Welcome to AWS re:Post

We have an RDS cluster with 1 writer and 1 reader in the same region but different AZ's Auto minor version upgrades is enabled. Currently running 5.7.mysql_aurora.2.09.2 We received an email to say that a new patch version was available to go to 2.09.3 I thought this would be handled by the "auto minor version upgrade" and each instance would upgrade during the instance maintenance window ? However there is currently no pending maintenance for either instance ? Is there a delay between a patch release and automatically being updated ? That said we have been running 2.09.2 for a while and 2.10.0 and 2.10.1 have been released in the mean time. Should these not have counted as minor upgrades ?

So, I am trying to figure out the NodeJS Code for sending SMS to Indian mobile numbers using AWS SNS. I have gotten the code down to sending the SMS but I am not able to map the senderID or the templateID which I have gotten registered. The DLT Template ID has been registered with Airtel DLT Connect and even the entityID has been registered there. I am getting the SMS but with a random senderID, not the one I am assigning. The code snippet is below: ``` var AWS = require('aws-sdk'); var config = { AWS: { accessKeyId: "", secretAccessKey: "", region: "ap-south-1" } } AWS.config.update({ accessKeyId: config.AWS.accessKeyId, secretAccessKey: config.AWS.secretAccessKey, region: config.AWS.region }); var params = { Message: "Your verification code is 123345. This code is valid for 24 hours.", MessageStructure: 'string', PhoneNumber: '+91XXXXXXXXXX', MessageAttributes: { "AWS.SNS.SMS.SenderID": { DataType: 'String', StringValue: 'CustomSenderID' }, "AWS.SNS.SMS.SMSType": { DataType: 'String', StringValue: 'Transactional' }, "AWS.MM.SMS.EntityID": { DataType: 'String', StringValue: 'EntityID' }, "AWS.MM.SMS.TemplateId": { DataType: 'String', StringValue: 'TemplateID' } } }; var sns = new AWS.SNS(); sns.publish(params, function (err, data) { if (err) { console.log(err); } else { console.log(data); } }); ``` So, if I don't pass the EntityID and the templateID, I get the SMS but with a random numeric senderID. When I try to pass it in the example shown above, I get the below error: ``` ParameterValueInvalid: Message attribute names starting with 'AWS.' or 'Amazon.' are reserved for use by Amazon. at Request.extractError (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\protocol\query.js:50:29) at Request.callListeners (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\sequential_executor.js:106:20) at Request.emit (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\sequential_executor.js:78:10) at Request.emit (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\request.js:686:14) at Request.transition (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\request.js:22:10) at AcceptorStateMachine.runTo (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\state_machine.js:14:12) at D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\state_machine.js:26:10 at Request.<anonymous> (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\request.js:38:9) at Request.<anonymous> (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\request.js:688:12) at Request.callListeners (D:\WORK\Agri10x\Development\Projects\dataserver\node_modules\aws-sdk\lib\sequential_executor.js:116:18) { code: 'ParameterValueInvalid', time: 2022-01-06T09:33:30.590Z, requestId: 'dc92b0a1-e561-5ae4-a32d-eaf15ccb3fea', statusCode: 400, retryable: false, retryDelay: 57.53422286102854 } ``` Any help would be appreciated! Thanks in advance!

Hello, I'm trying to find a way to store AWS secret access key in secure "only read" hardware in order to be PCI DSS complaint, for now i tried to store this secret access key in yubikey NEO, but the yubikey supports only 38 characters of "known" password ( all of the types of yubikey ), and the AWS generated secret access key is 40 characters, i tried to find " a way around " : i tried to compress this secret key ( dosnt work because of key complexity ),was thinking of storing this secret access key in yubikey as *everyone* do with ssh but for that i need to convert this string to pgp format (and i dont know how;P) , i was thinking of dividing this key in 2 parts and store it in different slots of the yubikey, but this sounds as very bad practice implementation. So the questions are : **If someone has any other "work around" for this problem? Is it possible to generate 38 character access secret key?** P.S I use AWS CLI *mainly* , and no access to browser needed is appreciated, so the U2F ( as far as i have read ) is not an option.

I have a Launch Template with multiple volumes. I'd like to tag one of the volumes in a specific way so that I can make snapshots solely of this volume via DLM or AWS Backup, is there any way to do that ?

I have setup DMS to connect to MySQL database as the source and Kafka as target. I tested the source and target flow without TLS authentication works fine.Now I want to setup DMS with Kafka endpoint using TLS authentication. I tried out this [link](https://docs.aws.amazon.com/msk/latest/developerguide/msk-authentication.html) to check if I am able to connect using TLS authentication to Kafka cluster using the certificates generated, which worked. I used this with Glue as well and the connectivity works. Now for DMS, I followed the steps provided [here](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kafka.html) ( Section: Using SSL authentication ). But when I test the endpoint I get the error: `Test failed due to KMS key Exception : No permission to access Key 'arn:aws:kms:ap-southeast-2:xxxxxxxxxxxx:key/xxxxxxxxxxxxx'`. The KMS key here is the default key that DMS creates when we launch a replication instance. I tried using a CMK for DMS and created the endpoint using this KMS key. But it did not work. In this case, the endpoint errored out saying it could not connect to Kafka. Not really sure what the issue is. Has anyone come across this issue?

Created one ec2 instance for the spring boot web app & setup app load balancer & in target chose ec2 instance but every after 2-3 days load balancer target automatically deregister the targeted instance, tried to fix i.e changing the configurations. but still the issue. This is the app link: https://adjustment.jsdentallab.net/

Hello All, I am getting an error when using Amazon SES SMTP Host and credentials to send email from the AWS EC2 Instance: Reason : Could not convert socket to TLS Port: 587 Security Type: STARTTLS

Accessing any load balancer in us-east-1 from AirTel network in Inida results in packet loss. Sites are loading very slow. The problem does not persist if * I access same site from a different network (other than AirTel) * I access sites hosted in datacentre (other than us-east-1) ping <loadbalancer-dns> and ping <lb-ip-address> shows there is a 30% packet drop. Packet drop is seen not just with our VPC, but also other VPCs. Ping report for our Loadbalancer (suremdm.42gears.com) - https://mars.42gears.com/support/inout/aws/screenshot%202022-01-05%20at%207.25.37%20pm.png Ping report for docs.aws.amazon.com - https://mars.42gears.com/support/inout/aws/screenshot%202022-01-05%20at%207.59.22%20pm.png

I am in the process of upgrading the java version from Java 8 to latest Java LTS version (Java 17) and the architecture from x86_64 to ARM64 for some of my lambda functions. I am interested to know the timeline of the Amazon Corretto 17 support in Lambda.

I noticed that NodeJS is the only runtime option when creating an application. https://us-east-2.console.aws.amazon.com/lambda/home?region=us-east-2#/create/application/configure Is there a reason that NodeJS is the only option? I've heard that NodeJS is able to cold start faster than Java for lambdas. I also noticed the example Java lambda project defaults to 512MB MemorySize and NodeJS defaults to 128MB. Is Amazon trying to push us to NodeJS when building lambda applications because it's a better language for the environment? Is it possible to create a Java lambda resource within the template.yml of an application? Do I need to build the classfiles and upload them manually? The `java-test` folder in my project has this structure ``` java-test/src/main/java/example/Handler.java java-test/src/main/resources java-test/build.gradle ``` I've tried the following Resource configuration, but the example.Handler class cannot be found. ``` javaTest: Type: AWS::Serverless::Function Properties: CodeUri: java-test/ Handler: example.Handler Runtime: java11 Description: Java function MemorySize: 512 Timeout: 10 # Function's execution role Policies: - AWSLambdaBasicExecutionRole - AWSLambda_ReadOnlyAccess - AWSXrayWriteOnlyAccess - AWSLambdaVPCAccessExecutionRole Tracing: Active ``` I copied parts of the blank-java lambda project below. https://github.com/awsdocs/aws-lambda-developer-guide/tree/main/sample-apps/blank-java Here's the full build output ``` docker ps "C:\Program Files\Amazon\AWSSAMCLI\bin\sam.cmd" build javaTest --template C:\Users\bensi\IdeaProjects\team-up\template.yml --build-dir C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build --use-container Starting Build inside a container Building codeuri: C:\Users\bensi\IdeaProjects\team-up\java-test runtime: java11 metadata: {} architecture: x86_64 functions: ['javaTest'] Fetching public.ecr.aws/sam/build-java11:latest-x86_64 Docker container image...... Mounting C:\Users\bensi\IdeaProjects\team-up\java-test as /tmp/samcli/source:ro,delegated inside runtime container Build Succeeded Built Artifacts : .aws-sam\build Built Template : .aws-sam\build\template.yaml Commands you can use next ========================= [*] Invoke Function: sam local invoke [*] Test Function in the Cloud: sam sync --stack-name {stack-name} --watch [*] Deploy: sam deploy --guided Running JavaGradleWorkflow:GradleBuild Running JavaGradleWorkflow:CopyArtifacts "C:\Program Files\Amazon\AWSSAMCLI\bin\sam.cmd" local invoke javaTest --template C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build\template.yaml --event "C:\Users\bensi\AppData\Local\Temp\[Local] javaTest-event5.json" Invoking example.Handler (java11) Skip pulling image and use local one: public.ecr.aws/sam/emulation-java11:rapid-1.36.0-x86_64. Mounting C:\Users\bensi\IdeaProjects\team-up\.aws-sam\build\javaTest as /var/task:ro,delegated inside runtime container START RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303e Version: $LATEST {"errorMessage":"Class not found: example.Handler","errorType":"java.lang.ClassNotFoundException"}Class not found: example.Handler: java.lang.ClassNotFoundException java.lang.ClassNotFoundException: example.Handler. Current classpath: file:/var/task/:file:/var/task/lib/aws-lambda-java-core-1.2.1.jar:file:/var/task/lib/gson-2.8.6.jar END RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303e REPORT RequestId: 3e9debb6-a640-4ba2-bd6e-5f2d818d303e Init Duration: 0.07 ms Duration: 271.19 ms Billed Duration: 272 ms Memory Size: 512 MB Max Memory Used: 512 MB ```

I have followed the instructions of creating a private subnet and a public subnet. I have added route to internet gateway for public subnet and NAT gateway to private subnet. When attaching VPC configuration to the lambda function, I have set these two subnets. Sometimes I am able to access boto3 code inside the lambda function, but sometimes it timesout as if internet is not available. Please help me.

I'm trying to work with cloudwatch log data in opensearch. While building some dashboards, I'm querying by "@log_stream". My log streams vary slightly, like "productName_filterlog" and "productName_messagelog". However, my query for one "@log_stream" yields results with many different log streams mixed in. I'm doing a term search with explain enabled in hopes of getting some reasoning for this: ### Request ``` POST myindex/_search?explain=true { "query":{ "term": { "@log_stream": "productName_filterlog" } } } ``` ### Response ``` ... "hits": [ { ..., "_explanation" : { "value" : 1.0, "description" : "*:*", "details" : [ ] } } ] ``` **My question** : what does this _explanation object mean? Why is it so useless? Is there a better way to determine why some unwanted results are showing up? I'm assuming the reason is due to some analyzer shenanigans, but how would one determine this? thanks!

I am trying to make a custom authentication flow using AWS Cognito so that i can send MFA codes via email instead through the cognito triggers. I am using the initiateAuth() method to do this which is correct according to the documentation; https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityServiceProvider.html#initiateAuth-property My payload seems to be valid but when i try login with a user i get the error 't.getauthparameters is not a function' I've had a look through some other stackoverflow posts but nothing is helping Any ideas what is going wrong? This is a snippet from my code below: ``` const payload = { AuthFlow: 'CUSTOM_AUTH', ClientId: 'my client id', AuthParameters: { USERNAME: $('input[name=username]').val(), PASSWORD: $('input[name=password]').val(), CHALLENGE_NAME: 'SRP_A' } }; cognitoUser.initiateAuth(payload, { onSuccess: function(result) { // User authentication was successful }, onFailure: function(err) { // User authentication was not successful }, customChallenge: function(challengeParameters) { // User authentication depends on challenge response var verificationCode = prompt('Please input OTP code' ,''); cognitoUser.sendCustomChallengeAnswer(verificationCode, this); }, }); ```

I use aws s3 --no-sign-request --region us-west-2 ls s3://aws-cloudtrail-logs-01-*******, An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied. but aws s3 ls working. why?

Hi, I am using Quicksight to embed a dashboard into a SFDC ISV application. Running into issues because each new SFDC customer that uses my application needs to be whitelisted in Quicksight. Is there a way around this? An example of a URL is ***"https://MYCOMPANY--four-cast.naXX.visual.force.com"*** where ***MYCOMPANY ***is a unique organization name and "***XX***" is a number of one of the ~100 North American instances SFDC uses.

There is an EC2 instance attempting to get a secret from SecretsManager but errors with the following: ``` Error getting database credentials from Secrets Manager AccessDeniedException: User: arn:aws:sts::{AccountNumber}:assumed-role/aws-elasticbeanstalk-ec2-role/i-{instanceID} is not authorized to perform: secretsmanager:GetSecretValue on resource: rds/staging/secretName because no identity-based policy allows the secretsmanager:GetSecretValue action ``` I have tried adding the following policy to the general aws-elasticbeanstalk-ec2-role to allow for access but it is still not able to get the secrets: GetSecretsPolicy: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:{AccountNumber}:secret:rds/production/secretName" }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "secretsmanager:GetRandomPassword", "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds" ], "Resource": "arn:aws:secretsmanager:*:{AccountNumber}:secret:rds/staging/secretName" } ] } ``` I continue to get the error and am wondering if there is something I can tweak to make it able to have proper access to the secret values

Recently our running EC2 instance (t2.micro) failed and we weren't able to login anymore. Even though in the EC2 console it had Online Ping Status. So we had to Stop it and Start it again, which changed the IP address of the site, and caused some issues in our IoT online platform :( To understand what happened, I checked for that EC2 instance reports with different metrics, and I see in the exact moment when it stopped working, the CPU usage increased suddenly to 100% and Network In Data also increased in a very unusual way. This is a very high peak druing a minute, in a whole year and several months that it had been working with no single issue. Also the FailChecksum graph was high from that moment until we Stopped and Started the EC2 instance again. Graphs here: https://ibb.co/qsgPXXs https://ibb.co/YhpQHmQ https://ibb.co/MSYmN8g Do you have any idea of what could cause this anomaly? And which would be the way to find out exactly? Is is this a common issue? Thank you in advance for any help.

I have confirmed the metadata loaded for the integration specifies ``` <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> ``` However, the generated AuthnRequest from cognito is not signed.