Modifying and unchecking the field to solely embrace the present area doesn’t pull in information from different areas
CloudTrail Lake was introduced in January 2022 so it’s a newer function of AWS. Hopefully this problem will get fastened by the point you learn this.
Checkbox to incorporate solely present area or all has a glitch
If you uncheck the “Embrace solely the present area” field for an present information retailer, subsequent queries don’t decide up new occasions in different areas, nor do previous occasions in different areas present up.
If there’s a solution to set off a refresh to make that occur I couldn’t discover it within the documentation and it’s not apparent within the UI.
I don’t know if the info will present up if I wait longer however making an attempt to finish a mission and don’t need to wait to seek out out.
I created one other information retailer and unchecked the field from the begin to see if that fastened the issue.
Then I modified the editor to this new information retailer:
Initially I attempted to run a question for all occasions within the information retailer and I obtained no outcomes.
I used to be undecided if it’s because I’ve two information shops or it’s nonetheless operating.
I attempted a number of occasions in several methods till lastly my SSO Session timed out. Then I ran a question and it labored for *all* occasions. I used to be getting IAM occasions from an alternate area in addition to the occasions for the present area.
Then I went again to the unique information supply which, after was not working, I checked the field once more to solely embrace the present area’s occasions. And now, although I’ve checked the field to solely get the present area, I get occasions from all areas.
I ran my saved question to get particular actions for a selected function session and it labored.
Hidden Character Bug Switching Knowledge Shops
Once I change the info retailer to the brand new information retailer utilizing the drop down field on the left aspect of the UI and attempt to run my saved question that began all this, I get an error that claims my question is invalid. The UI is switching the info retailer ID within the question code to the brand new information retailer id after I make that change.
The issue on this case appears to be a hidden character within the question code after I use the UI to change the info retailer. I deleted and re-added the area between the FROM key phrase and the info retailer id and likewise between the info retailer id and the WHERE key phrase after which the question works. I think one thing is inserting quotes or tabs or one thing into the code that don’t present up within the UI however break issues behind the scenes.
The one downside is, though I can get the question to run, it returns no outcomes. This needs to be the identical information as the opposite information retailer. Shouldn’t it? Or do the occasions solely begin from after I created the info retailer? That wasn’t clear to me from the weblog submit or the documentation however possibly I missed one thing.
#AWSWISHLIST : Make investments extra in QA (and bug bounties!)
I don’t assume I get a free trial for this service. So I needed to pay extra cash to attempt to determine this out as I needed to ingest the info twice and extra information than I needed to within the first occasion information retailer.
Proper now, I’m giving a buyer free further time to repair errors with a brand new report engine I created over and above the work I did to create the info for the report to be able to enhance the outcomes for them. I’ve to do what I can with restricted sources. If one thing doesn’t work the way in which it ought to I make investments time to repair it (inside purpose) at no cost to the shopper.
The distinction between my firm sources and Amazon’s is billions of {dollars}. This looks like an apparent take a look at case. Perhaps make investments more cash into QA? Or let prospects use the product or free in the event you’re not by way of testing it moderately than inflicting them to pay further for assist or to attempt completely different choices to repair errors. Simply my 2 cents.
The bugs and errors trigger me to have delays making an attempt to get my services to my very own prospects. I’m making an attempt to complete the framework I’m writing about in my newest companies of weblog posts to hurry up my work, however I’ve to spend a lot time troubleshooting, I can’t get the factor I’m truly making an attempt to construct completed.
This isn’t particular to Amazon.
It’s in all places round me. That’s why I began this weblog. I report the errors I run throughout and I simply occur to be utilizing AWS proper now. It’s typically my most well-liked cloud. I just lately wrote an entire report on trials and tribulations with Azure. Far more painful expertise.
It looks like tech corporations want to take a position extra into QA and correctly coaching folks methods to take a look at software program. That requires understanding all of the paths and use circumstances and monitoring logs for errors. Maybe you additionally must pay customers to check out the services or products earlier than you launch it.
Teri Radichel
For those who favored this story please clap and comply with:
Medium: Teri Radichel or E mail Listing: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests companies by way of LinkedIn: Teri Radichel or IANS Analysis
© 2nd Sight Lab 2022
____________________________________________
Writer:
Cybersecurity for Executives within the Age of Cloud on Amazon
Want Cloud Safety Coaching? 2nd Sight Lab Cloud Safety Coaching
Is your cloud safe? Rent 2nd Sight Lab for a penetration take a look at or safety evaluation.
Have a Cybersecurity or Cloud Safety Query? Ask Teri Radichel by scheduling a name with IANS Analysis.
Cybersecurity & Cloud Safety Assets by Teri Radichel: Cybersecurity and Cloud safety lessons, articles, white papers, shows, and podcasts
