text:
refactor(vehicle_cmd_gate): use lateral command while creating stop cmd

Description
In the vehicle_cmd_gate package, if the vehicle disengages, it creates a stop command. However, while creating a stop command, it inserts current steering as lateral command and it causes unwanted behavior like in the video:
https://github.com/autowarefoundation/autoware.universe/assets/45468306/6dd86034-de2a-43f5-b972-d860e3f6d568
After disengaging, the vehicle sends current steering so the vehicle moves outside of the road.

Tests performed
https://github.com/autowarefoundation/autoware.universe/assets/45468306/d3bdf096-2b22-43f6-9a69-6890fae75baf

Not applicable.
Effects on system behavior

Not applicable.
Pre-review checklist for the PR author
The PR author must check the checkboxes below when creating the PR.

[ ] I've confirmed the contribution guidelines.
[ ] The PR follows the pull request guidelines.

In-review checklist for the PR reviewers
The PR reviewers must check the checkboxes below before approval.

[ ] The PR follows the pull request guidelines.

Post-review checklist for the PR author
The PR author must check the checkboxes below before merging.

[ ] There are no open discussions or they are tracked via tickets.

After all checkboxes are checked, anyone who has write access can merge the PR.

@brkay54 The stop command can be used in several ways. It can use the target steering value when we want to send the stop signal (as of the function name: createStopControlCmd).
However, sending a target steering when the engage is off doesn't make sense.
My proposal to solve the issue reported above is

"STOP" button in RViz should use the stop interface (https://github.com/autowarefoundation/autoware.universe/pull/3790), not engage interface.
When the stop interface is called, the target steering should be used at least while the vehicle is moving. (It can use the current steering angle when completely stopped.)

@TakaHoribe Great idea! I will create a new PR after https://github.com/autowarefoundation/autoware.universe/pull/3790 is merged! Thank you for the suggestion!

@TakaHoribe Thank you for your advice, in autoware_state_panel, stop button calls the service to change operation_mode. After operation_mode is changed, operation_mode_transition_manager changes engage to disengage. I want to ask a question about it. What actually means the engage and disengaging for Autoware? Does disengage mean that operation mode is stop? Maybe if the operation mode is stop, calling the moderate stop interface is a better solution. I always think that if autoware disengage, it does not involve controlling the vehicle, but in the current implementation it means stop the vehicle. It is little confusing for me sorry for that. What do you think?


text:
fix(avoidance): fix previous data inconsistency

Description
Close https://github.com/autowarefoundation/autoware.universe/issues/4178?notification_referrer_id=NT_kwDOAqz13LM2OTcyODU5NTcyOjQ0ODg5NTY0
If it fails to generate avoidance path, module doesn't update any previous data.

Tests performed

[x] PASS TIER IV INTERNAL SCENARIOS

Effects on system behavior

Nothing.
Pre-review checklist for the PR author
The PR author must check the checkboxes below when creating the PR.

[x] I've confirmed the contribution guidelines.
[x] The PR follows the pull request guidelines.

In-review checklist for the PR reviewers
The PR reviewers must check the checkboxes below before approval.

[ ] The PR follows the pull request guidelines.

Post-review checklist for the PR author
The PR author must check the checkboxes below before merging.

[ ] There are no open discussions or they are tracked via tickets.

After all checkboxes are checked, anyone who has write access can merge the PR.

@rej55 I would like you to review and approve as code owner if you're available. @ismetatabay san has already confirmed that this PR resolves https://github.com/autowarefoundation/autoware.universe/issues/4178.

source: gharchive/pull-request

license_type: permissive

license_source: github-api


text:
fix(probabilistic_occupancy_grid_map): fix robot_pose to refer base_link_frame

Description

As reported in https://github.com/orgs/autowarefoundation/discussions/4202#discussioncomment-8564823, we found probabilistic occupancy grid map is published not on the baes_link but on the raw pointcloud frame.
This PR fixes the issue.
Related links

https://github.com/orgs/autowarefoundation/discussions/4202#discussioncomment-8564823
Tests performed
@tseco15 Could you check this PR in your environment and check if the problem is fixed?

Notes for reviewers

Interface changes

Effects on system behavior

Pre-review checklist for the PR author
The PR author must check the checkboxes below when creating the PR.

[ ] I've confirmed the contribution guidelines.
[ ] The PR follows the pull request guidelines.

In-review checklist for the PR reviewers
The PR reviewers must check the checkboxes below before approval.

[ ] The PR follows the pull request guidelines.
[ ] The PR has been properly tested.
[ ] The PR has been reviewed by the code owners.

Post-review checklist for the PR author
The PR author must check the checkboxes below before merging.

[ ] There are no open discussions or they are tracked via tickets.
[ ] The PR is ready for merge.

After all checkboxes are checked, anyone who has write access can merge the PR.

Hi,
I can confirm that the PR solves the problem. I have tested it in my environment, and the occuppancy_grid_map is now published in base_link frame.


text:
ci(build-and-test): reset ccache stats before build

Description
Right now ccache stats are not correct because it accumulates over time.

https://linux.die.net/man/1/ccache
-z, --zero-stats
Zero the cache statistics (but not the configured limits).

This command will reset it before the build. So we can get to know the real stats after build.
Related links
How was this PR tested?
Notes for reviewers
None.
Interface changes
None.
Effects on system behavior
None.

https://github.com/autowarefoundation/autoware.universe/actions/runs/10702198996/job/29669865121?pr=8761#step:5:10599

96% hit rate, it works :D
Thanks @mojomex
Now I will revert the dummy change and we can merge

Merging this as is since it's a simple change.


text:
Perplexica UI doesn't terminate initialization

Hi,
Trying Perplexica, it installs without errors, but the UI is stuck before writing its "prompt". It seems its settings must be adjusted, but also the settings page remains stuck waiting with the UPLOAD button disabled:

It seems also that Perplexica doesn't take advantage of the Harbor ecosystem (Ollama, SearXNG).
I got Perplexica working in a dedicated LXC container after setting its config.toml before starting it:
[API_KEYS]
GROQ = "gsk_******"

[API_ENDPOINTS]
OLLAMA = "http://10.4.0.100:11434"
SEARXNG = "http://10.4.0.105:4000"

The only harbor config I'm aware of is this:
[root@HarborAI ~]# harbor config ls | grep -i perplexica
PERPLEXICA_HOST_PORT           34041
PERPLEXICA_BACKEND_HOST_PORT   34042

How to solve?
Thank you

Thanks for the report, it's not an expected state, since Perplexica should:

Start from scratch with harbor up perplexica
Connect to built-in Ollama and Searxng out of the box

Unfortunately, Perplexica is one of the services that are a tiny bit "picky" in terms of configuration, I've outlined some most possible caveats here: https://github.com/av/harbor/issues/60#issuecomment-2411864309

The only harbor config I'm aware of

Perplexica (and many other services) cross-connections are setup with cross-service files (I call them x files, haha), here's one for Ollama and another one for SearXNG, these are merged with the rest of the configs whenever harbor sees that matching services are run together (including default services). So one of the things to check is to verify if values in these files match the expected network layout.

I still have the same issue https://github.com/av/harbor/issues/60#issuecomment-2411864309
Also, I noticed that perplexica config survives rm -rf harbor

I managed to solve this same issue I had with Perplexica in a LXC container on Proxmox VE, but I don't know how to apply this solution to Perplexica on Harbor.
After finding this https://github.com/ItzCrazyKns/Perplexica/issues/467, the solution was substituting 127.0.0.1 with the LAN IP of the computer runnong Harbor, in my case 10.4.0.174, into docker-compose.yaml:
perplexica-frontend:
    build:
      context: .
      dockerfile: app.dockerfile
      args:
        - NEXT_PUBLIC_API_URL=http://127.0.0.1:3001/api
        - NEXT_PUBLIC_WS_URL=ws://127.0.0.1:3001

This requires rebuilding the image, if you are lazy override it on runtime:
  perplexica-frontend:
    image: itzcrazykns1337/perplexica-frontend:main
    restart: unless-stopped
    depends_on:
      - perplexica-backend
    ports:
      - 3000:3000
    networks:
      - perplexica-network
    command: >
      sh -c "
      find .next -type f -name '*.js' -exec sed -i 's|ws://127.0.0.1:3001|ws://10.0.5.100:3001|g' {} + &&
      find .next -type f -name '*.js' -exec sed -i 's|http://127.0.0.1:3001/api|http://10.0.5.100:3001/api|g' {} + &&
      yarn start"

source: gharchive/issue

authors: PieBru av ecker00 nullnuller

repo: av/harbor


text:
Avail LC issue

Hi,
I use Amazon Linux EC2.
After running : curl -sL1 avail.sh | bash
🆙 Starting Availup...
🛜  No network selected. Defaulting to goldberg testnet.
📌 Goldberg testnet selected.
🗑  Wiping old config file at /home/ec2-user/.avail/config/config.yml.
📲 No app ID specified. Defaulting to light client mode.
🔑 Identity found at /home/ec2-user/.avail/identity/identity.toml.
✅ Avail is already installed. Starting Avail...
2024-04-05T15:39:50.193407Z  INFO avail_light: Identity loaded from /home/ec2-user/.avail/identity/identity.toml
2024-04-05T15:39:50.193650Z  INFO avail_light: Running Avail light client version: 1.7.10. Role: lightnode.
2024-04-05T15:39:50.193711Z  INFO avail_light: Using config: RuntimeConfig { http_server_host: "127.0.0.1", http_server_port: 7000, secret_key: None, port: 37000, autonat_only_global_ips: false, autonat_throttle: 1, autonat_retry_interval: 20, autonat_refresh_interval: 360, autonat_boot_delay: 5, bootstraps: [Compact(CompactMultiaddress((PeerId("12D3KooWBkLsNGaD3SpMaRWtAmWVuiZg1afdNSPbtJ8M8r9ArGRT"), "/dns/bootnode.1.lightclient.goldberg.avail.tools/tcp/37000/p2p/12D3KooWBkLsNGaD3SpMaRWtAmWVuiZg1afdNSPbtJ8M8r9ArGRT"))), Compact(CompactMultiaddress((PeerId("12D3KooWRCgfvaLSnQfkwGehrhSNpY7i5RenWKL2ARst6ZqgdZZd"), "/dns/bootnode.2.lightclient.goldberg.avail.tools/tcp/37000/p2p/12D3KooWRCgfvaLSnQfkwGehrhSNpY7i5RenWKL2ARst6ZqgdZZd")))], bootstrap_period: 3600, operation_mode: Client, relays: [], full_node_ws: ["wss://rpc-goldberg.sandbox.avail.tools:443", "wss://goldberg-rpc.fra.avail.tools:443"], genesis_hash: "6f09966420b2608d1947ccfb0f2a362450d1fc7fd902c29b67c906eaa965a7ae", app_id: Some(0), confidence: 99.0, avail_path: "/home/ec2-user/.avail/data", log_level: "INFO", origin: "external", log_format_json: false, ot_collector_endpoint: "http://otelcol.lightclient.goldberg.avail.tools:4317", disable_rpc: false, dht_parallelization_limit: 20, query_proof_rpc_parallel_tasks: 8, block_processing_delay: Some(20), block_matrix_partition: None, sync_start_block: None, sync_finality_enable: false, max_cells_per_rpc: Some(30), threshold: 5000, kad_record_ttl: 43200, publication_interval: 43200, replication_interval: 10800, replication_factor: 5, connection_idle_timeout: 30, max_negotiating_inbound_streams: 128, task_command_buffer_size: 32, per_connection_event_buffer_size: 7, dial_concurrency_factor: 8, query_timeout: 10, query_parallelism: 3, caching_max_peers: 1, disjoint_query_paths: false, max_kad_record_number: 2400000, max_kad_record_size: 8192, max_kad_provided_keys: 1024, retry_config: Exponential(ExponentialConfig { base: 10, max_delay: 4000, retries: 3 }) }
2024-04-05T15:39:50.193876Z  INFO avail_light: Avail ss58 address: 5EtRee2zrhbwrPCWBzTwh9uqnaNcMmSTMr8q1jZkQcgDJkNF, public key: 7cddaff4f161d9dc31137f743102f2cc7a4f93678eb5a177e9e01d2d264cd050
2024-04-05T15:39:50.222543Z  INFO avail_light: TCP listener started on port 37000
2024-04-05T15:39:50.222678Z  INFO avail_light: Bootstraping the DHT with bootstrap nodes...
2024-04-05T15:40:00.223090Z  WARN avail_light: Bootstrap process:
0: Dialing Bootstrap peer failed.
1: Failed to negotiate transport protocol(s): [(/dns/bootnode.1.lightclient.goldberg.avail.tools/tcp/37000/p2p/12D3KooWBkLsNGaD3SpMaRWtAmWVuiZg1afdNSPbtJ8M8r9ArGRT: : Timeout has been reached)]
Location:
/home/runner/work/avail-light/avail-light/src/network/p2p/event_loop.rs:523

same here

That's just failure to connect to bootstrap nodes, not an issue with Availup, will work on restart when bootstrap nodes are alive.

repo: availproject/availup

license: MIT


text:
Action 'add_uri_to_queue' unlisted in docs

Dear maintainers,
Thank you so much for this tool, it's really helpful and saves me time with my custom scripts :)
Before switching to this app,
A feature that I often used in my custom script is add_uri_to_queue, found in SoCo Github repo, docs here:
https://soco.readthedocs.io/en/latest/api/soco.core.html?highlight=_uri#soco.core.SoCo.add_uri_to_queue
I was unable to find this in the README.md however it does work and is in the action_processor.py
Could you document this feature as it really helps me with creating a daily URI playlist for Sonos and might help others as well.
Thank you!

Hi -- thanks for the feedback. Glad you're finding it useful.
I'd actually forgotten I'd implemented a wrapper for add_uri_to_queue. In v0.1.52, I've updated the action so that it can optionally be followed with a queue position (an integer, or 'next' to play as the next track), and it now returns the queue position at which the URI has been inserted. I've added it to the documentation.

Hi -- thanks for the feedback. Glad you're finding it useful.
I'd actually forgotten I'd implemented a wrapper for add_uri_to_queue. In v0.1.52, I've updated the action so that it can optionally be followed with a queue position (an integer, or 'next' to play as the next track), and it now returns the queue position at which the URI has been inserted. I've added it to the documentation.

authors: naxels pwt

repo: avantrec/soco-cli


text:
Add support for @n_failures

I'm working on a large codebase that has many jet failures. I'd like to chip away at them, and prevent more from entering. Can we add a function @n_failures that returns n in ═════ n possible error found ═════?
This way users can add a test as, for example,
n_failures = JET.@n_failures foo()
@test n_failures ≤ 72

You can do something like:
julia> using JET

julia> macro n_failures(ex)
           return :(let result = JET.@report_call $(ex)
               length(JET.get_reports(result.analyzer, result.result))
           end)
       end
@n_failures (macro with 1 method)

julia> function n_failures(args...; kwargs...)
           result = JET.report_call(args...; kwargs...)
           return length(JET.get_reports(result.analyzer, result.result))
       end
n_failures (generic function with 1 method)

julia> @n_failures sum("julia")
2

julia> n_failures(sum, (String,))
2

authors: aviatesk charleskawczynski


text:
it is not resposive for phone

can I work on this issue

i have converted it to phone responsive.

any more changes are required?

please add screen shot

please add screen shot

sure


text:
Adding wallpaper viewer

Description
Wallpaper viewer is a gui based project where you are able to see bunch of wallpapers. For this i use tkinter module, readme file is included.
Fixes #1838
Type of change
Please delete options that are not relevant.

[ ] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] This change requires a documentation update
[ ] Documentation Update

Checklist:

[x] My code follows the style guidelines(Clean Code) of this project
[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] I have created a helpful and easy to understand README.md
[x] My documentation follows Template for README.md
[ ] I have added the project meta data in the PR template.
[ ] I have created the requirements.txt file if needed.

Project Metadata
If there is no-file/nothing to fill the below fields with, then type: none
Example: If no requirements.txt needed/present, then type none in Requirments.
Category:

[ ] Calculators
[ ] AI/ML
[ ] Scrappers
[ ] Social_Media
[ ] PDF
[ ] Image_Processing
[ ] Video_Processing
[ ] Games
[ ] Networking
[ ] OS_Utilities
[ ] Automation
[ ] Cryptography
[ ] Computer_Vision
[ ] Fun
[x] Others

Title: wallpaper viewer
Folder: Wallpaper_viewer
Requirements: tkinter
Script: wallpaper_view.py
Contributor: Pro-18
Description:
The Python Wallpaper Viewer project is a program that allows users to view and manage their collection of wallpapers using a graphical user interface (GUI) built with the Tkinter library. Tkinter is a standard Python library for creating GUI applications.

Found No Script

Found No Script

Certainly! Could you please provide a description of the problem so that I can work on it

There was no Script in the PR

repo: avinashkranjan/Amazing-Python-Scripts


text:
Animated Splash Screen

Hey,I have noticed that this app doesn't have splash screen . If you want I can add animated Splash screen to the app

Hey, I want to work on it.

repo: avjinder/Minimal-Todo

license: mit

license_source: bigquery


text:
As a front-end tester, I want quality-written tests, so that they are more rigid and less likely to fail

Acceptance Criteria:

Tests are refactored and tested with several environments.
Avoid using anti-patterns that build up over time.
Use conditional checking to have scalable tests.

Demo Steps:

Tests run and pass on a branch
Tests run and pass on a PR
Tests run and pass on the CI

Potential Risks:

Trying to use shortcuts that pile up errors at the end.
Rendering issues due to the slow nature of the CI.

repo: awaazo/awaazo


text:
Add 'No result found' feature

If no match is found, show 'No result found' text

Actually with the callback function in combination with the total variable users can create totally individual "no results" scenarios which are much more elegant in my solution.

repo: awbush/jquery-fastLiveFilter


text:
[ADD] PySpark Cheatsheet

Quick reference guide to common patterns & functions in PySpark.

https://github.com/kevinschaich/pyspark-cheatsheet  last update 5mohts ago

You guys wanna merge this or should I close it, 4 years 🙃

Are you OK with this @oluies ?

authors: kevinschaich oluies zero323

repo: awesome-spark/awesome-spark


text:
add ability to select issues or prs for closing

Description of changes:
Allow configuration of closing issues, pull requests, or both. No tests were updated.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Can you add a description of the new field in action.yml?

@kdaily please squash your commits. Also, you need to sign your commit before posting a PR. (See https://docs.github.com/en/github/authenticating-to-github/about-commit-signature-verification)

@kdaily Got it. If it works through the Action run then no change is needed.

authors: debora-ito kdaily kellertk

repo: aws-actions/stale-issue-cleanup


text:
Optional relation forced

How did you install the Amplify CLI?
npm install -g @aws-amplify/cli
If applicable, what version of Node.js are you using?
v18.20.3
Amplify CLI Version
12.13.1
What operating system are you using?
ubuntu 22.04
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
no manual changes
Describe the bug
type File
  @model
{
  id: ID!
  ownerEmail: String!
  createdAt: AWSDateTime
  updatedAt: AWSDateTime
  fileName: String!
  filePath: String!
  storeID: ID
  store: Store @belongsTo(fields: ["storeID"])
}

createFile = """
  mutation CreateFile(
    $input: CreateFileInput!
    $condition: ModelFileConditionInput
  ) {
    createFile(input: $input, condition: $condition) {
      id
      ownerEmail
      createdAt
      updatedAt
      fileName
      filePath
      storeID
      store {
        id
        ownerEmail
        createdAt
        updatedAt
        name
        __typename
      }
      __typename
    }
  }
"""

createFile mutation variables:
"fileName": "text_file",
"filePath": "/random_user/text_file",
"ownerEmail": "test@o2.pl",
"storeID": "3afa26ba-b30f-405e-aee6-804a9a9c19a6"
With the newest version of amplify it is not possible to resolve the Store, I had to dump the version of the amplify cli so that the created resolvers would understand that store can be associated with a file but doesn't have to and if the store id is given during the file creation mutation it then can resolve the actual store.
You have a serious problem with hasMany and belongs to directive, no doubt about that.
Expected behavior
I expected to have successful graphql call during file creation mutation with or without providing the existing associated store id with the newest version of amplify cli. This isn't the case
Reproduction steps
If you would like to reproduce the bug just install the newest aws cli and then create two models
one model will have
storeID: ID
store: Store @belongsTo(fields: ["storeID"])
another model will have:
files: [File] @hasMany(fields: ["id"])
And try to create the file without specifying the store in this example, or omitting it completely.
I am forced to use the older version 12.1.0 which created the "reasonable" resolvers.
Project Identifier
No response
Log output

# Put your logs below this line

Additional information
N/A
Before submitting, please confirm:

[X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
[X] I have removed any sensitive information from my code snippets and submission.

Hi @Lisciowsky, thanks for raising the issue! We'll investigate and see what's going on, and get back to you once we have a solution.

Hi @Lisciowsky 👋 A few questions to better understand the issue described.

How is the relationship being forced? Can you provide any error messages or logs you've received related to this issue?
The createFile mutation returns store and possibly required fields on store so if one doesn't exist, those fields being included in the selection set would likely cause an error.
Can you confirm if there's a difference in the resolver logic or in the mutation selection set between the working and non-working CLI versions?
Can you share the schema for both File and Storage so can reproduce the issue as closely to your setup as possible? It might help identify any issues related to non-obvious things like auth rules as well.

in the meantime, as a potential workaround, you could try omitting the entire store, or at least any required fields on it from the selection set.
i'm not sure what the non-nullable fields on store are, but usually id, createdAt, updatedAt are non-nullable so I removed them from the mutation selection set below.
createFile(input: $input, condition: $condition) {
      id
      ownerEmail
      createdAt
      updatedAt
      fileName
      filePath
      storeID
      store {
        ownerEmail
        name
        __typename
      }
      __typename
    }
  }

Hello,

How is the relationship being forced? Can you provide any error messages or logs you've received related to this issue?
The createFile mutation returns store and possibly required fields on store so if one doesn't exist, those fields being included in the selection set would likely cause an error.

It is forced because the createFile mutation does include the [optional] store, and without providing it, it causes the error as you have mentioned.

Can you confirm that there's a difference in the resolver logic or in the mutation selection set between the working and non-working CLI versions?

Yes I can confirm, I had to compare on 2 separate environemnts DEV (created with newest version of amplify cli) and STAGE with (12.1.0)
DEV:
#if( $ctx.stash.deniedField )
  #return($util.toJson(null))
#end

#set( $partitionKeyValue = $util.defaultIfNull($ctx.stash.connectionAttributes.get("officeProjectsId"), $ctx.source.officeProjectsId) )

#if( $util.isNullOrEmpty($partitionKeyValue) )
  #return($util.toJson(null))
#else
  #set( $GetRequest = {
    "version": "2018-05-29",
    "operation": "Query",
    "query": {
      "expression": "#partitionKey = :partitionValue",
      "expressionNames": {
        "#partitionKey": "id"
      },
      "expressionValues": {
        ":partitionValue": $util.dynamodb.toDynamoDB($partitionKeyValue)
      }
    }
  })

  #if( !$util.isNullOrEmpty($ctx.stash.authFilter) )
    $util.qr($GetRequest.put("filter", $util.transform.toDynamoDBFilterExpression($ctx.stash.authFilter)))
  #end

  $util.toJson($GetRequest)
#end

#if( $ctx.error )
$util.error($ctx.error.message, $ctx.error.type)
#else
  #if( !$ctx.result.items.isEmpty() && $ctx.result.scannedCount == 1 )
    #set( $resultValue = $ctx.result.items[0] )
    #set( $operation = $util.defaultIfNull($ctx.source.get("__operation"), null) )
    #if( $operation == "Mutation" )
      $util.qr($resultValue.put("__operation", "Mutation"))
    #end
    $util.toJson($resultValue)
  #else
    #if( $ctx.result.items.isEmpty() && $ctx.result.scannedCount == 1 )
$util.unauthorized()
    #end
    $util.toJson(null)
  #end
#end

STAGE:
#if( $ctx.stash.deniedField )
  #return($util.toJson(null))
#end
#set( $partitionKeyValue = $util.defaultIfNull($ctx.stash.connectionAttibutes.get("officeProjectsId"), $ctx.source.officeProjectsId) )
#if( $util.isNull($partitionKeyValue) )
  #return
#else
  #set( $GetRequest = {
  "version": "2018-05-29",
  "operation": "Query"
} )
  $util.qr($GetRequest.put("query", {
  "expression": "#partitionKey = :partitionValue",
  "expressionNames": {
      "#partitionKey": "id"
  },
  "expressionValues": {
      ":partitionValue": $util.parseJson($util.dynamodb.toDynamoDBJson($util.defaultIfNullOrBlank($partitionKeyValue, "___xamznone____")))
  }
}))
  #if( !$util.isNullOrEmpty($ctx.stash.authFilter) )
    $util.qr($GetRequest.put("filter", $util.parseJson($util.transform.toDynamoDBFilterExpression($ctx.stash.authFilter))))
  #end
  $util.toJson($GetRequest)
#end

#if( $ctx.error )
$util.error($ctx.error.message, $ctx.error.type)
#else
  #if( !$ctx.result.items.isEmpty() && $ctx.result.scannedCount == 1 )
    $util.toJson($ctx.result.items[0])
  #else
    #if( $ctx.result.items.isEmpty() && $ctx.result.scannedCount == 1 )
$util.unauthorized()
    #end
    $util.toJson(null)
  #end
#end

This is CGPT comment:
Why Stage Works, but Dev Doesn’t:
Different Resolver Logic: The Stage resolver uses toDynamoDBJson($util.defaultIfNullOrBlank(...)) while the Dev resolver directly uses $util.dynamodb.toDynamoDB($partitionKeyValue). If the officeProjectsId is blank, the Stage resolver gracefully handles it with "___xamznone____", whereas the Dev resolver fails.

Error Handling Differences: The Stage resolver is more concise and handles error cases better, directly returning unauthorized() or null, while the Dev resolver introduces unnecessary complexity in logic and error handling.

Can you share the schema for both File and Storage so we can reproduce the issue as closely to your setup as possible? It might help identify any issues related to non-obvious things like auth rules as well.
You can replicate this one easily as long as you have one to many with @belongsTo ans @hasMany directives on the one-to-many model relation.
Here is the example grapqhl schema definition:
type Store
  @model
  @auth(
    rules: [
      { allow: owner, ownerField: "ownerEmail", identityClaim: "email", provider: oidc, operations: [create, update, delete, read] }
      { allow: groups, groups: ["Admins"], groupClaim: "groups", provider: oidc, operations: [create, update, delete, read] }
    ]
  ) {
  id: ID!
  ownerEmail: String!
  createdAt: AWSDateTime
  updatedAt: AWSDateTime
  name: String!
  files: [File] @hasMany
}

type File
  @model
  @auth(
    rules: [
      { allow: owner, ownerField: "ownerEmail", identityClaim: "email", provider: oidc, operations: [create, update, delete, read] }
      { allow: groups, groups: ["Admins"], groupClaim: "groups", provider: oidc, operations: [create, update, delete, read] }
    ]
  ) {
  id: ID!
  ownerEmail: String!
  createdAt: AWSDateTime
  updatedAt: AWSDateTime
  fileName: String!
  filePath: String!
  storeID: ID
  store: Store @belongsTo(fields: ["storeID"])
}

Just to summarize, the newest version of the aws cli does create the resolvers but they force the File (following the example schema above) to ensure it points to the store. Your tempfix would certainly work (not including the store in the grapqhl).
I do not want to modify the auto-generated amplify schema and I believe nobody wants to every time I code gen or make some changes. Then I would end up in a scenario where a file without an associated store would have to use a different query, that's just bad news.
PS: The resolver differences on DEV & STAGE example were taken from different project but the issue is exactly the same.
I hope it helps you to fix this, or perhaps roll back the changes that impact the resolver creation

I think, I have same Issue. My schema:
type Chat
  @model(queries: null, mutations: { create: "createChat", update: "updateChat" })
  @auth(rules: [{ allow: owner, ownerField: "owners", operations: [create, read, update] }]) {
  id: ID!
  lastMessageID: ID
  owners: [ID!]! @auth(rules: [{ allow: owner, ownerField: "owners", operations: [create, read] }])
  updatedAt: AWSDateTime!

  LastMessage: ChatMessage @hasOne(fields: ["lastMessageID"])
}

type ChatMessage
  @model(queries: null, mutations: { create: "createChatMessage" })
  @auth(rules: [{ allow: owner, ownerField: "owners", operations: [create, read] }]) {
  id: ID!
  chatID: ID
  images: [ID]
  message: String
  owners: [ID!]!
  userID: ID!
  createdAt: AWSDateTime

  Chat: Chat @hasOne(fields: ["chatID"])
}

When I use CreateChat I get the following error message:
[{"locations": null, "message": "Cannot return null for non-nullable type: 'ID' within parent 'ChatMessage' (/createChat/LastMessage/userID)", "path": [Array]}, {"locations": null, "message": "Cannot return null for non-nullable type: 'null' within parent 'ChatMessage' (/createChat/LastMessage/owners)", "path": [Array]}

Error message although the lastMessageID field is optional. It used to work like this, but no longer does.

@Lisciowsky I found out that if I deploy with version 12.12.1, everything works correctly. If I deploy with version 12.12.2, then I get the error message. Can you confirm this?

Hey @armanian Thank you for providing additional details. Could you please try using the latest version of the CLI (12.13.1) and let us know if the issue persists?

@Lisciowsky @armanian Thanks for sharing this info. I am working on repro-ing your error.

@AnilMaktala yes, with the latest version of CLI (12.13.1) the problem is still present. Downgrade to 12.12.1 works again.

@armanian Thank you for confirming. This appears to be a duplicate of #2609. This behavior is intentional, and you can opt out of the new behavior by setting the subscriptionsinheritprimaryauth feature flag to true.
For more information, please refer to the updated documentation:
Build a Backend: GraphQL API - Subscribe to Data
CLI Reference: Feature Flags - subscriptionsInheritPrimaryAut

@AnilMaktala Thank you very much, that has solved the problem 🥳
But strange that such a beaking change is integrated in a patch version.

@Lisciowsky Please let us know if the fix above address your issue. Thanks.

authors: AnilMaktala Lisciowsky Siqi-Shan armanian bobbyu99 chrisbonifacio

repo: aws-amplify/amplify-category-api


text:
Adding an owner auth rule does not add an owner in the schema

Before opening, please confirm:

[X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
[X] I have searched for duplicate or closed issues.
[X] I have read the guide for submitting bug reports.
[X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
[X] I have removed any sensitive information from my code snippets and submission.

How did you install the Amplify CLI?
yarn
If applicable, what version of Node.js are you using?
No response
Amplify CLI Version
8.3.1
What operating system are you using?
Mac
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
Amplify Categories
auth
Amplify Commands
Not applicable
Describe the bug
type Note @model @auth(rules: [{ allow: owner }]){
    id: ID!
    name: String!
    description: String
    image: String
}

It's supposed to list the todos of user (owner), when I run the code, it's null. Response was unauthorized
Use Case: Just need different users to be able to CRUD their own todos using allow: owner
Expected behavior
It's supposed to list the todos of user (owner)
Reproduction steps
Add an @auth(rules: [{ allow: owner }]) to any schema, even just a normal to do list, then fetch is using a simple UI. After logging in, you can see an unauthorized response
GraphQL schema(s)

# Put schemas below this line
type Note @model @auth(rules: [{ allow: owner }]){
    id: ID!
    name: String!
    description: String
    image: String
}

Log output

# Put your logs below this line

Additional information
No response

Hey @adrian-santos :wave: thanks for raising this! I was not able to reproduce this using Amplify CLI 8.5.0, can you try upgrading your CLI and re-push with a small update to your API resource?
type Todo @model @auth(rules: [{ allow: owner }]) {
  id: ID!
  name: String!
  owner: String
  description: String
}

@josefaidt - upgraded my amplify cli. it's working now

authors: adrian-santos josefaidt


text:
Amplify codegen for TypeScript uses the wrong path separator for an import

How did you install the Amplify CLI?
npm install -g @aws-amplify/cli
If applicable, what version of Node.js are you using?
19.5.0
Amplify CLI Version
12.5.0
What operating system are you using?
Windows 11
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
I didn't make any manual changes.
Describe the bug
When amplify codegen is set to generate TypeScript files, the 3 GraphQL files generated (queries.ts, mutations.ts, subscriptions.ts) all have the following line:
import * as APITypes from "..\API";

Notice that the path separator is a backslash (\) and not a forward slash (/). Because of this, JavaScript treats the \A as an escape character and is unable to import the file.
Expected behavior
I would expect the import to use a forward slash (/) as the path separator to avoid the unwanted escape character.
Reproduction steps

Run npx create-react-app amplify-test
Run cd amplify-test
Run amplify init
Leave the default configuration.
Run amplify add api
Choose the default options but choose Single object with fields for the schema template.
Run amplify codegen add
Choose TypeScript as the language target. Use the default values for the other settings.
Run amplify api gql-compile followed by amplify codegen.
Open /src/graphql/queries.ts or /src/graphql/mutations.ts or /src/graphql/subscriptions.ts and notice that they all have the invalid import line.

Project Identifier
No response
Log output
No response
Additional information
No response
Before submitting, please confirm:

[X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
[X] I have removed any sensitive information from my code snippets and submission.

Hey @ChapterSevenSeeds, thank you for reaching out. I was able to reproduce the issue. The issue appears to be occurring on windows environments.

transferring to codegen repository for further investigation.

authors: ChapterSevenSeeds ykethan

repo: aws-amplify/amplify-cli


text:
A Python Lambda runtime version

Amplify CLI Version
12.11.1
Question
The latest Amplify version still generates v3.8 Python runtime, while it will be EOL soon:

We are ending support for Python 3.8 in Lambda on October 14, 2024. This follows Python 3.8 End-Of-Life (EOL) which is scheduled for October, 2024 [1].
As described in the Lambda runtime support policy [2], end of support for language runtimes in Lambda happens in several stages. Starting on October 14, 2024, Lambda will no longer apply security patches and other updates to the Python 3.8 runtime used by Lambda functions, and functions using Python 3.8 will no longer be eligible for technical support. Also, Python 3.8 will no longer be available in the AWS Console, although you can still create and update functions that use Python 3.8 via AWS CloudFormation, the AWS CLI, AWS SAM, or other tools. Starting February 28, 2025, you will no longer be able to create new Lambda functions using the Python 3.8 runtime. Starting March 31, 2025, you will no longer be able to update existing functions using the Python 3.8 runtime.
We recommend that you upgrade your existing Python 3.8 functions to the latest available Python runtime in Lambda before October 14, 2024.

I can manually update the CloudFormation for lambda function to use v3.10 runtime, but it still will create a v3.8 venv.
Is there any plans to upgrade a default Python runtime?

Hey @imortkz, thank you for reaching, marking this as feature-request to upgrade the default python runtime.
From https://github.com/aws-amplify/amplify-cli/blob/6340adbb6f02e139128c712719d8054d8fab5ad1/packages/amplify-python-function-runtime-provider/src/util/buildUtils.ts#L10
you should be able to update the runtime in the CloudFormation template and pip file present in the function to 3.10, then run amplify build function to build the function locally before pushing.

It's supposed to work for new function only?
Tried that with already deployed Python lambda function, didn't work:
`Pipfile.lock (a89a07) out of date, updating to (296d86)...
Locking [packages] dependencies...
Building requirements...
Resolving dependencies...
✔ Success!
Locking [dev-packages] dependencies...
Updated Pipfile.lock (4575da8dd7dda667a455b5ea8c5b6bf1c2a8fde62a8d4b747ada6e2146296d86)!
Installing dependencies from Pipfile.lock (296d86)...
To activate this project's virtualenv, run pipenv shell.
Alternatively, run a command inside the virtualenv with pipenv run.
🛑 Could not find a pipenv site-packages directory at /Users/username/.local/share/virtualenvs/function-yFQL_vgG/lib/python3.10/site-packages
Learn more at: https://docs.amplify.aws/cli/project/troubleshooting/
Session Identifier: e4c545fe-1701-4253-8053-da203153cc0f`
I guess the problem is that virtualenv was already built for Python 3.8
Can you please recommend steps to migrate function from 3.8 to 3.10 properly?

@imortkz the information is currently documented here: https://docs.amplify.aws/react/build-a-backend/functions/configure-options/#updating-the-runtime

+1. Just want to emphasize these dates for the amplify team:
Starting February 28, 2025, you will no longer be able to create new Lambda functions using the Python 3.8 runtime. Starting March 31, 2025, you will no longer be able to update existing functions using the Python 3.8 runtime.

Struggled with this for a while, but I was able to successfully upgrade an existing 3.8 function to 3.11 AND build it using amplify.yml. Note - this was using the AL2023 image, not AL2. Special shout out to this guide for filling in the final pieces:
https://medium.com/@miramnair/aws-amplify-building-a-bedrock-powered-ai-model-with-python-based-lambda-function-556d501f1e5f
Steps:

Update the cfn template runtime as per guide (https://docs.amplify.aws/gen1/react/build-a-backend/functions/configure-options/#updating-the-runtime)

"Resources": {
  "LambdaFunction": {
      ...
      "Properties": {
        "Runtime": "python3.11",
        "Layers": [],
      }
      ...
    }
}

Update the Pipfile to the new runtime

[requires]
python_version = "3.11"

rebuild the lambda with the new python3.11 env (I did this using a local Anaconda 3.11 env) to update pip lockfiles

npx amplify build function <function_name>

Update my amplify.yml build commands to:

install python 3.11
install pipenv
update PATH to have access to pipenv
overwrite python3 and pip3 symlinks

version: 1
backend:
  phases:
    build:
      commands:
        # install python3.11
        # https://plainenglish.io/community/how-to-install-python-3-11-with-pip-on-amazon-linux-2023-9ab2ed
        - sudo dnf install python3.11 -y
        - sudo dnf install python3.11-pip -y
        # install pipenv directly into 3.11
        - pip3.11 install --user pipenv
        # update path
        # https://medium.com/@miramnair/aws-amplify-building-a-bedrock-powered-ai-model-with-python-based-lambda-function-556d501f1e5f
        - export PATH=$PATH:/root/.local/bin
        # update python3.11 symlinks
        # it is not recommended to overwrite the python3 symlink, but it's been working so far, so whatever
        # https://docs.aws.amazon.com/linux/al2023/ug/python.html
        - ln -fs /usr/bin/python3.11 /usr/bin/python3
        - ln -fs /usr/bin/pip3.11 /usr/bin/pip3
        - amplifyPush --simple

Committing call the changes in:

cfn templates
Pipfile files
Pipfile.lock files
amplify.yml file

Pushing all those changes FINALLY resulted in a successful build, and the lambdas deployed to the new python 3.11 runtime 😃

authors: hisham imortkz stratiform ykethan


text:
Amplify Publish is uploading huge lambda zip file containing .npm folder inside it which contains _cacache and other folders

Which Category is your question related to?
amplify cli ci/cd
Amplify CLI Version
4.13.1
What AWS Services are you utilizing?
Creating a react application on AWS as mentioned in https://aws-amplify.github.io/docs/js/react
When I am trying deploy whole stack using My dev machine and amplify CLI, stack is getting updated. But same thing when I try to deploy using Jenkins and build agents (where I don't have control over infrastructure), it is failing for lambda with this error:
Unzipped size must be smaller than 19405331 bytes (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException
On further investigation found that, the lambda zip which gets uploaded in s3 via Jenkins contains additional .npm folder in it which is increasing size and facing above error. Manually execution of same from my dev laptop doesn't contain that folder.
As per Jenkinsfile, I see no difference in amplify cli commands. Let me know if anyone have any idea for this scenario.

Issue was with Jenkins infrastructure.


text:
amplify push hosting has errror ... TypeError: Cannot read property 'client_id' of undefined

Describe the bug
When I try to push for amplify hosting. That had error.
UPDATE_FAILED
HostedUIProvidersCustomResourceInputs
Custom::LambdaCallout      Mon Mar 30 2020 18:57:29 GMT+0900 (Japan Standard Time) Failed to update resource. See the details in CloudWatch Log Stream: 2020/03/30/[$LATEST]xxxxxx
UPDATE_ROLLBACK_IN_PROGRESS amplify-xxx-dev-xxxxxx
AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:30 GMT+0900 (Japan Standard Time) The following resource(s) failed to update: [HostedUIProvidersCustomResourceInputs].
⠏ Updating resources in the cloud. This may take a few minutes...

UPDATE_FAILED
authxxxxxxxxx
AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:39 GMT+0900 (Japan Standard Time) Embedded stack arn:aws:cloudformation:ap-northeast-1:xxxxxx:stack/amplify-xxxx-dev-202249-authxxxxxxx-xxxxx/xxxxx-1111-11ea-xxxx-xxxxxxxx was not successfully updated.
Currently in UPDATE_ROLLBACK_IN_PROGRESS with reason: The following resource(s) failed to update: [HostedUIProvidersCustomResourceInputs].
CREATE_FAILED
hostingS3AndCloudFront AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:39 GMT+0900 (Japan Standard Time) Resource creation cancelled

Also the cloud watch error is following.
2020-03-30T09:57:27.950Z	xxxx-xxxx-xxxx-xxxx-xxxx
INFO. TypeError: Cannot read property 'client_id' of undefined
    at getRequestParams (/var/task/index.js:1:1053)
    at updateIdentityProvider (/var/task/index.js:1:1635)
    at hostedUIProviderMeta.forEach (/var/task/index.js:1:2373)
    at Array.forEach (<anonymous>)
    at identity.listIdentityProviders.promise.then (/var/task/index.js:1:2249)
    at process._tickCallback (internal/process/next_tick.js:68:7)
{
    "Status": "FAILED",
    "Reason": "See the details in CloudWatch Log Stream: 2020/03/30/[$LATEST]xxxx",
    "PhysicalResourceId": "2020/03/30/[$LATEST]xxxxx",
    "StackId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:stack/amplify-xxx-dev-xxxx-authxxxx-xxxxxx/xxxxx-xxxx-xxxx-xxxx-xxxx",
    "RequestId": "xxxx-xxxxx-xxxx-xxxx-xxxxxx",
    "LogicalResourceId": "HostedUIProvidersCustomResourceInputs",
    "NoEcho": false,
    "Data": {
        "err": {}
    }
}

Amplify CLI Version
$ amplify -v
4.17.2

To Reproduce
$ amplify add hosting
$ amplify status

Current Environment: dev

| Category | Resource name               | Operation | Provider plugin   |
| -------- | --------------------------- | --------- | ----------------- |
| Hosting  | S3AndCloudFront             | Create    | awscloudformation |
| Auth     | xxxxxxx                 | No Change    | awscloudformation |
| Function | xxxxCustomMessage    | No Change | awscloudformation |
| Function | xxxxPostConfirmation | No Change | awscloudformation |
| Function | AdminQueriesxxxxx        | No Change | awscloudformation |
| Auth     | userPoolGroups              | No Change | awscloudformation |
| Api      | xxx                         | No Change | awscloudformation |
| Api      | AdminQueries                | No Change | awscloudformation |
| Storage  | xxxx                  | No Change | awscloudformation |

GraphQL endpoint: https://xxxx.appsync-api.ap-northeast-1.amazonaws.com/graphql
Hosted UI Endpoint: https://xxxx-xxxx-dev.auth.ap-northeast-1.amazoncognito.com/
Test Your Hosted UI Endpoint: https://xxxx-xxxx-dev.auth.ap-northeast-1.amazoncognito.com/login?response_type=code&client_id=xxxx&xxxirect_uri=http://localhost:3000/thankyou/

$ amplify push
...
UPDATE_FAILED
HostedUIProvidersCustomResourceInputs
Custom::LambdaCallout      Mon Mar 30 2020 18:57:29 GMT+0900 (Japan Standard Time) Failed to update resource. See the details in CloudWatch Log Stream: 2020/03/30/[$LATEST]xxxxxx
UPDATE_ROLLBACK_IN_PROGRESS amplify-xxx-dev-xxxxxx
AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:30 GMT+0900 (Japan Standard Time) The following resource(s) failed to update: [HostedUIProvidersCustomResourceInputs].
⠏ Updating resources in the cloud. This may take a few minutes...

UPDATE_FAILED
authxxxxxxxxx
AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:39 GMT+0900 (Japan Standard Time) Embedded stack arn:aws:cloudformation:ap-northeast-1:xxxxxx:stack/amplify-xxxx-dev-xxxxx-authxxxxxxx-xxxxx/xxxxx-1111-11ea-xxxx-xxxxxxxx was not successfully updated.
Currently in UPDATE_ROLLBACK_IN_PROGRESS with reason: The following resource(s) failed to update: [HostedUIProvidersCustomResourceInputs].
CREATE_FAILED
hostingS3AndCloudFront AWS::CloudFormation::Stack Mon Mar 30 2020 18:57:39 GMT+0900 (Japan Standard Time) Resource creation cancelled

Expected behavior
I want to deploy amplify hosting with success.

Amplify hosting is success
Deploy to Nuxtjs with spa mode.

Desktop

OS: OSX Mojave 10.14.5 (18F132)
Node Version v10.16.3

Just running amplify push instead of amplify hosting push should solve the issue. Can you please try that?

@kaustavghosh06 Thank you for reply.
I tried that but I got same error...
$ amplify hosting push
...
UPDATE_FAILED               HostedUIProvidersCustomResourceInputs                Custom::LambdaCallout      Tue Mar 31 2020 13:13:40 GMT+0900 (Japan Standard Time) Failed to update resource. See the details in CloudWatch Log Stream: 2020/03/31/[$LATEST]xxxxxx

UPDATE_FAILED               authxxxxxxx        AWS::CloudFormation::Stack Tue Mar 31 2020 13:13:49 GMT+0900 (Japan Standard Time) Embedded stack arn:aws:cloudformation:ap-northeast-1:xxxxx:stack/amplify-xxx-dev-xxxx-authxxxxx-xxxxxx/xxxxxx-xxxx-xxxx-xxxx-xxxxxx was not successfully updated. Currently in UPDATE_ROLLBACK_IN_PROGRESS with reason: The following resource(s) failed to update: [HostedUIProvidersCustomResourceInputs].
CREATE_FAILED               hostingS3AndCloudFront AWS::CloudFormation::Stack Tue Mar 31 2020 13:13:49 GMT+0900 (Japan Standard Time) Resource creation cancelled

cloud watch log.
2020-03-31T04:13:38.849Z	a2341d3a-4a55-4570-ae06-bcff9a692cb4	INFO	TypeError: Cannot read property 'client_id' of undefined
    at getRequestParams (/var/task/index.js:1:1053)
    at updateIdentityProvider (/var/task/index.js:1:1635)
    at hostedUIProviderMeta.forEach (/var/task/index.js:1:2373)
    at Array.forEach (<anonymous>)
    at identity.listIdentityProviders.promise.then (/var/task/index.js:1:2249)
    at process._tickCallback (internal/process/next_tick.js:68:7)
2020-03-31T04:13:38.850Z	a2341d3a-4a55-4570-ae06-bcff9a692cb4	INFO	Response body:

{
    "Status": "FAILED",
    "Reason": "See the details in CloudWatch Log Stream: 2020/03/31/[$LATEST]xxxxxx",
    "PhysicalResourceId": "2020/03/31/[$LATEST]xxxxxx",
    "StackId": "arn:aws:cloudformation:ap-northeast-1:xxx:stack/amplify-xxx-dev-xxxx-authrxxxx-xxxx/xxxxx-xxxx-xxxx-xxxx-xxxxx",
    "RequestId": "xxxxxx-xxxx-xxxx-xxxx-xxxx",
    "LogicalResourceId": "HostedUIProvidersCustomResourceInputs",
    "NoEcho": false,
    "Data": {
        "err": {}
    }
}

I have multiple github repositories and these are using same amplify cloud formation.
(customer, admin)
I can't across to use multiple github repositories when I use amplify?

@kaustavghosh06  I'm having the exact same problem. I'm running amplify push because this is a React Native app. Notice that the failure is this:
TypeError: Cannot read property 'client_id' of undefined

And is related to a cloud formation update of HostedUIProvidersCustomResourceInputs, and it also started occuring after adding Facebook federation to Cognito.
Something seems to be missing. Any ideas what it could be?

I was able to figure it out.
We were using two environments: dev and prod. The prod environment was missing the Facebook credentials in amplify/team-provider-info.json, only the dev one had it.
So:
"prod": {
        "awscloudformation": {
            ...
        },
        "categories": {
            "auth": {
                "XXXXXXXXXXXXXXX": {
                    "hostedUIProviderCreds": "[{\"ProviderName\":\"Facebook\",\"client_id\":\"XXXXXXX\",\"client_secret\":\"XXXXX\"}]"
                }
            },

The above was needed, it was initially an empty array [].

I had the same issue but with Google as provider, this solution worked

Still seeing this in 4.49.0
The hostedUIProviderCreds fix worked the first time, although those values were removed from the team-provider.json file after this step:
? Amplify has been upgraded to handle secrets more securely by migrating some values in team-provider-info.json to deployment-secrets.json

But after making updates to the API component and attempting to push the changes, the same "client_id" error popped up as before.

Having the same issue. Is there any fix for the same?
It's actually taking more time to get the amplify cli work than coding the app.
I'm using ampli cli 4.50.2

Hi @indrajitb,
I had the same problem and I solved it by following the same procedure as @andreialecu but instead of doing it in amplify/team-provider-info.json, I had to do it in ~/.aws/amplify/deployment-secrets.json as these information are moved there with latest versions of the amplify cli

Hello @TheMoums - Thank you for taking your time to share your suggestion. I checked the file that you mentioned (~/.aws/amplify/deployment-secrets.json), the credentials for both FB and Google are present. What ultimately I did was to run amplify update auth again ! It fixed for me !

The thing that solved it for me was switching to my computer with access to all the social logins I was using. For me, I was using Login with apple, and that can't be configured on windows. So, often when I would run amplify push on Windows I would get the error you are describing, but whenever I used my Macbook it would work.

the same thing happened to me @ajhool.
I'm not able to reproduce it now but I'm sure it happened when I set up the auth mechanism using Admin UI and then went back to CLI (Windows installation). I wasn't aware of the ~/.aws/amplify/deployment-secrets.json file thank you @TheMoums , after update its contents it worked

authors: TheMoums ajhool andreialecu bencooper01 indrajitb jesuscovam kaustavghosh06 oscarnevarezleal ragate-tatsuyoshi


text:
How do permissions on relationship override permissions on the related model? (for versions >=7.5.0)

In the new Amplify 7.5.x, how do permissions on relationship override permissions on the related model?
For example, for graphQL schema below, can I read Message.sender.spamRating? What about Message.chat.spamRating and Message.chat.status?
type Message
  @model
  @auth(rules: [
    { provider: userPools, allow: owner, operations: [read] }
  ])
{
    id: ID!

    text: String

    sender: User @hasOne

    chat: Chat @hasOne
}

type User
  @model
  @auth(rules: [
    { provider: userPools, allow: owner, operations: [read] }
  ])
{
    id: ID!

    name: String

    spamRating: Number
      @auth(rules: [
        { provider: userPools, allow: owner, operations: [] }
      ])
}

type Chat
  @model
  @auth(rules: [
    { provider: userPools, allow: owner, operations: [] }
  ])
{
    id: ID!

    spamRating: Number

    status: Number
      @auth(rules: [
        { provider: userPools, allow: owner, operations: [read] }
      ])
}

@skryshi you may want to check out the new amplify status api -acm YOUR_MODEL_NAME command. You can use that to identify how various auth types will interact in your schema.

Thank you, will do.

authors: cjihrig skryshi


text:
fix(graphql): correct searchable instance types

This change adds the OpenSearch instance types allowed by cloudformation.
This reverts the incorrect instance types added in PR https://github.com/aws-amplify/amplify-cli/pull/9834.
This is a short term solution to unblock the customers.
Long term solution is tracked in https://github.com/aws-amplify/amplify-cli/issues/10075

Fixes https://github.com/aws-amplify/amplify-cli/issues/9956

Why not just remove the allowedValues altogether? Just let CFN define those. That way no one has to maintain the list and people that need to run an older version of the CLI are not stuck with an old list.

If we remove the allowed values list and someone misspell an instance type, the error would appear at much later time on push resulting in poor DX. We are thinking about using SDK to retrieve the allowed instance types.
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listinstancetypedetails

Codecov Report

Merging #9973 (699db62) into master (2f2229c) will decrease coverage by 0.00%.
The diff coverage is 62.50%.

@@            Coverage Diff             @@
##           master    #9973      +/-   ##
==========================================
- Coverage   54.09%   54.08%   -0.01%
==========================================
  Files         837      837
  Lines       46374    46376       +2
  Branches     9890     9891       +1
==========================================
  Hits        25084    25084
  Misses      19295    19295
- Partials     1995     1997       +2

Impacted Files
Coverage Δ

...rc/graphql-transformer/transform-graphql-schema.ts
15.41% <25.00%> (-0.12%)
:arrow_down:

...chable-transformer/src/cdk/create-cfnParameters.ts
100.00% <100.00%> (ø)

...graphql-elasticsearch-transformer/src/resources.ts
100.00% <100.00%> (ø)

:mega: Codecov can now indicate which changes are the most critical in Pull Requests. Learn more

@sundersc why were all the X.Y.search instance types removed, and only the X.Y.elasticsearch instance types kept?
I believe .elasticsearch instance types are deprecated/outdated, and .search instances are now the preferred ones. E.g. see this document describing the OpenSearch summary of changes that occurred on September 8th 2021:

Instance types in Amazon OpenSearch Service are now in the format <type>.<size>.search—for example, m6g.large.search rather than m6g.large.elasticsearch

That document goes on to say that

"Existing domains will start automatically referring to the new instance types within the API and in the Billing and Cost Management console"

BUT it seems that if this is going to happen, it hasn't yet. .elasticsearch instance types appear to result in outdated deployments which behave different from the latest ones, and which the AWS OpenSearch console prompts you to upgrade.

authors: ataibarkai codecov-commenter sundersc wvidana


text:
fix(amplify-codegen-appsync-model-plugin): include isNullable in version hash

Issue #, if available:
Given a basic schema in a JavaScript project:
type Post @model {
  id: ID!
  title: String
}

after running amplify models codegen for the first time, the schema.js file is populated as expected with a unique version hash based on the type and the fields.
However, after changing title to be required with String!, and then running amplify models codegen again, the version doesn't change.
My expectation is that a field's "required" attribute should be considered in this hash.
Description of changes:

include isNullable when calculating the version hash.

How are these changes tested:

tested locally with a sample app as described above.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

It appears to impact all platforms, since they all utilize the version. I imagine that they all would need to know if this sort of schema change happened.

The change looks good! Maybe we should add another unit test that changes the model schema and verify that the version has changed?
Also will it take care of changing between list of nullable items vs required items? intList: [Int!] vs intList: [Int]

The change looks good! Maybe we should add another unit test that changes the model schema and verify that the version has changed?
Also will it take care of changing between list of nullable items vs required items? intList: [Int!] vs intList: [Int]

Good callouts 👍
I've added some unit tests around this as well as the use-case that you pointed out. That particular case did work as expected, but that also made me realize that we should include isList in the hash for cases when a field switches from String to [String].

authors: Amplifiyer amhinson

repo: aws-amplify/amplify-codegen


text:
User email only sign in

Please describe which feature you have a question about?
User Pool atributes.
Provide additional details
I want my users to login using only their email, I have been doing the following. See image bellow:

When I use the command "amplify push" and go check I got the following. See image bellow:

I need to know what is the path to follow to get the second option in the second screen shoot.
I have been following the documentation and no result so far
What AWS Services are you utilizing?
Amplify and Cognito
@aws-amplify/cli@5.3.0
"aws-amplify": "4.2.3"
Provide additional details e.g. code snippets
See images

Hi  :wave:, thanks for raising. I'm going to transfer to the Amplify CLI repo to get some more eyes on it.

repo: aws-amplify/amplify-console


text:
"Some error occuring retrieving the IdentityId"

This app is entirely set up using Amplify, and I get this error message when trying to upload a file to S3.
Failed: Unexpected error occurred with message: Some error occuring retrieving the IdentityId.. This should not happen. There is a possibility that there is a bug if this error persists. Please take a look at https://github.com/aws-amplify/amplify-ios/issues to see if there are any existing issues that match your scenario, and file an issue with the details of the bug if there isn't. Issue encountered at:
file: ../Pods/Amplify/Amplify/Categories/Storage/Error/AuthError.swift
function: recoverySuggestion
line: 30
I am uploading a JSON file created on the mobile device, using basically the same function that is used in the Amplify Storage setup documentation.
func uploadFileToS3(tripId: String) {
    let fileName = tripId + ".json"
    let fileURL = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0].appendingPathComponent(fileName)

    _ = Amplify.Storage.uploadFile(key: fileName, local: fileURL) { (event) in
        switch event {
        case .completed(let data):
            print("Completed: \(data)")
        case .failed(let storageError):
            print("Failed: \(storageError.errorDescription). \(storageError.recoverySuggestion)")
        case .inProcess(let progress):
            print("Progress: \(progress)")
        default:
            break
        }
    }
}

hi @drshre did you also add the auth category as well (amplify add auth)? How are you authenticating your user before making this call?

hi @kneekey23, I have added the auth category and am not using guest access

Hi @drshe are you using AWSMobileClient to authenticate your user?

@kneekey23, yes I am! Using everything through AWS Amplify

Hi @drshre, thanks for reporting this issue. Since then we have released AWSCognitoAuthPlugin which replaces AWSMobileClient. The new usage looks like this: storage getting started
To reproduce the error, I provisioned the S3 bucket with only authenticated users allowed to perform operations.
? Who should have access: `Auth users only`
? What kind of access do you want for Authenticated users? `create/update, read, delete`

This means only a signed in user can perform the CRUD operations on the S3 bucket. No unauthenticated/guest access allowed.
When I run the example uploadData, without a signed in user, the error is now:
Failed: There is no user signed in to retreive identity id. Call Auth.signIn to sign in a user or enable unauthenticated access in AWS Cognito Identity Pool

You can now handle this correctly by checking that the error is the .authError case, ie.
case .failure(let storageError):
    print("Failed: \(storageError.errorDescription). \(storageError.recoverySuggestion)")
    if case .authError = storageError {
        // Auth error
    }

For more details on Auth.signIn
I will optimiscally close this issue, feel free to open another issue if you are still seeing a problem

authors: drshre kneekey23 lawmicha

repo: aws-amplify/amplify-ios


text:
Federated Users with Custom Authentication

Is your feature request related to a problem? Please describe.
At the moment, federated auth is only available when using the Web UI, which doesn't feel like a completely native experience.
Describe the solution you'd like
Allow federated authentication for custom auth flow similar to the currently working Web UI solution.
Describe alternatives you've considered
One workaround is listed here by a customer using the SDK
https://github.com/aws-amplify/aws-sdk-ios/issues/1177#issuecomment-472265432
Additional context
This may need to be escalated to the Cognito team as the functionality may not actually exist

Amplify.Auth.signInWithWebUI uses Cognito User Pool's HostedUI and can be configured to directly open social providers' sign in page, ie. create a Facebook button in the UI that opens Facebook login page as webview from the app. Without passing in any options like (link) will have a poor experience that shows the HostedUI. Although that is a use case for developers if they want to show the HostedUI as their main flow for authentication.
_ = Amplify.Auth.signInWithWebUI(for: .facebook, presentationAnchor: self.view.window!) { result in

After the user has signed in using HostedUI, a user is also created in the Cognito User Pool.
AWSMobileClient.federatedSignIn refers to a feature with Cognito Identity Pool. On Cognito Identity Pool, you can enable different providers such as Facebook, Google, Apple to sign in with, so developers retrieve the accessToken from that provider, and then pass it to Cognito Identity Pool to be authenticated (AWSMobileClient.federatedSignIn), and then make calls authenticated calls to AWS services. A user is not created in the user pool since there is no interaction with the user pool. Often times, i've seen confusion around this as one common use case is to be able to manage your users after they've signed in, like adding user attributes, adding them to cognito groups, etc.

This issue was created because of a comment I made on Twitter, so let me add my experience here.
Fundamentally this is an issue with Cognito, rather than the iOS SDK but a proper solution will impact both. For mobile apps the main point of social login is that it removes friction from the sign-up process. Facebook is by far the most important (at least on iOS, Google login is pretty popular and streamlined on Android) so I'll use that example.
What should happen is this:

There's a proper branded Facebook login button on your login page
You press it and if you have the Facebook app installed and signed in, you get auto-magically logged in after accepting the permission prompt in the Facebook app the opens - even if you never logged in before (you shouldn't need to sign-up with Facebook).

The best you can do using the hosted UI (assuming your user doesn't use Facebook in mobile Safari - which most don't) is this:

You have a proper branded Facebook login button on your login page
You press it and get taken to the Facebook login page in a Safari View Controller (note: if you use a WKWebView to make it less obviously jumping to the web, there's a decent chance Apple rejects your app - this has happened to me)
You login to Facebook on the web using your Facebook credentials (which you might not remember, because the native app always keeps you logged in!).

This somewhat defeats the object of social sign-in because you now have to enter and email and password, so you might as well have just signed in/up with email.
However, it gets worse...
If you need to use the native Facebook SDK for anything else (or maybe even if you don't - it's only happened on one of my projects with the Facebook SDK installed anyway for app install ad attribution) and Facebook reviews your app (which they seem to do somewhat randomly sometime after it has gone live) then Facebook then says you have to use native Facebook login, not a web login and threatens to remove authorisation for your app if you don't update it to fix that within a certain time limit. You are then stuck implementing native Facebook auth via Cognito custom auth yourself, and probably migrating all your live users to a new user pool because you didn't have the right settings enabled to do this and they are immutable.
You could do native Facebook login via a Cognito Identity Pool, but on all of the (~5) projects where I've used Cognito AND needed social login, this doesn't work because of the issues described:
"A user is not created in the user pool since there is no interaction with the user pool. Often times, i've seen confusion around this as one common use case is to be able to manage your users after they've signed in, like adding user attributes, adding them to cognito groups, etc.".
It's also far from ideal, because you get short-lived tokens from the Cognito Identity Pool, and no refresh token, so to keep the user logged in as is typical on mobile, you have to re-authenticate with the relevant provider and then get a new token from the identity pool.
Last but not least - this got noticeably worse after I last needed to use it, because Apple now requires you to include sign-in with Apple if you have any other third-party login options. In an iOS app, the Apple sign-in really needs to be native. I don't know if anyone got this working without the hosted UI to login to a Cognito User Pool? I only saw docs for the identity pool option.

Hi @markwilcox thanks for the insight, this is a lot of good, let me summarize what we have here

UX - HostedUI forces the user sign into the provider again even though they are already have, say the FB app, and already authenticated. This is a lot of friction since i have to enter my credentials and possible MFA code if enabled with the provider
Usabiliity - I want to be able to access the scoped down information from FB using the FB SDK and authenticate with Cognito, how do i use the FB SDK and HostedUI together?
Usability - Cognito HostedUI provides a user management through Cognito User Pool, this should be a requirement for any features that address the issues with HostedUI.
4, UX - As Apple requires all apps to have Apple Sign-in when there's any other providers present. There are two UX's to consider: HostedUI should be the almost the experience as any other provider. Cognito Identity Pool federation currently has the 10min expiry where the developer needs to ensure to prompt the user to sign in again, and the user ends up needing to sign in every 10 mins to continue to have access the authenticated parts of the app

Good summary. Just a couple of clarifications to that list:

how do i use the FB SDK and HostedUI together?

This isn't really the right question. What should mobile federated login and Cognito User Pools look like? The ideal is no hosted UI at all, but a mobile native equivalent, using the relevant native SDKs / APIs and creating you a user in the User Pool with the data from the provider, and exchanging the relevant valid provider token for a set of Cognito tokens you can then stay logged in with. The less code developers have to write themselves to make this work the better. It applies across iOS, Android and React Native (where there's quite a bit of plumbing to do to include the native SDKs for each login).

Cognito Identity Pool federation currently has the 10min expiry where the developer needs to ensure to prompt the user to sign in again, and the user ends up needing to sign in every 10 mins to continue to have access the authenticated parts of the app

I believe it's not necessary to force the user to sign in again in this scenario, as you can get usually get a refresh token from the provider. You just have to manage the complexity of refreshing the token with the provider, then using that to sign-in to the identity pool. This usually means a few network round trips, which will have some impact on your UX.
For me at least the much bigger issue with the Identity Pool route for federation, is that you almost always have your own login, so you're using a User Pool to login to the Identity Pool too, but then there's an asymmetry were you have an account for the User Pool users, but not for the federated users. The only way around this is to keep your own separate user database for both, which kind of defeats the object of using a managed service like Cognito in the first place. Unrelated point, but not being able to index and search/filter on custom attributes in Cognito (it's fairly obviously DynamoDB under the hood) makes it very limited versus an alternative like Auth0.

This issue was created because of a comment I made on Twitter, so let me add my experience here.
Fundamentally this is an issue with Cognito, rather than the iOS SDK but a proper solution will impact both. For mobile apps the main point of social login is that it removes friction from the sign-up process. Facebook is by far the most important (at least on iOS, Google login is pretty popular and streamlined on Android) so I'll use that example.
What should happen is this:

There's a proper branded Facebook login button on your login page
You press it and if you have the Facebook app installed and signed in, you get auto-magically logged in after accepting the permission prompt in the Facebook app that opens - even if you never logged in before (you shouldn't need to sign-up with Facebook).

This entire comment is so spot on, but the above quote the most relevant part... The entire purpose of using federated identities is to make the end user's life as simple as possible. Talking to friends a colleagues, the large majority of them don't even remember their Facebook credentials (whether or not this is good practice on their part is irrelevant). If a user of my app clicks a properly branded "Continue with Facebook" button and is prompted with a username and password input in a web view, they're simply going to close the app and move on. Furthermore, the Amplify Auth plugin prompts the user saying it's going to open a link to AWS Cognito, not Facebook, which is potentially another non-starter for a new user.
From my experience, the Google sign-in in a web view is actually a little bit easier to get away with, and there are generally less Google users than Facebook users anyway.
If I use FBSDKLoginKit, implement the native FBLoginButton, I get the exact behavior I want, and I also receive a true Facebook access token with which I can call the FB Graph API to get the user profile. Is there really no way to manually insert myself into the Cognito chain at this point, with the Facebook access token, and have it create and/or authenticate my user with the Cognito user pool?
Has there been any progress identifying a potential solution to this issue?

If I use FBSDKLoginKit, implement the native FBLoginButton, I get the exact behavior I want, and I also receive a true Facebook access token with which I can call the FB Graph API to get the user profile. Is there really no way to manually insert myself into the Cognito chain at this point, with the Facebook access token, and have it create and/or authenticate my user with the Cognito user pool?

There has always been a way to do this manually, it's just slow and a bit painful to do. Basically you have to use the Cognito hooks for custom auth. So you write a lambda function which takes the token from Facebook login and fetches whatever details you need in Cognito from the Facebook Graph API. If the user already exists you log them into Cognito, if they don't already exist you create them and log them in.

There has always been a way to do this manually, it's just slow and a bit painful to do. Basically you have to use the Cognito hooks for custom auth. So you write a lambda function which takes the token from Facebook login and fetches whatever details you need in Cognito from the Facebook Graph API. If the user already exists you log them into Cognito, if they don't already exist you create them and log them in.

Is there documentation and examples on how to do this for all kind of providers (FB, Google, Apple)? That would really help me getting started.
I agree that the hosted web ui is an incredible bad UX that really removes a big advantage of federated identities.

Closing this feature-request in favor of https://github.com/aws-amplify/amplify-swift/issues/1121.

authors: Kilo-Loco doneill612 flodaniel harsh62 lawmicha markwilcox

repo: aws-amplify/amplify-swift


text:
chore: update jazzy version to 0.15.1

Issue #

Failing Release Docs step due to old jazzy version
https://github.com/aws-amplify/amplify-swift/actions/runs/10357530582/job/28670225432
Description

Jazzy (sourcekitten) doesn't support Xcode 15.3 / Swift 5.10 due to incompatible changes in SwiftPM.
Fix was released in  Jazzy 0.15.0.
Related issue: https://github.com/realm/jazzy/issues/1381
General Checklist

[ ] Added new tests to cover change, if needed
[ ] Build succeeds with all target using Swift Package Manager
[ ] All unit tests pass
[ ] All integration tests pass
[ ] Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)
[ ] Documentation update for the change if required
[ ] PR title conforms to conventional commit style
[ ] New or updated tests include Given When Then inline code documentation and are named accordingly testThing_condition_expectation()
[ ] If breaking change, documentation/changelog update with migration instructions

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Testing in https://github.com/aws-amplify/amplify-swift/pull/3815, adding Ruby passed.

authors: lawmicha thisisabhash


text:
Updated walk_resource function to handle lists.

Issue #, if available: https://github.com/aws-cloudformation/aws-cloudformation-macros/issues/7
Description of changes:
Refactored the walk_resource function to handle the lists. With this change, Explode Transform works when the template has !Join function or plain items of list as a value for any property.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

We are archiving this repository in favor of similar content located here: https://github.com/aws-cloudformation/aws-cloudformation-templates/tree/main/aws/services/CloudFormation/MacrosExamples

authors: ericzbeard zechariahks


text:
Support FirelensConfiguration.

cfn-lint version: (cfn-lint --version)
cfn-lint 0.25.0
Description of issue.
This version of cfn-lint still detects FirelensConfiguration  as an error. I know this is a pretty new feature in ECS/Fargate but my organization is planning to use it and we need to pass the cfn-lint tests in our pipelines before deploying our infrastructure. Now it is not possible and is a big concern to us.

It should be there as of v0.25.5. What version are you using?  The other methodology to update is to do “cfn-lint —update-specs”.  Either an upgrade or the update specs should fix your issue.

Yup, should be in the latest us-east-1 CloudFormation Resource Specification. Updating should fix this

authors: PatMyron alexey-ktx kddejong

repo: aws-cloudformation/cfn-python-lint


text:
testing Python 3.9

https://github.com/aws-cloudformation/cfn-python-lint/issues/1520
https://tox.readthedocs.io/en/latest/example/basic.html
to start being aware of anything that doesn't work in Python 3.9 in anticipation of its release

why is this running twice?

why is this running twice thrice?

had to get rid of the Travis labels to speed up the build, so have to look at .travis.yml itself now, but there's linting, unit tests, and integration tests in Python 3.8

authors: PatMyron miparnisari


text:
Add AwsCommunity::Resource::Lookup resource type.

Issue #, if available:
Description of changes:
Add AwsCommunity::Resource::Lookup resource type.
Tests excerpts
Unit tests excerpts
[...]
[INFO] --- jacoco:0.8.9:check (jacoco-check) @ awscommunity-resource-lookup-handler ---
[...]
[INFO] Analyzed bundle 'awscommunity-resource-lookup-handler' with 10 classes
[INFO] All coverage checks have been met.
[...]
Contract tests excerpts
[...]
13 passed, 2 skipped, 9 deselected, 1 warning in 1021.84s (0:17:01)
[...]
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

I like this a lot!
A few feature requests:

Can we add a Serial or Trigger parameter (like AwsCommunity::Time::Sleep), so that you can refresh the value without changing the query (It's not a 100% clear to me from the schema if changing the query triggers a new lookup, so making that more clear might be a good thing too)?
Would AwsCommunity::Resource::Lookup be a better name, if that's the only output it can generate?

And some questions  related to that:
I think there is also a need for

a way to get other properties of a resource. This could be part of this  (there could be a JmesPathSelectorQuery and a JmesPathOutputQuery, or a separate thing (AwsCommunity::Resource::Read).
a way to get a list of resources / identifiers / properties (in that case I think it makes more sense to have a AwsCommunity::CloudControlQuery::List and AwsCommunity::CloudControlQuery::Get resource, and not the two different kinds of JmesPath). (eg. I want all the subnets of one vpc that have the type=private tag).

Can we add a Serial or Trigger parameter [...]

I am currently looking into adding and testing a LookupSerialNumber property in the schema for this.

Added in a new commit.

[...] (It's not a 100% clear to me from the schema if changing the query triggers a new lookup, so making that more clear might be a good thing too)?

Added this clarification to the description of the relevant property in the schema in the same new commit as well.

Added changes - no code changes made.  Contract tests excerpts:
13 passed, 2 skipped, 9 deselected, 1 warning

Small schema and docs updates made.  No code changes.  Contract tests excerpts:
13 passed, 2 skipped, 9 deselected, 1 warning

Another small documentation-related update made, in the schema. No code changes. Contract tests excerpts:
13 passed, 2 skipped, 9 deselected, 1 warning

Made additional changes to the README.md file.  Please review - thanks!

Added changes for using a namespace for the primary ID.  Tests excerpts:
[...]
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running com.awscommunity.resource.lookup.LookupHelperTest
[INFO] Tests run: 20, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.508 s - in com.awscommunity.resource.lookup.LookupHelperTest
[INFO] Running com.awscommunity.resource.lookup.ReadHandlerTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.779 s - in com.awscommunity.resource.lookup.ReadHandlerTest
[INFO] Running com.awscommunity.resource.lookup.CreateHandlerResourceLookupTest
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.09 s - in com.awscommunity.resource.lookup.CreateHandlerResourceLookupTest
[INFO] Running com.awscommunity.resource.lookup.CreateHandlerTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.037 s - in com.awscommunity.resource.lookup.CreateHandlerTest
[INFO] Running com.awscommunity.resource.lookup.ListHandlerTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.03 s - in com.awscommunity.resource.lookup.ListHandlerTest
[INFO] Running com.awscommunity.resource.lookup.UpdateHandlerTest
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.041 s - in com.awscommunity.resource.lookup.UpdateHandlerTest
[INFO] Running com.awscommunity.resource.lookup.ClientBuilderTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.44 s - in com.awscommunity.resource.lookup.ClientBuilderTest
[INFO] Running com.awscommunity.resource.lookup.TagHelperTest
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.013 s - in com.awscommunity.resource.lookup.TagHelperTest
[INFO] Running com.awscommunity.resource.lookup.CreateHandlerStabilizeTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.005 s - in com.awscommunity.resource.lookup.CreateHandlerStabilizeTest
[INFO] Running com.awscommunity.resource.lookup.DeleteHandlerTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.02 s - in com.awscommunity.resource.lookup.DeleteHandlerTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 63, Failures: 0, Errors: 0, Skipped: 0
[...]

[...]
INFO] --- jacoco:0.8.9:check (jacoco-check) @ awscommunity-resource-lookup-handler ---
[...]
[INFO] Analyzed bundle 'awscommunity-resource-lookup-handler' with 10 classes
[INFO] All coverage checks have been met.
[...]

13 passed, 2 skipped, 9 deselected, 1 warning

authors: benbridts mrinaudo-aws


text:
networkAcl update fails if ruleAction field has camelcase Allow/Deny

Issue #1966
Description of changes:
RCA and steps to reproduce are mentioned in the issue
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

/test all

/test all

authors: a-hilaly nnbu


text:
Feature Request: Support templates that requires package as a prestep

Describe the bug
One of the common use cases when using cloudformation is to use lambd, when handling lambda in a code base, it is crucial to have it in 2 steps, first to use aws cloudformation package followed by aws cloudformation deploy .. Currently, taskcat throws an exception because it does not simulates or does the packaging step, although all the code is already in a s3 bucket.
To Reproduce
Steps to reproduce the behavior:

Are you testing a QuickStart or Custom template? custom template
Attach or link a copy of the template if possible (remove any sensitive info)

AWSTemplateFormatVersion: '2010-09-09'
Description: Template for Lambda Sample.
Parameters:
  EnvName:
    Type: String
    Description: Name of an environment. 'dev', 'staging', 'prod' and any name.
    AllowedPattern: ^.*[^0-9]$
    ConstraintDescription: Must end with non numberic character.
Outputs:
  LambdaRoleARN:
    Description: Role for Lambda execution.
    Value:
      Fn::GetAtt:
        - LambdaRole
        - Arn
    Export:
      Name: LambdaRole
  LambdaFunctionName:
    Value:
      Ref: LambdaFunction
  LambdaFunctionARN:
    Description: Lambda function ARN.
    Value:
      Fn::GetAtt:
        - LambdaFunction
        - Arn
    Export:
      Name:
        Fn::Sub: LambdaARN-${EnvName}
Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: lambda-role
      AssumeRolePolicyDocument:
        Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Path: /
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName:
        Fn::Sub: lambda-function-${EnvName}
      Description: LambdaFunction in python 3.6
      Runtime: python3.6
      Code: ../functions/source/myfunc
      Handler: myfunc.lambda_handler
      MemorySize: 128
      Timeout: 10
      Role:
        Fn::GetAtt:
          - LambdaRole
          - Arn
      Environment:
        Variables:
          ENV:
            Fn::Sub: ${EnvName}
          TZ: UTC

Provide the parameters that you passed.  EnvName=dev
How did you install taskcat? (docker or pip3) pip3
Are you using a profile, an instance role or  access keys to run taskcat?
access keys
Is your AWS environment configured via aws configure?
yes

Expected behavior
I expect taskcat to run the test on templates that requires package before it is able to run. (current workaround is to create a yaml file per region and uploading it manually)
**Version (Please make sure you are running the latest version of taskcat)

Taskcat Version 0.9.0

Additional context
There are more cases where package is part of the standard pipeline.
Could be added to the stage create_stacks, there the code code be reused from the awscli that implement that part

Similar: #278

In good-faith, I believe this to be resolved. Please reopen if necessary.

authors: andrew-glenn drorasaf

repo: aws-ia/taskcat


text:
plan after initial deployment detects drift

Just deployed from main... initial deployment fine.. a new plan shows the a drift detection, despite doing nothing at all... The strange thing is that actually the drift is "non-existent"
These are the 3 resources with drift detected

module.aft.module.aft_lambda_layer.aws_iam_role.codebuild
resource "aws_kms_key" "aft_log_key"
resource "aws_s3_bucket_policy" "aft_logging_bucket"

all the "drifts" are policy objects where one of the principals has been replaced by another (of the same name) e.g.
~ Principal = {
                      ~ Service = [
                            - "cloudtrail.amazonaws.com",
                               "delivery.logs.amazonaws.com",
                             + "cloudtrail.amazonaws.com",
                               "vpc-flow-logs.amazonaws.com",
                            ]
                        }

running : terraform apply -refresh-only
doesn't fix the issue.. we see that one or more of the policies remains in "drift" state..

Fairly certain this is an issue in the aws provider. They have a new tracking issue, summarizing all the reported issues...

https://github.com/hashicorp/terraform-provider-aws/issues/21968

agreed.. will close this as an issue for this project

Just a note that we have a handle on the part of the problem that you mention here: nonexistent drift detections (i.e., perpetual diffs). Once we roll out the fixes that are in progress, that part should be good. However, the other part is valid out-of-band changes causing much larger diffs than they should. The extra layer of JSON wrapping seems to be causing problems there as well.

authors: YakDriver danno-rose lorengordon


text:
How to configure prometheus when add ons are managed via ArgoCd?

[x] ✋ I have searched the open/closed issues and my issue is not listed.

Please describe your question here
I'm managing add on through argo by setting argocd_manage_add_ons = true. I'm attempting to install prometheus on our cluster using the instructions described here, but enable_amazon_prometheus = true does create a AMP workspace.  My assumption was a AMP workspace should get created and the prometheus server install on our cluster would forward metrics to the workspace. Then using the workspace we could configuring various monitoring alerts for our applications. Is the assumption correct? With out a AMP workspace what value does setting enable_prometheus = true and enable_amazon_prometheus = true provide?

I'm facing the same issue

I would follow along here https://github.com/aws-ia/terraform-aws-eks-blueprints-addons/issues/114

authors: DylanWarnock bryantbiggs netzon-eladio

repo: aws-ia/terraform-aws-eks-blueprints


text:
Support for encoder-decoder models

Hi team,
I wondered if the tool has support for any encoder-decoder models too (like FLAN-T5 or FLAN-UL2)?
If not at the moment, do you have a plan for it?
Thanks!

Hi kwontaek-amazon - We support T5 models and you can find a tutorial on it here. However we are working on updating this tutorial to support the flan-t5 models. Expect that to be completed in a future release.

Hi @kwontaek-amazon , encoder-decoder models inference like T5 are supported using NeuronX Distributed library, please see T5 Tutorial in the Neuron documentation. Encoder-decoder models are not part of Transformers NeuronX current roadmap.

authors: aws-donkrets aws-maens kwontaek-amazon

repo: aws-neuron/transformers-neuronx


text:
README.md: Fixed mistake parameter precedence examples

Overview
Documentation fix for examples used to demonstrate parameter precedence.
Testing/Steps taken to ensure quality
How did you validate the changes in this PR?
N/A
Testing Instructions
N/A

/do-e2e-tests

authors: andrew-glenn wnjuguna

repo: aws-quickstart/taskcat


text:
Error: The argument "image_id" is required, but no definition was found.

I am trying to run the cloud9.sh script in Cloud9 for my aft account. Everything seems to install fine until the end I am getting this error below. How can I get past this error? I am not able to acutally view the code in this repo for some reason.
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
╷
│ Error: Missing required argument
│
│   on main.tf line 34, in resource "aws_cloud9_environment_ec2" "cloud9-aft":
│   34: resource "aws_cloud9_environment_ec2" "cloud9-aft" {
│
│ The argument "image_id" is required, but no definition was found.
Brian

relates to #16

PR #17 resolves this issue, please let me know if it still causing issue for you

authors: schwinbp wellsiau-aws

repo: aws-samples/aft-workshop-sample


text:
[Question] Using Fido2 credentials for non-signin challenges

Hey folks,
first I have to repeat myself: What a fantastic piece of work you're delivering here. This is greatly simplifying the adoption of safer authentication methods!
Now, I have a more conceptual question:
Let's imagine the use case where an admin user is trying to take some destructive action through an application's UI.
The application owners want to secure this destructive action with an additional challenge, i.e., "Confirm with your password."
With our FIDO flow, we don't have a password, but rather, we have the custom challenge through Cognito.
How would one handle this? Would we re-initiate the authentication flow? Or would we need another API for that?
Thank you!

Sorry for the late reply. You could use a step up auth flow, with webauthn for this case. An expample of this, is in the end to end example of this repo.
You'd have to make destructive actions two legged as per the step up auth docs in this repo.
If you have already implemented something else yourself, please share your solution

authors: SlootSantos ottokruse


text:
adding module compliance

Issue #, if available:
Description of changes:

Added compliance module with new notebook and readme.
Added associated pictures
Update main readme.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tested new notebook in Module 10 to demonstrate compliance practices, focusing on HardDelete operations.
Tested end-to-end, runs successfully.
Markup added as requested.
Action: Will Merge this PR now.

authors: lauerarnaud pmhargis-aws


text:
Rate exceeded when deploying PaystubAndW2Spacy

When deploying the PaystubAndW2Spacy sample code, I get

PaystubAndW2Spacy: creating CloudFormation changeset...

12:46:50 PM | CREATE_FAILED        | AWS::Logs::MetricFilter                     | TextractAsyncundef...rrorFilterB2971F4 E
Resource handler returned message: "Rate exceeded (Service: CloudWatchLogs, Status Code: 400, Request ID:
ebeed457-f9a5-4 498-aecd-f50e65b83db6)" (RequestToken: ffe99900-0a79-eb6b-b906-fcc4d4a6dce1,
HandlerErrorCode: InvalidRequest)

12:46:50 PM | CREATE_FAILED        | AWS::Logs::MetricFilter                     | TextractAsyncundef...rrorFilter83C16E6D
Resource handler returned message: "Rate exceeded (Service: CloudWatchLogs, Status Code: 400, Request ID:
dd049db8-919f-4
d78-99b9-1e398a1dcfd4)" (RequestToken: 665cbafe-6837-5970-fddd-e17f6918c5b4, HandlerErrorCode:
InvalidRequest)

12:46:51 PM | CREATE_FAILED        | AWS::Logs::MetricFilter                     | TextractAsyncWithC...tionFilter953AB54 4
Resource handler returned message: "Rate exceeded (Service: CloudWatchLogs, Status Code: 400, Request ID:
decd012c-5ebc-4 0fa-a37b-0102d738c169)" (RequestToken: e740defa-630d-3392-91d5-d77b878c8750,
HandlerErrorCode: InvalidRequest)
12:46:51 PM | CREATE_FAILED        | AWS::Logs::MetricFilter                     | TextractAsyncWithC...rrorFilter7B30D9D 3
Resource handler returned message: "Rate exceeded (Service: CloudWatchLogs, Status Code: 400, Request ID:
8ad4756a-b9ae-4 bdc-bd4a-623ea4e8d21e)" (RequestToken: 4671ef73-7ef4-921a-e9a2-4a8c734bd3ff,
HandlerErrorCode: InvalidRequest)

fixed with cc4a11e9a542d4b9916ed651e1bc7f3d75a70f90


text:
[tracking] CDK Workshop V2

Since there's been a lot of conversation about improvements to the CDK Workshop, let's talk about those so they dont' get lost to the sands of time.
The current outstanding updates to the current version of the CDK workshop include:

[ ] A Spanish translation (tracked in #1125 / #1101 )
[ ] Various fixes to the content:

[ ] #1132
[ ] #931
[ ] #1140
[ ] #1147
[ ] #1169
[ ] #676
[ ] #693
[ ] #742
[ ] #804
[ ] #1139
[ ] #1049
[ ] #1131
[ ] #1139

[ ]  Requests for improvement to the content overall:

[ ] #31
[ ] #558
[ ] #367
[ ] #409
[ ] #648
[ ] #1048 #1050
[ ] #1051

What the future of the CDK workshop looks like
I have half a mind to patch up the current content until it's "More or less correct" and make it considered the "Legacy" CDK Workshop. Take a majority of the current content, massage it down, and build it into the "Modern" CDK workshop.
This "Modern" CDK workshop would be divided into:

Introductory content: Deploying a very simple bucket that you can then call PutObject and ListObjects on, with associated roles and such.
Intermediate: Deploying a very simple container application that uses DynamoDB and some edge functions to have a page counter, built as a construct.
Advanced: Deploying a CI/CD pipeline, running the CDK Construct Hub
The Toolbox: Things that are useful to know, but don't have a "level" to them:

Aspects, Attributes, etc.
Mucking about with CloudFormation

What I want to know from the community
Given our current CDK workshop, where do you draw the lines between "intro/intermediate/advanced" topics? how would you re-design the CDK workshop today if you could?

I would add a few things for the TypeScript tutorial

[ ] Use the SDK V3
[ ] Use the NodejsFunction construct
[ ] Use node 20 and ideally explain what to do if a future node version comes out

I've just created a PR into the v1 cdk workshop with these changes

authors: SamWSoftware indrora

repo: aws-samples/aws-cdk-intro-workshop


text:
In ANFW-centralized-2az-template.yaml line 732 is duplicate of 685

in ANFW-centralized-2az-template.yaml line 732 is duplicate of 685
Looks like it should be
685 -->
SubnetCFirewallADefaultRoute:
Type: AWS::EC2::Route
DependsOn: AttachVPCC
Properties:
DestinationCidrBlock: "0.0.0.0/0"
TransitGatewayId: !Ref TransitGateway
RouteTableId: !Ref SubnetCFirewallRouteTableA
732
SubnetCFirewallADefaultRoute:   --->this should be SubnetCFirewallBDefaultRoute
Type: AWS::EC2::Route
DependsOn: AttachVPCC
Properties:
DestinationCidrBlock: "0.0.0.0/0"
TransitGatewayId: !Ref TransitGateway
RouteTableId: !Ref SubnetCFirewallRouteTableB

Fixed. Resolving the issue. Thanks.


text:
fix(appsec): access log for solution build

Issue #, if available:
https://sim.amazon.com/issues/GALI-2112
Description of changes:
fix for solution template access log of ALB
Checklist:

[x] Have you successfully deployed to an AWS account with your changes?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Please remove internal links from the PR description.

repo: aws-solutions/solution-spark-on-aws