Question: Disabling DNS Recursion within a private zone

"A customer is asking how to disable recursive DNS in R53 in re private zones.  Any ideas on this?We would like to use Route53 Private DNS Zone and access that zone from a VPC.  All well and good there.When we use the subnet .2 ip address to resolve internal zones all well and good, however when we resolve an internet address like google.com it also resolves.  The problem with this is that DNS can be used as an exfiltration method for sensitive secrets.How do we turn DNS recursion off for route53 Private DNS zones?FollowComment"

Answer: "0Accepted AnswerJust to clarify Route53 is an authoritative DNS service and not recursive. It is a subtle detail, but important. i.e. if you go to Route53 directly  (query name servers with NS records) and try to resolve DNS name other than R53 hosted DNS zone it will refuse. In addition private hosted zone with R53, can be associated with VPC and in that case resources with in VPC may be able to resolve DNS name for private hosted zone via VPC CIDR (2nd IP address) or (169.254.169.253 on EC2 host in that VPC).It the  latter that provides DNS recursion and able to resolve R53 private hosted DNS zone or any DNS names such as www.amazon.com. I don't think there is a lot of control on this part, other than simply switch off/on (VPC DNS options enableDnsHostnames, enableDnsSupport set to true/false).One option could be to setup bunch of DNS forwarders on EC2 instances and use those for forwarding/route DNS queries. Change DHCP option set for VPC and by default it points to EC2 DNS forwarders rather than (VPC CIDR; 2nd IP address). Forward DNS queries such as R53 hosted zone, queries for Amazon DNS domains such as .amazonaws.com (this is used for RDS, ELB etc) to VPC CIDR (2nd IP address) and rest to their own recursive DNS servers(or deny), if possible.This doesn't prevent for someone with in VPC to go directly to  VPC CIDR (2nd IP address) or (169.254.169.253 on EC2) and try recursive queries, as long as   enableDnsHostnames,enableDnsSupport:true for VPC. So it is obfuscation at best.CommentSharemehrajkanswered 6 years ago"


Question: Monitoring API activity - Does AWS have a function that could help

We’re looking for some kind of URL or API monitoring tool that allows us to measure how many hits certain URLs receive and segment by parameters/basic auth/headers.Our API is currently located on an EC2 and written in LaravelFollowComment

Answer: "2Application and access logs can be monitored by outputting them to CloudWatch logs and setting up metrics filters.https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.htmlFor example, the API "/api/exemple" can be filtered and metrics such as number of accesses, number of failed executions, etc. can be set.Another external monitoring is CloudWatch synthetics.This allows the API to be periodically executed by CloudWatch and detected as an anomaly when it fails.https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries.htmlCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: i am using free tier as a new user. i am connecting my EC-2 instance from my laptop through putty.

i am unable to to connect my ec-2 instance. I am getting below error attached screen shot. I also tried with default user ec2-user but same error.FollowComment

Answer: "0Accepted AnswerHello,have you had a little at this article https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html ?it might help you out.    check the ppk isn't just a rename but a conversion as well.CommentShareDanielManswered 9 months ago0Hi,Your problem can be related to incorrect login which varies depending on AMIs. Use following logins on following AMIs:ubuntu or root on ubuntu AMIsec2-user on Amazon Linux AMIcentos on Centos AMIdebian or root on Debian AMIsec2-user or fedora on Fedoraec2-user or root on: RHEL AMI, SUSE AMI, other ones.If you are using OS:Windows - get PEM key from AWS website and generate PPK file using PuttyGen. Then use Putty to use the PPK (select it using left-column: Connection->SSH->Auth: Private key for authorization)Linux - run: ssh -i your-ssh-key.pem login@IP-or-DNSrefer-https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.htmlIf the Answer is helpful, please click Accept Answer and up-vote, so that it can help others in the community looking for help on similar topics.CommentSharelearn2skillsanswered 9 months ago0I was doing one terrible mistake. I deleted the original key pair and created the new one that was not accepted by the system. i created new instance and by its original key pair ssh that instance by the steps provided by you its connected.Thank you all for your supportCommentSharerePost-User-3274391answered 9 months ago"


Question: jpgs as input?

"Hi,I just got working an extension to my zoneminder home security system that uploads camera jpgs to S3. The extension is here: https://github.com/CampsiteHelper/ZoneMinderS3/ From what I've read, I won't be able to use mediaconvert to process the individual images into a video, because it requires video of some kind as input. Is my understanding correct? At home I use Windows Movie Maker for this. Thanks.FollowComment"

Answer: "1Hi,Yes, your understanding is correct. MediaConvert does not process individual images into a video. It only supports the Video/Audio inputs listed on this page:Link: https://docs.aws.amazon.com/mediaconvert/latest/ug/reference-codecs-containers-input.htmlRegards,-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks.CommentSharethinkpadanswered 4 years ago"


Question: AppStream sealing isssue with image joined to AD

"I have built a new AppStream image that is joined to Active Directory. When I go to seal the image, I am using a standard domain user for the template and test user as part of the sealing process. Once I deploy the sealed image to the stack, it works fine if I log in with the same domain user to the pool. Any other user gets errors that the recycle bin is corrupted for each user data folder and we can see the path is pointing to the original test user data folders, which obviously another user doesn't have rights to access. It will prompt you with a serious of prompts for each folder and then prompt you for windows credentials, but won't accept them. After clicking cancel the user ends up with a blank desktop. I was not able to find any documentation specifically for sealing images joined to AD. Just what it says in the sealing wizard. I'll try to attach as screenshot.FollowComment"


Question: Get openid and custom scopes from InitiateAuthAsync or Oauth2 .0 password grant type.

"Hi, my users do not want to use the Cognito  Hosted UI for loging in and prefer to authenticate with a custom api gateway endpoint.  We thought it was working fine, but when we try to secure a different api gateway endpoint.  We do not have the scopes that will validate when using the access_tokenI have tried the .net SDK InitiateAuthAsync call and I am also trying raw http calls to the oauth2/token endpoint "https://{our domain}.auth.us-east-1.amazoncognito.com/oauth2/token"The  InitiateAuthAsync only returns scope:   "scope": "aws.cognito.signin.user.admin",the Oauth endpiont does not allow the password grant type according to this web page:https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.htmlFollowComment"


Question: Polly speech speed

"Hi, could you please suggest me how to change the speech speed with ssml from Polly Console? Thank you.FollowComment"

Answer: "0The prosody tag is what you'll want to use to adjust speedhttps://docs.aws.amazon.com/polly/latest/dg/supportedtags.html#prosody-tagTry this to speed up the entire phrase<speak><prosody rate="x-fast">This text is read really fast.  Instead of using labels, I can also type in numbers.</prosody></speak>Try this to speed up one word<speak>This <prosody rate="110%">word</prosody> will be read 10% faster.</speak>Edited by: vabtm on Nov 17, 2020 7:59 PMCommentSharevabtmanswered 3 years ago0Thank you so much!CommentShareLBajardanswered 3 years ago0If you want to emphasize a word or even just one syllable, sometimes slowing down the speech and simultaneously increasing the volume will do the trick. I typically increase the volume by 1 to 4 dB, and slow down the speech by 10 or 15%.For example, I used this code for Matthew in SSML.<speak>  how can you <prosody volume="+5dB" rate="80%"> possibly</prosody> get any taller.  </speak>CommentShareAntiochusanswered 3 years ago"


Question: Unable to deploy application version: Environment named is in an "invalid state" for this operation. Must be Ready.

I can't change configuration. Can't clone. Can't reboot. I was able to reboot the individual EC2 instances but that didn't helpFollowComment

Answer: "0Hi there,This most likely indicates that the underlying cloudformation stack for your Elastic Beanstalk environment is currently in a non-updatable state such as UPDATE_ROLLBACK_FAILED due to some previous failed update or rollback operation on the environment.You can verify this by going to the AWS Cloudformation console and checking the status of the cloudformation stack corresponding to the beanstalk environment. (The stack name would have the beanstalk environment ID).If this is indeed the case, then you need to follow the below steps to fix the environment state,Manually perform a continue update rollback operation on the cloudformation stack by skipping the failed resource. More details in our documentation here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-continueupdaterollback.htmlOnce Step 1 is complete, open a technical support case with AWS under the Elastic Beanstalk service in order to get the environment status updated. More details here: https://docs.aws.amazon.com/awssupport/latest/user/case-management.htmlHope this helps. Please feel free to reply if you have any further questions/concerns.CommentShareAdarsh_Sanswered 4 months agorePost-User-9027259 4 months agoThanks for the follow up. What is the turn around time range on step 2? In the case of my issue, I was unable to deploy or modify my website so I didn't have the luxury of time, so I ended up just creating a whole new environment from scratch and switching over the DNS.Share"


Question: [Announcement] Amazon EMR Studio is now available in US West (N. California)

"EMR Studio is an integrated development environment (IDE) that makes it easy for data scientists and data engineers to develop, visualize, and debug big data and analytics applications written in R, Python, Scala, and PySpark. Today, we are excited to announce that EMR Studio is now available in US West (N. California) region.With this launch, EMR Studio is now available in 16 regions globally: US East (Ohio), US East (N. Virginia), US West (N. California), US West (Oregon), Canada (Central), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Stockholm), Europe (Paris), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and South America (Sao Paulo) regions.You can learn more by reading our Amazon EMR Studio documentation, visiting the Amazon EMR Studio detail page, or watching the Amazon EMR Studio demos.FollowCommentNguyen_M SUPPORT ENGINEERa year agoThis is an announcement migrated from AWS Forums that does not require an answerShare"


Question: Nil `quota.value` returned from GetServiceQuota for  service code `elasticloadbalancing` and quota code `L-E9E9831D`

"Hi,I am trying to get the service quota for Classic Load Balancers using the SDK for Go. When I attempt to retrieve it using the service code elasticloadbalancing and the quota code L-E9E9831D, I get a proper and normal response with every value filled out except the actual quota value. This is nil, and I have no idea why. If I use the CLI to get the service quota for these exact same service and quota codes, I get the quota value on the account. But in the SDK, I get a nil value.Any ideas? Is this a bug?FollowComment"

Answer: "1Based on my research, I have found that this behaviour is observed for quotas that are not adjustable, when using GetServiceQuota. You need to use GetAWSDefaultServiceQuota instead.  If this does not work either, try to see if this is observed on other languages as well.I can confirm that this is an unexpected behaviour seen with SDK, and a known issue I've come across before where it works properly with CLI only. On a side note, although a rare possibility - I would suggest to see if there is perhaps anything wrong with the code as well. Because, if it works with the CLI it means that there is no issue with the API call being made.CommentShareSUPPORT ENGINEERShreyas_Manswered 5 months agohkepley 4 months agoThanks for the reply, I will try out GetAWSDefaultServiceQuota -- but I will say that we are not using the default quota for Classic Load Balancers. I have checked the code several times and have gotten others on my team to check it but it seems to be correct.I will also try out other languages to see if it exists in those SDKs. Thanks for your reply, Shreyas.ShareAWS-User-6944452 3 months agoHey Shreyas,I checked and it seems that L-E9E9831D is adjustable in the console.Do you know when the bug for the AWS GO SDK will be addressed?We need a way to fetch the "Applied quota value" using the SDK.ThanksShare"


Question: Does user need Programmatic Access if using EC2 Instance Connect service?

"Does a new user need Programmatic Access if using EC2 Instance Connect service and AWS CLI or just AWS Management Console access?It is unclear or missing from the documentation whether or not this first very basic step is needed.From documentation:Amazon EC2 Instance Connect is a simple and secure way to connect to your instances using Secure Shell (SSH). With EC2 Instance Connect, you can control SSH access to your instances using AWS Identity and Access Management (IAM) policies as well as audit connection requests with AWS CloudTrail events.andhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.htmlThanks,AmyEdited by: aramsdell on Nov 10, 2020 4:54 AMFollowComment"

Answer: "0Accepted AnswerI think you're confusing two different connections.SSH is for accessing the operating system of that instance... you don't need any special access rights within AWS for that -- other than you need access to the virtual private network that the instance is in.  Otherwise, if you have the SSH key and the user to login - you're done.The "IAM" and "AWS CLI" are ways of interacting/CRUD (create, read, update, delete) with the "objects" within the account. These include spinning up a new instance or creating a new subnet, changing the parameters of a dynamic group, many many many others.  Neither IAM (what rights an AWS user has over which objects) nor the AWS CLI give you access to the operating system of a EC2 instance by themselves.CommentSharearam535answered 3 years ago"


Question: Post a Log to Cloudwatch log group with aws-java-sdk 1.11.817

"I am trying to post a log to cloudwatch from an ElasticBeanstalk Tomcat. I get the error: ...is not authorized to perform: events:PutEvents on resource: arn...:event-bus/default because no identity-based policy allows the events:PutEvents action...I understand that I need to attach an additional policy to the aws-elasticbeanstalk-service-role role ? But what policy ? Is there a built-in amazon template for that ?I would like to publish certain logs directly to my own cloudwatch loggroup from my Elastic Beanstalk server.I am trying to follow this post: https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/examples-cloudwatch-send-events.html and It does not gives me error on my local machine, but I don't know where the logs are!Thanks.FollowComment"

Answer: "1Hello there,Thanks for posting your question on re:Post and helping our community to grow.I can see that you are trying to directly post a log(Log Event) to your CloudWatch Log Group from your ElasticBeanstalk Tomcat application. Unfortunately, the guide[1] that you are following is not relevant to posting Log event to CloudWatch Log service but it is related to EventBridge service(a.k.a CloudWatch Events) and it is using the PutEvents[2][3] API call you can refer to the links for more information about the API. PutEvents API call publishes an Event to Event Bus, a resource on EventBridge service that receives events from AWS services(default EventBus) and other custom events(custom EventBus).So to post a Log Event to your CloudWatch Log Group, we need to use PutLogEvents[4] API call and you can refer to [5][6] for information on Java SDK. Ideally on the RequestParameters you need to provide the logEvents, logGroupName, logStreamName, sequenceToken which are required to issue the call.Regarding the IAM permissions required to post a Log(PutLogEvents) ideally what you need is logs:PutLogEvents. You can refer to this page[7] for ElasticBeanstalk resources and the permission required for logging instance logs to CloudWatch. Presumably you are using the EC2 instance profile attached to the Elastic Beanstalk instance to put the Log Events to CloudWatch Log Group, so this permission can be used here:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "logs:CreateLogStream",        "logs:PutLogEvents",        "logs:DescribeLogGroups",        "logs:DescribeLogStreams"      ],      "Resource": [        "*"      ]    }  ]}I also would like to suggest that you check this page[8] if this is covering what you are trying to achieve and see if you want to use this available logging feature from ElasticBeanstalk service.Thanks again for your question and I trust that above information help you with progressing further in your tasks.Regards,MunkhbatCommentShareSUPPORT ENGINEERMunkhbat_Tanswered 7 months ago"


Question: CAPI gateway doesn't work

"Hi, not sure if this is a right place to ask the question, but our AWS CAPI interface doesn't workhttps://zwgvmy.klarstein.sk/hub/capig/I get the blank page after I click on login button.FollowComment"


Question: Clone Failed SageMaker MLOps Project Using Third-party Git Repos

"I'm trying to use MLOps template for model building, training, and deployment with third-party Git repositories using CodePipeline in my ML project. I created the project successfully using the template and all the seed code is available in the GitHub repos I specified. But when I try to clone the repo, I am getting the below errorI see that the local path that has been specified inNo such file or directory: '/home/sagemaker-user/home/sagemaker-user/cat-ml-test-1-p-mtd5ofsbdgva/sagemaker-p-mtd5ofsbdgva-modeldeploy'does not sound quite right. But there's is no option to change the local path by myself also.How can I solve this? Any leads are welcomeTIAFollowComment"

Answer: 0Hi there!Have you seen this documentation - https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-projects-walkthrough-3rdgit.html?How are you trying to clone the repo? Is this within Sagemaker studio?Have you tried to use the navigation bar which has git?CommentSharearnasinhanswered 4 months ago


Question: How to make Lambda + API Gateway obey REQUEST_URI?

"I created an AWS Lambda with my application (a Web server) written in Rust Actix. I use https://crates.io/crates/lambda-webThen I added this Lambda as the backend of an AWS HTTP API. The HTTP API has only $default stage.https://XXX.execute-api.us-east-1.amazonaws.com/ produces correct result (what my packaged Web server outputs when the root is requested).But https://XXX.execute-api.us-east-1.amazonaws.com/p/YYY produces: {"message":"Not Found"} what is surely not my Web server's output.My task is to run the Web server in Lambda with path forwarded to the server in the normal way (as REQUEST_URI). So, when I request https://XXX.execute-api.us-east-1.amazonaws.com/p/YYY it should pass /YYY to my application. How?Or probably it can be done with Lambda@Edge? Lambda@Edge follows the same protocol for Lambda as AWS HTTP API, doesn't it? In this case, there would be a CloudFront without origins, or what should I put as the origin, an arbitrary domain? Should Lambda@Edge be invoked on request or on response?FollowComment"

Answer: "0Look at Proxy integrations. You need to define a greedy path using /{Proxy+}. This way you do not need to specify all routes in the API but rather specify one and let the Lambda function do the routing internally.As an alternative you could create multiple routes and assign each one to a different function.CommentShareEXPERTUrianswered a year agoAWS-User-7103808 a year agoAfter I added ANY /{proxy+} route, every request (including the root request /) returns {"message":"Internal Server Error"}.I tried both /{proxy+} and /{Proxy+}.ShareUri EXPERTa year agoIs your target invoked? If so, maybe it returns a malformed answer.Share"


Question: Instance Type to Use

"Hello,I am currently using a T3 small instance with 2 vcpu and 2 GB ram for a school web application (LAMP) . It is working fine and handles the load well.I wish to replicate the web app for 4 other schools.I thus want to upgrade the same instance to cater for the need.When I checked the price calculator for 2 VPUs and 16 GB Ram, it recommends me a r6g.large instance. I am just wondering why propose r6g type when there is t3.xlarge with almost the same spec. Am i missing something here?I believe there could be a max of 5000 users per day accessing the web app during school hours. Traffic during school holidays (2 months per year) would be very low (maybe 200 users per day)FollowComment"

Answer: "2t3.xlarge offers 4 vCPU and 16GB RAM while r6g.large offers 2 vCPU and 16GB RAM ie. r6g instance offers more memory ratio. Also t3x.xlarge is burstable instance which means that the performance is limited to sustain at around 20-30%, anything more than that it will need to consume burst credit.Usually to estimate whether your current capacity is sufficient, you would need to do a load test. The maximum instance capacity is usually limited to a number of users it can handle concurrently (ex: 100 users concurrent or per second). So although 1 day the school can have max 5000 students, you still need to know how many out of 5000 may access the web app concurrently. It is probably much less unless it is exam period.CommentShareapradanaanswered 9 months agoEXPERTToni_Sreviewed 9 months ago"


Question: WebsocketApi does not detect when a client has lost connection

"I have a problem with my socket server built with webSocketApi. everything works fine unless the decive loose its connectivity, close the conection and someone try to send a message to this device.The websocketApi does not throw any error and if i try to get the connection via @connections API, the SocketApi stll giving like the device is connected untill the idle timeout come. And then it's impossible to detect from my side this case to enqueue the message to be sent later.I'm thinking about using the keep alive client ping to trace the last ping and close the connection manually if the last ping is older than 30 secs or something like this.Has someone any solution for this case or this is the normal way to works?thank you.FollowComment"

Answer: "0@jsola we are using WebSocketApi for one of our Dashboards, and the connection handling is quite seamless.If you can share your infra code for the WebSocketApi, and the Client code making the connections, I can try to help find the issue you are facing.CommentShareAmazing Ashanswered 3 months ago0Thank you for your reply. In our case, the connection works perfectly unless the client loose the connection, i don't have the code, but is an android service and when the device loose the internet access, it close the connection with the socket(may be the problem is there), but the WebsocketApi does not know that the device has close the connection, then, the connection for the SocketApi still alive but it is false.From our server side the problem is that from the lambda which try to do the post to the connection the api don't throw any error or if i try to get the connection from that device i receive connection infostatic async run(connectionId) {        const apiGateway = new ApiGatewayManagementApi({            endpoint: Config.API_DOMAIN,        })                return await apiGateway            .getConnection(                {                    ConnectionId: connectionId                }            )            .promise();    }I receive{  ConnectedAt: 2023-02-17T11:11:55.344Z,  Identity: {    SourceIp: 'xxx.xxx.xxx.xxx',    UserAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36'  },  LastActiveAt: 2023-02-17T11:11:55.344Z}I think the only way to work with this case i make a workaround playing with the idle connections o client pings and disconnect manually if the server don't receive any ping from the client.(I don't like the solution mainly because is not a solution) but i think that with the actual WebsocketApi behavior is the only wayThank youCommentSharejsolaanswered 3 months ago"


Question: Protect  HTTP Api Gateway with WAF

"Hi team,I using HTTP API Gateway (not REST API GateWay),is there a way to make the  HTTP Api Gateway to use/support WAF ?Thank you.FollowComment"

Answer: "3Hello,WAF support for HTTP APIs is currently not supported.As a workaround, you can front the API Gateway with Amazon CloudFront and enable WAF on CloudFront.CommentShareben_canswered a year agoJess a year agoIn this case how to prevent that we bypass  the Cloud Front and hit the API GW directlyShare2As ben_c mentioned you can put CloudFront in front of your API.To prevent the direct call of your API and to only allow CloudFront to call your API is described in the Well-Architected Labs and follows best practices.https://wellarchitectedlabs.com/security/300_labs/300_multilayered_api_security_with_cognito_and_waf/3_prevent_requests_from_accessing_api_directly/In general it is handled by inserting a specific header in CloudFront and check this header during the call.CommentShareMarcoanswered a year agoJess a year agoThank you so much for your answer: I followed the above tutorial, but in my case in Cloud Front, under Origins, mu Origin is an S3 bucket, not the API GW.I have My CF distribution that has an S3 bucket as Origin and then behind it Have the API GW.how can I do that in my case if my origin is my S3 bucket that contains static assets and not the API GW?users => CF (with angular App in s3 bucket as Origin : my s3 is not configured with static website hosting) => API GW = > NLB => fargate clusterSharehopscotch-devops a year ago@Marco the link you posted explaining how to prevent API Gateway to be reached directly, still relies on using WAF directly on the REST API (v1) to validate the custom origin header, but this is unsupported for HTTP APIs (v2), which is what the question was about in the first place. I think the only way this could work with HTTP API is by having a Lambda Authorizer that validates the custom header.Share0HTTP API does not support WAF. If you need it, use REST APIs. If you still want to use HTTP API, you should follow the recommendations done by others which is to use a CloudFront distribution in front of your API and make sure the request is coming from there.CommentShareEXPERTUrianswered a year agoJess a year agoThank you so much for your answer: I followed the above tutorial, but in my case in Cloud Front, under Origins, mu Origin is an S3 bucket, not the API GW.I have My CF distribution that has an S3 bucket as Origin and then behind it Have the API GW.how can I do that in my case if my origin is my S3 bucket that contains static assets and not the API GW?users => CF (with angular App in s3 bucket as Origin : my s3 is not configured with static website hosting) => API GW = > NLB => fargate clusterShareYedidya_OwnID a year agoHi Uri,any plans to implement WAF for http gateway in the soon year?Isn't the cloudfront wrapper solution might cause some latency with that extra layer?Share"


Question: Cloudfront Video Lag Issues

"Hii AWS Developers or Community Members,I'm facing some issues with video playing can someone please give me any solution or feedback on what I need to do?https://www.npmjs.com/package/react-native-video I'm using this package for playing a cloudfront video but the video is lagging.Please give me some solution or feedbackThank YouFollowComment"


Question: Is it possible ignore all fileds parsing in a query or mutation ?

"Can any one suggests a better to ignore parsing of fields at appsync, because query fields already parsed in my lamda with graphql moduleFollowComment"

Answer: "0Hello,I understand that your use case is to ignore parsing of all fields in a query or mutation i.e, pass fields directly to Lambda resolver without any modification at the VTL template.Please note that the parsing process in AppSync is done via the utility helper. Hence, kindly remove these utility helper from the VTL template to ignore the parsing. You may also check the VTL template which forwards the field and input arguments directly to the Lambda function without any parsing at the VTL template level.In case I misunderstood the query, please feel free to reach out to us via creating a support case from the support centre dashboard.CommentShareSUPPORT ENGINEERMukul_Vanswered 10 months ago"


Question: System Manager Automation Document restriction to use the S3 PutObject

"I'm trying to put up a reporting feature that utilises couple of AWS API calls done via the aws:executeAwsApi automation action.When getting to the PutObject operation, there is an error which doesn't seem to be described very well:Step fails when it is Execute/Cancelling action. PutObject API is not supported. Please refer to Automation Service Troubleshooting Guide for more diagnosis details.The FailureType is Verification , FailureStage is Invocation and the VerificationErrorMessage is PutObject API is not supported.I can't seem to find any reference about this neither in the System Manager Automation Troubleshooting Guide https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-troubleshooting.html , nor in the aws:executeAwsApi page https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-executeAwsApi.htmlI know how to achieve the goal using boto3 and Lambda, but in the current case I'm trying to reach the end goal via SSM automation document.If there is a limitation to use certain API actions, why is this not in the docs (or I can't seem to find it)?FollowComment"

Answer: "1It's possible that the restriction on using the S3 PutObject operation in System Manager Automation documents is not explicitly documented. However, there are some limitations to what AWS API operations can be used in Automation documents, and it's possible that PutObject is one of them.One way to work around this limitation would be to use a Lambda function instead of an Automation document, as you mentioned. Another option would be to use the AWS CLI command "aws s3 cp" instead of PutObject to copy the file to an S3 bucket. You can use the "aws:executeAwsApi" action to run the CLI command.Here's an example of how to use "aws s3 cp" in an Automation document:{  "description": "Copy a file to S3",  "schemaVersion": "0.3",  "assumeRole": "{{ assumeRole }}",  "mainSteps": [    {      "name": "CopyFileToS3",      "action": "aws:executeAwsApi",      "inputs": {        "Service:": "ssm",        "Api": "runShellScript",        "Parameters": {          "commands": [            "aws s3 cp /path/to/local/file s3://my-bucket/path/to/destination/file"          ]        }      }    }  ]}This example assumes that you have already configured your AWS CLI credentials on the instance where the Automation document will be run. If you need to specify credentials, you can add them to the "commands" parameter using the "--profile" option.I hope this helps! Let me know if you have any further questions.CommentSharehashanswered a month ago0This is a valid solution if you are running the automation over an instance. However, I'm trying to run it with a target of AWS account (no EC2 involved), with a role that I supply externally. I made it work, using boto3 as a wrapper of the last action of publishing the report to S3 (again, I didn't want to utilise Lambda to full extend in this solution).The final step looks like this:def script_handler(events, context):          import boto3          import json          data = events['json']          s3 = boto3.client('s3')          file = json.dumps(data)          s3.put_object(Body=file,Bucket='sample-bucket',Key='report.json')This is  aws:executeScript step where I provide the json input from the output of last step, similar to this:inputpayload: json: '{{jstepName.stepOutput}}'As a final word, I also managed to decode the official docs. There is a word about streaming operations (like PutObject):Most API operations are supported, although not all API operations have been tested. Streaming API operations, such as the GetObject operation, aren't supported. If you're not sure if an API operation you want to use is a streaming operation, review the Boto3 documentation for the service to determine if an API requires streaming inputs. https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-executeAwsApi.htmlCommentShareCrateDiggeranswered a month ago"


Question: Problem with adding SSO user/group to Managed Grafana

"Hi,I'm trying to add user or group from SSO to Grafana but it ends with error:400Failed to associate identity 996707c13f-1af38066-6ab6-48bd-bbdf-35094dc7a3ef, type: SSO_USER with workspace SSO application"I created Grafana workspace with "Service managed" option with AWS IAM Identity Center authentication method.SSO is deployed on different account and AD Connector is used as a source, my user has full privileges and grafana is able top list users and groups but cannot add selected.The only error I found in CloudTrail is:(...)    "eventSource": "sso.amazonaws.com",    "eventName": "AssociateProfile",    "awsRegion": "eu-central-1",    "sourceIPAddress": "grafana.amazonaws.com",    "userAgent": "grafana.amazonaws.com",    "errorCode": "InvalidInputException",    "requestParameters": {        "accessorId": "S-1-5-...",        "accessorType": "USER",        "directoryId": "d-xxxxx",        "directoryType": "ADConnector",        "instanceId": "ins-6a1...",        "profileId": "p-bb..."    },    "responseElements": null,    "requestID": "ebd8b359-ce31-4996-812d-41cf8802852e",    "eventID": "790e94a8-b2e6-418a-a474-e086e84bf558",    "readOnly": false,    "eventType": "AwsApiCall",    "managementEvent": true,    "recipientAccountId": "(...)",    "eventCategory": "Management",    "sessionCredentialFromConsole": "true"FollowComment"

Answer: 0Review your configuration.  Here's the recommended procedure from AWS:https://docs.aws.amazon.com/grafana/latest/userguide/authentication-in-AMG-SSO.htmlI don't think you'd see the ADConnector information if you were configuring your Grafana to use SSO.Hope this helps.CommentShareCarlos del Castilloanswered a month ago


Question: Two Identical Lightsail Plesk Instances Very Different Performance

"I've set up 2 idenical lightsail pldesk instances, one in Germany and one in the UK. The German one is performing fantastically. I'm getting good response times from my websites and plesk.The UK one is extremely slow. I've disabled all my web sites on that instance and still plesk is almost unusable (30 seconds to switch pages).I'm connecting from Germany, but I can't imagine that that is the problem here.Any ideas?ThanksPeterFollowComment"

Answer: "0Thanks for using Lightsail! Have you looked at the "Metrics" tab to see what's going on with the underlying hardware? It's possible that you are running out of resources. If you need further help, please contact Customer Support and cut us a ticket and Lightsail engineer can help investigate the issue in detail.CommentShareYiran-AT-AWSanswered a year ago"


Question: How can I update the kernel on my lightsail server

I received the following error message:Kernel Security Notice mail.xyz.comThe new kernel is availablePlease update your kernel as soon as you can to keep your system secure. This will require a server reboot.Does anyone know the exact steps to complete this?FollowCommentGovind Kumar a month agoWhich OS are you using?Share

Answer: "1you can follow these stepssudo apt-get updatesudo apt-get upgradesudo apt-get install linux-image-$(uname -r)sudo rebootuname -rCommentShareEXPERTsdtslmnanswered a month agoRVAWEB a month agoThanks for this information, however, I can imagine I’d type this somewhere, but I don’t have a clue as to where, how, or format.I “rent” the server here for this reason- I don’t want to manage, or repair a server.I’m told that a kernel update is my responsibility- so, I have to try. I would need “baby steps “ if you don’t mind. And confidence that the process would work and it would boot back up without a hitch.Sharesdtslmn EXPERTa month agoAt first yes you are responsible for the security and keeping your instances updated/patched.Since for EC2 and lightsail AWS just provides you with the infrastructure, the operation is upon you.Note: before starting such operations please take a snapshot of your instancehttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/lightsail-how-to-create-a-snapshot-of-your-instanceThen connect the instance through the SSHhttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-ssh-using-terminalthen execute the above commandsShare"


Question: Glacier Retrieval Pricing

"Would someone help to better explain retrieval request pricing.Expedite is $10 per 1,000 requests. What exactly does that mean? $10 per 1,000 files being retrieved on top of the $.03 per GB?Thank youFollowComment"

Answer: "0Restores from Glacier are charged on two dimensions, by API request, which is one per object (or file), and by GB restored. I've excerpted a relevant section from our S3 FAQ page below:Q:  How much does it cost to retrieve data from Amazon S3 Glacier?There are three ways to restore data from Amazon S3 Glacier – Expedited, Standard, and Bulk Retrievals - and each has a different per-GB retrieval fee and per-archive request fee (i.e. requesting one archive counts as one request). For detailed S3 Glacier pricing by AWS Region, please visit the Amazon S3 Glacier pricing page.https://aws.amazon.com/s3/faqs/CommentShareAWS-User-1169509answered 3 years ago0So if I'm requesting to restore a folder that has 2,000 files, the requesting fee will be $20 for expedite?Expedite is $10 per 1,000 requests.CommentShareJrAdminanswered 3 years ago0Yes, assuming the cost of expedited restore requests is $10 per 1,00 requests, the request cost to restore 2,000 objects will be $20. However, there will also be a cost be GB restored for those objects.Suggest looking at our AWS calculator (https://calculator.aws/) to model the cost before initiating the restore. You can also use standard or bulk to reduce the retrieval costs.CommentShareAWS-User-1169509answered 3 years ago"


Question: Configure CloudTrail for Redshift Cluster

"Hi All, is there anyone tried to configure CloudTrail for Redshift? we are trying to do this to get the IAM user activity who run the query in query editor v2.We have found few docs and followed the steps to configure the CloudTrail, we cant get the logs we are looking forward.https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.htmlhttps://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.htmlThis is the docs we have found to show us CloudTrail can integrate with Redshift. And it can get the log result for the query editor v2.https://docs.aws.amazon.com/redshift/latest/mgmt/logging-with-cloudtrail.htmlBut it doesn't show the steps that how to logging the calls with CloudTrail.Looking forward the guidance from you all, so that we can learn together.Thanks.FollowComment"


Question: Permission to execute procedure - SQL

"I have an RDS instance, with MS SQL Server database.I need to grant permissions to a user in my application to execute some important procedures.However, even connected to the RDS instance with the admin user, I cannot grant these permissions.The query I need to run is the following:USE [master]GOsp_configure 'Advanced Options', 1GORECONFIGUREGOsp_configure 'Ole Automation Procedures', 1GORECONFIGUREGOGRANT EXECUTE ON sys.sp_OACreate TO [usr_apis]GRANT EXECUTE ON sys.sp_OADestroy TO [usr_apis]GRANT EXECUTE ON sys.sp_OAGetErrorInfo TO [usr_apis]GRANT EXECUTE ON sys.sp_OAGetProperty TO [usr_apis]GRANT EXECUTE ON sys.sp_OAMethod TO [usr_apis]GRANT EXECUTE ON sys.sp_OASetProperty TO [usr_apis]GRANT EXECUTE ON sys.sp_OAStop TO [usr_apis]and when running the query above, the following errors are returned:Msg 15247, Level 16, State 1, Procedure sp_configure, Line 105 [Batch Start Line 2]User does not have permission to perform this action.Msg 5812, Level 14, State 1, Line 5You do not have permission to run the RECONFIGURE statement.Msg 15247, Level 16, State 1, Procedure sp_configure, Line 105 [Batch Start Line 6]User does not have permission to perform this action.Msg 5812, Level 14, State 1, Line 9You do not have permission to run the RECONFIGURE statement.Msg 15151, Level 16, State 1, Line 11Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 12Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 13Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 14Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 15Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 16Cannot find the user 'usr_apis', because it does not exist or you do not have permission.Msg 15151, Level 16, State 1, Line 17Cannot find the user 'usr_apis', because it does not exist or you do not have permission.How can I grant the user of my application the necessary permissions to execute these procedures?Thanks.FollowComment"

Answer: "0To deliver a managed service experience, Amazon RDS restricts access to certain system objects and procedures that require advanced privileges, including the "primary" database.Some system tools such as sp_configure are not available as a way to set server level settings. You'll need to manage your database engine configuration through parameter groups.OLE Automation isn’t supported either on RDS.  If OLE Automation is a strong requirement then you’ll need to run a self-managed SQL Server on EC2.CommentShareNZanswered 3 months ago"


Question: Appsync GraphQL responses are slow and have high latency?

"My GraphQL http CRUD type requests through AppSync are consistently getting done in around 500ms. Is this normal and expected? I'm comparing it another app I have that is a more traditional REST-based CRUD stack and requests are performed in under 100ms.I see other people have brought issues about AppSync slowness here as well:https://forums.aws.amazon.com/thread.jspa?messageID=835710&#835710https://github.com/awslabs/aws-mobile-appsync-sdk-js/issues/95I know this is all dependent on each person's setup. And I for example have data sources outside of the appsync region that may be contributing to the slowness. But it still seems AppSync GraphQL api has higher latency than traditional REST stacks.Is this true, does AWS have any numbers to share? I guess I can run one of your sample apps, make sure everything is in the same data center and see what the 'optimal' performance looks like.FollowComment"

Answer: "0Hi,Sorry for the issues. It depends on your setup, but no, that kind of latency shouldn't be normal. Cross regional calls will add to your overhead, but that shouldn't cause that much.Could you share some more about your setup? Your data sources would help. We could investigate in depth if you could share region info, api id, a rough timestamp, and/or a request id. Feel free to DM me those if you'd like me to do so.Thanks!JeffCommentShareAWS-User-4365954answered 4 years ago0Thanks @JeffB! I just sent you private message with the info you requested.Edited by: hisham on Jan 11, 2019 9:29 AMCommentSharehishamanswered 4 years ago0I have the same issue even for a simplest query & resolver. @JeffB, have you found any clues yet? I'm willing to provide all necessary details to help nail down the cause.Edited by: phi on Jan 23, 2019 3:25 AMCommentSharephianswered 4 years ago0Hi,Sorry for the troubles. Generally, latencies can be caused by a lot of things unique to each customer setup – mutation processing from Lambda, network conditions... etc. It would probably be best to either open up a new post for us to track rather than commenting on existing issues that might be unrelated, or DM me your info we can look at your API and setup to offer advice.Thanks,JeffCommentShareAWS-User-4365954answered 4 years ago"


Question: AWS Amplify CLI installation issue

"Hey everyone! I have a problem trying to install Amplify CLI. I've tried following this guide:https://docs.amplify.aws/cli/start/install/ I've used this command on my Maccurl -sL https://aws-amplify.github.io/amplify-cli/install | bash && $SHELLand after it runs, it does sayDownload complete! Extracting binary... Extraction complete!Successfully installed the Amplify CLI.Run 'amplify help' to get started!But when I do run amplify help, it just says command not found.I do have the prerequisites, Node.js and npm installed, and their versions are v18.14.0 and 9.3.1I also tried using the npm install in that guide above, got EACCESS permissions resolved by following the link, and when I tried installing it with npm again, I'm only getting a message that sayschanged 26 packages in 17sbut am not able to install Amplify CLI.I'd appreciate any help!FollowComment"


Question: Connect Cloudflare DNS to a service in EKS

"Hi,I am trying to install open edX (Tutor) on AWS EKS by this guide.I already have a DNS zone that is defined in Cloudflare and I want to use it for external access to the new services.Did anyone implement such a solution or can point me to documentation?Thanks,YanivFollowComment"

Answer: "0Accepted AnswerYou can see that alb-ingress-controller is installed in the guide. And you will create Ingress resource in the Step 5.Now wait till an external address gets assigned to ingress.extensions/web, this will be a DNS name for the ALB. You may also head on to the LoadBalancer section in EC2 service of AWS console to view this. Now make two CNAME entries in the Record Set for your domainYou will get a DNS name for the ALB. Then, you can create a CNAME record on your Cloudflare account.lms.your-domain.com -> ${ALB-DNS-NAME}And you should configure *.lms.your-domain.com to redirect to lms.your-domain.com.Check Cloudflare Tutorial! :)CommentShareEXPERTposquit0answered a year agoYaniv Gershon a year agoThanks! I'll try itShare"


Question: "RDS Reserved Instances, instance size increased"

"We have an db.m6g.8xlarge instance that was recently upgraded from a db.m6g.4xlarge.We also have a reserved instance for this of the size  db.m6g.4xlarge, which appears to be applying to half of the instance.  My question is, am I able to get another RI with the size of db.m6g.4xlarge, which would cover the other half, effectively being a db.m6g.8xlarge RI?The documentation on reserved instances is kind of confusing and it's not entirely clear, I'd like to know for certain before I commit to another RI.Thanks,KeithFollowComment"

Answer: "1Accepted AnswerIf you say that your RI still applies to half of the instance, then you use size-flexible platform. And yes, in that case you could buy an extra db.m6g.4xlarge RI, which will effectively be covering another half of your running instance.Note that the end date of the new RI will be different from the original one. You will have a situation later in the future where one of your RIs will expire, and another one will still be active. You will either need to refresh (repurchase) one of your RIs, or maybe you might need to downsize your instance later at that time, and in that case you can skip the renewal of that first expired RI and continue running .4xlarge with just one RI.CommentShareEXPERTNataliya_Ganswered 9 months ago"


Question: Can't forward placements constraints to F1 FPGA

"Hi,Working in Xilinx Vitis flow for F1 FPGA instanceI am trying to forward placement constriants on F1 FPGA in the synthesis/placement stage but the vivado said there is collision with current constraints probably becuase the vitis flow with AWS shell provide constrints on the user logic locationsSo I tried to put placement constraints on the use logic side but again got error from impl process and terminated the execution of the synthesis.Please advise how to forward placement constraints to my user logic in a way that I can put my logic in the place that was dedicated for the userThanksFollowComment"

Answer: "0Dear customerThank you for your interest in using AWS. Vitis flow does provide option to add placement constraints. The document below can provide details on how to enable placement constraints in vitishttps://docs.xilinx.com/r/en-US/ug1393-vitis-application-acceleration/vivado-OptionsIf you are looking for injecting SLR constraints to vitis, it can also be done via config files.In your script or makefile, you need to have something similar to this :v++ -t hw --platform […] --config ./vmult_vadd_SLR0.cfg […]for example using a modified version of the github example Vitis_Accel_Examples/sys_opt/slr_assign, in the file vmult_vadd_SLR0.cfg, assuming the kernels are named vmult_1 and vadd_1, we’d get :[connectivity]slr=vmult_1:SLR0slr=vadd_1:SLR0Also can you please provide the log and/or exact conflict errors you are seeing for further help with the issue if the provided information did not resolve your issue.ThanksCommentShareAWS-User-7905434answered a year ago"


Question: How to host a Nuxt.js SSR app on Amplify

"Hey hey, I'm currently trying to deploy a Nuxt.js SSR app on AWS Amplify. Unfortunately all documentation available is about static page generation. AWS announced Amplify SSR support for Nuxt about a year ago (https://aws.amazon.com/de/about-aws/whats-new/2020/09/amplify-javascript-adds-server-side-rendering-support-frameworks-next-js-nuxt-js/). But as far as it looks like it just means that data can be pulled from an Amplify backend. Hosting still seems to be impossible. As far as I figured it out reason might be internal deployment handling of different frameworks. Does AWS have a solution to this? Thanks a lot!FollowComment"

Answer: 0I'd like to know too. I'm trying todeploy a Nuxt application with SSR in EBS with no success. I've tried to use Amplify but the SSR functions seems not to be enough for deploy.CommentShareclaytongfanswered 2 years ago


Question: Oracle instance in reboot state for too long after upgrade

"Hi,We have an oracle instance stuck in "Rebooting" mode following an upgrade to the most recent 12.2 patch.There was also a parameter change of max_string_size to extended.CPU show around 14 % activity but no progress can be seen in logging events.Is there a way to force a db shutdown ?Thanks in advance,Best regards,RicardoFollowComment"

Answer: "0Hi,I´ve since been contacted by AWS Support.BD convertion to extended types failed because there was not enough memory. Support recommended a change on class type.Best regards,RicardoCommentShareukbanswered 3 years ago"


Question: AHB Slave interface issue in Vivado IP (AWS f1 Instance)

"Hi,I am able to create AHB Slave interface in local machine in vivado IP design.But I am unable create AHB Slave interface in AWS Server. In AWS server AXI Slave interface I am able to create and connect it using pencil tool in vivado ip.I am facing problem with AHB interface.In local machine it is working perfectly not in aws cloud vivado. I need it in aws server.Kindly help me.Thank you.FollowComment"

Answer: "0Dear customerThank you for your interest in developing designs for F1 instances. Can you please provide the following information to understand the issue you are seeing further1.) Which version of FPGA developer AMI are you using for creating FPGA designs?2.) When you say unable to create, do you see no AHB slave interface available with the IPI flow or are you seeing any error when trying to create?3.) If you are seeing an error, can you please provide the error message/snapshot of what error are you encounteringThanksCommentShareAWS-User-7905434answered 2 months ago0Hi @AWS-User-7905434When I am trying to create AXI interface using Vivado axi interface format (eg: M_AXI_araddr) it is automatically grouped and I am able to connect it directly using pencil tool with other interfaces. But in case of AHB I am unable to do it.So I am trying to connect the signals individually but after connecting it is showing that incomplete path. I mean I am unable to assign the addrewss.Thank youCommentShareGOGULanswered a month ago"


Question: Deleting a Elemental MediaLive reservation

"Hello everyone,I have been using and testing some features of MediaLive, and last week I added two offerings to my offering cart and purchased them. However, I have discovered that I have been charged more than I anticipated, and I would like to delete this reservation now.Unfortunately, I am unable to find the 'delete' button as described in the guide [1], and I suspect that this may be because the reservation contract has not yet expired.Is there any way to terminate this contract early, and will I continue to be charged even if I don't use it?[1] https://docs.aws.amazon.com/medialive/latest/ug/deleting-reservations.htmlFollowComment"


Question: Simple AD not replicating

"Greetings,Our Simple AD DCs don't seem to be synchronizing anymore:After joining a server to the domain only one of the two DC shows the new server record under Computers in AD Users and Computers. A new A record is only seen with that first DC, as verified via the DNS Manager.Two days later the second DC is still not synchronized - only showing the old entries.An attempt to trigger replication via Windows ADSS hangs. An attempt to run repadmin /syncall from the command prompt hangs indefinitely too. No errors in the Windows server event log. The status of the Simple AD is "Active".Is that normal? How soon Simple AD DCs are supposed to replicate?Should I resort to contacting aws technical support?Thanks.EDIT: In addition, it appears that automatic snapshots of the Simple AD haven't been created for about two weeks now. Previously, they were created every other day or so.  Also, attempts to create a manual snapshots fail.FollowComment"

Answer: 1Please opens a support case for this issue.  There is nothing you can do from the customer side to repair this issue.  It requires the AWS service owner to fix your directory.CommentShareEXPERTJeremy_Ganswered a year ago


Question: I cannot connect windows 2019 base after created successful

"I cannot ping or telnet to rdp port(3389) from my NAT instance or my local PC event I already enabled all tracffics from any IPv4 for that instance.I tried creating many times, but I got the same result.I think the instance windows was not start normally.In two weeks ago, I created one in HongKong zone and didn't face the problem.Now, I tred in Singapore zone.ThanksFollowComment"

Answer: "1Accepted AnswerSo i am assuming that your windows instance is having public IP associated and we have the Security Group enabled for 3389 for your machine public IP ?? Or NAT instance in AWS are into same network with proper rule allowed?Ideally if networking and firewall is correct we should be able to connect windows .. I tested and its working properly.On Ping:-In terms of ping what i have seen on windows that if you dont enable icmpv4 packets from inbound windows firewall rules that will not allow you to ping.Let me know if above pointers are useful.CommentShareShashank Abhishekanswered 5 months agorePost-User-5902367 5 months agoThank for your quick reply. I follow your suggest and recheck again.I forgot allow outbound from NAT.Share1Hi,Check the below configurations:Security Group(s) rules applied to your NAT Instance and Target EC2 instance.NACL rules (both inbound and outbound) applied to Subnets.Route Table Routes.You can utilize the AWS VPC Reachability Analyzer feature to troubleshoot your issue. This is really nice feature to troubleshoot such connectivity issues caused due to SG, NACL, or RT misconfiguration.Regards,Ashish PatelCommentShareAshish Patelanswered 5 months agorePost-User-5902367 5 months agoThank for your quick reply. I forgot allow outbound from NAT.Share"


Question: MySQL RDS maintenance applied immediately

"We are currently using MySQL RDS (v8) and have recently adjusted our maintenance window from 8AM UTC on Sundays to 4AM UTC. A Version Upgrade was also available for our instance. Via the RDS interface, we opted for this update to be applied during our next maintenance window. Despite us selecting the "Apply on next maintenance window" option, the system proceeded to update mode, and after about 30 minutes, it appeared that our RDS instance had been updated. This event took place today, on Sunday, May 21, 2023, at 10PM UTC, which is outside of our designated maintenance window. We were cautious not to click the "Apply immediately" option to avoid any downtime or availability issues during non-maintenance hours.However, this unexpected upgrade resulted in a 15-minute downtime for our application. We are puzzled as to why this upgrade was executed immediately, rather than waiting for the next scheduled maintenance window (Sunday, May 28, 2023, at 4PM UTC).This unexpected behaviour of the system has led to some disruptions in our application, and we seek an explanation for this occurrence.FollowComment"


Question: use postgres function to get clustername

"I know this is probably more of a dev type question, but I'm asking anyways. Has anyone figured out a solid way of being able to query the clustername of an aurora postgres cluster inside a function?I can pass the :'HOST' psql variable to a function and get the results needed, but I'd like to get this embedded into the function itself.This is how I pass it into the functionSELECT func_name(:'HOST','value2');I've tried something like the following in the function and it doesn't work. It does not like that ":" at the beginning of the variable.select :'HOST' into v_host;I've see some custom extensions that do this work, but Aurora PG won't allow for these custom extensions.Thoughts? Any advice?thanks in advance!FollowComment"

Answer: "0Accepted AnswerIn order to fetch the respective instance name (reader or writer) to which you are connected to, you can use below :- (please note you have to connect using cluster endpoint in order to get cluster name)[userr@machine]$ psql -h database-3.cluster-xxxxx.region.rds.amazonaws.com -U postgres -d postgrespostgres=> SELECT :'HOST';database-3.cluster-xxxxx.region.rds.amazonaws.com-- The above output can be further trimmed to just have cluster namepostgres=> SELECT SPLIT_PART(:'HOST','.',1);database-3-- To use above as variable in function , following workaround can be used as ":" is considered as variable in the psql.postgres=>create table host_name_tab (ht varchar);postgres=> insert into host_name_tab select :'HOST';postgres=> create or replace function get_host()returns varcharlanguage plpgsqlas$$declarehost_name varchar;beginSELECT SPLIT_PART(ht,'.',1) into host_name from host_name_tab ;return host_name;end;$$;postgres=>  select get_host();get_hostdatabase-3(1 row)If you which to get the instance name you are connected to you can use below :postgres=>  select aurora_db_instance_identifier() as host_name;host_namedatabase-3-instance-1-ap-south-1a(1 row)Please note as this is development related query it can be achieved by different logic.CommentSharerePost-User-4379767answered a month agorePost-User-0232352 a month agoI thought of a similar idea (manually inserting into a table like you did) in a shower epiphany. I think I will use this solution for it. It's an extra step, for sure, but it does solve the problem.Thank you!Share"


Question: Opensearch Serverless - Slow and fails to index

"I created a simple index with the following schema (in a search collection):PUT musers1{    "mappings": {        "properties": {            "uuid":            { "type" : "keyword" },            "ext_id":          { "type" : "keyword" },            "last_name":       { "type" : "text", "fields": { "raw": { "type":  "keyword" }} },            "first_name":      { "type" : "text", "fields": { "raw": { "type":  "keyword" }} },            "primary_location":{ "type" : "long" },            "created_date":    { "type" : "long" },            "permissions":     { "type" : "keyword" },            "roles":           { "type" : "keyword" }        }    }}Then I attempted to load 73 records in the dashboard (subset of data):POST _bulk{"index":{"_index":"musers1","_id":"14399575-cb41-4d33-4ee2-9a69c90a18af"}}{"created_date":1464369890,"ext_id":"1111111","first_name":"Demo","last_name":"User1","primary_location":481549029373652992,"roles":["MEMBER"],"uuid":"14399575-cb41-4d33-4ee2-9a69c90a18af"}{"index":{"_index":"musers1","_id":"f9644fb8-e790-429a-4965-9e18be4b8d8f"}}{"created_date":1464369890,"ext_id":"2222222","first_name":"Demo","last_name":"User2","primary_location":481549029373652992,"roles":["MEMBER"],"uuid":"f9644fb8-e790-429a-4965-9e18be4b8d8f"}{"index":{"_index":"musers1","_id":"4a621fc9-dc93-4934-756d-450412ca2f7a"}}{"created_date":1607376361,"ext_id":"63844","first_name":"Demo","last_name":"User3","primary_location":1183110257241493504,"roles":["MEMBER","FT-FLOOR"],"uuid":"4a621fc9-dc93-4934-756d-450412ca2f7a"}...And I got back the response 4 minutes later!{  "took": 251331,  "errors": true,  "items": [...In the end, there were 64 records indexed, and the other nine failed with the error Timeout while processing request.Also, I loaded 2000 records (slowly and painfully) yesterday into a different index and ran a few searches against it. I ended up with 5 Search and 5 Index OCUs. These OCUs have remained since yesterday. Is it normal to have 10 OCUs active when there is no indexing or search activity?Is it normal for 73 records to fail 12% of the time and take 4 minutes? That's 18 records per minute. If I had 20 million records to index, (I have more than that actually) it would take over 2 years to index!I hope I am doing something wrong, because this seems too slow and too expensive...Any ideas?ZFollowComment"

Answer: "0When you create your first collection, OpenSearch Serverless instantiates two OCUs—one for indexing and one for search. These OCUs exist even when there's no activity on any collection endpoints. All subsequent collections share these OCUs. When you create additional collections in the same account, OpenSearch Serverless only adds additional OCUs for search and ingest as needed to support the collections, according to the capacity limits that you specify. Capacity does scale back down as your compute usage decreases. [1]If you are facing issue with OCUs not scaling down and latency while ingesting records, recommend you to kindly open a case with AWS Premium Support team so that they can have a better look at the resources.[1] https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-overview.html#serverless-processCommentShareSUPPORT ENGINEERSachin_Kanswered 3 months agorePost-User-1545327 3 months agoI have opened a ticket and I was informed that 6 index and 6 search OCUs were not enough to index 73 records successfully.I was hoping for a different answer from the users of the forum as this seems excessive.Share"


Question: "Error getting, While running the Powershell script to generate the temporary access key."

"Error getting, While running the Powershell script to generate the temporary access key.For one user its working, whereas for other user its not working.FollowComment"

Answer: 0Have you made sure that they have loaded the AWS Tools for PowerShell and not just the AWS CLI?To have access to the cmdlet in PowerShell they need to install the tools.Take a look at the docs here > aws.amazon.comCommentShareRobin Fordanswered 6 months ago


Question: EC2 instance failing status check

"I have an Ubuntu 22.04 instance which runs perfectly fine until two days ago, when it failed one of the status checks. At first I thought it was just some temporary error so I just rebooted the instance and restarted my server. But today it failed the status check again.I checked the system log but there was only log for when I rebooted the instance (some internet configuration log). How can I get a full system log?FollowComment"

Answer: "1Is the instance status check or the system status check failing?https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.htmlThe general troubleshooting procedure is as described in the following document.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.htmlAlso, try stopping and starting instances instead of restarting them.The system log can also be viewed in the following ways.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html#troubleshooting-retrieve-system-logsCommentShareEXPERTRiku_Kobayashianswered a month ago"


Question: AWS CLI ls return

"Greetings,I am using AWS cli in s3 to return the dates of files in buckets, the aim is to find old files to archive/delete.The syntax that I am using is standard cli syntax. The files have been updated, but it returns the wrong date 2022-11-17??Not 2023-02-01aws s3 ls s3:bucket/Europe/ --recursive --human-readable --summarize --query "Contents[?contains(LastModified, '2022-11')].{Key: Key}" --output text | xargs -n1 -t -I 'KEY' FollowComment"

Answer: "0Hello,Please try with the s3api as below to meet your requirements to list the keys based on last modified dateaws s3api list-objects-v2 --bucket bucket_name  --query "Contents[?contains(LastModified, '2023-02-22')].{Key: Key}" --output=textCommentSharegokul_Ganswered 3 months agoEXPERTkentradreviewed 3 months ago0Hi,You can use the s3api list-objects command to achieve that:aws s3api list-objects --bucket MY-BUCKET --query "Contents[?contains(LastModified, '2023-01')].{Key: Key}" --output textAbove allows you to filter the Lastmodified attribute.Otherwise you can simply run:aws s3 ls s3://MY-BUCKET --recursive --human-readable --summarize > s3_files.txt    and see results in the fileCommentShareEXPERTalatechanswered 3 months ago"


Question: Much slow down of responses of s3select requests several times today

"Hello!Today I met a suddenly slow down of my s3 bucket several times. Sometimes it worked well, but at other time it's 100x slower than usual.I didn't meet this before today, just now I tried again and it became normal.But I'm not sure whether this large delay will occur again. Also wondering if there's any daily limit on the bucket that when exceeding it shows huge delays.Fyi, I'm using c++ aws sdk to send s3select requests to s3.Can anyone help me? My bucket is s3://pushdowndbThanks!FollowComment"

Answer: "0Is  there anyone ever experienced this?When the slowdown occured, my other bucket worked normallyStill getting "slowdown -> normal -> slowdown...." repeated today :(Edited by: yyfyyf123123 on Oct 9, 2020 11:13 AMEdited by: yyfyyf123123 on Oct 9, 2020 11:14 AMCommentShareyyfyyf123123answered 3 years ago"


Question: AWS Simple Email Service not sending emails to outlook.com or live.in from ap-south-1 region

I am unable to verify outlook.com or live.in mails with AWS SES. Not receiving the verification mail. The account is moved out of the sandbox and it is working when sending to other providers such as Gmail. The issue is present when using ap-south-1 region. If I select another region able to verify outlook.com mail. Kindly share your suggestionsFollowComment

Answer: "1Accepted AnswerThere is an exception for region ap-south-1. You need to get out of the sandbox in a different region: ap-southeast-1 I found this exception here:https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-email-phone-verification.htmlSMS messages from Amazon Cognito user pools are routed through Amazon SNS in the same region unless noted in the following table.Amazon Cognito RegionSupported SNS regionsUS East (Ohio) us-east-2us-east-1Asia Pacific (Mumbai) ap-south-1ap-southeast-1Asia Pacific (Seoul) ap-northeast-2ap-notheast-1Canada(Central) ca-central-1us-east-1Europe (Frankfurt) eu-central-1eu-west-1Europe (London) eu-west-2eu-west-1Example: If your Cognito user pool is in us-east-1 region, you can update the Amazon SNS limit in us-east-1 region.Example: If your Cognito user pool is in ap-south-1 region, you can update the Amazon SNS limit in ap-southeast-1 region.CommentShareJaccoPKanswered a year ago1Please check and confirm your SPF and DKIM settings. I faced similar issue with AWS SES with office365, once I fixed the DKIM it started working properly.For more information on AWS SES DKIM and SPF:Authenticating Email with SPF in Amazon SESAuthenticating Email with DKIM in Amazon SESSetting Up Easy DKIM for a DomainAlso please check following:DNS Blackhole List (DNSBL) FAQsTroubleshooting DKIM problems in Amazon SESCommentSharehameedullahanswered a year ago"


Question: How Amazon Lightsail handle failures

"I have a single AWS Lighstail instance that runs LAMP stack, without static IP address. There is a php app deployed and it connects to a MySQL on the same instance.I've setup an automatic snapshots of the instance (every 24 hours). A couple of questions now:Where are these snapshots stored ?If the instance fails, who is responsible of restoring it from the latest backup ? Me or Amazon ?2a. If me, then how will I know when it was down and how to restore it ?2b. If AWS, then are there any actions that I need to do ? And what will be the downtime ?When it's restored from the backup, will it have the same IP address or not ? If different, then what will the users see when they go the domain, which was still pointing to the old IP address?FollowComment"

Answer: "0Accepted AnswerHi, Here are answers to your questions:The snapshot is stored in AWS, and you can visit all your existing snapshots for a instance  from snapshots tab in Lightsail console instance detail page. Alternatively, you can use lightsail cli to get snapshots, you can use get-auto-snapshots to get automatic snapshots, or get-instance-snapshotsto get all manual created instance snapshots.You will be responsible for restoring the snapshot. You can set up alarm on operation system level failure by following this doc. If it the software level failure, you have to implement your own alarming mechanism to reduce the downtime of your software.Without a static ip, the ip address will not remain the same, the public ip address is randomly assigned when instance started. To preserve the ip address, I would recommend you to create a static ip. Once you restored a new instance from snapshot, you can attach the static ip to the newly created instance. Without static ip, the domain will still resolve to old ip address which no longer accessible.CommentShareyujieanswered a month agorePost-User-1028852 a month agoTHANKS A LOT @yujie. A couple of follow up questions:Is the lightsail snapshot stored in the same lighstail instance ? If yes, it means if an instance fails, there is no way to get to the latest snapshot.Does snapshot contain the file system (as much files it has) or it's a disk snapshot. If just the filesystem, the way to restore it to copy all the files to a new instance. Or if its a snapshot, we can just create a new instance and give it an snapshot to restore from ?Shareyujie a month agoSnapshot is not stored in the same lightsail instance, it is stored separately in AWS, if the instance failed, you can still find the latest snapshot from Lightsail console and restore a new instance from the snapshot.The instance snapshot contains the file system and the entire operation system. If you have a disk attached to the instance, you can also create a disk snapshot and restore disk from the disk snapshot.you can view more details here https://lightsail.aws.amazon.com/ls/docs/en_us/articles/understanding-instance-snapshots-in-amazon-lightsailShare"


Question: Access S3 object via cloudfront as a specific IAM user

"When adding my s3 bucket policy, i set the principal to be the ARN of a specific IAM user i created. I read in the docs that it was best practice to not use the root IAM user, but instead create a user that i would use to access all AWS services. The issue is, whatever i PUT into the bucket as that user , i am unable to GET using a cloudfront distribution i created (s3 denies me access to the objects). I want to be able to GET the object back to the client using cloudfront. So my question is, how do i make it that s3 sees that the cloudfront distribution is owned by the same user that PUT the object in the bucket. How do i link the user and the cloudfront distribution.PS: i used s3 presigned URLs to PUT the objects in the bucket and used signedURLs to GET the objects from s3 using cloudfrontFollowCommentRafael Koike EXPERTa year agoThe user that is doing the PUT is from the same AWS account of the S3 bucket?If you are doing a signed url GET to the S3 object and you are using cloudfront, what is the endpoint/fqdn that you are using to craft the signed url?Share"

Answer: "1Accepted AnswerApparently, the issue was from how i was naming the object in the bucket. I added a timestamp in ISO8601 format to each objects' name when creating the s3 presignedUrl for the PUT request. So when cloudfront tries to access it, it changes the some of those weird characters in the date string, and as a result, s3 denies access. Because the object cloudfront is trying to access doesn't exist. Thanks for the helpCommentShareInfinityStringanswered a year ago1I'm not sure, but you need asterisk after bucket name in Resource section as bellow."Resource": "arn:aws:s3:::S3 bucket/*"CommentShareYManswered a year agoInfinityString a year agoi did that. It got removed when posting the commentShare0It does not matter who puts the object in the bucket. What matter is who has GET access to the object. If I understand your question, you want to be able to restrict access to your S3 bucket so that objects can be accessed only through your Amazon CloudFront distribution. If that's your intention, here is how to achieve that: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-access-to-amazon-s3/CommentShareharlembluesanswered a year agoInfinityString a year agoI already did that. But i am unable to access the object PUT by that user. The only way i can get access to an object in the bucket using cloudfront, is id i upload that object directly from the s3 console. Once i try to do that outside the console (programmatically) i am denied access. Here's a snippet of my bucket policy in case i am doing anything wrong:{"Version": "2012-10-17","Id": "Policy1638646826561","Statement": [{"Sid": "Stmt1638646778880","Effect": "Allow","Principal": {"AWS": "arn:aws:iam:: non root IAM user"},"Action": ["s3:DeleteObject","s3:GetObject","s3:PutObject"],"Resource": "arn:aws:s3:::S3 bucket/"},{"Sid": "Stmt1638646824013","Effect": "Allow","Principal": {"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity someOAI"},"Action": "s3:GetObject","Resource": "arn:aws:s3:::S3 bucket/"}]}Share0The bucket policy snippet you provided allows ANYONE with the cloudfront distribution to READ specific objects from the specified bucket.The part of the bucket policy restricting s3 actions to a non root IAM user only applies from the console, CLI or API calls made to S3 service. You probably want to update it to something like    "Action": [        "s3:Get*",        "s3:List*",        "s3:Put*"    ],Note: There is no link between CloudFront access (using OAI) and the IAM user.You mentioned using a presigned URL to restrict who can access the file - here are a couple of other things to look out for:ensure that you create the presigned URL using your non root IAM user - that is the context in which it is created and it 'inherits' the security policy of that userwhen creating a distribution and selecting the S3 origin with a bucket - select “Forward all query params, cache based on all” on the Query String Forwarding and Caching part, as S3 signed URLs utilize query parameters for the signatureyou may need to update the CloudFront distribution so that the origin S3 url contains the correct region, for example if you simply select a bucket it will be something like cf-signed-url.s3.amazonaws.com however the S3 signed URL is actually something like cf-signed-url.s3-eu-west-2.amazonaws.com, so manually update the origin as requiredCommentShareAlex_AWSanswered a year ago"


Question: Backup external server data to AWS over SSH

"Hello everybody,I run an server outside of AWS which can be accessed over SSH.I don't want to do backups from the server to AWS. It should work the opposite.How can I run a serverless tool in aws, which is daily connecting to the server and copy all data to a cheap AWS storage.Is there something build in or do I have to build something on my own with Lambda? and S3 Glacier? (Or how would you do this?Thank youFollowComment"

Answer: "0While there is AWS Transfer for SFTP, it provides an SFTP server (and cannot login to existing SSH/SFTP servers).So for your use case, the most serverless option is probably to create a (via EventBridge periodically executed) CodeBuild job which eithermounts an EFS (with infrequent access) volumeand then calls (in the buildspec) rsync/scp myserver.com:/what/to/backup /efsmountpointor - another possibility without EFS, but with S3 (and thus Glacier storage tier possible):Create an AWS Transfer SFTP Servercalls (in the buildspec) rsync/scp myserver.com:/what/to/backup awstransferendpoint:/You might also be able to remove the AWS Transfer SFTP step by directly mounting the S3 bucket in the CodeBuild job with s3fs-fuse.CheersCommentShareSoenke Ruempleranswered a year agoPhilippS a year agoI am new to aws and wondering why you choose buildspec to do this. Why not a lambda python script. Is there a specific reason?Share"


Question: Aurora MYSQL 8 Load From S3 Privileges Not Working

I have created an Aurora MYSQL 8 cluster - engine: 8.0.mysql_aurora.3.02.2 and are testing the LOAD FROM S3 statement.  The appropriate S3 role is added to the server and the DB Cluster parameter group has been changed to use this role.The LOAD FROM S3 statement is working when I use the default admin user however when I create another user and grant it the LOAD FROM S3 privilege the command does not work.  The error I get isAccess denied; you need (at least one of) the LOAD FROM S3 privilege(s) for this operation.When I run SELECT * FROM mysql.user u  the column Select_into_S3_priv is no longer there as it was in MYSQL 5.7.Can you confirm if there is an issue with the LOAD FROM S3 command for Aurora MYSQL 8?ThanksFollowCommentAWS-User-2395500 4 months agoI granted access by running the following:GRANT AWS_LOAD_S3_ACCESS TO 'data_etl_user'@'%';Share

Answer: "0Accepted AnswerThank you for asking your question.Please make sure you activate the role by SET ROLE role_name or SET ROLE ALL before using the role based privileges.You can also use the activate_all_roles_on_login DB cluster parameter to automatically activate all roles when a user connects to a DB instance. When this parameter is set, you don't have to call the SET ROLE statement explicitly to activate a role.You can find more detailed procedure on this in our and MySQL documents.I hope this might help.https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.LoadFromS3.html#AuroraMySQL.Integrating.LoadFromS3.Granthttps://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMySQL.Compare-80-v3.html#AuroraMySQL.privilege-modelhttps://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_activate_all_roles_on_loginCommentShareYUTAKA_Hanswered 4 months ago"


Question: Why NS in route53 are different to what is shown in whois.com?

I bought a domain directly in route53 and now want to route traffic to an EB environment but IT DOES NOT WORK. I am checking the Name Servers and they're not equal to what is shown in whois.com. I don't really know if that's normal because it might work with a different configuration inside route53 which I have no access or somehow that changed on its own.FollowCommentlp901 9 months agoThe records could be cached due to the TTL and the whois could be cached as well to avoid spam and similar issuesShare


Question: Searching the right ETL Tool for transferring data within aws

"Hello everybody,I'm working for a small retail company, where we want to move our data to aws. Our data can be from different sources (postgresDB, MySQL DB or other unstructured data sources or APIs). We want to move from our on prem solution, to aws cloud.We are currently using an ETL solution, like ab initio. We do not use a code based solution like python or other scripting language. That's why we prefer an ETL solution, where we can just create ETL processes via drag and drop.Is anybody here who can give his / her recommendations for an ETL Tool, for transferring data from several kind of sources (structured / unstructured data on prem)? We prefer a solution outside from aws (not glue).Thank you very much.FollowComment"

Answer: "1Hi, you should have a detailled look at DMS and its CDC features: https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.htmlIts full export and CDC features will probably do what you're looking for.Otherwise AWS Glue is our ETL that may also be a good solution: https://aws.amazon.com/glue/CommentShareDidier_AWSanswered 15 days agoSaschaSingh 15 days agoThanks for your answer. We don't want to be limited by databases. We want to extract data from several kind of sources (not only databases). That's why DMS wouldn't work for us. And we also don't want to work only with glue. We prefer a low code option. That's why we use an ETL solution like ab initio, to extract every kind of sources with just one tool. Are there any kind of recommendation of using an external ETL tool in AWS?Share1Hi ,I understand you are looking for partner solutions for data integration,  while I cannot advice on the best solutions, you can see all AWS partner solutions in this page , on the left under Categories filter for Data Integration and Preparation and you will see all partners who offer tools for ETL type workload.Two Additional considerations:for the ingestion part , ingesting from APIs and SaaS you could also look at Amazon Appflow (no code solution)while I understand you do not want to use coding solutions and for that reason you are not really considering AWS Glue, I would recommend giving it a second try because with the new visual transforms  and Connector Marketplace does allow for most thing to be done in a no-code approach.hope this helpsCommentShareEXPERTFabrizio@AWSanswered 15 days ago"


Question: AWS GameKit not running on android (UE5)

"Hey all. I've recently updated GameKit Plugin to version 2.0.0 https://github.com/aws/aws-gamekit-unreal and I'm having problems with running it on an Android platform. The Login attempt returns an error with code 0x10003. Also when I'm trying to register, there is an error with the message: "You need to deploy the Identity/Authentication feature first". I've tried redeploying it in project settings but it doesn't help.P.S. Windows packaged build works fineP.P.S. Login mechanism is Email/PasswordFollowComment"

Answer: 0Bump. Any suggestions on fixing this issue?CommentSharerePost-User-5317208answered 7 months ago


Question: RHEL 9 US-EAST-1 ARM64 Repos having issues again 2/28/2023...

"Make a copy of your redhat-rhui.repo file, and do a search and replace with REGION with us-east-2 and you'll be able to grab updates again.Change:mirrorlist=https://rhui.REGION.aws.ce.redhat.com/pulp/mirror/content/dist/rhel9/rhui/$releasever/$basearch/appstream/ostomirrorlist=https://rhui.us-east-2.aws.ce.redhat.com/pulp/mirror/content/dist/rhel9/rhui/$releasever/$basearch/appstream/osIt appears that the us-east-1 aarch64 RHEL9 repos are having issues again.  But at least we're able to point to another region this time for updates.   I've notified RHEL of the issue again.Both us-east-2 and us-west-2 work fine for me.   us-east-1 has no updates, going on 24 hrs+ now.FollowComment"

Answer: "0I tested this without success using the public RHEL 9 ARM AMI ami-0373218dcae329f21 in us-east-1. I found that updates were working normally. However I have a few ideas:First, I spotted on https://status.redhat.com/ that there was an outage today for newly registered entitlements, and this was taking place from 13:39 - 15:55 EST. However, there is no regional component to this issue. If this was the cause then the updates should be working normally at this time.Next, in the repository configuration there is a variable "REGION" which you mentioned substituting for a fixed string such as us-east-2. This variable is handled by a plugin called "amazon-id" which must be enabled for this variable to be converted to the proper region. If the plugin is not working normally yum/dnf operations will fail with "[Could not resolve host: rhui.REGION.aws.ce.redhat.com]".The amazon-id plugin receives the region from the Instance Metadata Service. It's possible that the service could have an issue or that a rate limit could be reached (1024 packets per second). You can check for any limit being reached by running[1]:[root@ip-172-31-1-190 ~]# ethtool -S eth0 | grep linklocal_allowance_exceededlinklocal_allowance_exceeded: 0This output should be 0, and any non-zero output is a count of dropped packets. As well, I would be sure the region is present in the output of a curl directly to the metadata service:[root@ip-172-31-1-190 ~]# curl 169.254.169.254/latest/meta-data/placement/availability-zoneus-east-1dAny issues with the Instance Metadata Service can be worked around by stopping and starting an instance to move it to new underlying hardware. Another interesting test for this scenario is to try substituting REGION with us-east-1. This would be a an apples-to-apples comparison with substituting the variable with us-east-2, while using REGION requires the plugin and metadata.[1] https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-ec2-instance-level-network-performance-metrics-uncover-new-insights/CommentShareJames Wanswered 3 months ago"


Question: Failed to start the instance i-xxxx This account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions.

"In Ohio region, after I increased the volume size and restarted my EC2 instance, I encountered the following error message: "Failed to start the instance i-xxxx This account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions."I sent an email describing the situation to aws-verification@amazon.com a few days ago, but haven't received a response yet. Please tell me how to resolve this issue.FollowComment"

Answer: "0This can happen for various reasons, such as a security concern or violation of the AWS terms of service.Since you have already contacted AWS support at aws-verification@amazon.com, the next best step is to wait for their response. They will review your case and provide you with instructions on how to proceed.In the meantime, you can check if there are any outstanding payments or account issues that may have caused the block. If there are, resolve them as soon as possible to ensure your account is in good standing.If you don't hear back from AWS support after a few days, you can try reaching out to them again through the AWS Support Center. They will be able to provide you with more specific information on why your account has been blocked and what steps you can take to resolve the issue.CommentShareManuanswered a month ago"


Question: Account is currently blocked when trying to create EC2 instance.

I am trying to create a free tier EC2 instance in ca-central-1. The task fails with the error "This account is currently blocked and not recognized as a valid account. Please contact aws-verification@amazon.com if you have questions." The account has a credit card on file so I'm not sure why it would be blocked.FollowCommentDaniel Craigie a year agoWhat did the people at aws-verification say?Share

Answer: "2Hi,it is possible that your account is limited to use certain region only as free tiers ( mainly US East (N. Virginia), US East (Ohio), US West (Oregon)) You can validate by trying to create the EC2 in those regions.if you need more regions, you will have to contact aws-verification@amazon.com and explain why you need other regions.But test first in US East to confirm.Hope it helps.CommentShareLaurentanswered a year ago0Here is an email that I got from AWS:Dear AWS Customer,Thank you for signing up with Amazon Web Services!As a new customer, you can launch Elastic Compute Cloud (EC2) instances in 3 AWS regions. We suggest you to use the regions US East (N. Virginia), US East (Ohio), US West (Oregon), but if you prefer other regions please contact us at aws-verification@amazon.com and let us know which 3 regions are more convenient for you. You can find the list of regions and which services are available in each of the regions at http://aws.amazon.com/about-aws/globalinfrastructure/regional-product-services/. Please make sure you are not running EC2 instances in the region you are transitioning from.If you have a use case that requires you to run EC2 instances in more than 3 regions, please contact us at aws-verification@amazon.com describing your use case and we will increase the number of available regions.This limitation is temporary and only affects EC2 – other AWS services are available in all regions.Sincerely, Amazon Web ServicesSo please change your region to US West (Oregon) or US East (N. Virginia) or US East (Ohio) and then it will works. If you still want to use other regions, contact aws-verification@amazon.com for more detailed.CommentSharerePost-User-6294432answered 2 months ago"


Question: CDK DMS replication instance

"I try to setup a DMS replication instance using CDK, it's working almost as expected except that the instance is deployed in the default VPC.Is there a way to choose the VPC for this instance using CDK? It's possible to choose the VPC using the AWS console but I didn't manage to do it using CDK.ThanksFollowComment"

Answer: "0Accepted AnswerManage to make it works with this code:    tmp = []    for sub in vpc.private_subnets:        tmp.append(sub.subnet_id)    rep_sub = dms.CfnReplicationSubnetGroup(self, "rep_sub",                                           replication_subnet_group_description="desc rep_sub",                                           subnet_ids=tmp                                           )    rep = dms.CfnReplicationInstance(self, "rep-instance",                                     replication_instance_class="dms.t2.micro",                                     replication_subnet_group_identifier=rep_sub.ref,                                     publicly_accessible=False                                     )It creates the Subnet group and the association with the replication instance. The replication instance is then placed in the VPC where the subnets belongs.CommentShareAWS-User-3281629answered 3 years ago"


Question: "SSL Cetificate ok, not run"

"Hi,I creat certificate for my website ok, not runnig.link:  http://autoprog.eng.br/seeDistribution IDE2RALL0IYM2DMDARNarn:aws:cloudfront::210471392264:distribution/E2RALL0IYM2DMDLog Prefix-Delivery MethodWebCookie LoggingOffDistribution StatusDeployedComment-Price ClassUse All Edge Locations (Best Performance)AWS WAF Web ACL-StateEnabledAlternate Domain Names (CNAMEs)autoprog.eng.brwww.autoprog.eng.brSSL Certificateautoprog.eng.br (22999037-dac3-4a76-aca6-d381387dff95)Domain Named37n98273429av.cloudfront.netCustom SSL Client SupportClients that Support Server Name Indication (SNI) - (Recommended)Security PolicyTLSv1.2_2019Supported HTTP VersionsHTTP/2, HTTP/1.1, HTTP/1.0HTTP/AND/TTTPSregister in N. ViginiaSSL autoprog.eng.br by AWSautoprog.eng.brwww.autoprog.eng.brIssuedAmazon IssuedYesEligibleall ok,what else you need to do to make my website safe.Thanks,Carlos.FollowComment"

Answer: "0hi,[SOLVED]ADD new regiter AAAA in Router 53.thanks,Carlos.CommentShareccandidoanswered 2 years ago"


Question: AWS CodePipeline custom stage to read config file and call external service endpoint

"Hi All,I'm using AWS CodePipeline with CodeBuild & CodeCommit . I want to add custom stage and there I need to read configuration file & send that data to external service endpoint. Is there any option to achieve this using CodePipeline?Please guide me through this.FollowComment"

Answer: "0You can use another CodeBuild stage with a standard Linux image provided by AWS (ex: aws/codebuild/standard:6.0 which is an Ubuntu 22.04) and do any commands you need. For example:version: 0.2env:  shell: bashphases:  pre_build:    commands:      - aws s3 cp s3://<myconfigbucket>/<myconfigfile> # get a config file      - $(<command to parse config file or any other action needed>)  build:    commands:      - curl -X POST -d 'key1=value1' -d 'key2=value2' https://example.com/fake.phpThis is just an example, you can put any bash command you need to match your use case.CommentShareMonicaanswered 10 months ago"


Question: RDS encryption - Switch from KMS AWS Managed Key to Customer Managed Key

"Hello,I'm working with a customer who has encrypted their RDS instances with KMS AWS Managed Key.Now, due to the need to use AWS Backup with cross-account backup they need to switch from AWS Managed key to Customer Managed key.What is the AWS recommended procedure to perform the switch also considering that the customer has a retention policy for production backup of 31 days and of course they don't want to loose existing backup ?Thanks in advance,EnricoFollowComment"

Answer: "1As described in the following AWS blog, Customer Managed key is used to encrypt the backup vault.Cross-accounting can be set up by sharing that Customer Managed key with the destination account.https://aws.amazon.com/jp/blogs/storage/protecting-encrypted-amazon-rds-instances-with-cross-account-and-cross-region-backups/If this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month agoAWS-User-8528002 a month agoThe issue is that the customer has 31 days of RDS snapshots encrypted with AWS Managed Key and need to convert them to snapshots encrypted with Customer Managed Key before to copy them to the destination account in order to avoid losing any previous backup (retention policy for this customer is 31 days). The customer is asking for the recommended procedure to make conversion and copy to the destination account.ShareRiku_Kobayashi EXPERTa month agoIt would be a good idea to include a setting to copy from the existing backup vault to a backup vault encrypted with a customer-managed key, and from there to other accounts.Share"


Question: "Domain certificate renewal after expiry, android app not working"

"Hi Team,We renewed our domain certificate on AWS after getting expired. The renewal is verified and the app started to work on web and ios but somehow it is not working on android.FollowComment"

Answer: "1Hi,This seems to be more specific to the platform or device.Verify on multiple devices.Validate the cache behavior.For future - You can explore using AWS ACM if possible which provides managed renewal to avoid manual process - https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.htmlCommentShareAWS-CSinghanswered 5 months ago"


Question: Device registration via JITP w/ pre-provisioning hook

When creating provisioning templates in AWS IoT Core you can attach a pre-provisioning hook.https://docs.aws.amazon.com/iot/latest/developerguide/pre-provisioning-hook.htmlI'm looking at onboarding devices using the JITP flow referenced here.https://docs.aws.amazon.com/iot/latest/developerguide/jit-provisioning.htmlThere exist thing attributes that need to be populated at provisioning time. These attributes are not available to be encoded in the device certificate at manufacturing time. The attributes are used as part of the device policy and topic pattern in a multi-tenant solution to ensure no cross-contamination of data between customers. I would like to use a pre-provisioning hook to further augment the data available to the provisioning template. Is this possible?I understand that JITR is an option that would allow further augmentation but I would like to avoid having to manage the infrastructure necessary to support that approach.FollowComment


Question: AWS KVS: Provided SDK and API are same

"Hi,As per the documentation AWS provided producer SDK and consumer parser lib to PUT and GET the video data.Also provided the API for getMedia and putMedia, so wanted to check with u both are same. ?Thanks,VenkatFollowComment"


Question: Is it possible to dynamically change the capacity-upfront for EMR cluster using Data Pipeline?

"Main problemI understand that is no need to add Auto Scaling to an EMR cluster launched by Data Pipeline. Instead, we can specify the capacity up-front and it will be used for the duration of the job. But what if I am doing transformation on some data weekly basis and the instance type size needed do this every week, and I can't be sure about how many nodes are required in the cluster for better performance?Possible solution?At the moment, I can predict the amount of data that EMR could process thanks to the number of events tracked in a period of time on OpenSearch (where EMR will extract data), E.g. If 1 EMR node can handle 1,000 events and the actual number of events was 10,000 then create 10 nodes.I though on create an EventBridge cron job to execute a Lambda function ~10 minutes before the Data pipeline process and calculate the number of nodes, then store the value in a service like SSM parameter store. So when the Data Pipeline starts, I can be able to retrieve the value and pass it as a parameter for the task.This may sound a little complicated so I would like to know if there's maybe an easier way to achieve this, thanks in advance!FollowComment"