the Organization root account.One note of clarification here - there are root ACCOUNTS (the AWS account itself) and root USERS [1] (the user account you login with - the email address, not the IAM user [2]).It also looks like you have some Service Control Policies (SCPs) [3] in place for the Organization that restrict actions of the root user in the member accounts.If you login to the organization root account (shown under 'Root' in the Organization console) as a user with Admin privileges (or, as a last resort, root - but this is not recommended), you should have unrestricted access to make the changes you need to make to allow your member account IAM user (Mathias) to make the changes in the member account.[1] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html[2] https://docs.aws.amazon.com/accounts/latest/reference/root-user-vs-iam.html[3] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlCommentShareGreg_Hanswered 4 months agoEXPERTBrettski-AWSreviewed 4 months ago0Thank you so much. Yes, there were certain restrictions and I now understood better what's Root user and account.CommentSharerePost-User-4330459answered 4 months agoGreg_H 4 months agoThank you for responding to confirm.If the answer helped, please accept the answer to help others in the future.Share"


Question: Taking EC2 Snapshots

"When creating an EC2 instance, is it a default part of the setupthat a snapshot will be taken of all the EBS volumes attachedto the instance?  A snapshot was taken of the volumes of one ofmy EC2 instances, and I didn't manually take this snapshot.FollowComment"

Answer: "0When you launch an EC2 instance snapshots are not automated by default.  It is your data and one of the components of the shared responsibility model puts the decisions of data retention for non managed services with the customer. It's your data and you decide it's residency and backup frequency.Complete instance backups for instances with multiple EBS volumes can be automated through AWS Backup. Volume Snapshots can also be automated through Amazon Data Lifecycle Manager.You can define backup and retention schedules for EBS snapshots by creating lifecycle policies based on tags defined for volumes.Regularly back up your EBS volumes using Amazon EBS snapshots, to create an Amazon Machine Image (AMI) from your instance to save the configuration as a template for launching future instances.You can also create an AMI and manual snapshot of all of the volume of an instance from the EC2 console of an instance.Select the instance. Navigate to Image and Templates  --> Create Image (Illustrated in the attached image)CommentSharetedtrentanswered 6 months ago"


Question: Update 1.13 - Required SDKs missing

"Hello,I updated to Amazon Lumberyard 1.13 using the github repo.I launched the Lumberyard Setup Assistant and I have issues with the required SDKs.When I installed those SDK in earlier versions, it was installed using the "Install all" button.However, thebutton is greyed out with the message:REMOVEDUPLOADGoogle MockREMOVEDUPLOADFor GoogleMock, the assistant requires version az-1.3. When I look in the /3rdParty folder, I only have the version az-1.2. The link provided in the assistant is not the complete version. It only contains the googlemock folder. https://github.com/google/googlemockREMOVEDUPLOADWhen I look at VERSION.txt, it says:This GoogleTest/GoogleMock package is based on commit a2b8a8e07628e5fd60644b6dd99c1b5e7d7f1f47 in GitHub. https://github.com/google/googletest/commit/a2b8a8e07628e5fd60644b6dd99c1b5e7d7f1f47 This package has been modified from its original version by Amazon and is maintained under a different versioning system.I have not found the GoogleMock version of Amazon.OpenSSLREMOVEDUPLOADI have the right version already installedREMOVEDUPLOADI'm not sure why the checksum is invalid.All the other SDKs are detected properly.Is anyone able to help me?Follow"

Answer: "0Accepted AnswerI reinstalled lumberyard. The Install All button was available and I was able to download the required SDKs that were missing.SharerePost-User-1026337answered 5 years ago0I had no issues with required ones. I think your thinking of Optional SDK's.SharerePost-User-1354821answered 5 years ago0No, this is requiredREMOVEDUPLOADSharerePost-User-1026337answered 5 years ago"


Question: Update on DocumentDB indexing progress

Is there any update or ETA on when DocumentDB can provide indexing progress on db.collection.createIndex() via db.currentOp()? This was asked 2 years ago here  but I can't seem to find a way to upvote that feature.FollowComment

Answer: "0Thank you for providing your valuable feedback on the service. I have up-voted a feature request with the service team on your behalf. While I am unable to comment on if/when this feature may get released, I request you to keep an eye on our What’s New and Blog pages for any new feature announcements.AWS News: https://aws.amazon.com/new/Amazon Blog: https://aws.amazon.com/blogs/aws/category/amazon-rds/CommentShareArchana_Danswered a year ago"


Question: Sending Cloudfront realtime logs to aws msk

"Hi, I am creating a video-on-demand streaming data pipeline, where I am using an event-based tracking system to track how much the user has watched the video. In order to verify this data, we will need to track the user's CloudFront access logs, and we would want to add the real-time logs to AWS-MSK (Kafka), how to send the real-time logs of CloudFront to AWS-MSK (Kafka) ?FollowComment"

Answer: "0Hi.I understand that you want to process CloudFront real-time logs with MSK.Kinesis is the only destination for CloudFront real-time logs.As far as I can see, there is no managed mechanism to connect from Kinesis to MSK.Therefore, I think you need to create a program that connects CloudFront real-time logs to Kinesis, creates your own consumer from there, and sends it to MSK, referring to the following.Please refer to the following.https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.htmlCommentShareEXPERTiwasaanswered 4 months ago0If it is a must to use MSK to gather logs from a Cloudfront distribution, then You could:use a combination of Kinesis DataStream/Firehose to send real time logs from Cloudfront. (https://aws.amazon.com/blogs/networking-and-content-delivery/cloudfront-realtime-logs/).Use or create your own Kafka connector (https://docs.confluent.io/kafka-connectors/kinesis/current/overview.html)  to pull data from Kinesis to a Kafka topic.CommentShareEXPERTalatechanswered 4 months ago"


Question: DNS Propagation

"Hi,As a quick background:Last year we bought a domain from GoDaddy later transffered it to AWS to be our registrar. We had the NS records for AWS and it was fine. We are also connected to Office365, which required us to update the NS records to microsoft ones and modify TXT and MX records.The issue is that there are some moments, where for a few people in specific domains, they cannot access the domain/website. The domain name cant be resolved at all and it causes multiple issues. It occurs every once in a while and consistently on some networks.When we run the dig command with the GTLD, we get (not disclosing domain due to privacy issues):<DOMAIN>.          172800  IN      NS      ns-641.awsdns-16.net.<DOMAIN>.          172800  IN      NS      ns-411.awsdns-51.com.<DOMAIN>.          172800  IN      NS      ns-1689.awsdns-19.co.uk.<DOMAIN>.          172800  IN      NS      ns-1192.awsdns-21.org.and they are still pointing to the old records, whereas other major public DNS services already have the correct updated information:~$ dig <domain> @1.1.1.1 NS +shortns4.bdm.microsoftonline.com.ns1.bdm.microsoftonline.com.ns2.bdm.microsoftonline.com.ns3.bdm.microsoftonline.com.~$ dig <domain> @8.8.8.8 NS +shortns1.bdm.microsoftonline.com.ns2.bdm.microsoftonline.com.ns3.bdm.microsoftonline.com.ns4.bdm.microsoftonline.com.~$ dig <domain> @9.9.9.9 NS +shortns1.bdm.microsoftonline.com.ns2.bdm.microsoftonline.com.ns3.bdm.microsoftonline.com.ns4.bdm.microsoftonline.com.Why has this change not propagated and how can we get around to fixing this?CheersFollowComment"

Answer: 0It looks like (maybe) there are some DNS resolvers that are not honouring the TTL. But it's difficult to say. I would raise a case with the AWS support team to help troubleshoot.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Setting up OpenSearch on Amplify

"I followed this guide (adding to the schema.graphql and pushing to amplify), although it didn't add OpenSearch resource. Any tips on doing this?FollowComment"


Question: EC2 instance stuck in Pending

"My EC2 instance (ID: i-040166ba182c261a3) is stuck in the pending state, and previously was stuck in the starting and stopping states.FollowComment"

Answer: "0Hello,Thank you for reaching out. Currently, I can confirm that the Instance is running healthy and passing status check.If the issue still persists, try Force-Stopping the Instance via the console or AWS CLI command below. See Troubleshoot stopping your instance - Force stop the instanceaws ec2 stop-instances --instance-ids i-040166ba182c261a3 --forceNote that you can use AWS CloudShell to run AWS CLI commands via the Console. See Working with AWS CloudShellAdditional information on the use case can be seen from the AWS article Why is my EC2 instance stuck in the stopping stateShould you need further assistance, reach out to AWS Premium SupportCommentShareChibuike_Aanswered a year ago"


Question: Amazon recently added one Dedicated Ip to our SES .But the IP is already listed  on Sorbs  DUHL

"Amazon recently added one dedicated IP (76.223.183.13) to our SES, but upon further investigation, this IP was found to be listed on SORBS DUHL. I attempted to contact sorbs but was unsuccessful in delisting. Contacted Amazon, but no support pack is available. How do I remove this IP address from the list? Why does Amazon assign a listed  IP address to our account?FollowComment"

Answer: "0Hi!  To relinquish the IP Address, you will need to open a new support case.  This can be done via SES Console -> Configuration -> Dedicated IPs ->  Request or relinquish dedicated IPs.More information and details here: https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-case.htmlCommentSharejsoncanswered a year agoAWS-User-7849727 a year agoI requested that Amazon remove the IP address and replace it with a new one. Amazon assigned a new dedicated IP address, but it was still on the same subnet. SORBS's response is below.The SORBS DUHL listing is used to list dynamic IPs. Unfortunately, a dynamic IP cannot be removed from the DUHL list, since that is what the DUHL list is, a list of dynamic IPs. When the IP was listed, or why you are using the IP, has nothing to do with it.If this address is static, the regional Internet registry contact for the address (your Internet service provider) should contact us with details of their statically and dynamically assigned ranges. Further to prevent relisting the reverse DNS names should be set to indicate static assignment.Delisting is also possible by having the reverse DNS set to the same as the MX record for a domain. However, please be aware that the DNS PTR, MX and A records should have a minimum Time-to-Live of 12 hours.What identifies the IP as dynamic, are the markers in the PTR (rDNS name). For example, key strings like dhcp, pool, dyn, cable, DSL, dial, cpe, cust, RES, IP address, etc.QUESTIONS: 21.183.223.76.in-addr.arpa, type = PTR, class = IN ANSWERS: -> 21.183.223.76.in-addr.arpa type = PTR, class = IN, dlen = 42 name = c183-21.smtp-out.eu-west-2.amazonses.com ttl = 900 (15 mins)Name: c183-21.smtp-out.eu-west-2.amazonses.com Address: 76.223.183.21You may want to review our Dynamic IP FAQ at: http://www.sorbs.net/delisting/dul.shtml"The reverse DNS PTRShare"


Question: ssh operation timed out when use MyIP on port 22

"Hello!I m doing a SSH connection from my computer to an Amazon EC2 instance.When I configure with ssh protocol, port range 22 to 0.0.0.0/0 it works fine. However when I configure the security group with ssh protocol, port range 22 with select MyIP to permit the Inbound connection from my IP address. and run this command : ssh -i <your_pem_key> <username>@<ip-address>I got this "ssh: connect to host X.XX.XX.XXX port 22: Operation timed out"FollowComment"

Answer: "0Is MyIP set to the wrong security group?Please visit the following site to check your IP address.https://checkip.amazonaws.com/Other items to check are that the EC2 IP address has not changed.CommentShareEXPERTRiku_Kobayashianswered 2 months agorowaida 2 months agoI checked both and all set-up correctly.every EC2 connected with its security group.is that related to ACLs ?once I replaced MyIP to 0.0.0.0/0 it works.ShareRiku_Kobayashi EXPERT2 months agoIf you have also changed the network ACL settings, please allow it with your IP in the inbound rules.For outbound rules, set the port range to "1024-65535" and set the IP address to your IP and enter the allow setting, or set the allow setting to 0.0.0.0/0 and you should be able to communicate.https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/vpc-network-acls.htmlShare"


Question: enhanced subscription filtering connection error when using amplify-cli generated mutations

"I am using amplify-cli with angular front-end.I have the following schema (schema.graphql):type CardDeck @model@key(name: "byBoard", fields: ["boardId"], queryField: "cardDeckByBoardId"){  id: ID!  type: String!  properties: [PropertyOrderTwo]  boardId: ID!}type Subscription {   onUpdateCardDeckByBoardId(boardId: ID!): CardDeck @aws_subscribe(mutations: "updateCardDeck")}I added the following response mapping template to the subscription in the appSync console.## Response Mapping Template - onUpdateCardDeckByBoardId subscription$extensions.setSubscriptionFilter({    "filterGroup": [        {           "filters" : [                {                    "fieldName" : "boardId",                    "operator" : "eq",                    "value" : "**** -> a valid board id"                }           ]                   }    ]})$util.toJson($context.result)This results in the following connection error when subscribing to the listener in my app:Connection failed: {"errors":[{"message":"Cannot return null for non-nullable type: 'ID' within parent 'CardDeck' (/onUpdateCardDeckByBoardId/id)"},{"message":"Cannot return null for non-nullable type: 'String' within parent 'CardDeck' (/onUpdateCardDeckByBoardId/type)"},{"message":"Cannot return null for non-nullable type: 'ID' within parent 'CardDeck' (/onUpdateCardDeckByBoardId/boardId)"},{"message":"Cannot return null for non-nullable type: 'AWSDateTime' within parent 'CardDeck' (/onUpdateCardDeckByBoardId/createdAt)"},{"message":"Cannot return null for non-nullable type: 'AWSDateTime' within parent 'CardDeck' (/onUpdateCardDeckByBoardId/updatedAt)"}]}What am I doing wrong?FollowComment"

Answer: "0Accepted AnswerHi!I followed the tutorials proposed by AWS:https://docs.aws.amazon.com/appsync/latest/devguide/aws-appsync-real-time-enhanced-filtering.html#aws-appsync-real-time-enhanced-filtering-defining-from-clienthttps://aws.amazon.com/blogs/mobile/appsync-enhanced-filtering/Apparently the problem is that the subscription, not having a DataSource that describes the shape of the object (NoneDS), returns an error because it is not able to ensure that the mandatory fields (id, type and boardId) are always returned.In fact, directly from the documentation they say:$context.result: The value returned by the resolver from the data source. The shape of this object depends on the data source and operation.As workaround it's possible to make the response mapping template of the subscription return a default payload, with the mandatory fields empty (or populated with defaulting).In this way I actually managed to get the subscription to work.## Response Mapping Template - onUpdateCardDeckByBoardId subscription$extensions.setSubscriptionFilter({    "filterGroup": [        {           "filters" : [                {                    "fieldName" : "boardId",                    "operator" : "eq",                    "value" : "**** -> a valid board id"                }           ]                   }    ]})## Workaround: In case of subscription with custom response template you must provide a valid payload that respects any mandatory fields defined in the model (in this case CardDeck has id, type, boardId and AppSync's default createdAt and updatedAt as mandatory fields).$util.toJson({"id": "", "type": "", "boardId": "", "createdAt":"1930-01-01T16:00:00-07:00", "updatedAt":"1930-01-01T16:00:00-07:00"} )CommentShareNoneNoneanswered a year agoPatrickSteyaert a year agoLooks like the workaround solves the problem. Thx Riccardo!!!Share"


Question: How to configure multiple subdomains in 1 Hosted Zone?

"I have a registered domain xxx.com.I would like to make an aaa.xxx.com and bbb.xxx.com subdomains, and point them to different locations (in my case, CloudFront distributions). I found conflicting documentation even on the AWS Docs about this use case, and there's a lot of confusion out there on the net in different tutorials.For the time being, I have the following configuration in Route 53 for the public hosted zone xxx.com:xxx.com             NS              ...xxx.com             SOA           ...<rnd>.xxx.com  CNAME     ... (needed for the ssl cert)aaa.xxx.com       A               Routes to CloudFront1bbb.xxx.com      A                Routes to CloudFront2If I copy&paste the CloudFront2 location here to the browser, I get to the proper static website I'd like to use. If I go to the address bbb.xxx.com, then I see the contents of aaa.xxx.com*. I have waited 72h+ to wait for the DNS caches to clean up, but still no change unfortunately. I'm suspecting I might be doing something completely flawed here :-)So, my question is: how should such a normal config would look like where there is a root domain + 2 subdomains pointing to different location? Any articles, links would be more than welcome!FollowComment"

Answer: "0What you need is NS records in the parent domain for your subdomains.For example:Record Name = aaa.xxx.comRecord Type = NSValue = the four nameservers from the aaa.xxx.com Hosted Zone definition.CommentShareEXPERTskinsmananswered 3 months ago0Actually, it seems separate Hosted Zone definitions are not required.I wrote a short tutorial how I managed to solve this for my case:https://xcafebabe.blogspot.com/2023/03/how-do-i-create-multiple-subdomains-for.htmlIf someone would like to follow the official approach (i.e., separate hosted zones for the subdomains, then NS records in the root domain for the subdomains), here are the relevant docs I was able to find with some help:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-routing-traffic-for-subdomains.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/CommentSharerlegendianswered 3 months ago"


Question: InvalidClientTokenId exception while validating AccessKeyId

"Hi Everyone,I am using Python boto3 libraries to create STS Temporary tokens. I am storing the Access Key ID, Secret Access Key, Session token in default credentials file. This piece works fine.I am trying to validate, whether the token has expired, before creating a new token. boto3.get_access_key_info() (Ref:  https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts.html#STS.Client.get_access_key_info ) seems validates the token ID and returns the account number.However, get_access_key_info() method always throwing exception InvalidClientTokenId, even if the Access Key ID is valid.Below is my code -session = boto3.session.Session(profile_name='saml')client = boto3.client('sts')try:print ('Validating Profile: {0} | AccessKeyId: {1}'.format('saml', session.get_credentials().access_key))accessKeyId = session.get_credentials().access_keyaccKeyChkResp = client.get_access_key_info(AccessKeyId=accessKeyId)return Trueexcept Exception as e:print(Fore.LIGHTRED_EX + 'Code: {0} | Profile Name: {1} | Exception: {2!r}'.format(e.response['Error']['Code'], awsProfileName, e.args))return FalseError:Code: InvalidClientTokenId | Profile Name: saml | Exception: ('An error occurred (InvalidClientTokenId) when calling the GetAccessKeyInfo operation: The security token included in the request is invalid.',)Please let me know, if there is any solution to this issue.FollowComment"

Answer: "0Hi,I ran the following code in my test environment, and it worked fine. It printed out the account number for the access key, and it gave an error when no associated account exists.import boto3import jsonsession = boto3.session.Session(profile_name='saml')client = boto3.client('sts')try:  print ('Validating Profile: {0} | AccessKeyId: {1}'.format('saml', session.get_credentials().access_key))  accessKeyId = session.get_credentials().access_key  accKeyChkResp = client.get_access_key_info(AccessKeyId=accessKeyId)  print(json.dumps(accKeyChkResp))except Exception as e:  print(Fore.LIGHTRED_EX + 'Code: {0} | Profile Name: {1} | Exception: {2!r}'.format(e.response, awsProfileName, e.args))However, this piece of code does NOT provide the information that you are looking forThis operation does not indicate the state of the access key. The key might be active, inactive, or deleted. Active keys might not have permissions to perform an operation. Providing a deleted access key might return an error that the key doesn't exist.Link: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts.html#STS.Client.get_access_key_infoAlso, this is discussed a bit in this stackoverflow post.. Where they discuss that this capability does NOT currently exist and if it did exist, it might be considered a security risk.  Also, they discuss work-arounds where you could do a list-buckets() call to see if the Key works.. but that would only be workable if all possible Keys have the list-buckets() permissions.Link: https://stackoverflow.com/questions/53548737/verify-aws-credentials-with-boto3it may be a good to have feature, but it may lead to security risks. If a such a method would exist, it may lead to better recon for an adversary, should the adversary find a pair of creds. –Hope this helps.-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi Randy,Are you using Temporary Access Keys? Can you please check, if keys (starting with ASIA*) received through assume_role_with_saml works.Thanks,IndranilCommentShareindraonlineanswered 4 years ago0My bad!! While creating the client, I should have referred the session context, rather than boto3.It should be -session = boto3.session.Session(profile_name='saml')client = *session*.client('sts')Notsession = boto3.session.Session(profile_name='saml')client = _boto3_.client('sts')Thanks for your help.CommentShareindraonlineanswered 4 years ago0My bad!! While creating the client, I should have referred the session context, rather than boto3.It should be -session = boto3.session.Session(profile_name='saml')client = session.client('sts')Notsession = boto3.session.Session(profile_name='saml')client = boto3.client('sts')Thanks for your help.CommentShareindraonlineanswered 4 years ago"


Question: Estimated cost of setting up a log metric filter and alarm on Cloudwatch

"As a part of increasing the AWS security score, I wish to set up a log metric filter and alarm for the following actions :-Changes to network gatewaysRoute table changesChanges to Network Access Control Lists (NACL)Security group changesVPC changesUnauthorized API callsManagement Console sign-in without MFAAWS Management Console authentication failuresCloudTrail configuration changesIAM policy changesS3 bucket policy changesDisabling or scheduled deletion of customer-created CMKsThere is just one root user. I wish to estimate the cost of this operation. PFA screenshot of failed controlsFollowComment"

Answer: "0Hello,Considering that you are looking into creating log metric filters [1], note that CloudWatch Logs use these metric filters to turn log data into numerical CloudWatch metrics that you can graph or set an alarm on.For example if we were to work with 12 filters that will mean that we will be creating 12 metrics at the very least (or more). Based on pricing calculator tool you can calculate the price on your end.https://calculator.aws/#/addService/CloudWatchFor example 12 metrics in us-east-1 will cost -Tiered price for: 12 metrics12 metrics x 0.3000000000 USD = 3.60 USDTotal tier cost = 3.60 USD (Metrics cost (includes custom metrics))CloudWatch Metrics cost (monthly): 3.60 USDFor 12 standard alarms (60 seconds), you will incur the following -12 alarms x 0.10 USD = 1.20 USD (Standard Resolution Alarms cost)CloudWatch Dashboards and Alarms cost (monthly): 1.20 USDFor 12 High Resolution Alarm (10 seconds), you will incur the following -12 alarms x 0.30 USD = 3.60 USD (High Resolution Alarms cost)CloudWatch Dashboards and Alarms cost (monthly): 3.60 USDAgain, these numbers will change depending upon how many metrics you have, and the types of alarms you configure.My recommendation here is to play around with the pricing calculator tool to get an estimate idea based on your requirements, and if you still have any queries or concerns, then please feel free to log a support case with our billing and support team directly, and they can help answer your queries further in terms of cost and pricing.References:[1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.htmlCommentShareSUPPORT ENGINEERYash_Canswered 2 months ago"


Question: How to stop matchmaking for a particular game session?

"So I have a game session where maximum 20 players can join. Players join through lambda response from APIs. The lambda checks for available servers and see if players joined are less than the max players that can be accommodated in the available sessions. if current players are less than max players the session can accommodate, the player will be allocated to the session. But for my game, I want the session to stop accepting players once the game starts playing phase from lobby. How can I achieve this. I am not using flex match or anything. Just Gamelift with API gateway and lambda.FollowComment"

Answer: "0Hi!You could use UpdateGameSession with the required max player session count, to update the maximum number of players that can be connected simultaneously to the game session.Thanks!CommentShareShashankJ_AWSanswered a month ago"


Question: EMR spark no module named

"Hi,I'm trying to run a python job on EMR with some dependencies installed with venv as followingpython -m venv pyspark_venvsource pyspark_venv/bin/activatepip install pyarrow pandas venv-packvenv-pack -o pyspark_venv.tar.gzand the job runs with following conf{   "spark.yarn.appMasterEnv.PYSPARK_PYTHON":"./environment/bin/python",   "spark.yarn.appMasterEnv.PYSPARK_DRIVER_PYTHON":"./environment/bin/python",   "spark.yarn.dist.archives":"s3://DOC-EXAMPLE-BUCKET/prefix/my_pyspark_venv.tar.gz#environment",   "spark.submit.deployMode":"cluster"}but when I run the job I get no module named Pandas. Locally the script runs correctly with the same venv and printing sys path seems that spark is using the system python instead of venvAny idea on the conf to apply to use venv?ThanksFollowComment"

Answer: "0Accepted AnswerIt looks like your EMR Spark job is not able to find the packages installed in your virtual environment. To ensure that Spark is using the Python environment in your virtual environment, you can try the following:Add the following line to your EMR Spark job configuration to ensure that Spark uses the Python binary from your virtual environment:"spark.executorEnv.PYTHONHASHSEED":"0"In your PySpark code, add the following lines to explicitly set the Python environment to use:import osos.environ['PYSPARK_PYTHON'] = './environment/bin/python'os.environ['PYSPARK_DRIVER_PYTHON'] = './environment/bin/python'Make sure that the pyspark_venv.tar.gz file is uploaded to your S3 bucket with read permissions.Verify that the virtual environment is successfully extracted by checking the logs in the yarn/userlogs directory.CommentSharehashanswered a month agoPaolo a month agoThanks for the answer, after further test in the end was the version of python not compatibleShare"


Question: Amazon Simple Email Service

"Hi,  i am using SES for sending mail from my application. my SES under Production but still i cannot able to send to mail all recipients. when i try to send mail to other than @gmail.com. it shows email not verified message. can you help to shortout this issueFollowComment"

Answer: "0Make sure that the AWS Region you're using to send email is the same as the region where you received production access. According to the SES documentation, "the sandbox status for your account is unique per each AWS Region."In other words, if your account was removed from the sandbox in the us-east-1 region, you won't be able to send through the us-west-2 region because you're still in the sandbox in us-west-2.CommentShareEXPERTBrentAtAWSanswered 3 months ago0i have a production access for the us-east-1 region, but still when i try to send email through SES SMTP credentials, i got a error message like "Restricted in West region" even i am in East-1 Region.CommentShareaztechanswered 3 months ago"


Question: Create an IAM role to read from Secrets Manager

"HiI use Secrets Manager to store passwords which I need to read (in Python) from services launched in my EC2 instances.In order to do that one solution that I thought about where creating a role which can access to Secrets Manager and attach it to instances I want to read secrets from. However, when I try to create the role I cannot find the Secrets Manager service.Another solution could be storing both the access key and the secret key of an user who can access to that service in the EC2 instances but I don't like that solution because I would prefer not storing that kind of keys in the instances.Any ideas to create the role I talk about or any other solution?Thank you very muchFollowComment"

Answer: "1When you create a  role for EC2 https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role  you should select EC2 as the service in the first screen of the IAM create role UI. This service is the one that has permission to assume the role, so you need to grant EC2 permission to assume the role in order to provide the credentials to the instance.On the next screen where you are attaching policies to the role, you would select SecretsManagerReadWrite which grants permission for "secretsmanager:*" as well as a number of other permissions. Alternatively, if you know exactly what permissions you need on the instance, you could skip attaching a policy and write a stripped down in-line policy to provide least privileges to the instance.CommentShareAWS-User-9028130answered 3 years ago0Ok, thanks, now is more clear.RegardsCommentSharemalopezanswered 3 years ago"


Question: Nice DCV - Limit client access to applications

"Is it possible to configure Nice DCV to only stream certain applications to a client?For example say on windows, I boot up notepad.exe on start up. When a client connects can I set up the stream that the client only gets a stream of notepad.exe?FollowComment"

Answer: "1Accepted AnswerDCV doesn't currently offer the ability to stream a single application window to the client, however Amazon AppStream 2.0 does with it's Windows native client. The AppStream 2.0 HTML5 client offers it too, but the experience is contained within the browser window/tab, versus appearing as though the application is running locally.CommentShareEXPERTMuraliAtAWSanswered a year agoEXPERTToni_Sreviewed a year ago"


Question: Amazon Workspaces Client not working

"I am using an ARM Linux machine, with which i am trying to access AWS Workspaces Desktop, but the Linux deb file is for amd64 architecture (i am using arm64 architecture). I tried to access via the Amazon Workspaces Client web option, but i get the error -ERROR_TYPE_CONNECTIONAn error occurred while connecting to your WorkSpace.If the problem persists please contact your WorkSpaces administrator.ERR_SIG_TIMEOUTFollowComment"


Question: PCoIP & Teradici

"Are those required?  I have a single workspace that my user connects to using the workspaces client. That workspace is domain joined.  User complains he can't switch between one sided and two sided printing so I hopped on his workspace only to find it absolutely crawling.  Looking at the running processes, I found the PCoIP process taking 90+% CPU consistently. Once I finally got access to the printer settings, I found he was stuck using the Teradici XPS driver for his Canon IR, which didn't allow him to modify any settings. Since the workspaces report as server 2016, the Canon driver I need won't install locally, although it does get pushed up from his workstation.  If I disable the Teradici service and reboot, he can't print at all, even when I switch the driver over to the one pushed up by his workstation. I can't seem to find any information on whether those are required to access the workspace, or whether it's safe to delete them.edit connecting from a different workstation fixes the performance issue, but all printers are still using the Teradici Client Render XPS driver which does not allow for any changes to printing preferences.  I would update the agent (currently at 2.7.x.x.x and it appears the latest is 2.14.x.x.x) but I have no confidence that won't break more than it fixes (if anything).Edited by: StevenW on Jan 15, 2019 7:12 PMEdited by: StevenW on Jan 15, 2019 7:55 PMFollowComment"

Answer: "0Short answer: yes.When you say "PCoIP", I presume you are referring to the pcoip_server*.exe executable that you see running.  And "Teradici" is the "Teradici XPS driver" service.The "Teradici" printer service is what allows you to print remotely, so of course if you stop it, you will have disabled all the printing.Communicating remotely to a printer is non-trivial, and in order to get the features of a specific printer you'll generally need the drivers for that printer installed on the VM side.  As you discovered, this can be problematic if the VM is running on a Windows Server OS vs the desktop.Don't try and manually upgrade the Teradici Standard Agent on your workspace.  AWS periodically checks the installed version and will automatically revert the version.  But that wouldn't help as the fundamental limitation of the printer plugin remains.https://www.teradici.com/web-help/pcoip_agent/standard_agent/windows/2.14.0/admin-guide/configuring/configuring-tasks/ mentions a bit about the printer driver.Not much can be done unless Canon comes out with printer drivers that support Server 2016.CommentShareDonawaAtTeradicianswered 4 years ago0Thanks. Appreciate the answer (even if it's not what I was hoping for)!CommentShareStevenWanswered 4 years ago"


Question: Improve slow DMS table validation query

"DMS is using this query to perform table validation post full load migration (in this case on a MySQL source) :SELECT tableID  FROM ( SELECT @row:=@row+1 AS rownum, tableID  FROM   (SELECT @row:=0) v, (  SELECT tableID  FROM mySchema.bigTable ORDER BY tableID ASC  ) AS sorted ) as ranked  WHERE rownum % [PartitionSize] = [PartitionNumber]It is quite slow on a table with over 10 million rows (20 seconds for each 10000 partition pass) or painfully slow on a table with over 50 million rows (around 7 minutes for each 10000 partition pass).Why not use this much faster query until no rows are returned?MySQL:SELECT tableID  FROM mySchema.bigTable ORDER BY tableID ASC LIMIT [PartitionNumber]*[PartitionSize],[PartitionSize]Oracle / PostgreSQL:SELECT tableID  FROM mySchema.bigTable ORDER BY tableID ASC LIMIT [PartitionSize] OFFSET [PartitionNumber]*[PartitionSize]SQL Server:SELECT tableID  FROM mySchema.bigTable ORDER BY tableID ASC OFFSET [PartitionNumber]*[PartitionSize] ROWS FETCH FIRST [PartitionSize] ROWS ONLYFollowComment"


Question: Lambda Deployment - Do you have to set the TargetVersion?

"So I have a CodeBuild project that uploads my latest code to the $latest Lambda version, then publishes a new Lambda version and then does a string replacement on the CodeDeploys appspec file to set the CurrentVersion and the TargetVersion.This works for basic stuff but if say there are 2 people working on the Lambda code and 2 CodeBuilds get kicked off, you will end up with 2 sets of appspec files e.g.Appspec1:CurrentVersion: 1TargetVersion: 2Appspec2:CurrentVersion: 1TargetVersion: 3So when Appspec1 is deployed all goes well and the CurrentVersion becomes 2. But then when Appspec2 gets deployed, it will fail because the CurrentVersion is set to 1 instead of the now new version 2.So how do people get around this? Do you have to set the versions or can CodeDeploy figure it out for itself somehow?FollowComment"


Question: service catalog recreate new ec2 when updating ebs volumetype from gp2 to gp3

"As on topic, I have created a new service catalog Portfolios > Products with two version.1.) First version with the below cloudformation template.2.) Launch the product using the below template is ok. EC2 launched successfully.3.) Create a second version and modify the cloudformation template for BlockDeviceMapping > DeviceName /dev/xda > Ebs VolumeType to gp3.4.) It create a new EC2 with EBS VolumeType gp3 instead of modifying the existing EC2 EBS VolumeType launched from first version.5.) When checking from Provisioned products > provisioned product plan, the replacement is set to True. I believe this is the issue. How can I make it to use the existing EC2 launched from first version and modify the EBS VolumeType from gp2 to gp3?Thank you for help. AWSTemplateFormatVersion: "2010-09-09" Description: "Create EC2 instance" Resources:  EC2Instance:  DeletionPolicy: Retain Properties:   BlockDeviceMappings:   - DeviceName: /dev/xvda    Ebs:       VolumeType: gp2      VolumeSize: 10  IamInstanceProfile: roletest  ImageId: ami-123456  InstanceType: t2.micro  SecurityGroupIds:     - sg-123456  SubnetId: 123456  Tags:     -       Key: Name      Value: ec2testType: "AWS::EC2::Instance"FollowComment"

Answer: "0Hello,Per the VolumeType property, updates to this property after the instance is running results in an instance replacement. There is no way for CloudFormation to update the EBS volume type for the instance that is already running without an instance replacement.An workaround is to first remove the instance from CloudFormation management (delete the instance from the stack after having applied the DeletionPolicy: Retain) as in your template above. After this, manually modify the EBS volume to gp3 via the EC2 console and after modification is complete, import the instance back to CloudFormation.Additionally, note that because Service Catalog is being used, the stack needs to first be disassociated from Service Catalog using the "--retain-physical-resources" option in the terminate-provisioned-product command. After the instance have been imported back to the stack as in the step above, you can then add this stack back to Service Catalog using the import-as-provisioned-product CLI command.CommentShareUgochukwu_Ianswered a year agokyiori a year ago@Ugochukwu_IAre you referring to this?https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-update-volume-instance/Are you able to explain this further?"An workaround is to first remove the instance from CloudFormation management (delete the instance from the stack after having applied the DeletionPolicy: Retain) as in your template above."How do I remove the instance from the current Cloudformation template? Can you highlight what needs to be changed from the cloudformation template?ShareUgochukwu_I a year agoHello Kyiori,I was referring to your use-case where you want to modify the volume without instance replacement. The workaround for this is to use the CloudFormation import feature. First, you perform a stack update where you apply a "DeletionPolicy: Retain" on the instance (which you have already done). To remove/delete the instance from CloudFormation management, simply comment out the EC2Instance from the template and update the stack. CloudFormation will take it out of its management. Then you can manually update the volume from EC2 and when done import the instance back to CloudFormationShare"


Question: protect http API GW when CF has S3 as origin

"Hi team,Is it possible to prevent users to hit directly my HTTP API GW if my HTTP GW doesn't support WAF AND my CF distribution doesn't have a custom origin (that can support WAF), my CF origin is an S3 bucket.so I don't have any way to prevent users hit directly HTTP API GW.FollowComment"

Answer: -1You can use Custom Headers with CloudFront and API Gateway to prevent hit the API directly.https://wellarchitectedlabs.com/security/300_labs/300_multilayered_api_security_with_cognito_and_waf/3_prevent_requests_from_accessing_api_directly/CommentShareMarcoanswered a year ago


Question: lambda for CustomMessage_AdminCreateUser not rendering the right message

"Hi,I created the following lambda to customize the forgot password message.I am willing to use the SAME message for the case of a user created directly on the Cognito user pool interface, but despite the fact that the correct event is called, the user does NOT receive the message I have configured.So,if the event.triggerSource is CustomMessage_ForgotPassword:  I enter the "if condition" and log the temporary code and email and the custom message is sent with the custom subjectif the event.triggerSource is CustomMessage_AdminCreateUser:  I enter the "if condition" and log the temporary code and email but then Cognito default message is used but with the custom subjectexports.handler = (event, context, callback) => {  console.log("EVENT", event);   if (event.triggerSource === "CustomMessage_ForgotPassword" ||    event.triggerSource === "CustomMessage_AdminCreateUser") {        const { codeParameter } = event.request;    const { email } = event.request.userAttributes;    const encodedEmail = encodeURIComponent(email);    console.log("EMAIL", encodedEmail)    console.log("PARAM", codeParameter)    const link = `http://localhost:3000/sign-in/password-confirmation?email=${encodedEmail}&code=${codeParameter}`;    event.response.emailSubject = "Reset your password";    event.response.emailMessage = `AWS

            Hi!                       Forgot your password?

          RESET PASSWORD

            Thank you

                 `;  }  // CallBack to the lambda for the email trigger  callback(null, event);};FollowComment"

Answer: 0Two elements:Code in ForgotPassword is really a verification code while in AdminCreateUser it is a temporary password and therefore does allow usage with a link  defined as  http://localhost:3000/sign-in/password-confirmation?email=${encodedEmail}&code=${codeParameter}There is a typo is your logic :const { codeParameter } = event.request;In fact it should be event.request.codeParameterCommentShareJeff Lombardo-AWSanswered 4 months ago


Question: JS SDK createPresignedPost returns error Cannot read properties of undefined (reading 'endsWith')

"I have the following code in my Node server:const { S3Client } = require('@aws-sdk/client-s3');const { createPresignedPost } = require('@aws-sdk/s3-presigned-post');router.post(  '/sign-s3', async (req, res, next) => {    const { name, type } = req.body;    const client = new S3Client({      region: 'eu-central-1'    });    const params = {      Bucket: process.env.S3_BUCKET_NAME,      Expires: 60,      Conditions: [        ['content-length-range', 100, 5242880],        { 'Content-Type': 'image/jpeg' },      ],      Fields: {        key: `blog/${name}`,        'Content-Type': type,        success_action_status: '201',      },    };    try {      const data = await createPresignedPost(client, params);      return res.json(data);    } catch (err) {      return next({ status: 500, message: err.message });    }  });This route returns the following: Cannot read properties of undefined (reading 'endsWith').The error is not really helpful. I've tried the following possible solutions:Checking if AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are available from process.envPassing credentials into the S3Client, like so:credentials: {      accessKeyId: process.env.AWS_ACCESS_KEY_ID,      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY}Removing credentials from .env and S3Object to narrow down the issue - it does throw a credential error if both are removed, however, if for instance I pass an empty credentials object into S3Object, I still get the Cannot read properties of undefined (reading 'endsWith') error. It's almost like there's no credentials validation? I also tried passing completly wrong credentials.Passing credentials DIRECTLY into the credentials object (omitting .env altogether)Uninstalling and installing SDK againRemoving params and leaving bucket name onlyNothing works. Please help.FollowComment"


Question: Cost of Access to Amazon S3 via Amazon CloudFront within an AWS Region

"If I serve S3 objects via CloudFront and use the CloudFront URL/Domain Name to GET the object, is that considered "Regional Data Transfer Out to Internet (per GB)" from a pricing perspective?FollowComment"

Answer: "0Accepted AnswerYes, by using Amazon CloudFront to GET objects from Amazon S3 the requests will incur the "Regional Data Transfer Out to Internet" from CloudFront. The prices differ depending on which CloudFront Edge Location region served the request. You will not be charged for the data transfer OUT from S3 to CloudFront.CommentShareEXPERTEJanswered 3 years ago"


Question: Large Oracle Migration Feature similar to restore from (Snowballed In) S3 that RDS SQL Server Has

Are there any mechanisms that would allow using Snowball for Oracle migrations.  With SQL Server you can Snowball your bak and then use RDS SQL Server restore from S3.  Is there a similar mechanism for Oracle?FollowComment

Answer: "0Accepted AnswerSpecific to Snowball, there's nothing inherent in the device or client that supports integration with ORCL (or any other flavor of a RDBMS) for import/export operations. Depending on the migration approach desired (reference: Oracle Database on AWS),  Snowball can be leveraged to accelerate ingest of RMAN backups or dump files generated by Oracle Data Pump into s3, however those features are independent of Snowball itself. Similarly, re-hydrating any ORCL data that's been migrated via Snowball in RDS or EC2 would rely on operations external to the Snowball service (e.g. Database Migration Service).CommentShareAWS-User-7888703answered 6 years ago"


Question: guaranteed delivery of events with intermittently offline Device

"I have a GreenGrass device that can be intermittently offline, and I would like to inform the server of important events that happen.Is there a message queuing system I can use within GreenGrass where I publish the event locally and whenever the Device is re-connected it will deliver this message.Can I use IoT-Core for this ? Will it allow me to publish multiple messages to a topic and will they all get cached until delivery, and they arrive in the same order that they were sent with ?Does it have a 'save to disk' option so it will retain the messages for delivery even in-between reboots ?FollowComment"

Answer: "0Accepted AnswerThere is an MQTT spooler, but it's presently an in-memory spooler.https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.htmlspooler(Optional) The MQTT spooler configuration for the Greengrass core device. This object contains the following information:maxSizeInBytes(Optional) The maximum size of the cache where the core device stores unprocessed MQTT messages in memory. If the cache is full, the core device discards the oldest messages to add new messages.Default: 2621440 (2.5 MB)keepQos0WhenOffline(Optional) You can spool MQTT QoS 0 messages that the core device receives while its offline. If you set this option to true, the core device spools QoS 0 messages that it can't send while it's offline. If you set this option to false, the core device discards these messages. The core device always spools QoS 1 messages unless the spool is full.Default: falseYou can see some discussion about a persistent spooler here: https://github.com/aws-greengrass/aws-greengrass-nucleus/issues/825CommentShareEXPERTGreg_Banswered a year agoclogwog a year agoI'm a bit confused about the description, is this related to messages to IoT-Core ?Shareshagupta-aws a year agoHi, yes the spooler is for sending messages to IoT Core via Greengrass, you can use the Greengrass IPC SDK to take advantage of it https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-iot-core-mqtt.htmlShare"


Question: Multi Region-Active Directory

"A customer has a AD connector in the N.Virginia region to connect our Active directory to AWS to use Workspaces. They are looking to expand to the London Region, and will create a new AD connector to connect that region to the domain controller.My question is can they use the same Active directory user that they used in the Virginia region? Or would do they need to create a new user?FollowComment"

Answer: "0Accepted AnswerThey can use the same AD user. As you stated, they have to make a new AD Connector local to the VPC they want to use already; that's their only new requirement.The "one WorkSpace per user per AD" rule is more accurately, "one WorkSpace per user per AD per Directory Service instance." You could create infinite WorkSpaces for the same AD user as long as they were each in different AD Connector directories.CommentShareEXPERTgaribaydanswered 3 years ago"


Question: Server Access Logging Bucket

"Hi all,I was experimenting with server access logging and had a server access log bucket writing event notifications to an SQS queue during object creation events.the workflow resembles the following:S3 Test bucket (Server Access Logging enabled) -> S3 access log destination Bucket -> SQS queueTo test the queue, I had uploaded an object to the log bucket (not the test bucket). I expected 2 messages to appear on the queue, the test message and the object upload event message. To my surprise, there were more than 2 messages that appeared in my queue, and there were many log files created in my log bucket. Does anyone know the reason behind this? I am not familiar with reading the log objects but I do see some get ownership, get intelligent tiering and get notification requests among the object files.Thanks all!FollowComment"

Answer: "0Server Access logging provides details for the requests that are made to a bucket. It logs the request information in log files where each line is a record. For more information you can refer to below link for more info and log format details:https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.htmlLogging also be done through CloudTrail and it provides lot of other information.https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging.htmlS3 Event notification is used to receive notifications when certain events happen in your S3 bucket like object creation.https://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.htmlIf you have setup Event notification on your log bucket for any new object creation in log bucket, they may be notifications for new objects created i.e. log files or any object you manually upload to the log bucket. Looking into the lot files can help to give more insight.CommentSharerePostfanclubanswered a year agoPaul a year agoHm I did not set up event notification or server access logging on my log bucket, so when I created an object in my log bucket, I was confused why new log files were created in that same log bucket. The log bucket is the destination bucket for another s3 bucket that has server access logging enabled.Share0You are seeing the results of a distributed system. The API calls do not land on a single location.CommentShareRodney Lesteranswered a year ago"


Question: Testing Crawlers with Glue 3.0 Docker image

"So I have an ETL pipeline that read S3 parquet files, transforms and inserts into DynamoDB. I have a crawler defined which reads the parquet and populates a Glue Data Catalog table. The PySpark job then queries the catalog table and populates Dynamo. I would like to test this locally using the aws-glue-libs Docker image. Unfortunately I cannot seem to query a local Data Catalog or interact with crawlers via the Docker container. The Docker image has virtually no documentation outside of a 2 year old blog. Can I develop and test a full Glue workflow via this container or is the purpose just to run a PySpark job? Thanks!TLDR: Is it possible to use the boto3 Glue API against a local Docker endpoint to perform crawler/catalog operations, or is the Docker image just a glorified PySpark install?FollowComment"

Answer: "1Hi,As you said the Glue Docker image includes Pyspark libraries along Glue ones (DynamicFrames, GlueContext) but no more. There is no support for crawlers or Catalog right now.If you are in a Docker environment you can try Local Stack.Bests.CommentShareacmanjonanswered a year agoEXPERTFabrizio@AWSreviewed a year ago"


Question: Using Oracle Spatial in RDS for Oracle for up to 10M ordinates

"Need to set up Oracle Spatial in RDS to support over 1M ordinates… i.e. to grow up to 10M ordinates you need to run some commands/script… (and technically this isn’t available in RDS, wondering if there was any workaround (in RDS itself - without just going to RDS Custom)? - https://docs.oracle.com/database/121/SPATL/increasing-size-ordinate-arrays-support-very-large-geometries.htm#SPATL1426.FollowComment"

Answer: "0HelloThis is not supported by default but it is not the customer cannot execute the scripts.Linux: @$ORACLE_HOME/md/admin/sdoupggeom.sqlI guess it is the above command which needs to be executed to increase the ordinates to 10M. There are some considerations and restrictions which the customer need to understand first before they implement this. They also need to clearly have an overview and understanding of their data as well.Please raise a support request with AWS RDS Oracle team. It will be investigated and guided from there.If this answer has led to a solution, please approve the answer for the betterment of the community.CommentShareVetrivelanswered 2 months ago"