Questions tagged with AWS Management Console

hello. I'd like to get a secret key and access key ID as a cognito license. ``` cognitoUser.authenticateUser(authenticationDetails, { onSuccess: function (result) { const idToken = result.getIdToken().getJwtToken(); AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: 'ap-northeast-2:7fc9xxxx-xxxx-xxxx-xxxxx-xxxxx', Logins: { 'cognito-idp.ap-northeast-2.amazonaws.com/userPoolid': idToken, }, }) } ``` On the Cognito aws Identity Pool page, it is confirmed that the identity browser has become a credential. However, in getCredentials, "Could not load credentials from CognitoIdentityCredentials" is generated. ``` AWS.config.getCredentials(function (err) { if (err) return console.error(err.stack); else console.log('Access key:', AWS.config.credentials.accessKeyId); }) ``` If you look at the AWS.config.credentials console log, there are no values other than the parameters you put in. Problem not found. Is it right to get the secret key issued through Cognito Identity Credentials?

I am selling my site and need to transfer the AWS account to the buyer's business (the buyers do not use AWS for their other sites - but they want my site to continue with AWS). I cannot figure out how to do it. Do I need to pay for support and what level? This is Amazon's advice on transfering ownership of a site: https://aws.amazon.com/premiumsupport/knowledge-center/transfer-aws-account/ "To assign ownership of an AWS account and its resources to another party or business, contact AWS Support for help: Sign in to the AWS Management Console as the root user. Open the AWS Support Center. Choose Create case. Enter the details of your case: Choose Account and billing support. For Type, choose Account. For Category, choose Ownership Transfer. For all other fields, enter the details for your case. For Preferred contact language, choose your preferred language. For Contact methods, choose your preferred contact method. Choose Submit. AWS Support will contact you with next steps and help you transfer your account ownership." I have done all this but have not yet been contacted (24 hours). The text seems to suggest that advice on transfering ownership is a necessary aspect of transfering an AWS root account to a company, and that such advice is provided free by Amazon, since nothing is said about pricing. If on the other hand AWS clients must pay for a support package to transfer ownership, which package? The $29 Developer package or the $100 Business package or some other package? How quickly does Amazon AWS respond? How quick is the transfer process? I am finding this very frustrating.

Access an identity in cognito identity browser always redirect to cognito homepage. My account have AWSCognitoPowerUser role. Steps to reproduce: 1. go to Cognito service https://console.aws.amazon.com/cognito/home 2. select "Manage Identity Pools" 3. select an identity pool 4. select "identity browser" in the left side 5. select an identity id in the right side 6. EXPECTED: show records in this identity. ACTUAL: being redirected to Cognito service homepage (step 1) tested in multi web browsers and multi AWS account, this issue happens for months

Hi, My first question - https://repost.aws/questions/QUS8M4w0jkS8iV6EzPmaRmag/ssh-key-managment-for-multiple-accounts Im trying to use "AWS system manager" - "session manager". As i was advised in my previous question, to be able to login into the EC2 instances located in multiple accounts, i will need to do something similar to https://aws.amazon.com/blogs/mt/vr-beneficios-session-manager/ But the problem is that i need to have for each IAM user their own user in EC2 instance, as i found out, i need to pass tag "SSMSessionRunAs" with the value of the username to witch im login in. But if i will use "group" roles (roles assigned for multiple users), they will be authenticating with the same user in EC2 instance, which will not work for me. Does that mean, that in my case i will need to create a role for each IAM user? or i can change tag of the role depending on the user assuming this role? Thank you very much. Joann

Hi Gurus, I am working on setting up VMC on AWS. Can anybody please advise with Bill of materials(minimum required template) for setting up VMC on AWS? Thanks Jo

This started happening around the beginning of the week, and there were no changes made to our services that could of causes this. Basically the entire "Monitoring" tab of a database details page is unresponsive. Charts don't load at all, and the buttons are unresponsive. Also when trying to modify an instance we get an infinite loading screen. This does not happen on other accounts, only this specific account that I manage. Has anyone ever run into this issue? AWS Health and Service Status doesn't list any potential outages or anything similar.

This is connector is in an Inoperable state. When attempting to delete it, I get the following error: Cannot delete the directory because it still has authorized applications. Any attempt to remove the AWS Console application fails. I see that others have had similar issues and it requires technical support to resolve. Is that still the case? Thanks, John

I don't have an account to fill out a tech support ticket, but this isn't tech support. It feels like a bug: ``` Access to XMLHttpRequest at 'https://us-east-1.console.aws.amazon.com/s3/proxy' from origin 'https://s3.console.aws.amazon.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. ``` A lot of these errors for all of my buckets. On the main list of buckets I am getting all 400 responses from the `Access` column for all buckets. It shows '**Unknown Error**': ``` Request URL: https://us-east-1.console.aws.amazon.com/s3/s3control-proxy Request Method: POST Status Code: 400 Referrer Policy: no-referrer-when-downgrade ```

Hi, i'm free tier user and been charged of $8.40 for running a Linux t3a.small in the Northern California region which is not cover under the Free Tier promotion. Obviously i have done that by mistake. However for the time being i have stoped that instance to avoid charges, as a result the website is also not responding usually. Please suggest me what i need to do now to run my website and also how to avoid the unnecessary charges in the future?

This happen at aws console. Any clues? Thanks in advance. There was a problem connecting to your instance Log in failed. If this instance has just started up, wait a few minutes and try again. Otherwise, ensure the instance is running on an AMI that supports EC2 Instance Connect.

hi, i am following the aws amplify tutorial ( https://docs.amplify.aws/start/getting-started/installation/q/integration/angular/ ) and i want to create my first iam user via console ( https://us-east-1.console.aws.amazon.com/iamv2/home#/users ) but i get an "Unknown error" every time i press the "Add users" button (see screenshot https://imgur.com/a/SX3KrGw ). trying to open "Account settings" ( https://us-east-1.console.aws.amazon.com/iam/home#/account_settings ) leads to the same problem. i am logged in with the root user and don't know what to do. Can you help me or point me in the right direction to solve the issue? Thanks and greetings!

Hello, My server screenshot shows that the server is in lock screen even when the server is not in lock screen. I log into my server with RDP. I use the monitor to do task. I use the screen so it is not in lock screen. I do server screenshot from aws console online and it shows my server is in lock screen. So the aws console server screenshot does not capture what is happening, only shows lock screen. Can someone please help how to get the server screenshot to actually show what is happenign?

When changing the default message and adding new lines from console, all the text appears in a single line. Tried adding /n and <br> tags with no luck. Building a Lambda trigger seems overkill. Any options?

My website is not responding since last 10 days, it's showing Error 522 connection timed out. I have already done all the basic steps which are required to prevent this errors such as clear cookies, used different browsers etc but still it's didn't work. Please help me to fix this issue. Website: machcart.com

First of all, apologies if this does not fit the realm of the questions we ought to ask or if I should've searched a bit more. I am getting an error when listing my Email Templates in AWS SES. Not only in the AWS dashboard but, as I'm running a periodic task querying the API for that list, it gets the same error. Is this something that could be happening to everyone thus being an issue AWS ought to sort out or is this something that might actually be related to my account only and should be taken directly to support? The error message comes in a red flag at the top of the screen saying: "x The input you provided is invalid Invalid PageToken <the token>" Thanks in advance.

Hi, Im trying to achieve the "role chaining" as in the https://aws.plainenglish.io/aws-iam-role-chaining-df41b1101068 i have an user `admin-user-01` with policy assigned: ``` { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::<accountid>:role/admin_group_role" } } ``` I have a role, which is meant for `admin-user-01`, with `role_name = admin_group_role` and trust policy = ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<accountid>:user/admin-user-01" }, "Action": "sts:AssumeRole" } ] } ``` And it also has a policy: ``` { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::<accountid>:role/test-role" } } ``` Then, i have another role, which is assigned for the role above (`admin_group_role`), with `role_name = test-role` and trust policy = ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<accountid>:role/admin_group_role" }, "Action": "sts:AssumeRole" } ] } ``` But when i login as `admin-user-01` into account, then switch to the role `admin_group_role` and then try to switch to role `test-role` i get : `Invalid information in one or more fields. Check your information or contact your administrator.` P.S everywhere <accountid> is the same, all of the roles,users,permissions are created in the same account ( what, i suppose might be the reason why i face the error ) What am i doing wrongly?

Is it possible to give access only to a certain image, stack, or fleet with IAM policies? Do you have any examples? I tried with a policy but it returns this error: > User: arn:aws:iam::xxxxxxxxx:user/xxxxxxxx is not authorized to perform: appstream:DescribeFleets on resource: arn:aws:appstream:eu-central-1:xxxxxxxxxxx:fleet/* because no boundary policy allows the appstream:DescribeFleets action > My need is: in an AWS account, an IAM user must only see some image/fleet/stack. thanks

Does Amazon provide marketplace seller registration to Indian companies with Indian address? If yes , then please suggest as we did not find any guide for same.

Can we access and use multiple roles from a single user simultaneously(using STS assumeRole api right now)? My use case requires creation of different roles which have their specific policies assigned, and I need a different way other than creating one user per role sort of like a multiple account access. Instead of creating 1 user per role, is there any way that a single user can access/assume resources of multiple roles/accounts simultaneously?

I have enabled Customer Profile in my Aws Connect instance. When I have enabled Customer Profiles it provides default fields in Customer Profiles to store our customer's data. **Problem** I just want to know how I can customize these default fields and want to transform it into my desired/required fields. Please tell me how I can achieve this.

I would like to use an AWS service. I have several thousand phone numbers. This application must be able to send WEB REST API calls to a service (AWS) to send SMS. I had thought of SNS. Is this the right service for sending SMS to non verified destination phone numbers? Thank you

Hello, I (account #A) have given access to an external account (account #B) in an S3 bucket with the canonical ID. However, and when I try to download a file to an EC2 bucket, it's still producing the error: ``` fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden ``` I'm trying to follow the instructions at https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/. I think that points 2 and 3 have been taken care of (although I used the console). The issue is that for point 1, I'm starting from https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html and the JSON policy reads: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "statement1", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::***********:user/********" }, "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::cmaq-database/*" } ] } ``` However, the console is not accepting it claiming: '*This policy contains the following error: Has prohibited field Principal*." Thanks.

As a root user, I created an environment in Cloud9, then created IAMS users and gave them RW access to the environment, which I can see has worked when I click the Share button on the upper left corner of the environment, but when they log in and go to Cloud9 they can see the card for the environment but 'Open IDE' is grayed out and they can't access it. Sigh.

Can multiple developers use our same AWS Account. If so, what is the difference between Root access and Console Access? Where should I set the new developer up? He will need to create containers, configure servers and clients in macOS.

I found likely bugs in AWS console when using EBS snapshot feature. How do I report a defect or bug in AWS? Following is the issue. I am allowed to choose even a "Terminated" EC2 instance while attempting to create a snapshot. Further it incorrectly shows an EBS volume belonging to another EC2 instance which is running(not terminated) for the terminated EC2 chosen for snapshot generation. First of all it is a bug to allow a terminated instance to choose from a list of EC2 instance to create an EBS snapshot and then showing an EBS volume of other EC2 instance is second bug.

Hello, I create one Cloudformatin resource where I am creating custom resources by following:- ``` AWS::CloudFormation::CustomResource ``` Now I made a few manual changes in created resource and when I am checking the drift of CloudFormation template, It is showing InSync, So how can I check the drift of custom resources?

I need to produce a report showing which AWS Console users have been added, modified or removed during the past year. Is this possible? The report was requested by an auditor.

In my organization AWSAccount1 has created instances on EC2 that work smoothly. AWSAccount1 is an existing account that I have invited into my organization. The problem is that when I log in as root I don't see the instances and I don't see anything AWSAccount1 created in my AWS account. It is not a regional problem. I have selected the right one. I can't understand why this happens. Can someone help me? Thank you!

We have noticed that in some cases some users are getting the same sms repeatedly. We can see from our logs that the request was made to PINPOINT just once and even the callback we received is a single one. Are these kinds of cases common? What are the possible scenarios?

Hi - I exported the Draft ChatBot from the Amazon V2 Console and carefully created new intents (hundreds) with the corresponding folders and Intent.json. When I returned back to the Console and imported the chatbot (zipped) with the new intents, the Import will fail with little or no specific details. I verified that the new intents match up with the intent.json that I downloaded. I am a newbie, but need some assistance and I could not find much info on this topic online. The updated json with new intents matches the online examples and the json that I downloaded from V2 Console. Thanks for your assistance.

Looking to know what the process/scope of an AWS support agent is in responding to support requests. If I delegate access to a user so they can utilise AWS support services, am I creating a pathway for that user to make changes to the AWS account via a support request that is beyond that user's authority?

Is there a way in which I can Export the Inbound Rules for a network ACL?? Currently everytime a new server is created on AWS, and we setup the rules we have to manually key in the inbound rules each time? sometimes they have up to 18 entries on them. Is there a way so export and import these on the console???

Any method/code/tool can help to find out [1] What are the resources are provisioned with AWS CloudFormation templates (IaC/Automated way) [2] What are the resources are created/provisioned manually through AWS Management Console (UI) ? And [3] Any changes made to those resources after successfully provisioned (either through UI or services) ?

Hi AWS Community: We run our tenant with multiple VPC's along with account/role based on permissions granted. While this does a good job segmenting it presents a "front-end" issue: our tenant lacks a top-down view of all service configuration/reporting. Example - we use Inspector to scan all 100 EC2's. The problem is I cannot get a single report or even view into ALL results... they are broken out based on what the logged in acct/role can see. That produces what is at best a fragmented view - incredibly inefficient & prone to blind spots. This issue persists across all services. How does one solution this - either within AWS (preferable) or if not does anyone have suggestions for 3rd-party vendors who can help reconcile this?

Is anyone else experiencing this? The specific region is Stockholm. As soon as I pick it in the region selector in the console, I get logged out and sent to the login screen. Ideas?

I have been using AWS to host Debian 10 to connect my 3CX accounts for our phone systems. All working fine. All of a sudden, when i go to create a new service on AWS and then connect to it from 3CX via the installer, I get the following message An unknown error occured: User: arn:aws:iam::090946289178:user/ICT is not authorized to perform: servicequotas:GetServiceQuota on resource: arn:aws:servicequotas:ap-southeast-2:090946289178:ec2/L-34B43A08 because no identity-based policy allows the servicequotas:GetServiceQuota action I have tried everything I can think of. Delete the AWS service and install again Create user in IAM Create key pairs add debian subscription. I am following the same path as when I setup the existing system which works fine. I have also tried connecting with my other subscriptions to AWS and get the same message I also created a new AWS account and added a new subscription, IAM and Key pair there and got the same message. 3CX support has no idea what it is. Can anyone shed some light here? David

The help page in the console describes it as > The IP address range from which cluster services will receive IP addresses. So what are "cluster services"? Is that the control plane or something else?

Our SES service was working perfectly with Sendy mailing until an incident recently where the service was suspended because of bounced emails. We made corrections within our process and AWS reinstated our account. However now nothing is sending out of Sendy. Is there something needs to be reset at AWS SES?

On 26th Feb, I received a mail from AWS ragrding Irreular activity so I immediately followed the steps mentioned in that email, I deleted the access key, changed my password. I couldn't see any new user,roles and ploicies in IAM at that time but now I can see 30 roles and policies applied. I have deleted the roles and policies and other amazon resources whic were producing the bill. I made this account only for educational purpose, I cant afford to pay such an amount $(2845+3431). I'm a student. Today I generated a support ticket 9763861881 and reopend the ticket which got generated on 26th Feb for irregular activity. Please assist.

Hello, So I registered my Deeplens v1 camera 6 times already and I still get the same result when in the aws console: registration status failed I have no idea why this is happening since I am following the exact steps in the official documentation or any other registration tutorial video. No answers about such issues were provided here, this is why I am posting this question. What might be the reasons behind the registration failing? I did upload the certificates, provided the roles needed, connected the camera to the internet... The documentation only request me to repeat the registration again, but I've been doing this many times already and nothing was solved

I tried starting a couple of my ec2 instances this morning on the us-east-1a zone and kept getting an error saying "Failed to start the instance. Insufficient Capacity". I was trying to start 1 instance at a time and a total of 7 instances. Each instance has 32 vcpu and 192GB RAM. I've been running ec2 instances for a couple years now and have never ran into this issue or seen it before. Is there something I can do so this doesn't happen again in the future?

We had an employee quit and left around several dead AWS Amplify Projects. I tried to delete them from the console but it says the S3 Bucket isn't available and fails. Is there any way to force delete them permanently? the AppIds: d369hv0y9p6iqz d2netjeg8adem3 d2zlpazh2df4vm

Hi All, I have an AWS environment where all the resources (VPC’s, EC2, Route53, etc) were created and administered by the root account and I’m trying to move away from this so administration of the environment can be delegated to others. I’ve setup AWS SSO with our IdP (Okta), created a AWS Account for the user and linked it with an SSO User, created the permission set “AdministratorAccess” and assigned it to the AWS account. I’m able to sign-in to AWS via the IdP, can see the permission set assigned it AdministratorAccess, but I cannot access/view any of the resources that were created by the root account. I’ve been going through all the IAM, policy and access documentation and cannot figure out how to provide access to the resources. I assumed assigning the AdministratorAccess permission set was sufficient, but I’m clearly mistaken or missing something. Any assistance would be greatly appreciated. Thanks!

I've been following this recipe for enabling MFA.... https://medium.com/@sjsumit10/enable-mfa-for-aws-managed-ad-using-freeradius-with-google-authenticator-caaabc450c0b The procedure works well up until I reach the final step where MFA is enabled for the AD using the AWS console. The step fails with no obvious information as to why. I believe I've verified that UDP port 1812 is open. Where can I look for hints as to what the problem is? CloudWatch logs are not providing much insight.

I am trying to import the noncompliant rules and noncompliant resources from the AWS Config Dashboard. It there a way to do it using CLI or the console.

Hello, I use not only the AWS firewall but also UFW on my Debian 10 instance... So, now UFW block me. - Instance Connect don't work because I'm using Debian 10 - Since I cannot connect. I cannot install Session Manager. - Of course the daemon of UFW start at launch... Serial Console ask for a login, I did a user...etc But the login is not working. I'm missing something? Help please.

I do have an AWS EC2 and I'm unable to connect by SSH. Port 22 is open in the default AWS firewall (with my IP). I keep getting: Operation timed out I suspect that UFW or fail2ban block me. Is there a console in the AWS Panels can let me connect to this instance? Or an another way to connect to be able to unban me? Thank you.

I have a service I am trying to unsubscribe multiple queues from my SNS console; I notice they all have individual ARN's which correspond to different owners, however I cannot prod further into any of those owner's details. How can I check their ARN to make sure the right service owner's queue is the right one I am unsubscribing from.

(Probably this bug happened after I erased cookies from my browser.) When I open in AWS Console CloudFront support or billing or try to register as an IQ expert I see error 400. Also, CloudFront says: > There seems to be a problem with your session. > Please try again in a few minutes or login again. > If the problem persists try clearing your browser cookies. Logging again with or without erasing my cookies again does not help. "Enhanced tracking protection" in my Firefox is off for AWS Console. I can't even contact support to tell them about the trouble.

Hello, I've been trying to access the Lifecycle Manager since few weeks back. But until now, i'm stuck in the loading sequence. Has anybody encountered this? Or at least know how to fix it? It's just showing the loading animation with the message "It is taking a bit longer than usual to fetch your data". I also asked this same question in StackOverflow (https://stackoverflow.com/questions/71213963/aws-lifecycle-manager-stuck-in-loading), which also contains a screenshot. I hope somebody can help me with this.

Know which services work on this IPv6 port and which only work on IPv4? And if both protocols can be activated (dual stack) to have access to services that do not have IPv6, and continue to work with IPv4.

Most pages I go to, in the table where it is meant to display the records it says "Maximum call stack size exceeded." or in a red box at the top of the page for example "An error occurred calling the API: describeAvailabilityZones. Maximum call stack size exceeded."

Did anyone else noticed difficulties yesterday (2022-02-16) between 23:01 and 23:09? We started to notice problems when our Cloudfront implementation was unable to forward requests to ALB. Then, when we tried to login to aws console, it was also giving timeout. After a few minutes everything was working fine again. AWS status has no recent event about this.

We always have problems to onboard users on Appstream, because almost always the Welcome email (which is required to set the password) we send from the Appstream 2.0 management console will end up in Office 365 Quarantaine (or users don't receive this email at all). I would like to think that Microsoft (with Azure) sees AWS as competition so that's how they try to nag users. Is there any way we can prevent this?

The "new" Amazon ECS Console, which is an opt-in experience, is missing important functionality. One such missing function is the ability to specify a custom entrypoint or command override for each container defined in an Amazon ECS Task Definition. This makes the usage of the "new" console almost impossible, and I have to fallback to using the old console. When is the "new" ECS console going to be usable?

Hello, I've followed documentation here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-interface.html#cfn-cloudformation-interface-parameterlabels to set up parameter groups and labels for a stack. And everything was just fine for the last 5 (five) years in several regions (us-east-1, eu-west-1 and eu-central-1). However from today it doesn't seem to be working anymore: all my labels and groups are completely ignored and are not displayed during stack update. Assuming this is not a bug, there might be some changes in the template format made which are not reflected in the documentation. So, my questions are : 1. What is the right way to set up parameter groups and labels ? 2. Or in the case if this is just a bug, is it considered to be safe to perform stack updates ? Best Regards, Alex. **UPD:** Parameter labels are back, but still no names of ParameterGroups. I hope this is just a temporary issue.

I did a lab on AWS elastic disaster recovery in my aws free tier account. After I was done with lab I cleared all the resources. But still a snapshot in name of EDR Recovery is being created everytime. Even when I delete it, it comes up again. I think it is because of replication setting. If anyone can suggest how to delete this replication setting it would be a great help

I was working with a new ubuntu instance this morning, alternating between a serial console and ssh connection. I took a lunch break. When I came back the EC2 Dashboard is taking me to a bit of a different instances list. Once I select my instance, the connect button no longer gives an option for the serial connection. I checked and EC2 serial console access is still allowed under the account attributes. I would appreciate advice on how to get back to where I was earlier. thanks Cliff

I have made one Rest API in Django and now I have to deploy that in AWS. Any ideas to which AWS Service should be used? What will be the architecture? Any diagram?

i recall i read somewhere there's a page that allows you to see if there are any major issues in aws services..

The 'new' console does not have ANY of my existing organizations. I can't manage any email accounts, the only option is to create a NEW Organization!! I have 4 organizations already existing and NO WAY to access them. Help!!!

The S3 console is currently showing an error instead of the expected list of buckets. I have logged in as a user with AdministratorAccess and as the root user for the account. In both instances the table which should be showing the list of buckets is rendering "Unknown Error; An unexpected error occurred". I do not see any health status alerts. Are others affected by this currently?

Once I log onto AWS Console Home, I select EC2 under Compute services and open as a new tab (I am using Google Chrome as my browser). Normally I would see a list of EC2 instances that we have running. Today I get a blank screen. The Tab says "EC2 Management Console", but not even the page headers load. Any ideas on what's going on? I get the same issue with "S3 Management Console" and "Route 53 Management Console". The only one that I normally use that is still functioning is "Managed Services Console" under Customer Enablement.

Using AWS CodePipeline and setting a Source, Build and passing `taskdef.json` and `appspec.yaml` as artifacts, the deployment action `Amazon ECS (Blue/Green)` will fail with the error: STRING_VALUE can not be converted to an Integer This error does not specify where this error happens and therefore it is not possible to fix. For reference, the files look like this: ```yaml # appspec.yaml version: 0.0 Resources: - TargetService: Type: AWS::ECS::Service Properties: TaskDefinition: <TASK_DEFINITION> LoadBalancerInfo: ContainerName: "my-project" ContainerPort: 3000 ``` ```json // taskdef.json { "family": "my-project-web", "taskRoleArn": "arn:aws:iam::1234567890:role/ecsTaskRole-role", "executionRoleArn": "arn:aws:iam::1234567890:role/ecsTaskExecutionRole-web", "networkMode": "awsvpc", "cpu": "256", "memory": "512", "containerDefinitions": [ { "name": "my-project", "memory": "512", "image": "01234567890.dkr.ecr.us-east-1.amazonaws.com/my-project:a09b7d81", "environment": [], "secrets": [ { "name": "APP_ENV", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:APP_ENV::" }, { "name": "PORT", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:PORT::" }, { "name": "APP_NAME", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:APP_NAME::" }, { "name": "LOG_CHANNEL", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:LOG_CHANNEL::" }, { "name": "APP_KEY", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:APP_KEY::" }, { "name": "APP_DEBUG", "valueFrom": "arn:aws:secretsmanager:us-east-1:1234567890:secret:web/my-project-NBcsLj:APP_DEBUG::" } ], "essential": true, "logConfiguration": { "logDriver": "awslogs", "options": { "awslogs-group": "", "awslogs-region": "", "awslogs-stream-prefix": "" } }, "portMappings": [ { "hostPort": 3000, "protocol": "tcp", "containerPort": 3000 } ], "entryPoint": [ "web" ], "command": [] } ], "requiresCompatibilities": [ "FARGATE", "EC2" ], "tags": [ { "key": "project", "value": "my-project" } ] } ``` Any insights on this issue are highly appreciated!

I have an ECS service which is of Launch Type EC2 owned by an AWS account A. Our IT team has created an FSx storage owned by an AWS Account B - [see simple diagram here](https://i.stack.imgur.com/MyU1d.png) When I try to launch tasks I get this error in the Stopped reason section of the task: ``` Stopped reason Fsx describing filesystem(s) from the service for [fs-0c52aba0aac20c744]: FileSystemNotFound: File system 'fs-0c52aba0aac20c744' does not exist. ``` I have attached those 2 policies to the EC2 (container host) instance: - AmazonFSxReadOnlyAccess (AWS Managed) - fsx_mount (Customer Managed) fsx_mount: ``` { "Statement": [ { "Action": [ "secretsmanager:GetSecretValue" ], "Effect": "Allow", "Resource": "arn:aws:secretsmanager:us-west-2:111111111111:secret:dev/rushmore/ad-account-NKOkyh" }, { "Action": [ "fsx:*", "ds:DescribeDirectories" ], "Effect": "Allow", "Resource": "arn:aws:fsx:us-west-2:222222222222:file-system/fs-0c52aba0aac20c744" } ], "Version": "2012-10-17" } ``` **Note** that the account id of 222222222222 represents AWS Account B. Also, **VPC Peering is in place between the EC2 instance VPC and the FileSystem VPC**. Terraform aws_ecs_task_definition: ``` resource "aws_ecs_task_definition" "participants_task" { volume { name = "FSxStorage" fsx_windows_file_server_volume_configuration { file_system_id = "fs-0c52aba0aac20c744" root_directory = "\\data" authorization_config { credentials_parameter = aws_secretsmanager_secret_version.fsx_account_secret.arn domain = var.domain } } } ... } ``` I am not sure why ECS cannot find the FSx file system. Surely it must be because it is in another AWS account but I don't know what changes are required in order to fix this.

Hello, We need to get rid of situation that we need to store our access keys in PC memory ( on a disk, not the RAM ), because of that we cannot use `credentials` file that is created by AWS CLI command `aws configure`. Someone knows any work around for this? maybe somehow we can send "access keys" directly with the commands that we run?

I am trying to access the AWS Console via AWS SSO with Azure AD as my identity provider. Following this Microsoft tutorial: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-tutorial, I was able to successfully set up SSO and automatic provisioning. To initiate sign in I use the My App browser extension. I can authenticate but I am brought to the User Portal and I have no applications. What am I missing? How do I access the AWS Console using this method? Microsoft has another Enterprise Application call AWS Single-Account Access. If I set this up, I can access the Console: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial but I don't think that's what I want. Any help would be much appreciated. Thanks

We have a certificate that is pending email validation for renewal. When we attempt to view the certificate (to request a new email for validation), there are no certificates listed under the AWS Certificate Manager. What would cause this and how do we access the certificate?

The CloudTrail console is showing a blank screen in multiple regions. I've yet to find a region where it shows anything but a blank screen. All other aws services are displaying as normal. status.aws.amazon.com shows no issues. Test Machine Specs: - Brave (1.34.80) desktop browser - Safari (15.2) desktop browsers - macOS 12.1

I have been using Console service favorites for a long time - since they were introduced. A couple months ago - seemingly as the Console Home UI began changing - I started losing my favorites. I would add them back, and they'd simply disappear overnight. This happened several times before I began trying to figure out a pattern. I think it happens over the weekends or when I'm not active in the Console for a couple of days. I use so many services, that not having favorites pinned is really annoying and slows me down. Is anyone else having this issue?

Hello, the question is in the title - "do the aws supports HOTP"? (hmac based one time password), for now i tried to setup my yubikey as MFA in AWS SSO as "otp generator" , for TOTP it worked perfectly , but HOTP didn't worked, now im thinking if AWS is even supporting it.

Hi, is there a Golang equivalent for https://github.com/aws/aws-encryption-sdk-javascript?

How do I check my current service quotas for Amazon SageMaker? In the case of Amazon EC2, service quotas can be checked here: https://console.aws.amazon.com/servicequotas/home/services/ec2/quotas For SageMaker, the default quotas are listed here: https://docs.aws.amazon.com/general/latest/gr/sagemaker.html but there isn't a link to where one can find the current region-specific quotas for an account, which could have changed after a [request for a service quota increase](https://docs.aws.amazon.com/sagemaker/latest/dg/regions-quotas.html#service-limit-increase-request-procedure).

In the SSM Fleet Manger, a list of Native and Hybrid Cloud Managed instances are displayed. Is it possible to include, in the columns on the list, and/or on the report that can be downloaded using the Download Report button on this page, any tags and their values, similar as to what can be displayed in the EC2 Instances list view?

Hi, I get the following error when I try to login to my MTurk requester account with my AWS credentials (as an IAM user): "✖ There is a problem with your session. Please sign in again." The login information is correct, since I am able to login to the aws.console.amazon.com page. I have also used this account with MTurk a year ago and had no issues, so this issue appears to be recent. Any suggestions on what could be going on here? Thank you very much in advance!

Hi Can you please help me here, when I log in to my AWS account my default region is Oregon, how can i choose a different region as a default? so that any resource I. create goes into this default region. Thanks for your help. Regards Sam

We'd like to export IAM roles/users/groups policies report across multiple AWS accounts. What is the best way of doing this? I know there is an IAM credential report option; however, that would not be ideal for multiple accounts (hundreds).

we have some volumes that neither can be detached nor deleted. Even AWS console force or command-line aws cli comamnd helped if you try to detach (as it shows in-use but no instance iD) you get aws --profile XXXXXXX --region us-east-1 ec2 detach-volume --volume-id vol-XXXXXXXX --force An error occurred (IncorrectState) when calling the DetachVolume operation: Volume 'vol-XXXXXXXX' is in the 'available' state. and if you try to delete you get the in-use error message aws --profile XXXXXXXX --region us-east-1 ec2 delete-volume --volume-id vol-XXXXXXXX An error occurred (IncorrectState) when calling the DeleteVolume operation: The volume 'vol-XXXXXXXX' is 'in-use' We have 3 volumes that we like to put in the correct state and delete if needed. Any idea? volumes are in us-east-1 vol-da73b5b3, vol-2eee2e47 and vol-54ace93d. I am not able to create the support case regards, -Inder

I'm unable to upload a new version of my application. I get the following error in the browser's console: ``` Refused to send form data to 'https://elasticbeanstalk-eu-west-1-412334503295.s3.eu-west-1.amazonaws.com/' because it violates the following Content Security Policy directive: "form-action 'self' https://console.aws.amazon.com/feedback/submit-feedback https://signin.aws.amazon.com/switchrole https://us-east-1.console.aws.amazon.com/feedback/submit-feedback https://eu-west-1.signin.aws.amazon.com/switchrole https://eu-west-1.signin.aws.amazon.com/oauth". ```

I must say, I do enjoy the average of 3-5 times it takes to accurately complete the random character captcha security check each time I try to login to AWS from the web console or the mobile app. Nothing says "convenience" like authenticating against bots on my own mobile device or trusted workstation. In case you missed the tone of the above, this is sarcasm. Now for the constructive criticism: Captcha image checks are supposed to protect against rogue hacking scripts. I wouldn't mind it as much if the images were clear and accurate, but, as I indicated above, they rarely translate into the accepted answer. Additionally, AI is making these types of checks obsolete as well, so image checks are starting to show their age. AWS, please accept this constructive criticism and an area that would make your customer experience improve dramatically.

* I'm getting an error when trying to launch AWS CloudShell in the `us-west-2 (Oregon)` region. * My IAM Role has Administrator Access, and I'm the only creator/user of the AWS account. * I enabled AWS Organizations, but am not using any features of it right now. * I am not using any permissions boundaries in IAM * I am **not** receiving any kind of "access denied" error message. It is just a generic, useless message (see below). Any ideas on how to resolve this? `Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.`

Hello. Is there an easy way to find out if the disk attached to an instance is gp2, gp3 or io1? I'd like to know how to do this both from the console and once I'm connected to the instance. The console simply shows: ```EBS-optimized False Root device type ebs Root device /dev/sda1 Block devices /dev/sda1 /dev/sdb Elastic Graphics ID - Elastic Inference accelerator ID - Capacity Reservation - Capacity Reservation Settings Open Outpost Arn -```

Hey guys, I have a question about the Amazon Personalize Recipe, customers-who-viewed-x-also-viewed. I tried to call this recipe, but I got the error. It's like this: "InvalidInputException: An error occurred (InvalidInputException) when calling the CreateSolution operation: This recipe with ARN arn:aws:personalize:::recipe/aws-ecomm-customers-who-viewed-x-also-viewed is unsupported. Please use the supported recipes listed at https://docs.aws.amazon.com/personalize/latest/dg/working-with-predefined-recipes.html" I wanna know how to call the recipe. Thank you for your help.

I've recently used the PHP SDK to test some operations under the SecretsManager service. Everything works fine. However, I needed to ensure the information sent in using the **`createSecret`** operation was safe from any third-party threats. So I did a small investigation to view the request's body contents. I was able to view this content under ***StreamRequestPayloadMiddleware.php***. After modifying it by using **json_decode **to view the request's contents, I came across this: ``` array(4) { ["Name"]=> string(9) "demo/Test" ["SecretString"]=> string(39) "{"username":"Tom","password":"Test123"}" ["KmsKeyId"]=> string(xx) "arn:aws:kms:xx-xxxx-x:xxxxxxxxxx:key/xxx-xxx-xxx-xxx-xxxxxxxxxx" ["ClientRequestToken"]=> string(xx) "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" } ``` I then realized the plaintext contents of the SecretString were visible in the request's body. I'm aware the SecretsManager uses a KMS key to encrypt the secret values; however, this only happens once the operation has been sent to the server-side (AWS Console). Therefore, I need to know if there is any way to protect the payload contents in an **encrypted format** so that the SecretsManager service or AWS can **unpack this content to its original value** without having it saved in that encrypted format, on a new secret.

As a user of a hardware U2F security key, I always follow best practice and register a backup key in case the primary is damaged or lost. In the old AWS support forums, your customers have been asking for this since 2013. Nine years later and this still appears to be impossible. When will this critical feature be added?

I started a couple of instances yesterday and today none of them were visible in the AWS console nor I was able to access them using PuTTY even though I saved the session. I'm assuming those have been shut down by some process even if I have no way to check if it's so. now I would like to know if there is a way to keep an instance running unless I explicitly enter some commands to shut down the machine.

In the [Glue Crawler console](https://console.aws.amazon.com/glue/home?region=us-east-1#catalog:tab=crawlers), **Filtering by Name** seems to be working now, though the UX could be improved. 1. Select the **Filter By Attributes Field** to get a dropdown. 2. Pick **Resource Attributes: Name** and enter in the keyword. But consider as a use case of pages tables with the same prefix that we would filter on. We should be able to sort by name in case we don't know the exact full table name. Or if a user needs to find or group tables with the same status. Is there some way to sort by column?

I would like to create a web app that authenticates just as AWS does for console login. 1. A non-root user would first have to enter an account number (I can verify that the number entered is legit). --- 2. The non-root user would then enter an email and password combination. That alone is ok, but I don't see how to confirm those credential using Amplify in combination with the account number. I only want the user confirmed if those credentials are paired with the account number. --- 3. For root users, I would want to authenticate them only if the email and password can be confirmed with, presumably, a root user flag. Is there an Amplify API that allows email, password, and account parameters for authentication? Can you provide any guidance on how to authenticate root users based on email, password, and root user flag? Thanks.

Hi fellow AWS techs have a strange issue with AppStream 2.0 aftre setting up and then assigning a stack to a user. the workflow sennds out Welcome Email - no issues, then send another which requests user login from link and aos forces a password chaneg. This all works dandy, however, when I try and resend - email not sent when fleet re-assigned to user -

Unable to apply lifecycle configuration to a file system in EFS using AWS CLI. I m using below command `aws efs put-lifecycle-configuration \ --file-system-id $fsID \ --lifecycle-policies "[{\"TransitionToIA\":\"AFTER_60_DAYS\"},{\"TransitionToPrimaryStorageClass\":\"AFTER_1_ACCESS\"}]"` **output:** Parameter validation failed: Unknown parameter in LifecyclePolicies[1]: "TransitionToPrimaryStorageClass", must be one of: TransitionToIA I followed the documentation but still unable to apply 'TransitionToPrimaryStorageClass' policy. Pls help