Question: Ebconfigurations: Enable-WindowsOptionalFeature IIS-WebSockets fails reboot

"Hi,I have ebextensios script that enable IIS-WebSockets and then a step to reboot the machine to enable it (cause enabling this feture requires reboot) but the reboot fails.files:  "C:/mysetup/app-server.ps1":    content: |      $LASTEXITCODE = 0      Write-Host "Unistall Windows Defender";      Uninstall-WindowsFeature -Name Windows-Defender      Write-Host "Enable IIS WebSockets";      Enable-WindowsOptionalFeature -FeatureName IIS-WebSockets -Online -NoRestart      exit $LASTEXITCODE container_commands:  03-configure-application-server:    command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:/mysetup/app-server.ps1"    ignoreErrors: true    waitAfterCompletion: 0  04-reboot-server:    command: powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Restart-Computer -Confirm -Force"    waitAfterCompletion: 0I tried iven with waitAfterCompletion: forever.Here's the error I get:2022-10-25 12:26:30,420 [INFO] Command 03-configure-application-server succeeded2022-10-25 12:26:31,822 [ERROR] Command 04-reboot-server (powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Restart-Computer -Confirm -Force") failed2022-10-25 12:26:31,822 [ERROR] Error encountered during build of postbuild_1_pcube: Command 04-reboot-server failedTraceback (most recent call last):  File "cfnbootstrap\construction.pyc", line 578, in run_config  File "cfnbootstrap\construction.pyc", line 146, in run_commands  File "cfnbootstrap\command_tool.pyc", line 127, in applycfnbootstrap.construction_errors.ToolError: Command 04-reboot-server failed2022-10-25 12:26:31,822 [ERROR] -----------------------BUILD FAILED!------------------------2022-10-25 12:26:31,822 [ERROR] Unhandled exception during build: Command 04-reboot-server failedTraceback (most recent call last):  File "cfn-init", line 176, in <module>  File "cfnbootstrap\construction.pyc", line 137, in build  File "cfnbootstrap\construction.pyc", line 564, in build  File "cfnbootstrap\construction.pyc", line 578, in run_config  File "cfnbootstrap\construction.pyc", line 146, in run_commands  File "cfnbootstrap\command_tool.pyc", line 127, in applycfnbootstrap.construction_errors.ToolError: Command 04-reboot-server failedThanksMicheleFollowComment"


Question: AWS Keyspaces is not listed under services in scope for compliance

"Hi,I see that AWS Keyspaces is not listed under services in scope for compliance? Why is this and will this be changing?https://aws.amazon.com/compliance/services-in-scope/Thanks,ThomasFollowComment"

Answer: "0Perfect. I was looking for HIPAA compliance.Thanks,ThomasCommentSharetah-masanswered 2 years ago0Great! I also will add Keyspaces is now in scope for AWS SOC 1, SOC 2, and SOC 3 reports. The AWS compliance website will be updated to reflect the new status soon.CommentShareAWS-User-6425534answered 2 years ago0Hello,Which compliance program are you interested in? Keyspaces already supports PCI compliance and is in scope for AWS ISO and CSA STAR certifications. We also recently got approval for HIPAA compliance support (the AWS compliance website has not been updated yet).Edited by: ArturoAtAWS on May 17, 2021 10:54 PMCommentShareAWS-User-6425534answered 2 years ago"


Question: Roles and access

"Hello!1)Our admin opened AWS account, but now the administrator left, how can I get the statistics of entrances and understand which role am I by my email:IAM or Root user? And if something was changed recently? Emails seem to be received with a few hours delay.2)Adding Organization details will add security, or it's not on the Free Trial time?FollowCommentD G 18 days ago@rePost-User-8340655  did my answer work for you ? Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)Share"

Answer: "0IAM users and root users have different login methods.You can check which user is currently being used by logging into the management console, where the user name is displayed in the upper right corner of the screen.root userhttps://docs.aws.amazon.com/ja_jp/signin/latest/userguide/introduction-to-root-user-sign-in-tutorial.htmlIAMhttps://docs.aws.amazon.com/ja_jp/signin/latest/userguide/introduction-to-iam-user-sign-in-tutorial.htmlAs for the email, I too find it a bit slow, but once it is received, I don't think it is a problem.If you are using AWS Organizations to manage your AWS accounts, you can enhance security by using SCP to restrict actions on your accounts.This can be used even during the free period.It would also be a good idea to use AWS Control Tower to set up guardrails to prevent unexpected actions.https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htmlhttps://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-CTower.htmlCommentShareEXPERTRiku_Kobayashianswered 21 days ago0Also it sounds like there was a situation where the handling of a root credential wasn't locked down in the first place.Please seek the following documentation on best practices for handling an account's root user.https://docs.aws.amazon.com/accounts/latest/reference/best-practices-root-user.htmlI would read that documentation first after regaining control of your account, as you'd want to make sure this sort of thing doesn't happen again.CommentShareD Ganswered 20 days ago"


Question: Unable to set Logging Level to Debug in local and cloudwatch logs

"I seem to be unable to set a logging level above INFO. I set all logs (local and cloud) to DEBUG in the console, deployed, but don't see any DEBUG level messages in any log.Is this expected ?FollowComment"

Answer: "0Hi TJirsch,Info is the lowest level currently supported.Thanks,KeagenCommentShareKR-AWSanswered 4 years ago"


Question: Datasync Agent in VPC

"A customer is interested in DataSync and their security department is telling them to use VPC Endpoints/PrivateLink.  As the team is looking through the documentation to provide the security department, a point of clarification is needed (https://docs.aws.amazon.com/datasync/latest/userguide/datasync-in-vpc.html).Documentation states that the agent can be "either on-premises or in-cloud and the DataSync service doesn't need to travel across the public internet or need public IP addresses".  The following paragraph goes on to describe considerations when deploying the agent in a VPC.  The customer would prefer to deploy the VMWare Datasync agent on-premises.East question that I would like answered:  Does the agent have to be deployed in a VPC to use VPCE?Thank you in advance.FollowComment"

Answer: "0Accepted AnswerDataSync can use VPC endpoints with either on-premises agents or EC2-based agents, so your customer can absolutely deploy the agent in their VMware environment and use PrivateLink.  In fact, PrivateLink support was added specifically to address customers who want to use DataSync on-premises but don't want to traverse the Internet.CommentShareJeff_Banswered 4 years ago"


Question: pg_repack extension upgrade failure

"I have upgraded my Postgresql RDS from 12.7 to 13.5 and I'm able to upgrade the available extensions like pg_stat_statements, ltree, etc expect for pg_repack.Default version: 1.4.6Installed version: 1.4.5When I try to upgrade pg_repack extensions using sql statementALTER EXTENSION "pg_repack" UPDATE TO '1.4.6';Error message:[22023] ERROR: extension "pg_repack" has no update path from version "1.4.5" to version "1.4.6"I'm not sure how to solve this issue with RDS.FollowComment"

Answer: "0Accepted AnswerLooks like **pg_repack ** does not have update path.If you are upgrading from a previous version of pg_repack or pg_reorg, just drop the old version from the database as explained and install the new version.I will send a PR to update this note on their AWS upgrade documentation.CommentSharevigneshganswered a year ago"


Question: IAM how to give access to list certain buckets

"HI folks,I feel like this should be super simple, but I think i have everything enabled as it should be.I have a user, to whom I've given a policy like:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "s3:*"            ],            "Resource": [                "arn:aws:s3:::my-bucket",                "arn:aws:s3:::my-bucket/*"            ]        }    ]}However, he cannot see the bucket in the bucket list view. No buckets are listed. I would think, since I've given the user the action s3* for that bucket, they should be able to see that bucket listed. Am I wrong?Cheers.FollowComment"

Answer: "1What you've done is fine for accessing the bucket.  But to have the S3 Console working properly they need  "s3:GetBucketLocation", "s3:ListAllMyBuckets" allowed.CommentShareEXPERTskinsmananswered 3 months agotomhamiltonstubber 3 months agoThis was the answer. Important to note that the ListAllMyBuckets perm needs to have no resource restrictions.Shareskinsman EXPERT3 months agoGlad it worked!  If you get around to it, please hit Accept on this answer to help future people searching fot the solution.Share0Check for a bucket policy that is blocking access. Or an SCP. You can investigate using the Policy Simulator. Make sure to fill out the Resource in the simulator.CommentShareEXPERTkentradanswered 3 months ago0Hello!Granting the s3:* permission to a user allows them to perform any action on the S3 bucket and its objects, but it does not necessarily grant them the permission to list the bucket. To list the buckets, the user needs the s3:ListAllMyBuckets permission.To grant the s3:ListAllMyBuckets permission to the user, you can add a statement to their policy like this:{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["s3:ListAllMyBuckets"],"Resource": ""},{"Sid": "VisualEditor1","Effect": "Allow","Action": ["s3:"],"Resource": ["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]}]}Note that granting the s3:ListAllMyBuckets permission allows the user to list all the S3 buckets in your AWS account, so make sure to review and restrict the user's access as needed.Let me know if that answered your questionCommentShareZJonanswered 3 months ago"


Question: Can not connect to kafka brokers but zookeepers are still

"My msk service are running well until recently kafka brokers cannot be connected but zookeepers are still connected successfully.I also double checked VPC, It's same. Eventually restart all brokersI tried these commands belowtelnet broker_dns_1 9092  #=> Trying ip...  telnet: Unable to connect to remote host: Connection refused    telnet zookeeper_dns_1 2181  #=> Trying ip...  connected to zookeeper_dns  Because response of telnet broker_dns command are so fast, I guess they can be blocked by some rules. have you guys encountered this issue or known the root cause ?Edited by: taisytran on Jan 17, 2021 8:50 PMEdited by: taisytran on Jan 17, 2021 8:50 PMFollowComment"

Answer: "0I double checked broker status on my monitoring tool.Broker state is 2: Recovering from Unclean Shutdown extends Broker States (https://docs.itrsgroup.com/docs/geneos/5.3.0/Integrations/Kafka/kafka_monitoring_tr.html)follow this page, I guess my brokers are stuck on this stateCommentSharetaisytrananswered 2 years ago0I've resolved, out of storage problemCommentSharetaisytrananswered 2 years ago"


Question: "Lambda Function returned an error in Connect Contact Flow logs, but Lambda itself working fine"

"I have set up a configuration between Salesforce and AWS Connect. In this configuration Amazon provided us with built-in Lambda package that is used to add, update or lookup Salesforce records.In my case, I am using this lambda package for lookup into salesforce. Salesforce save data in the form of Contact and Account. When I try to fetch data from Salesforce Contact using lambda function in Connect Contact Flow, it works absolutely fine. But when I try to fetch Salesforce Account fields using Lambda function in Connect Contact Flow, It is not working.Although Connect Contact Flow properly calls my lambda function, and Lambda function is working fine as you can see my lambda function logs below:Response: {    "searchRecords": [        {            "attributes": {                "type": "Contact",                "url": "/services/data/v48.0/sobjects/Contact/0035pWFcaAAG"            },            "Id": "0035p00003dWFcaAAG",            "Name": "Artur Bensch",            "Account": {                "attributes": {                    "type": "Account",                    "url": "/services/data/v48.0/sobjects/Account/0015p000OcQAAV"                },                "City_CB__c": "Cologne"            }        },        {            "attributes": {                "type": "Contact",                "url": "/services/data/v48.0/sobjects/Contact/0035p000xtxAAA"            },            "Id": "0035p000txAAA",            "Name": "test us",            "Account": {                "attributes": {                    "type": "Account",                    "url": "/services/data/v48.0/sobjects/Account/0015p00ts3SAAQ"                },                "City_CB__c": "Berlin"            }        }    ]}It is not throwing any error, I have checked all logs very carefully, but when I see contact flow logs, it says "The Lambda Function Returned An Error." Also you can see in the Contact Flow logs.{    "Results": "The Lambda Function Returned An Error.",    "ContactId": "ab679f96-a75f-4fdfc-8sdfds0-a656542e2f8",    "ContactFlowId": "arn:aws:connect:eu-central-1:048600317115:instance/ba40-72b-a94d-a5b3bfde8b2f/contact-flow/b8fb79cc",    "ContactFlowName": "outboundWhisperFlow",    "ContactFlowModuleType": "InvokeExternalResource",    "Timestamp": "2022-05-30T06:43:58.108Z",    "Parameters": {        "FunctionArn": "arn:aws:lambda:eu-central-1:048600317115:function:serverlessrepo-AmazonConnectSalesforce-sfInvokeAPI-JrqDuYg",        "Parameters": {            "sf_operation": "phoneLookup",            "sf_phone": ".+4915251121195",            "sf_fields": "Id, Name, account.City_CB__c"        },        "TimeLimit": "8000"    }}It is very unexpected behavior by Contact Flow logs, because my Lambda function is running without any error then why contact flow is saying Lambda Function returned an error, it is very frustrating.FollowComment"

Answer: "0try setting your parameters to     "Parameters": {            "sf_operation": "search",            "sf_object": "Account",            "q": ".+4915251121195",            "sf_fields": "Id, Name, City_CB__c"        },The phoneLookup operation only searches against the Contact object in Salesforce as far as I can tell, so adding the City_CB__c as a field causes it to fail.  The documentation on the provided lambda leaves a bit to be desired.CommentShareledgeanswered a year ago0Looking at what is being return it seems your object might be too complex based on the limitations that the contact flow can handle based on their documentation - The output returned from the function must be a flat object of key/value pairs, with values that include only alphanumeric, dash, and underscore characters. Nested and complex objects are not supported. The size of the returned data must be less than 32 KB of UTF-8 data. can be found here - https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html#verify-functionCommentShareJacob Boardmananswered a year ago"


Question: Triplicated AWS Managed Grafana alerts using SNS

"Hi everyone!We have a AWS Managed Grafana alert connected to AWS Timestream:The alert fires a SNS notification (which is processed by a lambda function) and an email. The problem is, we keep receiving always 3 notifications, with the same valueString. For example, here are 3 valuesStrings which came in 3 different notifications:[ metric='_col1' labels={serial_device=158857075025556} value=-17.558333333333334 ],[ metric='_col1' labels={serial_device=132400469686384} value=-16.96666666666667 ],[ metric='_col1' labels={serial_device=246326151756948} value=-19.638461538461538 ],[ metric='_col1' labels={serial_device=27418224420500} value=-15.080000000000005 ][ metric='_col1' labels={serial_device=27418224420500} value=-15.080000000000005 ],[ metric='_col1' labels={serial_device=132400469686384} value=-16.96666666666667 ],[ metric='_col1' labels={serial_device=246326151756948} value=-19.638461538461538 ],[ metric='_col1' labels={serial_device=158857075025556} value=-17.558333333333334 ][ metric='_col1' labels={serial_device=158857075025556} value=-17.558333333333334 ],[ metric='_col1' labels={serial_device=246326151756948} value=-19.638461538461538 ],[ metric='_col1' labels={serial_device=132400469686384} value=-16.96666666666667 ],[ metric='_col1' labels={serial_device=27418224420500} value=-15.080000000000005 ]We also tested Reduce followed by Math expressions, instead of Classic Condition, but the problem remains.FollowComment"


Question: Move objects in Deep Glacier Archive from one account to another while preserving storage class

"Looking for the best approach to moving data in S3 Glacier Deep Archive from one account to another, while preseving current storage class. Any solutions I've come across thus far seem to indicate that all data must be retreived from Deep Archive before copying, which feels redundant and costly given that the data should ultimately remain in Glacier Deep Archive in the destination account.What is the least costly approach to doing this? Can it be done without first performing (e.g.) a Bulk Retrieval on the original data and then subsequently moving back to Glacier Deep Archive in the destination account?FollowComment"

Answer: "0Unless AWS Support can work out something custom with you, migrating the data will require you to retrieve it from Glacier in the origin account, and sending it to Glacier in the destination account. You'll probably want to do it from within AWS itself so you don't end up paying egress fees on that data getting it to your local workstation...CommentShareQuinnyPiganswered 7 months ago0Data stored in S3 Glacier Deep Archive must be retrieved/restored before said data can be moved/copied, regardless of the destination storage class. The best way to copy this data in my opinion, after restoring the data, would be to use the Copy S3 Batch Operation: https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-copy-object.html#batch-ops-examples-copyCommentSharecjcurrieanswered 7 months ago"


Question: Subfolder Permission

"How to manage permission at the subfolder level? For instance, 10 users have access to a folder, but I want to grant permission to 2 out of 10 to a subfolder.FollowComment"

Answer: "0Hi,Unfortunately, there is no way currently to remove the "view subfolder" permission in Workdocs [1] or "break inheritance". Please check again soon as we constantly improve the product and experience based on customer feedback.The simple approach is to use separate folders.[1] https://docs.aws.amazon.com/workdocs/latest/userguide/permissions.htmlRegards,JonCommentShareEXPERTJonathan_Danswered 4 months ago"


Question: Error when running test-invoke-authorizer: tokenSignature

"I am attempting to create a custom authorizer for IoT and am following this guide:https://aws.amazon.com/blogs/security/how-to-use-your-own-identity-and-access-management-systems-to-control-access-to-aws-iot-resources/When I attempt to test my authorizer with this command:aws iot test-invoke-authorizer --authorizer-name <authorizer_name> --token allow --token-signature <token_signature>I get the response:An error occurred (InvalidRequestException) when calling the TestInvokeAuthorizer operation: 1 validation error detected: Value '<signature here>'  at 'tokenSignature' failed to satisfy constraint: Member must satisfy regular expression pattern: [A-Za-z0-9_/]_={0,2}I am testing it in Centos, and have created a bash script like this:#!/bin/bashsig=cat token.sign.b64aws iot test-invoke-authorizer --authorizer-name MyAuthorizer --token allow --token-signature "$sig"The token.sign.b64 is created as per the instructions in the guide.How do I get it to authorize correctly?FollowComment"

Answer: 0I found the answer myself.Runningod -c token.sign.b64to view the actual byte contents of the file showed that it had \n chars in it which would have been generating the error.So instead of just running base64 on the file I ran this to ensure that no \n got into the output file:base64 token.sign | tr -d \n > token.sign.b64CommentSharetobyjoanswered 4 years ago


Question: OpenSearch Dev tool PUT resolves to 404

"I am trying to confirm my OpenSearch setup is working but I am not able to insert new data to confirm this. Here are a list of commands and response I am seeing from OpenSearch. My goal is to hook Firehose to OpenSearch but so far seeing multiple errors.When signing in:Page redirects to https://....us-east-1.aoss.amazonaws.com/_dashboards/api/core/capabilitiesResolves in 404statusCode404error"Not Found"message"Not Found"Testing out commands in https://....us-east-1.aoss.amazonaws.com/_dashboards/app/dev_tools#/consolePUT analytics-indexResolves in success.GET _cat/indicesReturns a list of indices.  analytics                              ...  opensearch_dashboards_sample_data_logs ...  analytics-index                        ...PUT commands failingPUT analytics-index/_doc{  "@timestamp": "2023-02-14T14:34:56.789Z",  "foo": "bar"}Resolves in 404Request failed to get to the server (status code: 404)PUT analytics-index/_doc/1{  "@timestamp": "2023-02-14T14:34:56.789Z",  "foo": "bar"}Resolves in 400{  "error": {    "root_cause": [      {        "type": "illegal_argument_exception",        "reason": "Document ID is not supported in create/index operation request"      }    ],    "type": "illegal_argument_exception",    "reason": "Document ID is not supported in create/index operation request"  },  "status": 400}PUT analytics-index{  "@timestamp": "2023-02-14T14:34:56.789Z",  "foo": "bar"}Resolves in 400{  "error": {    "root_cause": [      {        "type": "parse_exception",        "reason": "unknown key [@timestamp] for create index"      }    ],    "type": "parse_exception",    "reason": "unknown key [@timestamp] for create index"  },  "status": 400}Firehose error when using Test with Demo data.{ "deliveryStreamARN": "arn:aws:firehose:us-east-1:...:deliverystream/PUT-...", "destination": "https://....us-east-1.aoss.amazonaws.com", "deliveryStreamVersionId": 1, "message": "{"type":"security_exception","reason":"Authorization failure for the following indices: [analytics-index]"}", "errorCode": "403" }FollowComment"


Question: How do you pass special parameters for AWS Glue jobs via AWS CloudFormation

"When creating a AWS Glue ETL Job with AWS CloudFormation, how do you specify advanced options such as additional JAR's that the job may require, special security configuration parameters for KMS encryption, etc?FollowComment"

Answer: "0Accepted AnswerHi,In AWS CloudFormation when using the Resource AWS::Glue::Job under Properties you need to add these advanced parameter in the  DefaultArguments section.            "DefaultArguments": {            "--TempDir": "s3://aws-glue-temporary-633748029103-eu-west-1/serhat",            "--class": "GlueApp",            "--enable-glue-datacatalog": "",            "--enable-metrics": "",            "--encryption-type": "sse-s3",            "--job-bookmark-option": "job-bookmark-enable",            "--job-language": "scala"        },You can find the list of parameters here.For additional JARS: --extra-jars is the parameter.For Server Side Encryption: --encryption-type is the parameter.Hope this helps.CommentShareEXPERTSerhatanswered 4 years agoEXPERTRaphaelreviewed 2 years ago"


Question: Elastic Beanstalk CLI not working

"Hi, I've succesfully installed EBCLI on my local windows machine, but when I enter eb init I get'eb' is not recognized as an internal or external command,operable program or batch file.Can anyone help?FollowComment"

Answer: "0Some of the same answers are given here as well.Most likely your Windows machine does not have the required PATH set.https://stackoverflow.com/questions/41729006/unable-to-install-aws-elastic-beanstalk-cli-win10-python-3-6-pip-9-0-1Have you completed the PATH setup as described in the following official documentation?https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/eb-cli3-install-windows.htmlThe following PATH must be added to the environment variable.Where it says "Python37", change it to the Python version on your machine.%USERPROFILE%\AppData\roaming\Python\Python37\scriptsCommentShareEXPERTRiku_Kobayashianswered 16 days ago"


Question: How to Allow Federated Users logged into an Organization Member Accounts to their account's Billings

"Problem: Federated users logging into organization member accounts with the AWSAdministratorAccess PermissionSet cannot view the billing dash board for the account they are logged into. Specifically we want developers to be able to access the billing for their own individual sandbox accounts.Environment:Multi-account Organization setup with ControlTower, and SSO and an external IdPAccount structure following the multi-account white paperControlTower only allows creation of resources in managed regionsOn the Sandbox OU, the only SCP applied are full access, denying leaving the organization, denying performing actions as the root user, and those created by ControlTower.Billing access for IAM is enabled in the management accountAll Organization features are enabled including consolidate billingNo problems accessing billing in the management account from a Federated users with the AWSAdministratorAccess PermissionSetThis is a new organization (less than 1 month old)The accounts were created with Account Factory for TerraformThere are no passwords on member account root users and we will not be adding themLinked account access is granted to cost explorer.When I test with Access Analyzer, I get that it was denied by SCP but I cannot see any SCPs that are denying.FollowComment"

Answer: 1Please review the Repost Knowledge Center article:https://repost.aws/knowledge-center/iam-billing-accessOther Document for reference.Access Management:http://docs.aws.amazon.com/IAM/latest/UserGuide/PermissionsAndPolicies.htmlBilling and Cost Management Permissions Reference:https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.htmlYou can also find information on how to enable IAM access to billing information here:http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/grantaccess.html#ControllingAccessWebsite-ActivateI believe you'll find this information usefulCommentShareAneesh_Vanswered a month ago


Question: ServiceNow Integration of Change Request with AWS

"Hello,I am aware of AWS Systems Manager templates ServiceNow has. But our team has a review and application process(terraform), hence we do not want to use this.The usecase I have here: Automate ServiceNow requests (Push from ServiceNow?) to insert request details into an AWS Datastore(Dynamo). We have a post process from here that takes care of rest. The request , could be for resources such as Accounts, config, VPC.I believe AWS Lambda makes sense for this effort, but I am also looking for a trigger from Service Now.Please also let me know if there are better alternativesThank You.FollowComment"


Question: My Production EC2 Instance randomly became unresponsive and is now stuck in stopping state.

"My EC2 Instance randomly became unresponsive and is now stuck in stopping state, I tried to restart it but that didn't work, so I tried to stop and now it has been stuck in stopping for 20 minutes.FollowComment"

Answer: "1You can check this article about troubleshooting an EC2 instanceAs this is production, the best path is to open a technical support case.To have more visibility about what is happening you can enable cloud watch log for the EC2 instance, so you have a log outside the instance that can help you diagnose, also monitoring metrics on Cloudwatch can help know if this a resource related issue.    These articles might help:Cloudwatch logs on EC2CloudWatchUnifiedAgentCommentShareromerogtanswered 9 months ago"


Question: Canary Deployments for Lambda using CodeDeploy with CodePipeline

"I can't seem to set up a pipeline that uses CodeDeploy for a lambda function. I have tried:Generating the appspec.yml file as part of a CodeBuild action. In this case CodePipeline zips the file, and CodeDeploy says it can't find the appspec file.Generating the appspec.yml file manually (Lambda invocation). In this case CodeDeploy gives the error "The deployment specifies that the revision is a null file, but the revision provided is a zip file." (It is definitely not a zip file)Has anyone succeeded in doing this?Note: I know SAM apparently does this. But it would be difficult to introduce new tooling at this pointFollowComment"

Answer: "0It's a known issue, there are bunch of questions like yours in Stackoverflow like https://stackoverflow.com/questions/62210071/aws-codedeploy-for-lambda-cant-read-appspecI remember also having issues with it, I decided to use S3 to store appspec.yml because CodeDeploy simply refused to accept appspec as text. Also I ended up starting deployments from CodeBuild, here are the deployment instructions:      - zip -q -x yarn.lock -x *.git* -r artifact.zip .      - aws lambda update-function-code --region=eu-west-1 --function-name test-pipeline --zip-file fileb://artifact.zip      - newVersion=$(aws lambda publish-version --region=eu-west-1 --function-name test-pipeline --query Version --output text)      - currentVersion=$(aws lambda get-alias --region=eu-west-1 --function-name test-pipeline --name production --query FunctionVersion --output text)      - sed -i "s/%currentVersion%/${currentVersion}/g" appspec.yaml      - sed -i "s/%targetVersion%/${newVersion}/g" appspec.yaml      - aws s3 cp appspec.yaml s3://alex-test-bucket/      - aws deploy create-deployment --region=eu-west-1 --application-name test-pipeline --deployment-group-name test-pipeline-group --s3-location bucket=alex-test-bucket,bundleType=yaml,key=appspec.yamlHere is appspec.ymlversion: 0.0Resources:  - myLambdaFunction:      Type: AWS::Lambda::Function      Properties:        Name: "test-pipeline"        Alias: "production"        CurrentVersion: "%currentVersion%"        TargetVersion: "%targetVersion%"Hope it helpsCommentSharealeksei-aleksandrovanswered a year agodavid a year agoThank you for your answer. Its a little ridiculous that the integration between CodeDeploy and CodePipeline is so broken. Deploying from codebuild may be what I end up doing. Or maybe i'll try to keep the deployment separate by doing it in a lambda function...Share"


Question: Developer Access

How do you give access to a developer to serverlessrepo and should it be admin level or something else?FollowComment

Answer: "0Accepted AnswerIAM best practice is to "Grant least privilege".When you create custom policies, grant only the permissions required to perform a task. Start with a minimum set of permissions and grant additional permissions as necessary.https://docs.aws.amazon.com/serverlessrepo/latest/devguide/security_iam_id-based-policy-examples.htmlSet the developer to allow only the necessary permissionsCommentShareEXPERTRiku_Kobayashianswered 2 months agorePost-User-4355051 2 months agoThank you this is what I was looking for.Share"


Question: TwinMaker: using lambda to fetch data for non-timeSeries properties

"Hello!I've been trying to use IoT RoboRunner + IoT TwinMaker + AWS Grafana to create a dashboard.As one of the most basic things to show is a list of the current workers/robots.Take the following componentTypes:(parent, to be inherited from, to keep the lambda function common)Ideally, the lambda function would be able to see the event, and the associated telemetryAssetId, and reply with an appropriate payload.{  "componentTypeId": "com.example.lambda_reader",  "workspaceId": "MyWorkspace",  "functions": {    "dataReader": {      "implementedBy": {        "lambda": {          "arn": "arn:aws:lambda:us-east-1:<account>:function:RoboRunnerWorkerInfo"        }      }    }  },  "propertyDefinitions": {    "telemetryAssetId": {      "dataType": {        "type": "STRING"      },      "isExternalId": true,      "isStoredExternally": false,      "isTimeSeries": false,      "isRequiredInEntity": true    }  }}and the child, which inherits from the above{    "componentTypeId": "com.example.myworkspace.worker_list",    "extendsFrom": [        "com.example.lambda_reader"    ],    "propertyDefinitions": {        "telemetryAssetId": {            "defaultValue" : { "stringValue": "WorkerList" }        },        "workerList": {            "dataType": {              "type": "LIST",              "netstedType": {                "type": "STRING"              }            },            "isTimeSeries": false,            "isStoredExternally": true        }    }}When adding these two componentTypes, the latter shows up as abstract unless isTimeSeries is set to true. Is this intended behavior? Seems like I should be able to do this?Any help is appreciated!FollowComment"

Answer: "1Hi, to explain little bit more into the detail, if a property is marked as IsStoredExternally means TwinMaker will only keep the property schema but not the value. So to access the property value you'll need to invoke the unified data access APIs with a defined connector.For time-series property, you can use GetPropertyValueHistory API to access the property value, you need to define dataReader connector and while querying the property value in runtime, TwinMaker will forward the request to your connector to resolve it.For non-time-series property, you can use GetPropertyValue API to access, and as you already found out, you need to define attributePropertyValueReaderByEntity connector for that.We'll continue polishing our documentation to make it clear. Let us know if you are interested in more details on the topic.Best,CommentShareHaoanswered a year agorobotHamster a year agoThank for your reply! And yes, I arrived at the same conclusion myself. it was just a lot of hours spent looking around until I stumbled on the right function key/name to use (as it wasn't anywhere in the documentation).I'm having a slightly different problem now with regards to components that have multiple values that are of the list datatype, and it has to do with the grafana integration.I've posted the question here: https://repost.aws/questions/QUmLmOo_qLSsWJnl9LMTUSpw/io-t-twin-maker-and-grafana-integration-where-component-has-multiple-list-propertiesShare0Accepted AnswerI was able to fetch non-timeseries properties by specifying a function under a different name than dataReader.So, instead of  "functions": {    "dataReader": {      "implementedBy": {        "lambda": {          "arn": "arn:aws:lambda:us-east-1:<account>:function:RoboRunnerWorkerInfo"        }      }    }for non-timeseries properties, it should be  "functions": {    "attributePropertyValueReaderByEntity": {      "implementedBy": {        "lambda": {          "arn": "arn:aws:lambda:us-east-1:<account>:function:RoboRunnerWorkerInfo"        }      }    }Which is absolutely nowhere in the documentation. I arrived at it by sifting through github and finding https://github.com/aws-samples/aws-iot-twinmaker-samples/blob/main/src/modules/s3/component-types/s3_component_type.jsonCommentSharerobotHamsteranswered a year ago-1Are you unblocked?CommentShareAWS-User-3173780answered a year agorobotHamster a year agoThat really should have been a comment, not an answerShare"


Question: AWS Parallelcluster: slurmdbd for multiple clusters

"I'm trying to enable slurm accounting for multiple clusters created with AWS ParallelCluster 3, following this guide. I successfully enabled accounting for the first cluster (cluster-one), and now I'm trying to setup the second one (cluster-two) using the recommended way under "Replicate the process on multiple clusters" in the above page, that is, to use a single slurmdbd instance.However, the connection to slurmdbd from cluster-two to cluster-one is not working.This is from the slurmdbd.log file on cluster-one:[2022-05-22T15:09:02.965] error: Munge decode failed: Invalid credential[2022-05-22T15:09:02.966] auth/munge: _print_cred: ENCODED: Thu Jan 01 00:00:00 1970[2022-05-22T15:09:02.966] auth/munge: _print_cred: DECODED: Thu Jan 01 00:00:00 1970[2022-05-22T15:09:02.966] error: slurm_unpack_received_msg: auth_g_verify: REQUEST_PERSIST_INIT has authentication error: Unspecified error[2022-05-22T15:09:02.966] error: slurm_unpack_received_msg: Protocol authentication error[2022-05-22T15:09:02.976] error: CONN:10 Failed to unpack SLURM_PERSIST_INIT messageThis is from slurmctld.log on cluster-two:[2022-05-09T21:39:36.773] error: slurmdbd: Invalid message version=6500, type:1432[2022-05-09T21:39:37.250] error: auth_g_pack: protocol_version 6500 not supported[2022-05-09T21:39:37.250] error: slurm_send_node_msg: auth_g_pack: REQUEST_PERSIST_INIT has  authentication error: No error[2022-05-09T21:39:37.250] error: slurm_persist_conn_open: failed to send persistent connection init message to ip-10-0-21-180:6819[2022-05-09T21:39:37.250] error: Sending PersistInit msg: Protocol authentication error[2022-05-09T21:39:37.250] error: DBD_SEND_MULT_JOB_START failure: Protocol authentication errorSo I suppose it is an authentication problem related to munge, but how do I solve this?FollowComment"

Answer: "0Accepted AnswerHi,to enable communication in a federation of Slurm clusters you have to use the same munge key.For each new cluster ParallelCluster is generating a random key to be used by Munge, so you need to use the same in the two clusters.You can take the key from the first cluster, it is the /etc/munge/munge.key file and then replicate it in the other cluster, with the right permissions.After copying the munge key you need to restart the daemons in the head node (both munged and slurmctld).CommentShareenrico-awsanswered a year agoAWS-User-2263701 a year agoWorks perfectly. May I suggest to edit that tutorial to add this bit of information?Share"


Question: Is it possible to restore mysql installed on EC2?

"I don't have mysql dump files and log files, but is there any way to recover the data?It's really important data, so I'd really like to know how to recover it.FollowComment"

Answer: "1It is possible to restore a MySQL database on an EC2 instance even if you do not have a backup or dump file, but the success of the recovery will depend on the specific circumstances of the data loss.Here are some steps you can take to attempt to recover your data:Check if the MySQL service is still running on your EC2 instance. If it is not running, try starting it.Try running the MySQL command-line tool and see if you can access any of the databases or tables. If you can access the databases and tables, you may be able to extract the data.If the above steps do not work, you can try using data recovery tools such as Foremost or TestDisk to attempt to recover the lost data.It is important to note that without a backup or dump file, the chances of a successful recovery may be lower. Additionally, any recovered data may not be in a usable state, or some data may be lost or corrupted. Therefore, it is always important to regularly back up your databases and test the backups to ensure they can be restored.CommentShareAWS_Guyanswered 3 months ago"


Question: Error while creating custom authorizer in AWS IoT

"I am using AWS CLI version:aws-cli/2.9.17 Python/3.9.11 Windows/10 exe/AMD64 prompt/offOpenssl version: OpenSSL 1.1.1s  1 Nov 2022.I am trying to send http post request to aws IoT using Postman.Create Authorizer in IoT core with the following command:aws iot create-authorizer --authorizer-name "my-new-authorizer" --token-key-name "tokenKeyName" --status ACTIVE --no-signing-disabled --authorizer-function-arn "arn:aws:lambda:Region:57EXAMPLE833:function:custom-auth-function" --token-signing-public-keys FirstKey="-----PUBLIC KEY----"I am getting the following error:aws: error: the following arguments are required: --authorizer-name, --authorizer-function-arnKindly helpFollowComment"

Answer: 0The error message is indicating that the required arguments "--authorizer-name" and "--authorizer-function-arn" are missing in your command. Ensure that you have specified these arguments and try again:aws iot create-authorizer--authorizer-name "my-new-authorizer"--token-key-name "tokenKeyName"--status ACTIVE--no-signing-disabled--authorizer-function-arn "arn:aws:lambda:Region:57EXAMPLE833:function:custom-auth-function"--token-signing-public-keys FirstKey="-----PUBLIC KEY----"CommentShareMuhammad Imrananswered 4 months ago


Question: 3d Ground truth labelling job issue in bbox

"Hi, I have created a 3d labelling job for 100 frames and got the job running. When I started annotating the objects with cuboid I am facing 2 issues,The size of the bounding box for respective object is changing (increased or decreased) as I move to the next frames and drawing the bounding box (with increased or decreased size to the earlier frames). I believe this could be because of autofill functionality. Please confirm me whether I have an option to off the autofill functionality.The bounding boxes are getting scattered or displaced each time I login and start working. If I annotate the objects for 10 frames, save it and logout for today, later when I login back the bounding boxes were scattered for couple of frames. Can you please let me know what could be done to reduce this issue.FollowComment"


Question: Event is empty in my lambda function when using Rest API

"So I have a lambda function that's the following:def lambda_handler(event, context):http = urllib3.PoolManager()return {"statusCode": 200,"headers": {"Content-Type": "application/json"},"body": "{"message": "Hello from Lambda!"}","test": event}If I test run the event with some event JSON, it returns what I want. But...when I test to run the lambda through my rest API I created I either get the error 502 when "Use Lambda Proxy integration" is enabled. Or when it's disabled event is always empty. I have tried to setup a link the following way:https://something.execute-api.eu-north-1.amazonaws.com/test/test/{id}Where you enter an {id} for example and I can catch it in the event. But how can I fix so event is an actual thing and actually getting any information?If you feel like im missing some information that might be important just ask, I don't know what could be useful.FollowComment"

Answer: "0If you're using a non-proxy Lambda integration, you need to craft your payload using a model in the method request in API Gateway. You can see an example of how this works here [1]. If you're using a Lambda proxy integration type and you're getting a 502 error, this would often be a result of your function response being malformed and therefore API Gateway is unable to parse it. The response for a Lambda proxy integration must conform to the format that API Gateway is expecting in order for it to be successfully parsed. You can see the required format here [2]. If you're still having issues I'd recommend setting up execution logs for your API so that you can get more information on the cause of the failure.Resources:[1] Tutorial: Build an API Gateway REST API with Lambda non-proxy integration - Create an API with Lambda non-proxy integration - https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-lambda-non-proxy-integration.html#getting-started-new-api[2] Set up Lambda proxy integrations in API Gateway - Output format of a Lambda function for proxy integration - https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html#api-gateway-simple-proxy-for-lambda-output-formatCommentShareKevin_Canswered 2 months ago"


Question: Access S3 using Role in python or command line tool

How to access s3 bucket using role in python or command line tool. I don't want to use Access Id and Secret Key combination in code.FollowComment

Answer: "0Hi, @Amit Joshido you want to use it on your local machine?Usually you need an access key and a secret.Alternatively, you can make Assume Role by linking the identity provider.https://aws.amazon.com/jp/premiumsupport/knowledge-center/aws-cli-call-store-saml-credentials/For example, if you want to run Python or his commands on his EC2, you can use an EC2 instance profile, in which case you don't need an access key.https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.htmlCommentShareEXPERTiwasaanswered 5 months ago0You don't need the Access Key Id and Secret Key in code, you can put them in environment variables or config files and they are used by both the CLI and boto3 in Python.  See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html for example.CommentShareEXPERTskinsmananswered 5 months ago0If you are using CLI, you can create a profile to use IAM role.Refers to documentation at :https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.htmlCommentShareronald_lanswered 5 months ago0Some of this has been previously stated.  You can use aws configure to put your access key and secret key in a file and python and aws cli will find it.  If you use a standard location, it will just find it.  You can update an environment variable to point to any location on your local computer if you'd like.  Here's some documentation on setting this up.  Hope this helps even though it's not about using a role.  https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.htmlCommentSharejschwar313answered 5 months ago"


Question: How to determine what asset a Monitron sensor belongs too

How do you determine what asset a Monitron sensor was attached too? Example: you return from the weekend and five sensors are sitting on your desk. How can you determine what asset each of those sensor belong too?FollowComment

Answer: "0This is the doc I received for this.Identifying location of Monitron sensors with unknown location procedureClick on the link for ROI in WorkDocs.  ROI Excel DocumentClick on the most recent week and download under “Actions”. Example - Data WK 16.xlsxIf unable to access WorkDocs reach out to Monitron PdM Specialist for a copy.  pdm-specialist@amazon.comScan the 2D bar code on the Monitron sensor with phone.  Example - DF:DF:19:D0:D0:2143Remove colons and last four numbers of scan.  Result example – DFDF19D0D0Open up downloaded excel document.Select the tab with “gdpr_repo” in it.Highlight Column B and in the Task Bar above click on “Sort & Filter”.  Select FilterOn column B click on down drop arrowIn the search window enter your site name and click enterHighlight column EOn keyboard enter Ctrl FA “Find and Replace “window will appearEnter Bar code scan modified without colons and last four numbers removed in search windowSelect “Find Next”The sensor EAM Asset number and location on the conveyor will be identifiedDetermine if sensor is damaged beyond use.If damaged follow procedure to replace with a new sensorOther wise clean sensor and write on sensor conveyor number and location.Install sensorCommentSharerePost-User-8200383answered 9 months ago0Another simpler approach to determining the asset associated with the sensor:scan QR code at bottom of sensorsubmit support ticket with AWS Account ID, Monitron Project Name/ID, and sensor QR codeCommentShareEXPERTBishr_Tanswered 7 months ago"


Question: How to create a log file with all SES email sending events

"We are using SES free version for sending out regular emails to our 130 volunteers and would like to create a log file (or table) with all email related events (sent, delivered, bounced), similar to what we had when sending with mailjet.com smtp relay.Is that possible, i.e. in Cloudwatch, within a free account or would we need a paid account for 1000 plus USD per month?FollowComment"

Answer: "1First, explore the options available to you in the documentation: https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity.htmlWhen configuring your SES configuration set with CloudWatch as the event destination you need to define the dimensions that you wish to capture as metrics (the documentation has a walk-through of how to do this). This can be more convenient as it allows you to be more intentional of the type of information you find valuable to capture and you don't need to worry about processing the raw data, but it does require more planning.Since it sounds like you just want the raw event details in CloudWatch Logs, a simple and cost-effective way to accomplish this is to create an SES configuration set event destination to an Amazon SNS topic, and then create a Lambda function with the SNS topic as the trigger. The function code only needs to print/log the event that is passed into the Lambda function. e.g. in Python it would be: print(event). You can have additional subscribers to the SNS topic, so for example you can receive emails of the events if you are still evaluating the ways in which you would like to process the data.You can also have multiple event destinations for each SES configuration set, so you can evaluate all of the options that are presented in the documentation to determine which best meets your objectives.Here are links to the pricing details. Depending on your volume and what you choose to configure, you may be able to stay within the free tiers as outlined for each service. Nevertheless, it's best practice to set up a billing alarm so that you are alerted whenever estimated costs begin to exceed your level of tolerance.https://aws.amazon.com/sns/pricing/https://aws.amazon.com/cloudwatch/pricing/https://aws.amazon.com/lambda/pricing/https://aws.amazon.com/ses/pricing/CommentShareJesse_Tanswered a year agoEXPERTalatechreviewed 2 months ago"


Question: Need expert help for a maybe a very simple question

"Hi! I am building for free a tool children to learn and play board games. For this board game there is an AI engine that works on command line. I installed this engine (including its books (=internal database with moves)) on an EC2 linux instance. I can run it and it works. Wow. Anyway, for a non-expert this is a win already.Anyway, I want to be able to somehow call this AI engine and send some simple (as per AI protocol) commands and wait for the info back. Basically what would happen when I run the executable on and type the commands. I presume this requires some kind of API that I then can call? I have no clue. I am just a simple man trying to do something good and if someone can help me he/she will be honored on the website forever! Please!I am available to supply all info!FollowCommentskinsman EXPERT3 months agoThe best option is if the AIengine has a published API.  Failing thatm can the command-line AI engine be called with commands passed as parameters or is it only interactive?  If the former then you can front-end the commands to make an API.  Otherwise you may need to write a screen scraper - see https://en.wikipedia.org/wiki/Data_scrapingShareMBVL 3 months agoI am not totally familiar with all you say. The AI engine can be started on a linux instance like e.g. './AI hub' the hub parameter then allows me to communicate with the engine by typing simple commands and then it spits out a lot of data and ends with a move. So I want to basically run this AI engine on AWS and then from a distance (from my App) send the commands there and get the info back.Share"


Question: Getting connections error when updating Power BI table from AWS source

"Hello,could you please advice what is the issue? Power BI is throwing the following error when refreshing data from AWS?ODBC: ERROR [08S01] [Simba][DriverIAMSupport] (8600) Connection Error: SAML assertion not found.I have installed the latest version of Power BI desktop, simba athena driver, gateway personal mode, ODBC test connection successful, but non of these actions helped.Thanks for your help.FollowComment"

Answer: "0Hello,I understand that you are getting error : "ODBC: ERROR [08S01] [Simba][DriverIAMSupport] (8600) Connection Error: SAML assertion not found" from PowerBI console.Seems this error could not be an issue either with the SAML or the ODBC driver itself - but i am not 100% sure at this stage with the available information. Generally we do get connection error with SAML assertion with miss-configurational setup or it is getting SAML messages it is not expecting.Further you can check these also:Kindly check if there is any incorrect DSN connection configuration parameters in ODBC Data Source Administrator.Sometimes the ODBC driver incorrectly parses the connection url and cut the url if there is an = sign. To make sure this is not the cause of the issue, can you  “escape the url using the mechanism described in the specification in [1]”. Kindly escape the equal signs by replacing =  with  {=} and check if you are able to establish the connection.You can follow this detailed steps to Access Athena from PowerBI.https://docs.aws.amazon.com/athena/latest/ug/connect-with-odbc-and-power-bi.htmlCommentShareSUPPORT ENGINEERShubhanswered 10 months ago"


Question: ec2 instance extension

"I have just received free tier limit email. 2 questionsdoes my app in the elastic beanstalk env. get aborted shut down when i exceed it or do i get carged automatically when  i exceed the usage-how do i extend the power/capacity, etc. of the existing ec2 instance on which my app is running.FollowComment"

Answer: "0Your environment will not be terminated, charges will start.See: Configuring Amazon EC2 instances for your environment.If you want to project your costs, use the Pricing Calculator.Its a good idea to create a Billing Alarm.Its a good idea to use MFA on your IAM user accounts and the root user account.CommentShareEXPERTkentradanswered 3 months ago"


Question: Blue/Green on Fargate Load Balancer swap Target Group after deploy

"Hi all,we are setting up a service to AWS Fargate, we want to use a Blue/Green deployment.We have an Application Load Balancer, and two Target Group, and also we have setup a CodePipeline.The code Pipeline connects to our bitbucket repository, and build the Docker image of our service with no problem. It then add two artifacts "taskdef.json" and "appspec.yaml" that we use to deploy the app.On the Load Balancer we have setup two Listener, on port 80 forwarded to TargetGroup1, on port 8081 forwarded to TargetGroup2.The Deployment Group has port 8081 as Test listener port.It all works on first time deploy, it test the new service on TargetGroup2, and deregister the service on TargetGroup1.After the deployment the new service is registered to TargetGroup2 and BOTH the listener 80, and 8081 are forwarded to TargetGroup2.THIS IS WHERE PROBLEMS CAMES IN.This means the next time we deploy the "Stage 2: Test traffic route setup" will "skip" cause the status of the listener on TargetGroup1 is "Target group is not configured to receive traffic from the load balancer". This will take the Deploy directly to the next stage, that change the Load Balancer listener on BOTH port forwarding to TargetGroup1, but our service is still "initializing" and not in a "Healty" status.I though after the deploy the testing port would be forwarded (swapped) back to the not blue group.I'm for sure missing something, can someone please show me where I make wrong things.Thank you!FollowComment"

Answer: 0Think I've solved using Lambda.The trick was to wait an healthy status during the deploy process.On my appspec.yaml I've declared a function to be called AfterAllowTestTrafficAfterAllowTestTraffic: "CodeDeployAATT-myappname-production"This function will wait for the healthy target on the green trunk.Find below the functions used.https://gist.github.com/sb-davidegironi/36ad718da81c7ae89618c55e3f941c8dCommentSharetl-itopsanswered 2 years ago


Question: Unsupported data formats in MSK

Is there a list of supported data types for MSK connectors? It doesn't seem to be anywhere mentioned in the docs. I am getting an error related to data format in kafka connector -1. Converting byte[] to Kafka Connect data failed due to serialization error of topic 2. Caused by: org.apache.kafka.common.errors.SerializationException: Unknown magic byte!which seems to be referring to wrong data format. I wonder if there are some data formats not supported by MSKFollowComment

Answer: "1It appears you are encountering an error with data serialization in your Kafka connector. The error message "Unknown magic byte!" typically indicates an issue with the deserializer configuration or a mismatch between the producer's serialization and the connector's deserialization.MSK connectors rely on the Apache Kafka Connect framework, which supports a variety of data types and serialization formats. The list of supported data types is not explicitly tied to MSK but rather depends on the serializers and deserializers used in your Kafka Connect configuration.To resolve this issue, please ensure the following:Verify that your Kafka producer and MSK connector configurations match in terms of serialization and deserialization. For example, if your producer is using the org.apache.kafka.common.serialization.ByteArraySerializer, your MSK connector should use the org.apache.kafka.common.serialization.ByteArrayDeserializer.Double-check the configurations in your Kafka Connect worker and connector properties files. Ensure that the key.converter and value.converter properties are set correctly. For instance:key.converter=org.apache.kafka.connect.converters.ByteArrayConvertervalue.converter=org.apache.kafka.connect.converters.ByteArrayConverterIf you are using a schema registry, ensure that the registry's URL is configured correctly in your Kafka Connect worker and connector properties files.By confirming these settings, you should be able to resolve the serialization issue in your Kafka connector. Remember that the list of supported data formats depends on the serializers and deserializers you use in your Kafka Connect configuration, and is not limited by MSK itself.CommentShareNeerajskydiveranswered 22 days agoEXPERTFabrizio@AWSreviewed 21 days ago"


Question: AWS EC2 F1 ERROR: [v++ 60-773]  caught Tcl error: ERROR: '2201011829' is an invalid argument.

"Hi,I have been trying to run hardware system image in AWS f1.2x large instance. I am successfully able to run sw_emu. However, when I try to create the hardware image, I keep getting the following error. This is strange because the same code was able to be synthesized 2 days ago.ERROR: [v++ 60-773] In '/home/centos/<cwd>/_x/runOnfpga/runOnfpga/vitis_hls.log', caught Tcl error: ERROR: '2201012237' is an invalid argument. Please specify an integer value.Note: The ERROR number is observed to change as I run the hw synthesis each time.And in the vitis_hls.log, the following info is being displayedINFO: [IP_Flow 19-1686] Generating 'Simulation' target for IP 'runOnfpga_sitodp_32ns_64_4_no_dsp_1_ip'...ERROR: '2201012237' is an invalid argument. Please specify an integer value.    while executing"rdi::set_property core_revision 2201012237 {component component_1}"    invoked from within"set_property core_revision $Revision $core"    (file "run_ippack.tcl" line 1515)INFO: [Common 17-206] Exiting Vivado at Sat Jan  1 22:37:40 2022...ERROR: [IMPL 213-28] Failed to generate IP.INFO: [HLS 200-111] Finished Command export_design CPU user time: 55.92 seconds. CPU system time: 2.62 seconds. Elapsed time: 55.3 seconds; current allocated memory: 1.956 GB.command 'ap_source' returned error code    while executing"source runOnfpga.tcl"    ("uplevel" body line 1)    invoked from within"uplevel \#0 [list source $arg] "Update: It seems like even the Xilinx examples are giving out the same problem when we run on F1 instance.I tried to clone the Vitis Accel Examples and it gave the same problem as above.INFO: [v++ 200-789] **** Estimated Fmax: 339.33 MHzERROR: [v++ 213-28] Failed to generate IP.ERROR: [v++ 60-300] Failed to build kernel(ip) vadd, see log for details: /home/centos/Vitis_Accel_Examples/sys_opt/multiple_devices/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/vadd/vadd/vitis_hls.logERROR: [v++ 60-773] In '/home/centos/Vitis_Accel_Examples/sys_opt/multiple_devices/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/vadd/vadd/vitis_hls.log', caught Tcl error: ERROR: '2201020036' is an invalid argument. Please specify an integer value.ERROR: [v++ 60-773] In '/home/centos/Vitis_Accel_Examples/sys_opt/multiple_devices/_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/vadd/vadd/vitis_hls.log', caught Tcl error: ERROR: [IMPL 213-28] Failed to generate IP.ERROR: [v++ 60-599] Kernel compilation failed to completeERROR: [v++ 60-592] Failed to finish compilationINFO: [v++ 60-1653] Closing dispatch client.make: *** [_x.hw.xilinx_aws-vu9p-f1_shell-v04261818_201920_2/vadd.xo] Error 1Please suggest ways to debug this problem.FollowComment"

Answer: "1Accepted AnswerHello,Xilinx is posting updates on their issue record here: https://support.xilinx.com/s/question/0D52E00006vDlvJSAS/export-ip-invalid-argument-revision-number-overflow-issue?language=en_USWe expect to get the patch updates and will release new FPGA Developer AMI's with the patches.-DeepCommentShareDeep_Panswered a year ago0Hello, we are working with Xilinx on this issue and we will update when we have a fix or a workaround for you.-DeepCommentShareDeep_Panswered a year ago0Hello,Xilinx has provided a patch for mitigating this issue: https://support.xilinx.com/s/article/76960?language=en_USWe are working on releasing updates to the FPGA Developer AMI using this patch, but you could apply it directly on your instance in the meanwhile to get unblocked.Let us know if you still face issues after applying the patch.Thanks,DeepCommentShareDeep_Panswered a year ago"


Question: Glue Job - how to read from jdbc redshift tables in parallel?

"In the aws documnethttps://docs.aws.amazon.com/glue/latest/dg/run-jdbc-parallel-read-job.htmlIn reading from jdbc tables in parallel it's properties are ignored at redshift.therfore,  how to read from jdbc redshift tables in parallel? Is there anyone who knows?FollowComment"

Answer: 0Using DynamicFrames will utilize COPY/UNLOAD behind the scenes which are executed in parallel.https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-redshift.htmlCommentShareDon_Danswered 8 months ago


Question: Amazon Managed Workflows for Apache Airflow (MWAA) VPC Requirements

"From the MWAA documentation there is a provided template for VPC creation that specifies a CIDR range of /16 and each subnet (public & private) with size of /24.Are there any specific reasons on the default value? If not, what is the minimum size allowed?Can we modify the CIDR range starts with 10.192.0.0 in this template?FollowComment"

Answer: "0Accepted AnswerMost of our quick guides, and templates will have a standard /16 range for VPC and a /24 range for Subnet.Minimum size for a VPC or Subnet is /28. You can play around with the public and private subnets up to /28.You can modify the CIDR range of 10.192.0.0 before you create the VPC.CommentShareShun_Subramaniananswered 2 years ago"


Question: DeepLens cannot fetch its ip address

"I have successfully registered DeepLens device to an aws account, and deployed a project to the device. I could confirm that the project is running as I could receive mqtt messages through iot console. However, the "Device details" section does not show the IP address of the device, and the "View video stream" button is also disabled. When I try to click on the button, it says that the device should be active, but the device status section says that the device is registered and online.FollowComment"


Question: Aurora Postgres - Logical Replication with different databases in same instance

We are trying to setup logical replication with aurora postgres using different databases on same instance but the instance just hangs. Is this currently supported or is there anything special we need to do for it to work? Thanks!FollowComment

Answer: "0It is possible that you have hit this  -When creating a replication slot (the default behavior), CREATE SUBSCRIPTION cannot be executed inside a transaction block.Creating a subscription that connects to the same database cluster (for example, to replicate between databases in the same cluster or to replicate within the same database) will only succeed if the replication slot is not created as part of the same command. Otherwise, the CREATE SUBSCRIPTION call will hang. To make this work, create the replication slot separately (using the function pg_create_logical_replication_slot with the plugin name pgoutput) and create the subscription using the parameter create_slot = false. This is an implementation restriction that might be lifted in a future release.[+] https://www.postgresql.org/docs/11/sql-createsubscription.htmlCommentShareD-Raoanswered a year ago"


Question: Does SES verify delivery to S3 before before calling next action?

"Hi,I have a rule that forwards incoming mail to 2 different S3 buckets using a rule which consists of an action for each S3 bucket, meaning that action 1 deposits the data in bucket 1 and action 2 of the rule deposits the email in bucket 2.Can I assume that SES will only continue to action 2 once action 1 has successfully been completed? Meaning, can I trigger a lambda function through the delivery in bucket 2 that assumes a successful delivery to bucket 1? Or should I use a waiter in the lambda function?FollowComment"

Answer: "0In case anybody finds this through Google, according to AWS Support, SES will wait for successful delivery.CommentShareBastianZimanswered 3 years ago"


Question: New to AWS Device Farm and have a few questions about test runs

"I have a few newbie questions about AWS Device Farm.Probably a really dumb question, but how do I delete a test run?On the list of test runs under the "Automated tests" tab, I can't seem to find an option to delete a run. Even on the results page, there doesn't seem to be an option to delete the run either. Is there a way to delete a specific run without having to delete the entire project or use a third-party tool?I noticed that when a run doesn't have a 100% pass rate, the results page shows which specific tests passed or failed. But when all tests pass, all the tests are grouped together into a single "Tests Suite." How to I expand the suite to show all test cases?The results page only shows the test specification log when all tests pass. But in test runs where there is a failure, the log doesn't appear. How do I enable the test specification log for all runs?Edited by: DannyChiaIntel on Sep 18, 2019 12:29 PMFollowComment"

Answer: "0Hello,1: In we do not offer the ability to delete a specific run in the console; however, this can be done using our CLIhttps://docs.aws.amazon.com/cli/latest/reference/devicefarm/delete-run.htmlI'm going to group 2 and 3 together.Tests are grouped together as "Tests Suite." when you run using Custom Environments, and the individual reporting when ran in Standard EnvironmentsWhen using the console, you can choose either Standard or Custom Environments in the Configure step after you select your test package.Some benefits of using Custom Environments includeBeing able to configure specifically how your tests run in the yaml fileBeing able to download dependancies in the yaml filegenerally faster test executionslive log and video streamingBut Custom Environments does not have individual test reporting yet.Hope this answers your questions, and let us know if there's anything else we can help you with.ScottCommentShareAWS-User-1182145answered 4 years ago0This answers my questions. Thank you so much!CommentShareDannyChiaIntelanswered 4 years ago"


Question: Athena Query timing out connecting to spill bucket

I just created my first lambda function using the AWS pre-written jdbc connector for PostgreSQL. It connects to my database but throws an exception when I run a query. I think it can't connect to my spill bucket but I don't know why. My DB is in us-west-2. Here is the error: GENERIC_USER_ERROR: Encountered an exception[com.amazonaws.SdkClientException] from your LambdaFunction[arn:aws:lambda:us-west-2:554283132974:function:lambdapostgresconnector] executed in context[retrieving meta-data] with message[Unable to execute HTTP request: Connect to s3.us-west-2.amazonaws.com:443 [s3.us-west-2.amazonaws.com/52.218.204.48] failed: connect timed out]FollowComment

Answer: "2Accepted AnswerIf your lambda is VPC enabled, can you create a VPC endpoint for S3 in your VPC - https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html and https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.htmlAlso check if the IAM role associated with the lambda function has the necessary permissions to access S3 - https://aws.amazon.com/premiumsupport/knowledge-center/lambda-execution-role-s3-bucket/Also if you are following any particular tutorial from AWS, can you please provide the URL?CommentShareEXPERTIndranil Banerjee AWSanswered 9 months agoEXPERTChris_Greviewed 9 months agorePost-User-6036580 9 months agoI will try to create your suggestions. thank you so much!!ShareIndranil Banerjee AWS EXPERT9 months agoIf your lambda function is failing when trying to execute an Athena query, then this document may also help you set the right permissions - https://docs.aws.amazon.com/athena/latest/ug/hive-metastore-iam-access-lambda.htmlIf nothing works, please do share some more details on what you are trying to do and where exactly the failure is occuringShareMTs306 9 months agoI had the same issue. I tried to create an S3 endpoint of the type interface and I couldn't make it work.Once I created an S3 endpoint of the type gateway it started working.Share0Root cause: VPC have no internet connection issue, causing Lambda can't access S3.Solution: Add VPC Gateway Endpoint (Select com.amazonaws.us-west-2.s3) in Lambda associated VPC.CommentSharerePost-User-2608598answered 6 months ago"


Question: joining email talk to text with AWS

How do I begin doing my email (Gmail) talk to text?FollowComment

Answer: "0Hi Dallas,AWS tools that you can look into for implementing text-to-speech for content within your Gmail emails are Amazon WorkMail, Amazon Lambda, and Amazon Polly.Amazon WorkMail is an email service that allows handling and receiving of mail from other applications (Gmail in this case) and you to work with them in the AWS workspace. This will allow other AWS services to interact with the contents of your email to implement text-to-speech via Amazon Lambda and Amazon Polly.Amazon Lambda functions allow you to create functions that trigger on certain events (such as receiving an email). For your purposes, you can have a Lambda function trigger upon a new email being received in Amazon WorkMail and use it to convert text to speech using Amazon Polly.Amazon Polly is a service that allows text to be transformed into lifelike speech and can be used to implement the text-to-speech requirements of your request.I've provided a link to the documentation on the services I described above so you have more information on them:Amazon WorkMail: https://docs.aws.amazon.com/workmailAmazon Lambda: https://docs.aws.amazon.com/lambdaAmazon Polly: https://docs.aws.amazon.com/pollyPlease let us know if this helps! Otherwise, please describe in more detail what you are looking to achieve in implementing text-to-speech in Gmail and AWS and we will do our best to assist you.CommentShareKevin_Zanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: Skill Builder signing onto Amazon Purchase account wants OTP

"Trying to do some training which sends me to skill builder which wants me to sign into the Amazon account. My research indicates I need to sign in with my personal email, which I use to purchase products from Amazon. When I do that it prompts for a OTP. I wait over 10 minutes to get this email and by then it appears to be no longer a valid code or something else. The response says a problem but doesn't give a why/what the problem is. Note my personal email is an alias (like: H****@K*.name).FollowComment"

Answer: 0Accepted AnswerI am sorry you are having issues logging into Skill Builder! Please use https://www.amazon.com/gp/help/customer/account-issues/ to reach the Amazon.com team that can help with your account issues. For phone support in U.S. and Canada: 1-800-388-5512 and 1-800-383-9484 For International phone support: (charges may apply) 1-206-577-1364.CommentShareKimWD-AWSanswered 10 months ago


Question: SMS never arrive from PHP API

"Hello, I tested the SNS service to send SMS to france (my country) using the php api, it worked perfectly until I reach the limit.Then I asked amazon to use the service in production, they switch my account from the sandbox to production, I've been able to send one sms and nor more.When I try now I get a statusCode of 200 with a message ID but the message never arrives.This is my code:$SnSclient = new SnsClient(['region' => 'eu-west-3','version' => 'latest','credentials' => ['key'    => '**********************','secret' => '*************************************',],]);$sms = "Simple test";$phone = "+33123456789";try{$result = $SnSclient->publish([ "MessageAttributes" => ['AWS.SNS.SMS.SMSType' => ['DataType' => 'String','StringValue' => 'Transactional']],'Message' => $sms,'PhoneNumber' => $phone ]);} catch (AwsException $e){print_r($e);} print_r($result);The return is like that:(    [data:Aws\Result:private] => Array        (            [MessageId] => 9d7489b2-3662-5b52-ad7c-d299afb0fcd4            [@metadata] => Array                (                    [statusCode] => 200                    [effectiveUri] => https://sns.eu-west-3.amazonaws.com                    [headers] => Array                        (                            [x-amzn-requestid] => 2de95f01-356e-5303-9b85-042aacbc0485                            [content-type] => text/xml                            [content-length] => 294                            [date] => Tue, 21 Jun 2022 10:04:01 GMT                        )                    [transferStats] => Array                        (                            [http] => Array                                (                                    [0] => Array                                        (                                        )                                )                        )                )        )    [monitoringEvents:Aws\Result:private] => Array        (        ))```What can I check ?ThanksFollowComment"


Question: "SCP permission denied for some files, not all??"

"I am trying to update a website. I have created the files locally and now I am trying to upload them using SCP and an ssh key. Most files went fine; however, some files (notably the Javascript and PDF files, got a permission denied). What's going on and how do I fix it?FollowComment"

Answer: "0Mysteriously, it works now. No changes on my part. I'm guessing there was an error somewhere.CommentShareAdhocInterestanswered 3 years ago"


Question: HBase on EMR - multi-AZ availability

"A customer is asking how to achieve best uptime with HBase on EMR.He is looking for a managed solution, however they are not happy with the fact that the master nodes are deployed in a single AZ (data can be S3 for example, so it will survive AZ outage).I checked the docs [1] and it seems that even with multiple master nodes, they are deployed into a single subnet, hence a single AZ.They are looking for a solution that will automatically failover to another AZ.Do we have any offering on that front?[1] https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-ha-launch.htmlFollowComment"

Answer: "0Accepted AnswerAmazon EMR launches all nodes for a given cluster in the same Amazon EC2 Availability Zone. Running a cluster in the same zone improves performance of the jobs flows because it provides a higher data access rate. By default, Amazon EMR chooses the Availability Zone with the most available resources in which to run your cluster. However, you can specify another Availability Zone if required.For Configure instance fleets :Select the VPC and one or more subnets where you would like to deploy your Amazon EMR Cluster.We recommend choosing more than one Availability Zone. Your cluster will still be deployed in a single Availability Zone, however selecting multiple Availability Zones allows Amazon EMR to look across all selected Availability Zones to deploy your cluster in the Availability Zone with the most EC2 Spot Capacity to run your cluster.'To answer your question on ‘uptime with HBase on EMR’:Apache HBase on Amazon S3 can be recommended if your application does not require support for high availability of writes and can tolerate failures during writes/updates. If you would like to mitigate the impact of Amazon EMR Master node failures (or Availability Zone failures that can cause the termination of the Apache HBase on Amazon S3 cluster or any temporary degradation of service due to an Apache HBase RegionServer operational/transient issues), we recommend that your pipeline architecture relies on a stream/messaging platform upstream to the Apache HBase on Amazon S3 cluster. We recommend that you always use the latest Amazon EMR release so you can benefit from all changes and features continuously added to Apache HBase.https://d1.awsstatic.com/whitepapers/Migrating_to_Apache_Hbase_on_Amazon_S3_on_Amazon_EMR.pdfCommentShareAWS-User-2512070answered 3 years ago"


Question: NS and SOA records in my host zone but can't find them when I use dig

"My domain is chopdev.co and I have created a public host zone.The NS records are:ns-1146.awsdns-15.org.ns-2019.awsdns-60.co.uk.ns-870.awsdns-44.net.ns-48.awsdns-06.com.The SOA record is (I changed to 1 second to see if it refresh faster):ns-1146.awsdns-15.org. awsdns-hostmaster.amazon.com. 1 1 1 1 1I tried both dig and nslookup and I am not see any of these records and all I see is SERVFAIL.Is there anything else I can do?Edited by: Blkc on Feb 5, 2019 1:37 PMFollowComment"

Answer: "0Hi,The name servers that Route 53 assigned to your hosted zone don't match the name servers for your domain. I'd guess that you deleted the hosted zone that Route 53 created when you registered the domain and later created a new hosted zone. When you create the new hosted zone, Route 53 assigned four new name servers to the hosted zone. However, Route 53 doesn't update the domain to use the four new name servers.Here's how you resolve the problem:Get the name servers for your hosted zone. See "Getting the Name Servers for a Public Hosted Zone" in the Route 53 Developer Guide:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/GetInfoAboutHostedZone.htmlUpdate the domain registration to use the name servers that you got in step 1. See "Adding or Changing Name Servers and Glue Records for a Domain":https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.htmlScottCommentShareEXPERTAWS-User-6179575answered 4 years ago0Thank you! Didn't know domain also has name servers.CommentShareBlkcanswered 4 years ago"


Question: Amazon Data Exchange (ADX) Automatic Revision publishing issue

"Hello, I have gotten the automatic revision publishing working, such that I can drop a file into the bucket and it will publish a revision to my product, however, I noticed during the last one that it published two revisions for a single file drop. I had the timeout value of the lambda set at 61 seconds.So, at one point it timed out -2022-12-02T00:30:55.929Z 5db788f3-7660-44b4-8ae0-e45b3d061bcb Task timed out after 61.06 secondsThen, looking at the cloudwatch logs, I can see that it seemingly resumed and finished successfully but I noticed that I have two revisions to my data product and I only dropped the file into the bucket once.I have since increased the timeout on the lambda to be 15 minutes, however, I may have larger revisions in the future that may exceed the new time I have set and I need to make sure that I do not get two revisions published if I drop a file only one time. Thank you.FollowCommentjchan 6 months agoAs you have observed, the time it takes to publish a new revision is a function of the size of the files included in the revision. Something you can explore is the publisher coordinator (https://github.com/awslabs/aws-data-exchange-publisher-coordinator), which creates a new revision when a new manifest file is created. With that manifest file, you control what files should be contained in the revision.Sharejchan 6 months agoAlternatively, you can explore AWS Data Exchange for Amazon S3, where you grant access to assets contained in your bucket (without having to publish new revisions); instead, you specify which bucket and, optionally, which keys/prefixes to share in the data set. You can find out more at https://aws.amazon.com/data-exchange/why-aws-data-exchange/s3/ and https://docs.aws.amazon.com/data-exchange/latest/userguide/publishing-products.html#publish-s3-data-access-productShare"


Question: IVS Broadcast SDK on Safari iOS web portrait is stretched

"If you try to use IVS broadcast SDK on iOS Safari Web while holding the phone in portrait, the preview video for the broadcaster is stretched oddly and cannot be fixed. Is there a work around or a fix?To see issue go here on iOS phone and set it to portrait:https://codepen.io/amazon-ivs/pen/poLRoPpFollowCommentrecursivecodes 3 months agoHey @Slushy - I'm looking into this. Will get back to you as soon as I can.ShareSlushy 3 months agoRotating the device seems to fix the stretch effect, unfortunately if they switch video input it comes back. How do I do this without telling the user to rotate their device back and forth?Share"

Answer: 0Can you clarify a few things in your setup?Is a Safari web browser being used for the source? What version of Safari?(Safari Web is mentioned yet directions indicate mobile IOS device)What Portrait mode is being selected Basic or Standard?On what player devices is the stretching occurring? IOS? Android?CommentShareMike-MEanswered 3 months agoSlushy 3 months agoiOS Safari is the source of the video as for the version of Safari its the version on iOS 16.3.1 (currently the newest version of iOS).I am using Standard Portrait.The issue is not on the player device but the broadcast device. If you go to the codepen I shared on an iOS device you will see that video preview is stretched for the broadcaster.ShareSlushy 3 months agoAdded more detailsSharerecursivecodes 3 months agoThanks for reporting this issue. We are looking into it and will update you as soon as possible.Share


Question: InsufficientDBInstanceCapacity Sydney Region

"Hi,I am trying to modify an existing MySQL RDS instance to a t3.micro MultiAZ. I have tried 10-15 times over the past few days and every time I receive the following error.Cannot modify the instance class because there are not enough availability zones that have the requested instance class. Please try your request again at a later time. (Service: AmazonRDS; Status Code: 400; Error Code: InsufficientDBInstanceCapacity; Request ID: db6beac6-8b91-460e-bddf-6e032387df46)Can someone please advise when further capacity will be added? If I purchase a reserved instance, will it then allow me to change the instance type?ThanksFollowComment"

Answer: "0Can I get someone from AWS to comment on this?I have purchased a new RDS RI for a multiaz t3.micro and I am unable to deploy it due to insufficient capacity. Why am I able to purchase an RI with specs that you are currently unable to provide?CommentShareQuinn Mayoanswered 4 years ago0The forum is for community discussion and AWS participation is intermittent at best. You may need to contact support for help. Even if you don't have Premium Support, by purchasing an RI that they can't seem to deliver you could submit an "Account and Billing Support" request.It is unlikely to be an actual capacity problem, and even more unlikely since you have an RI. The most common case for seeing this message on an instance type modification is when you try to modify an EC2 Classic instance to an instance family that is VPN Only. Then what the message means is "there is no EC2 Classic instance capacity for the instance type you requested". That said, I've seen one earlier forum post where someone moving from a T2 (VPN Only) to a T3 received the ICE message. In that case AWS confirmed there was plenty of capacity, so something else was going on. I don't know how this was resolved as the resolution was never posted to the forum.CommentShareHalTempanswered 4 years ago0Thank you for the reply, your post gave me a hint.It turns out that Sydney now has 3 availability zones and t3 rds capacity is only available in 2 of them. I did not have a db subnet in place for the third zone which was added after I set up the original RDS instance. The error message on modifying the instance was vague, but I received a much more detailed error message when I tried to deploy a brand new instance instead.CommentShareQuinn Mayoanswered 4 years ago0That's a really interesting resolution, thanks for posting it.CommentShareHalTempanswered 4 years ago"


Question: D-Wave device access error

"Dear All,After loading the required python libraries, i just used the below APIAwsDevice.get_devices(types=['SIMULATOR'])which is giving me errorAccessDeniedException: An error occurred (AccessDeniedException) when calling the SearchDevices operation: User: arn:aws:sts::007842834122:assumed-role/AmazonSageMaker-ExecutionRole-20210702T205988/SageMaker is not authorized to perform: braket:SearchDevices on resource: arn:aws:braket:us-west-2:007842834122:/devicesMy query is, which sagemaker role i should assign to my notebook. By default the sagemaker's "AmazonSageMaker-ExecutionRole-20210702T205988" role should have been sufficient.I did same thing in both east and us-west-2, but same access issue.Please help.Edited by: SmartNeeraj on Jul 30, 2021 3:18 AMFollowComment"

Answer: "0Hello, I believe the error is because the execution role used in your example is incorrect, It should be AmazonBraketServiceSageMakerNotebookRole (i.e., the role that is created for you in the create notebook dialog).CommentShareAjinkyaGawalianswered 2 years ago0Could anybody please help me here!!CommentShareSmartNeerajanswered 2 years ago0Hello SmartNeeraj, the notebooks require a specific IAM role to function: a role with a name that begins with AmazonBraketServiceSageMakerNotebook. The Braket Developer Guide contains details on how to get the role setup:  https://docs.aws.amazon.com/braket/latest/developerguide/braket-manage-access.html#notebooks-and-rolesCommentShareAWSBraketDevanswered 2 years ago0I just gave additional policy to my amazon notebook 'AmazonBraketFullAccess'. Although this is something additional, because the user role already has 'AmazonBraketFullAccess' policy assigned to user's IAM role.CommentShareSmartNeerajanswered 2 years ago0Unfortunately, the notebooks don't inherit permissions from the logged in user. They only have the permissions from the role they are launched with. So, your solution was correct. Roles for notebook execution need to have AmazonBraketFullAccess.CommentShareAWS-User-0947835answered 2 years ago"


Question: ChangeMessageVisibility - existing receipt handle reported as expired

"In my JMS listener connected to an SQS queue I call setVisibilityTimeout to extend the timeout and allow for a long-running to finish as suggested in https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-visibility-timeout.html#configuring-visibility-timeout.Unfortunately,  most of the time I get an error response (Reason: The receipt handle has expired). visibilityTimeout for the queue is set to 300s and extending the visibility is the first thing that is done after receiving a message so there is no way that the handle is already expired.What is more interesting, after receiving such an error response, JMS calls setVisibilityTimeout again on the same receipt handle to change the timeout to 0 and make the message available for other workers to process. This second call is successful. It looks like the seemingly expired message handle is working again after just few milliseconds.I turned on debug logs for com.amazonaws.request and it can be clearly seen below:DEBUG 2020-08-12T17:40:19,981 \[ConsumerPrefetchThread-1] \[] \[com.amazonaws.request] "Sending Request: POST https://sqs.eu-central-1.amazonaws.com //queue.fifo Parameters: ({"Action":\["ReceiveMessage"],"Version":\["2012-11-05"],"AttributeName.1":\["All"],"MessageAttributeName.1":\["All"],"MessageAttributeName.2":\["SQSLargePayloadSize"],"MaxNumberOfMessages":\["1"],"WaitTimeSeconds":\["20"],"ReceiveRequestAttemptId":\["0bbb2c42-94d5-4a0b-8aca-4f2dce9058f2"]}Headers: (User-Agent: aws-sdk-java/1.11.228 Linux/5.4.0-42-generic OpenJDK_64-Bit_Server_VM/11.0.8+10-LTS java/11.0.8 /SQS Java Messaging Client v1.0 AmazonSQSExtendedClient/1.11.228, amz-sdk-invocation-id: 7593448a-2867-a2e7-907b-d893015d58cf, ) "DEBUG 2020-08-12T17:40:23,708 \[asyncExecutor-1] \[e76d55a4-0664-43c1-9c0c-b1458df62b4f] \[com.amazonaws.request] "Sending Request: POST https://sqs.eu-central-1.amazonaws.com //queue.fifo Parameters: ({"Action":\["ChangeMessageVisibility"],"Version":\["2012-11-05"],"ReceiptHandle":\["AQEBGqvUSuWJKtF4l1k9G2cC46jhcQQsLZJlQNCxIU2m8c_Iqo5fii/0u8W4tnk58golmCN0OynwsOFCEWw3pjs_fHL8/81X81360H/2qQB8/SQqoe6qCfXbxD8/9ATRP32Go3DHpMy93nb9RQ2_1Wqe9nLoxV2iIZxLChlhLcIYs6Le2z6gSXcfQykoj9N17sAY0lQ6d7qzZ3S3mmsc5QFlSlxY4_KrQp93guMbIS51gbyNrj_F_N2e9nM4lf5LWrelE8BhL6WDwIBtSGNk_DN4eLI8shTX1L1T/1DDpErysBblDFtJQ8iQxWC5ayufedCD"],"VisibilityTimeout":\["600"]}Headers: (User-Agent: aws-sdk-java/1.11.228 Linux/5.4.0-42-generic OpenJDK_64-Bit_Server_VM/11.0.8_10-LTS java/11.0.8, amz-sdk-invocation-id: ca2d4cbb-f6b4-e896-d7b2-5d41d01a5eef, ) "EBUG 2020-08-12T17:40:23,764 \[asyncExecutor-1] \[e76d55a4-0664-43c1-9c0c-b1458df62b4f] \[com.amazonaws.request] "Received error response: com.amazonaws.services.sqs.model.AmazonSQSException: Value AQEBGqvUSuWJKtF4l1k9G2cC46jhcQQsLZJlQNCxIU2m8c_Iqo5fii/0u8W4tnk58golmCN0OynwsOFCEWw3pjs_fHL8/81X81360H/2qQB8/SQqoe6qCfXbxD8/9ATRP32Go3DHpMy93nb9RQ2_1Wqe9nLoxV2iIZxLChlhLcIYs6Le2z6gSXcfQykoj9N17sAY0lQ6d7qzZ3S3mmsc5QFlSlxY4_KrQp93guMbIS51gbyNrj_F_N2e9nM4lf5LWrelE8BhL6WDwIBtSGNk+DN4eLI8shTX1L1T/1DDpErysBblDFtJQ8iQxWC5ayufedCD for parameter ReceiptHandle is invalid. Reason: The receipt handle has expired. (Service: AmazonSQS; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 560fb9f9-f79c-5f44-a21f-ee57dc5b5832)"DEBUG 2020-08-12T17:40:23,766 \[asyncExecutor-1] \[] \[com.amazonaws.request] "Sending Request: POST https://sqs.eu-central-1.amazonaws.com /************/queue.fifo Parameters: ({"Action":\["ChangeMessageVisibilityBatch"],"Version":\["2012-11-05"],"ChangeMessageVisibilityBatchRequestEntry.1.Id":\["0"],"ChangeMessageVisibilityBatchRequestEntry.1.ReceiptHandle":\["AQEBGqvUSuWJKtF4l1k9G2cC46jhcQQsLZJlQNCxIU2m8c_Iqo5fii/0u8W4tnk58golmCN0OynwsOFCEWw3pjs_fHL8/81X81360H/2qQB8/SQqoe6qCfXbxD8/9ATRP32Go3DHpMy93nb9RQ2_1Wqe9nLoxV2iIZxLChlhLcIYs6Le2z6gSXcfQykoj9N17sAY0lQ6d7qzZ3S3mmsc5QFlSlxY4_KrQp93guMbIS51gbyNrj_F_N2e9nM4lf5LWrelE8BhL6WDwIBtSGNk_DN4eLI8shTX1L1T/1DDpErysBblDFtJQ8iQxWC5ayufedCD"],"ChangeMessageVisibilityBatchRequestEntry.1.VisibilityTimeout":\["0"]}Headers: (User-Agent: aws-sdk-java/1.11.228 Linux/5.4.0-42-generic OpenJDK_64-Bit_Server_VM/11.0.8_10-LTS java/11.0.8 /SQS Java Messaging Client v1.0, amz-sdk-invocation-id: 9ddb4853-99e1-bda6-218e-e6646ec23a61, ) "DEBUG 2020-08-12T17:40:23,788 \[StartThread] \[e76d55a4-0664-43c1-9c0c-b1458df62b4f] \[com.amazonaws.request] "Received successful response: 200, AWS Request ID: 532e3d49-5764-5176-b2fa-6ae77ca370e5"Did anyone encounter similar problems? For me it seems like the SQS API is quite unreliable even with a really small load (less than one message per second).FollowComment"

Answer: "0Attaching logs, because the file was truncated in the original post.CommentSharemaciejmuchaanswered 3 years ago0The problem was caused by the Amazon SQS Java Messaging Library prefetching. By default the library prefetches one message into internal buffer and if the processing of the first message takes longer than the visibilityTimeout it may expire before it reaches the listener.My conclusion about the second call was wrong - according to https://docs.aws.amazon.com/cli/latest/reference/sqs/change-message-visibility-batch.html this call always return 200, so it probably failed as well.Solution for me is to disable prefetching by using ProviderConfiguration().withNumberOfMessagesToPrefetch(0) to create the configuration.CommentSharemaciejmuchaanswered 3 years ago"


Question: When do you upgrade RDS machine size?

I am running a MySQL db.t2.micro for a production web application.According to CloudWatch:The CPU Utilization varies between 6% and 20 % over a week (mostly around 6%).The RDS Free Storage is more or less constant at 103GThe RDS Freeable Memory varies between 50M and 90M over a weekI can see that the storage for db.t2.micro is 100 GiB. Can I measure in CloudWatch how much of that I am taking up?When should I think about upgrading the machine size?FollowComment

Answer: "0Accepted AnswerHi, as you noted there is a CW Metric for Free Storage which tells you how much of your 100GiB isn't used.  You can tell RDS to automatically increase storage as needed or do it manually.  I'm not sure what you mean by "103G" though.Your CPU usage is fine but Freeable Memory looks low.  Whether it's too low or not and a size increase is needed depends on how confident you are about ongoing consistency of your workload.  If number of connections ramps up you could have troubles with the current size.CommentShareEXPERTskinsmananswered 2 months ago"


Question: Account Update Issues in AWS Control Tower & Service Catalog

"In the past as at earlier last month, when members of our team create a new AWS account in AWS Service Catalog using the "AWS Control Tower Account Factory" product, they were able to update the provisioned product in AWS Service Catalog with a new email address that they have updated in the Account Settings using the root account.Starting from sometime in December this function is no longer working. Each time they want to update the product in Control Tower, it taints. On troubleshooting, I found out that the updated account email address does not reflect in Control Tower.Any help?FollowComment"

Answer: "0Hi ThereYou have to login to the account as the root user to change the email address first before updating it in the Provisioned Product.  Please follow these steps for updating the account email address:https://docs.aws.amazon.com/controltower/latest/userguide/change-account-email.htmlCommentShareEXPERTMatt-Banswered 3 months agonattylab 2 months agoMatt-B, your recommendation was already done. This was working before it stopped working. We have vended many accounts prior to this stopping to work.Share"


Question: How can i be sure i'm using EC2-VPC and not EC2-Classic?

"I'm using an old account but i'm a beginner at AWS so i need some help to make sure im using VPC and not Classic so i don't lose my instances when they retire classic. I've read other topics that say that if an instance has VPC-ID defined it means that it's on a VPC, but i just want to make sure. I have 5 instances, 4 of them have VPC-ID: VPC name, but there's an old instance that's like this:VPC-ID: - Does this VPC-ID thing work for RDS too? Meaning if it's defined, it's in a VPC? But apart from that, is there any other way to make sure they're already in a VPC and won't be deleted?I created the instances and rds's last year(I tried using the script but it's too complicated to do with my current knowledge)Thank you for your help and patienceFollowComment"

Answer: "0AWS is already notifying the remaining EC2-Classic customers via their account teams, and will soon start to issue notices in the Personal Health Dashboard.All AWS accounts created after December 4, 2013 are already VPC-only, unless EC2-Classic was enabled as a result of a support request.Refer section, "Finding EC2-Classic Resources" in the below mentioned blog and you ll be able to find anything related to EC2-classic in the account. Use the same and migrate the EC2- classic to VPC.Hope this helps. If it did, please click on accepted answer.Link- https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 10 months agoEXPERTToni_Sreviewed 10 months ago"


Question: Enable X-Ray Daemon on Fargate for AWS Batch Jobs

"I would like to use X-Ray to view traces of my AWS Batch jobs that I'm running on Fargate resources.  The following blog post shows how to install the daemon on EC2 instances running a Batch job.https://aws.amazon.com/blogs/mt/configure-aws-x-ray-tracing-aws-batch-jobs/Running User Data scripts does not appear to be possible with Fargate.Is X-Ray tracing possible on AWS Batch Jobs that run on Fargate resources? If so, how?FollowComment"

Answer: "0In ECS, tracing need to run a daemon process as a side car with your application https://aws-otel.github.io/docs/getting-started/collectorCommentSharerePost-User-4482292answered 3 hours ago"