Question: How do I troubleshoot the error AccessDeniedException when I'm trying to access an Amazon DynamoDB table?

"I'm trying to access an Amazon DynamoDB table, and I get the error AccessDeniedException."

Answer: "I'm trying to access an Amazon DynamoDB table, and I get the error AccessDeniedException.Short descriptionYou might get this error due to the following reasons:The AWS Identity and Access Management (IAM) role that you used to access the DynamoDB table doesn't have the required permissions.Access to the DynamoDB table is restricted at organization level.The policy associated with the Amazon Virtual Private Cloud (Amazon VPC) endpoint for DynamoDB restricts the operation.You activated multi-factor authentication (MFA) and tried to access the table without signing in using MFA.You use a customer managed key or an AWS managed key to protect your DynamoDB tables.ResolutionThe IAM role doesn't have the required permissionsDynamoDB doesn't support resource-based policies. When you create a DynamoDB table, be sure to grant the required permissions to the IAM role that you use to access the table. You can attach the policies to IAM users, groups, or roles to grant the required permissions. For more information, see Using identity-based policies (IAM policies) with Amazon DynamoDB.You can use an AWS Command Line Interface (AWS CLI) script to troubleshoot IAM permission API call failures.Note: This AWS CLI script requires the jq command line JSON processor. For the tutorial and download instructions, see JSON output format. For distributions that use the yum package, run the following command:$ sudo yum install jqRun the following AWS CLI command:( echo "Time,Identity ARN,Event ID,Service,Action,Error,Message";>   aws cloudtrail lookup-events --start-time "2022-08-04T13:23:00Z" --end-time "2022-08-04T13:27:00Z" --query "Events[*].CloudTrailEvent" --output text \>     | jq -r ". | select(.userIdentity.arn == \"your-ARN\" and .eventType == \"AwsApiCall\" and .errorCode != null>     and (.errorCode | ascii_downcase | (contains(\"accessdenied\") or contains(\"unauthorized\"))))>     | [.eventTime, .userIdentity.arn, .eventID, .eventSource, .eventName, .errorCode, .errorMessage] | @csv"> ) | column -t -s'",'Note: Be sure to replace your-ARN with the IAM ARN for your resources.The output of this command looks similar to the following:Time                 Identity ARN                           Event ID                             Service                Action     Error Message 2022-08-04T13:24:14Z arn:aws:iam::111122223333:user/article 42f420fe-ef06-43be-98a6-d5a0a90d7b4c dynamodb.amazonaws.com ListTables AccessDenied User: arn:aws:iam::111122223333:user/article is not authorized to perform: dynamodb:ListTables on resource: arn:aws:dynamodb:us-east-1:111122223333:table/* with an explicit deny in an identity-based policy2022-08-04T13:51:22Z arn:aws:iam::111122223333:user/article b174e4e1-94a7-403e-a15f-1234aec796a6 dynamodb.amazonaws.com ListTables AccessDenied User: arn:aws:iam::111122223333:user/article is not authorized to perform: dynamodb:ListTables on resource: arn:aws:dynamodb:us-east-1:111122223333:table/* because no identity-based policy allows the dynamodb:ListTables actionThe first message in this example means that you are unable to perform the ListTables action because you have attached a permission to the user 111122223333 that denies this operation. The second message means that no identity-based policy allows the dynamodb:ListTables action.Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.Use the following best practices to be sure that your IAM role has the required permissions to access the DynamoDB table:Be sure that the IAM role isn't included in any DENY statement of the trust policy.Be sure that the IAM role is included in the ALLOW statement of the trust policy.Be sure that all IAM conditions specified in the ALLOW statement are supported by the sts:AssumeRole API action.If you're trying to access the DynamoDB table through AWS CLI, be sure that you used the correct access key ID and secret access key.For more information, see How can I get data to assist in troubleshooting IAM permission access denied or unauthorized errors?Access to the DynamoDB table is restricted at organization levelIf you get the following error when you try to access the DynamoDB table, the access was denied due to a service control policy.User: arn:aws:iam::11111222333:user/Admin is not authorized to perform: dynamodb:ListTables on resource: arn:aws:dynamodb:us-east-1:11111222333:table with an explicit deny in a service control policyTo troubleshoot this issue, check the policy that's defined at the organization level.Note: If you deny DynamoDB operations on an organization level, then none of the IAM roles present in that organization or AWS account can access DynamoDB in spite of having the required permissions.The Amazon VPC endpoint policy restricts the operationYou can use an Amazon VPC to improve the privacy and security of data transfer between the DynamoDB table and your application. When you create the endpoint, you might choose to restrict access to the table for certain users by attaching an IAM resource policy with an explicit or implicitly deny to the VPC endpoint. If you restricted access to the IAM user that's trying to access the table, then you get an error similar to the following:An error occurred (AccessDeniedException) when calling the ListTables operation: User: arn:aws:iam::111222333444:user/Admin is not authorized to perform: dynamodb:ListTables on resource: arn:aws:dynamodb:us-east-1:11111222333:table/* with an explicit deny in a VPC endpoint policyThis error indicates that there is an explicit DENY statement in the VPC endpoint policy that denies the ListTables operation for the user Admin.To view the VPC endpoint policy, run the AWS CLI command describe-vpc-endpoints.-or-Do the following:Open the Amazon VPC console.In the navigation pane, choose Endpoints.Select the VPC endpoint.Choose the Policy tab to view the endpoint policy.You tried to access the table without signing in using MFASuppose that you configured MFA in your account with the following identity-based policy:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyAllExceptListedIfNoMFA",      "Effect": "Deny",      "NotAction": [        "iam:CreateVirtualMFADevice",        "iam:EnableMFADevice",        "iam:GetUser",        "iam:ListMFADevices",        "iam:ListVirtualMFADevices",        "iam:ResyncMFADevice",        "sts:GetSessionToken"      ],      "Resource": "",      "Condition": {        "BoolIfExists": {          "aws:MultiFactorAuthPresent": "false"        }      }    }  ]}In this case, all actions except those that are required to authenticate using MFA are denied. If the IAM user isn't signed in with MFA, then all actions that are not listed in the above policy are denied, including DynamoDB actions.Your DynamoDB table uses the customer managed key or AWS managed keyWhen you create a DynamoDB table with a customer managed key or an AWS Key Management Service (AWS KMS) key, the policies on that KMS key must give DynamoDB permission to use the key on your behalf.Be sure that the IAM user that's accessing the table has the following minimum permissions on the AWS KMS key:DynamoDB uses the AWS KMS key to generate and encrypt a unique data key for the table, called the table key. To generate and encrypt this key, you must have the kms:GenerateDataKey permission.The table key is used to secure the data encryption keys that are used to encrypt the table data. If the customer managed key is modified for a table, then DynamoDB produces a new table key. Then, DynamoDB uses the new table key to re-encrypt the data encryption keys. To do this operation, you must have the kms:ReEncrypt permission.DynamoDB uses the kms:DescribeKey operation to determine if the customer managed key you selected exists within the account and Region. If the key is randomly removed, the DescribeKey call returns an error.DynamoDB uses grants to set permissions on a customer managed key. These grant permissions are used when DynamoDB performs background system maintenance and continuous data protection tasks. Grant permissions are also used to generate table keys. Therefore, be sure that you have the kms:CreateGrant permission.For more information, see How Amazon DynamoDB uses AWS KMS.Follow"


Question: How do I use AWS SAM to build a Lambda-backed custom resource in Java for CloudFormation?

I want to use Java to build an AWS Lambda-backed custom resource to implement in AWS CloudFormation.

Answer: "I want to use Java to build an AWS Lambda-backed custom resource to implement in AWS CloudFormation.Short descriptionBuilding a Java-based custom resource in Lambda for CloudFormation is a complex process, especially if you do this process manually. To set up the environment manually, you need to set up the Java development kit and runtime before you build the resource. Then, you need to package and upload the code to Amazon Simple Storage Service (Amazon S3) before you finally create the Lambda function.To simplify this process, you can use the AWS Serverless Application Model (AWS SAM). AWS SAM is an open-source framework that you can use to build serverless applications on AWS. Use this service to help build the Java custom resource, upload your codes, and deploy the custom resource and Lambda function.ResolutionCreate an instance for development1.    Create an Amazon Elastic Compute Cloud (Amazon EC2) instance to develop your resource. You can use any environment for your instance, but it's a best practice to create your instance in Amazon Linux 2 for this use case.2.    Create and assign an Amazon EC2 SSH key pair to your EC2 instance.3.    Set up an instance profile with permissions to deploy a stack and resource. Specifically, grant permissions to perform the following actions:Create a Lambda functionUpdate function codeInvoke a functionCreate a log group that stores the Lambda's log4.    After you launch your instance, log in with SSH. Use this instance as your development environment in the following section.Set up your development environmentImportant: Before you begin, install and configure the AWS Command Line Interface (AWS CLI). If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Install java-corretto11To install corretto11, run the following command:sudo rpm --import https://yum.corretto.aws/corretto.key   sudo curl -L -o /etc/yum.repos.d/corretto.repo https://yum.corretto.aws/corretto.repo  sudo yum install -y java-11-amazon-corretto-develVerify Installation with the following command:java -versionFor more information, see Install Amazon Corretto 11 on RPM-Based Linux.Install AWS SAMTo install AWS SAM, run the following command:wget https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zipunzip aws-sam-cli-linux-x86_64.zip -d sam-installationsudo ./sam-installation/installsam --versionFor more information, see Installing the AWS SAM CLI.Install GradleTo install Gradle, run the following command:wget https://services.gradle.org/distributions/gradle-7.6-bin.zipsudo mkdir /opt/gradlesudo unzip -d /opt/gradle gradle-7.6-bin.zipexport PATH=$PATH:/opt/gradle/gradle-7.6/bingradle -vFor more information, see Installing with a package manager on the Gradle website.Note: You might need to export the PATH again after you reboot. To avoid this step, append the following line to the ~/.bashrc file:export PATH=$PATH:/opt/gradle/gradle-7.6/binCreate the project and filesTo create the root folder for the SAM project, run the following command:mkdir javaBasedCustomResourcecd javaBasedCustomResource/To create the necessary folders for your project, run the following command:mkdir -p src/Function/src/main/java/Create the project files through the Vim text editor. For more information, see the Vim website. Copy the following content to run in Vim:vim template.yamlvim ./src/Function/build.gradlevim ./src/Function/src/main/java/Handler.javaYour project's structure resembles the following structural tree:.└── javaBasedCustomResource    ├── src    │   └── Function    │       ├── build.gradle    │       └── src    │           └── main    │               └── java    │                   └── Handler.java    └── template.yamlSee the following sections for the file templates to build your project.template.yamlUse the following template for the stack. This defines the Lambda function, log group, and CustomResource:Transform: AWS::Serverless-2016-10-31Resources:  CustomResourceJavaBased:    Type: AWS::CloudFormation::CustomResource    Properties:      ServiceToken: !Join ["", [ !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:", !Ref CustomResourceLambdaInJava]]      DummyKey: DummyValue  CustomResourceLambdaInJava:    Type: AWS::Serverless::Function    Properties:      Description: !Sub        - Stack ${AWS::StackName} Function ${ResourceName}        - ResourceName: CustomResourceLambdaInJava      CodeUri: src/Function      Handler: Handler::handleRequest      Runtime: java11      MemorySize: 3008      Timeout: 30      Tracing: Active  CustomResourceLambdaInJavaLogGroup:    Type: AWS::Logs::LogGroup    DeletionPolicy: Retain    Properties:      LogGroupName: !Sub /aws/lambda/${CustomResourceLambdaInJava}build.gradleUse the following file template to facilitate your java build:apply plugin: 'java'repositories {    mavenCentral()}dependencies {    implementation 'com.amazonaws:aws-lambda-java-core:1.2.2'    implementation 'com.amazonaws:aws-lambda-java-events:3.11.0'    implementation 'com.google.code.gson:gson:2.10'    }task buildZip(type: Zip) {    from compileJava    from processResources    into('lib') {        from configurations.compileClasspath    }}build.dependsOn buildZipHandler.javaLambda runs the following code. This sets the input event to a Map from which you can get the necessary endpoint URL to send back the response. Put all the needed parameters in a JSON string, and send an HTTP request to the endpoint:import com.google.gson.Gson;import java.net.URI;import java.net.http.HttpClient;import java.net.http.HttpRequest;import java.net.http.HttpResponse;import java.util.*;import java.io.*;public class Handler {    public String handleRequest(Object event) {    /* Customer workload */    System.out.println("Dummy CustomResource Job");    /* sending signal back to CFN stack */    try {        sendResponse(event);    }    catch (Exception e){        System.out.println("Got Exception!!");        e.printStackTrace(System.out);    }        return "JobFinished";    }        public void sendResponse(Object event) throws IOException, InterruptedException {    System.out.println("start sending signal");        Gson gson = new Gson();    String eventJson = gson.toJson(event);    Map map = gson.fromJson(eventJson, Map.class);        System.out.println("Request event: " + eventJson);    /* Generate response  parameters */    String putEndpoint = (String)map.get("ResponseURL");    String Status = "SUCCESS"; // "SUCCESS" or "FAILED"        String Reason = "Dummy reason for Java based Custom Resource";    String PhysicalResourceId = "CustomResourcePhysicalID";    String StackId = (String)map.get("StackId");    String RequestId = (String)map.get("RequestId");    String LogicalResourceId = (String)map.get("LogicalResourceId");    /* Building response */        String responseJson = "{\"Status\":\"" + Status + "\",\"Reason\":\"" + Reason + "\",\"PhysicalResourceId\":\"" + PhysicalResourceId + "\",\"StackId\":\"" + StackId + "\",\"RequestId\":\"" + RequestId + "\",\"LogicalResourceId\":\"" + LogicalResourceId + "\",\"NoEcho\":false,\"Data\":{\"Key\":\"Value\"}}";    System.out.println("Response event: " + responseJson);    var request = HttpRequest.newBuilder()            .uri(URI.create(putEndpoint))            .header("Content-Type", "application/json")            .PUT(HttpRequest.BodyPublishers.ofString(responseJson))            .build();        var client = HttpClient.newHttpClient();        /* Sending Response */    System.out.println("Sending Response to stack, response code: ");        var response = client.send(request, HttpResponse.BodyHandlers.ofString());        System.out.println(response.statusCode());        System.out.println(response.body());    System.out.println("Finish sending signal");    }}Deploy the project1.    After you create your AWS SAM project, run following command under the root project folder javaBasedCustomResource:sam build2.    To deploy the project, run the following command. This initiates a guide that prompts you to specify the the stack name and AWS Region where you want the resources to be created:sam deploy --guidedThis deploys a CloudFormation stack in your account with the name that you specified. The stack contains a Lambda function that runs the code from the previous steps. CloudFormation also creates the custom resource type AWS::CloudFormation::CustomResource in the same stack.When CloudFormation creates AWS::CloudFormation::CustomResource, CloudFormation also invokes the above Lambda function. In response, the Lambda function sends a SUCCESS signal back to CloudFormation. This SUCCESS signal sends the resource to CreateComplete.When you see the custom resource in the stack create successfully, this means that Lambda is also running successfully. Lambda returns the signal to the stack, and the java based custom resource initiates successfully.You can check the Lambda logs for more details on metrics such as the request event and response event. You can modify the function code to specify your own tasks or create your own resources.Follow"


Question: How do I assign a static private IP address to the master node of my Amazon EMR cluster?

I want to create a static private IP address and associate it with the master node of an Amazon EMR cluster using a bootstrap action.

Answer: "I want to create a static private IP address and associate it with the master node of an Amazon EMR cluster using a bootstrap action.ResolutionConfirm that your AWS Identity and Access Management (IAM) policy allows permissions for EMR_EC2_DefaultRole and ec2:AssignPrivateIpAddresses.Sign in to GitHub.Download the assign_private_ip.py script from AWS Labs.Save the script in an Amazon Simple Storage Service (Amazon S3) bucket.Specify the script as a custom bootstrap action while launching an Amazon EMR cluster. You can also run the script as an Amazon EMR step. The script requires an argument, which is a private IP address from the CIDR range of your subnet. The script attaches that private IP address to the network interface (eth0) of the master node. The script also configures the network settings to redirect all traffic from the secondary IP address to the primary IP address.To find the new IP address, open the Amazon Elastic Compute Cloud (Amazon EC2) console. Then, select the EC2 instance that's acting as the master node of the EMR cluster. The new IP address appears on the Description tab, in the Secondary private IPs field.Related informationHow do I determine whether to use a bootstrap action or a step in my Amazon EMR cluster?Follow"


Question: How do I create an APNs platform application for sending push notifications in Amazon SNS using the AWS CLI?

I want to create an Apple Push Notification Service (APNs) platform application in Amazon Simple Notification Service (Amazon SNS) to send push notifications. How do I create an APNs platform application using the AWS Command Line Interface (AWS CLI) instead of the Amazon SNS console?

Answer: "I want to create an Apple Push Notification Service (APNs) platform application in Amazon Simple Notification Service (Amazon SNS) to send push notifications. How do I create an APNs platform application using the AWS Command Line Interface (AWS CLI) instead of the Amazon SNS console?Short descriptionTo create an APNs platform application in Amazon SNS using the AWS CLI, run the create-platform-application command.For more information, see CreatePlatformApplication in the Amazon SNS API Reference.Note: You can also create a platform application in the Amazon SNS console.ResolutionNote: Amazon SNS push notifications aren't available in all AWS Regions. For more information, see Supported Regions for mobile applications. If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.PrerequisitesYou must have a valid application for iOS, VoIP, or MacOS. You must also have the following resources from your Apple Developer account, based on your application's authentication method:For certificate-based authenticationA valid TLS certificateFor token-based authenticationA valid token signing keyA valid Apple Team IDA valid Apple Bundle IDFor more information, see Prerequisites for Amazon SNS user notifications and Apple authentication methods in the Amazon SNS Developer Guide.To create an APNs platform application in Amazon SNS using the AWS CLIFor certificate-based authentication1.    Run the following command:Important: Replace Your_Application_Name with your application's name. Replace Certificates.p12 with your PKCS#12 file. Replace the platform value with APNS_SANDBOX or APNS, based on your use case. Make sure that you run the command in the same directory where your PKCS#12 file is located.aws sns create-platform-application --name Your_Application_Name --platform APNS_SANDBOX --attributes PlatformCredential="\"$(openssl pkcs12 -in Certificates.p12 -nodes -nocerts)\"",PlatformPrincipal="\"$(openssl pkcs12 -in Certificates.p12 -nodes -nokeys)\""Note: For Apple services using certificate credentials, PlatformCredential is a private key. PlatformPrincipal is the SSL certificate. The OpenSSL pkcs12 command parses a PKCS#12 file into a readable format for certificate-based authentication. For more information, see pkcs12 on the OpenSSL website.A prompt to enter an import password value appears.2.    For import password, enter the password that was created when you exported the PKCS#12 file from the Keychain Access app.For token-based authenticationRun the following command:Important: Replace PlatformCredential with your token signing key. Replace PlatformPrincipal with your token signing key ID. Replace ApplePlatformTeamID with your Apple Team ID. Replace ApplePlatformBundleID with your Apple Bundle ID. Replace the platform value with APNS_SANDBOX or APNS, based on your use case. Replace Token.p8 with your PKCS#8 file. Make sure that you run the command in the same directory where your PKCS#8 file is located.aws sns create-platform-application --name token --platform APNS_SANDBOX --attributes ApplePlatformTeamID=XXXXXXX,ApplePlatformBundleID=com.XXXXX,PlatformPrincipal=XXXXXXX,PlatformCredential="\"$(openssl pkcs8 -in Token.p8 -nocrypt)\""Note: For Apple services using token credentials, PlatformCredential is a token signing key. PlatformPrincipal is the token signing key ID. The OpenSSL pkcs8 command processes private keys in PKCS#8 format and parses them into a readable format for token-based authentication. For more information, see pkcs8 on the OpenSSL website.For more information about platform attributes, see SeePlatformApplicationAttributes in the Amazon SNS API Reference.Related informationMobile push API errorsSetting up a mobile appMobile push API actionsFollow"


Question: How do I troubleshoot high source latency on an AWS DMS task?

I observe high source latency on my AWS Database Migration Service (AWS DMS) task. What causes source latency during migration?

Answer: "I observe high source latency on my AWS Database Migration Service (AWS DMS) task. What causes source latency during migration?Short descriptionYou can monitor your AWS DMS task using Amazon CloudWatch metrics. During migration, you might see source latency during the ongoing replication phase—change data capture (CDC)—of an AWS DMS task. You can use the CloudWatch service metric for CDCLatencySource to monitor the source latency for an AWS DMS task. You might see source latency on an AWS DMS task if:The source database has limited resources.The AWS DMS replication instance has limited resources.The network speed between the source database and the AWS DMS replication instance is slow.AWS DMS reads new changes from the transaction logs of the source database during ongoing replication.AWS DMS task settings are inadequate or large objects (LOBs) are being migrated.The Oracle source database used for the AWS DMS task is using LogMiner for ongoing replication.ResolutionThe source database has limited resources. It's a best practice to use native monitoring for your source DB engine. Using native monitoring makes sure that your database isn't experiencing a performance bottleneck like memory contention or I/O saturation.The AWS DMS replication instance has limited resources. Monitor the replication instance metrics, such as CPUUtilization, FreeStorageSpace, and FreeableMemory. Confirm that the replication instance has enough resources to manage your task.The network speed between the source database and the AWS DMS replication instance is slow. By design, a single AWS DMS task can't use the full network bandwidth. If you have a busy production database that has lots of changes, then you might need to increase the network bandwidth. For example, use AWS Direct Connect connections.AWS DMS reads new changes from the transaction logs of the source database during ongoing replication. Depending on your source DB engine, the source transaction log can also have uncommitted data. During ongoing replication, AWS DMS reads incoming changes from the transaction logs. But AWS DMS forwards only committed changes to the target. Eventually, this can result in source latency. Monitor the replication task metrics for CDC and detailed debug logging for the SOURCE_CAPTURE component to confirm that the task is progressing.But, when the source database writes a large dataset and runs fewer commits, AWS DMS continues reading from the transaction log. AWS DMS doesn't apply changes on the target until the entire transaction is committed. This can also cause source latency. Because the source latency increases, target latency also increases.AWS DMS task settings are inadequate or large objects (LOBs) are being migrated. AWS DMS migrates LOB data for ongoing replication in two phases. First, AWS DMS creates a new row in the target table with all columns except those that have LOBs. Then, AWS DMS updates the rows that have LOBs. If you have a source database that frequently updates tables that have LOB columns, then you might see source latency. For more information, see Migrating large binary objects (LOBs).If the task has too many tables, or multiple tables contain LOB columns, then split your task into multiple tasks. If you have sets of tables that don't participate in common transactions, then divide your migration into multiple tasks. This can help increase performance. Transactional consistency is maintained within a task, so it's important that tables in separate tasks don't participate in common transactions. Also, each task independently reads the transaction stream, so don't put too much stress on the source database. For more information, see the Best practices for AWS Database Migration Service.The Oracle source database used for the AWS DMS task is using LogMiner for ongoing replication. If your source database generates a large number of redo logs, then use the binary reader method for ongoing replication. You can also use this method if the source database is using Oracle Automatic Storage Management (ASM). For more information, see Using Oracle LogMiner or AWS DMS Binary Reader for CDC.Related informationImproving the performance of an AWS DMS migrationFollow"


Question: What are my options to analyze AWS WAF logs stored in CloudWatch or Amazon S3?

"I am storing my AWS WAF logs in Amazon CloudWatch, Amazon Simple Storage Solution (Amazon S3), or Amazon S3 as the destination for my Amazon Kinesis Data Firehose delivery stream. What options do I have to analyze my AWS WAF access logs."

Answer: "I am storing my AWS WAF logs in Amazon CloudWatch, Amazon Simple Storage Solution (Amazon S3), or Amazon S3 as the destination for my Amazon Kinesis Data Firehose delivery stream. What options do I have to analyze my AWS WAF access logs.ResolutionTo analyze and filter specific log requests, use Amazon CloudWatch Logs insights for CloudWatch logs or Amazon Athena for Amazon S3 logs.Analyzing AWS WAF access logs with CloudWatch Logs insightsOpen the Amazon CloudWatch console.In the navigation pane, choose Logs, and then choose Log Insights.For Select log group(s), choose one or more log groups to query that consist of AWS WAF access logs.(Optional) Choose a time range for the period that you want to query.Use query syntax to design queries.Choose Run to view the results for the log group.These are examples queries that you can use to filter out specific information for CloudWatch Logs Insights:Filter on a specific stringRun this query to filter the log based on a specific string:Note: Replace string {jndi:ldap. with the string you want to search.fields terminatingRuleId as Rule, action, httpRequest.country as Country, httpRequest.clientIp as ClientIP, httpRequest.httpMethod as Method,httpRequest.uri as URI| parse @message /\{"name":"[Hh]ost\",\"value":\"(?<Host>[^"}]*)/| parse @message /\{"name":"[Uu]ser\-[Aa]gent\",\"value\"\:\"(?<UserAgent>[^"}]*)/| filter @message like "{jndi:ldap"| sort action, URI descFilter by hostRun this query to filter by host:Note: Replace Host value www.example.com with the Host you want to search.parse @message /\{"name":"[Hh]ost\",\"value":\"(?<Host>[^"}]*)/| filter Host = "www.example.com"| fields terminatingRuleId as Rule, action, httpRequest.country as Country, httpRequest.clientIp as ClientIP, httpRequest.uri as URIFilter on POST requestsRun this query to isolate any POST requests:parse @message /\{"name":"[Uu]ser\-[Aa]gent\",\"value\"\:\"(?<UserAgent>[^"}]*)/| parse @message /\{"name":"[Hh]ost\",\"value":\"(?<Host>[^"}]*)/| fields terminatingRuleId as Rule, action, httpRequest.country as Country, httpRequest.clientIp as ClientIP, httpRequest.httpMethod as Method, httpRequest.uri as URI, httpRequest.requestId as RequestID| filter httpRequest.httpMethod ="POST"| display Rule, action, Country, ClientIP, Method, URI, Host, UserAgent, RequestID| sort Rule, action descFilter on UserAgentRun this query to filter by UserAgent:Note: Replace User-Agent-Value with your UserAgent value**.**parse @message /\{"name":"[Uu]ser\-[Aa]gent\",\"value\"\:\"(?<UserAgent>[^"}]*)/| filter UserAgent like "<User-Agent-Value>"| fields terminatingRuleId as Rule, action, httpRequest.country as Country, httpRequest.clientIp as ClientIP, httpRequest.uri as URIFilter requests not originating from a countryRun this query to filter requests that don't originate from a specific country:fields terminatingRuleId as Rule, action, httpRequest.country as Country, httpRequest.clientIp as ClientIP, httpRequest.uri as URI| parse @message /\{"name":"[Hh]ost\",\"value":\"(?<Host>[^"}]*)/| parse @message /\{"name":"[Uu]ser\-[Aa]gent\",\"value\"\:\"(?<UserAgent>[^"}]*)/| filter Country != "US"| sort Country, action descFilter for cross-site scripting or SQL injectionRun this query to filter for cross-site scripting or SQL injection:fields @timestamp, terminatingRuleId, action, httpRequest.clientIp as ClientIP, httpRequest.country as Country, terminatingRuleMatchDetails.0.conditionType as ConditionType, terminatingRuleMatchDetails.0.location as Location, terminatingRuleMatchDetails.0.matchedData.0 as MatchedData| filter ConditionType in["XSS","SQL_INJECTION"]Time series based on a terminating ruleRun this query to filter a time series based on a terminating rule:#Time Series by Terminating Rulefilter terminatingRuleId = "AWS-AWSManagedRulesCommonRuleSet"| stats count(*) as requestCount by bin(30m)Summarize blocked requests by ClientIP, country, URI, and ruleRun this query to summarize blocked requests by ClientIP, country, URI, and rule:fields httpRequest.clientIp as ClientIP, httpRequest.country as Country, httpRequest.uri as URI, terminatingRuleId as Rule| filter action = "BLOCK"| stats count(*) as RequestCount by Country, ClientIP, URI, Rule| sort RequestCount descTop client IPsRun this query to count the top client IPs:stats count(*) as RequestCount by httpRequest.clientIp as ClientIP| sort RequestCount descTop countriesRun this query to count the top countries:stats count(*) as RequestCount by httpRequest.country as Country| sort RequestCount descTop hostsRun this query to count the top hosts:parse @message /\{"name":"[Hh]ost\",\"value":\"(?<Host>[^"}]*)/| stats count(*) as RequestCount by Host| sort RequestCount descTop methodsRun this query to count the top methods:stats count(*)as RequestCount by httpRequest.httpMethod as Method| sort RequestCount descTop terminating rulesRun this query to count the top terminating rules:stats count(*) as RequestCount by terminatingRuleId| sort RequestCount descTop UserAgentsRun this query to count the top UserAgents:parse @message /\{"name":"[Uu]ser\-[Aa]gent\",\"value\"\:\"(?<UserAgent>[^"}]*)/| stats count(*) as RequestCount by UserAgent| sort RequestCount descRequest not terminated by Default_Action or rules with action ALLOWRun this query to filter by requests not terminated by a Default_Action or rules with an ALLOW action:fields @timestamp, terminatingRuleId, action, @message| filter terminatingRuleId != 'Default_Action' and action != 'ALLOW'| sort @timestamp descRequest with invalid Captcha tokenRun this query to filter by requests with an invalid Captcha token:fields @timestamp, httpRequest.clientIp, httpRequest.requestId, captchaResponse.failureReason, @message|filter captchaResponse.failureReason ='TOKEN_MISSING'| sort @timestamp descRequest block by rate-based ruleRun this query to filter by requests blocked by a rate-based rule:fields @timestamp, httpRequest.clientIp, terminatingRuleId, httpRequest.country,@message| filter terminatingRuleType ="RATE_BASED" ## and webaclId = "arn:aws:wafv2:us-east-1:xxxxxxxx:regional/webacl/waf-test/abcdefghijkl" ## uncomment to filter for specific WebACL| sort requestCount descFilter all request detected by AWS Bot Control (ABC)Run this query to filter all requests detected by ABC:fields @timestamp, @message|filter @message like 'awswaf:managed:aws:bot-control'| parse @message '"labels":[*]' as Labels| sort @timestamp descAnalyzing AWS WAF access logs with Amazon AthenaYou can turn on AWS WAF access logging directly to an Amazon S3 bucket. Or, you can use Amazon Kinesis Data Firehose delivery stream to deliver your AWS WAF access logs to an Amazon S3 bucket. To store logs in Amazon S3, see How do I configure AWS WAF comprehensive logging to store logs in Amazon S3?When your access logs are in the Amazon S3 bucket, create the AWS WAF table to use Amazon Athena to query logs and filter various details.These queries are examples that you can use to query AWS WAF logs with Athena:Blocked requests with AWS WAF rule informationRun this Athena query to list all the blocked requests with AWS WAF rule:SELECT timestamp,    action,    httpsourcename,    httpsourceid,    httprequest.requestID,    httprequest.clientip,    webaclid,    terminatingruleid,    terminatingruletype,    rulegrouplist,    terminatingrulematchdetailsFROM "wafv2"."waf_logs"WHERE ("action" LIKE 'BLOCK')Request User AgentRun this Athena query to request the User Agent:Note: Replace User-Agent with your UserAgent value.select n.value, count(n.value) as countfrom waf_logscross joinunnest(  cast(    httprequest.headers as ARRAY(ROW(name VARCHAR, value VARCHAR))    )  ) as x(n)where n.name = 'User-Agent'group by n.valueORDER BY count(n.value) DESCRequest URIRun this Athena query to check the request URI:SELECT"httprequest"."uri", "count"(*) "count"FROM  waf_logsWHERE ("action" LIKE 'BLOCK')GROUP BY "httprequest"."uri"ORDER BY "count" DESCCount blocked requests based on ClientIPRun this Athena query to view the count of blocked requests based on ClientIP and country:SELECT  "httprequest"."clientip", "count"(*) "count", "httprequest"."country"FROMwaf_logsWHERE ("action" LIKE 'BLOCK')GROUP BY "httprequest"."clientip", "httprequest"."country"ORDER BY "count" DESCView request countRun this Athena query to view the request count:SELECT   "httprequest"."clientip", "count"(*) "count","httprequest"."country"FROM waf_logsWHERE ("action" LIKE'BLOCK')GROUP BY"httprequest"."clientip", "httprequest"."country"ORDER BY "count" DESCFor additional Athena query examples, see Example queries for AWS WAF logs.Follow"


Question: Why am I getting a limit exceeded error when adding more rules to a rule group in AWS WAF?

"When trying to add more rules to a rule group, I'm getting the error that I've exceeded a limit. What is reason for this error?"

Answer: "When trying to add more rules to a rule group, I'm getting the error that I've exceeded a limit. What is reason for this error?Short descriptionIf adding additional rules results in exceeding the rule group capacity, you get a limit exceeded error when saving the changes:In AWS WAF Classic, the error appears as "Operation would result in exceeding resource limits."In AWS WAF, the error appears as "WAFInvalidParameterException: Error reason: You exceeded the capacity limit for a rule group or web ACL., field: RULE_GROUP, parameter: xx".The following limits apply in AWS WAF Classic or AWS WAF:In AWS WAF classic, the rule groups that you create have a quota of 10 rules per rule group.In AWS WAF, the capacity of a rule group is set when it's created. This capacity can't be changed after the rule group is created.ResolutionTo resolve the limit exceeded errors, perform the following steps in AWS WAF Classic or AWS WAF:AWS WAF ClassicYou can't add more rules to rule group that has reached capacity. You must create a new rule group, and then add the rule group to the web ACL.Open the AWS WAF console.In the navigation pane, choose Switch to AWS WAF Classic.In the navigation pane, choose Rule groups.For Filter, choose the AWS Region where you want to store the IP set. To use an IP set in web ACLs that protect Amazon CloudFront distributions, you must use Global (CloudFront).Choose Create rule group.Choose Use existing rules for this group.Choose Next.Enter a Rule group name.Select a rule, and then choose Add rule. Repeat this step for all rules that you want to add.Choose Create.In the navigation pane, choose Web ACLs.Select the web ACL where you want to add the new rule group.On the Rules tab, choose Edit web ACL.For Rules, choose the new rule group.Select Add rule to web ACL.Choose Update.Note: You can only add two rule groups to a web ACL in AWS WAF Classic. If you need to add more rule groups, you must migrate to AWS WAF.AWS WAFThe capacity of the rule group can't be changed after it's created. You must create a new rule group, and then add it to the web ACL.Open the AWS WAF console.In the navigation pane, choose Rule groups.For Region, choose the AWS Region where you want to store the rule group. To use a rule group in web ACLs that protect Amazon CloudFront distributions, you must use Global (CloudFront).Choose Create rule group.Enter a Name for the rule group.Be sure the correct region is selected, and then choose Next.For Rules, add the rules for your web ACL.For Capacity, set an appropriate capacity for the rule group that allows for adding more rules later. Then, choose Next.(Optional) For Set Rule Priority, select your rules and move the priority order. The rules are processed in the order that they appear. For more information, see Processing order of rules and rule groups in a web ACL. Then, choose Next.Review the settings for the rule group. If it matches your specifications, choose Create rule group.In the navigation pane, under AWS WAF, choose Web ACLs.Select your web ACL.Choose Rules, and then choose Add Rules, Add my own rules and rule groups.For Rule Type, select Rule group.Enter a Name for the rule.For Rule Group, add your new rule group to the web ACL.Choose Add rule.Choose Save.The capacity set on the rule group is an estimation of the number and type of rules that will be added to the rule group later. For estimates of web ACL capacity units used by different types of rules, see Rule statements list.Related informationRule groupsFollow"


Question: How do I change the time zone of my Amazon RDS DB instance?

I want to change the time zone of my Amazon Relational Database Service (Amazon RDS) DB instance to the local time zone.

Answer: "I want to change the time zone of my Amazon Relational Database Service (Amazon RDS) DB instance to the local time zone.Short descriptionAll Amazon RDS DB instances use UTC/GMT time by default. Changing your time zone is optional.It’s a best practice to use the UTC time zone at the database layer. Because UTC doesn't observe daylight savings (DST), you don’t have to adjust the time later when it shifts.If you must use a local time zone, convert the time zone at the application layer instead. Before changing your time zone, consult your database administrator or application team.ResolutionThe steps required to modify the time zone of an Amazon RDS DB instance vary depending on the database engine.Oracle – To modify the time zone for Amazon Relational Database Service (Amazon RDS) for Oracle DB instances, see Setting the database time zone. To change the time zone, Oracle Database Engine version 11.2.0.2.v4 is required.PostgreSQL – To modify the time zone for Amazon RDS for PostgreSQL DB instances at the database level, set the value of the time zone parameter in a custom parameter group. The time zone parameter takes the input form of UTC-X or UTC+X. X is the number of hours that the time zone is offset from UTC time.Important: PostgreSQL processes time zones differently if you reference UTC-5 compared to America/New_York. For example, the time zone America/New_York displays UTC-5. If you set the time zone as UTC-5, it updates as UTC+5. For more information, see the PostgreSQL documentation for Date/time types.MySQL – For a DB instance running MySQL 5.5, 5.6, 5.7, and 8.0 set the time_zone parameter in the DB parameter group for the DB instance. All DB instances and read replicas that use the parameter group change to use the new time zone. You can't change the time zone for Amazon RDS for MySQL versions prior to 5.5. By default, the time zone for RDS for MySQL DB instances is Coordinated Universal Time (UTC). For more information, see Local time zone for MySQL DB instances.Amazon Aurora – To change the time zone for an Amazon Aurora DB cluster, see Local time zone for Amazon Aurora DB clusters.MariaDB – To change the time zone for a DB instance that runs MariaDB, set the time_zone parameter in the DB parameter group for the DB instance. All DB instances and read replicas that use the parameter group use the new time zone. By default, the time zone for Amazon RDS for MariaDB DB instances is Coordinated Universal Time (UTC). For more information, see Local time zone for MariaDB DB instances.Microsoft SQL Server – To change the time zone, specify the time zone when creating a new Amazon RDS for Microsoft SQL Server instance. When creating the DB instance, expand the Additional configuration section, and then choose your preferred time zone from the Time zone menu. You can’t modify the time zone after you create the instance. For more information, see Local time zone for Microsoft SQL Server DB instances.Note: This feature is available only when creating an instance from the Standard create method.Related informationWorking with parameters on your RDS for PostgreSQL DB instanceDate and time data types and functions (Transact-SQL) (Microsoft SQL Server documentation)Follow"


Question: How do I replicate tables in RDS for PostgreSQL using logical replication?

I want to replicate tables between databases in Amazon Relational Database Service (Amazon RDS) for PostgreSQL without using any extensions.

Answer: "I want to replicate tables between databases in Amazon Relational Database Service (Amazon RDS) for PostgreSQL without using any extensions.ResolutionA typical use case for logical replication is replicating a set of tables between two Amazon RDS for PostgreSQL DB instances. RDS for PostgreSQL supports logical replication with PostgreSQL 10.4 and later. Amazon Aurora PostgreSQL-Compatible Edition version 2.2.0 and later supports logical replication with PostgreSQL 10.6 and later.In the resolution provided, two source tables are replicated to two target tables using logical replication in RDS for PostgreSQL. Logical replication first performs the initial load of data already present in the source tables and then continues to replicate ongoing changes.Turn on logical replicationTo turn on logical replication in RDS for PostgreSQL, modify a custom parameter group to set rds.logical_replication to 1 and attach rds.logical_replication to the DB instance. Update the parameter group to set rds.logical_replication to 1 if a custom parameter group is attached to a DB instance. The rds.logical_replication parameter is a static parameter that requires a DB instance reboot to take effect. When the DB instance reboots, the wal_level parameter is set to logical.Verify the values for wal_level and rds.logical_replication:postgres=> SELECT name,setting FROM pg_settings WHERE name IN ('wal_level','rds.logical_replication');          name           | setting-------------------------+--------- rds.logical_replication | on wal_level               | logical(2 rows)Connect to source database in source DB instanceConnect to the source database in the source RDS for PostgreSQL DB instance. Create the source tables:source=> CREATE TABLE reptab1 (slno int primary key);CREATE TABLEsource=> CREATE TABLE reptab2 (name varchar(20));CREATE TABLEInsert data into the source tables:source=> INSERT INTO reptab1 VALUES (generate_series(1,1000));INSERT 0 1000source=> INSERT INTO reptab2 SELECT SUBSTR ('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789',((random()*(36-1)+1)::integer),1) FROM generate_series(1,50);INSERT 0 50Create a publication for source tablesCreate a publication for the source tables. Use a SELECT query to verify the details of the publication that was created:source=> CREATE PUBLICATION testpub FOR TABLE reptab1,reptab2;CREATE PUBLICATIONsource=> SELECT * FROM pg_publication;  oid   | pubname | pubowner | puballtables | pubinsert | pubupdate | pubdelete | pubtruncate | pubviaroot--------+---------+----------+--------------+-----------+-----------+-----------+-------------+------------ 115069 | testpub |    16395 | f            | t         | t         | t         | t           | f(1 row)Verify that the source tables are added to the publication:source=> SELECT * FROM pg_publication_tables; pubname | schemaname | tablename---------+------------+----------- testpub | public     | reptab1 testpub | public     | reptab2(2 rows)Note: To replicate all the tables in a database, run this command:CREATE PUBLICATION testpub FOR ALL TABLES;Connect to target database and create target tablesConnect to the target database in the target DB instance. Create the target tables with the same names as the source tables. Be sure that there's no data present in the target tables by running a SELECT query on the target tables:target=> CREATE TABLE reptab1 (slno int primary key);CREATE TABLEtarget=> CREATE TABLE reptab2 (name varchar(20));CREATE TABLEtarget=> SELECT count(*) FROM reptab1; count-------     0(1 row)target=> SELECT count(*) FROM reptab2; count-------     0(1 row)Create and verify subscription in target databaseCreate the subscription in the target database. Use a SELECT query to verify whether the subscription is enabled:target=> CREATE SUBSCRIPTION testsub CONNECTION 'host=<source RDS/host endpoint> port=5432 dbname=<source_db_name> user=<user> password=<password>' PUBLICATION testpub;NOTICE:  Created replication slot "testsub" on publisherCREATE SUBSCRIPTIONtarget=> SELECT oid,subname,subenabled,subslotname,subpublications FROM pg_subscription;  oid  | subname | subenabled | subslotname | subpublications-------+---------+------------+-------------+----------------- 16434 | testsub | t          | testsub     | {testpub}(1 row)Important: To avoid storing a plaintext version of your user name and password in the database logs, before creating the subscription, run the following commands:target=> SET log_min_messages to 'PANIC';SETtarget=> SET log_statement to NONE;SETWhen the subscription is created, the subscription loads all the data present in the source tables to the target tables. Run a SELECT query on the target tables to verify that the initial data loads:target=> SELECT count(*) FROM reptab1; count-------  1000(1 row)target=> SELECT count(*) FROM reptab2; count-------    50(1 row)Verify replication slot in source databaseThe creation of a subscription in the target database creates a replication slot in the source database. Verify the replication slot details by running the following SELECT query on the source database:source=> SELECT * FROM pg_replication_slots; slot_name |  plugin  | slot_type | datoid | database | temporary | active | active_pid | xmin | catalog_xmin | restart_lsn | confirmed_flush_lsn | wal_status | safe_wal_size ----------+----------+-----------+--------+----------+-----------+--------+------------+------+--------------+-------------+---------------------+------------+--------------- testsub   | pgoutput | logical   | 115048 | source   | f         | t      |        846 |      |         6945 | 58/B4000568 | 58/B40005A0         | reserved   |(1 row)Test replication from source tablesTest whether data changes in the source tables are being replicated to the target tables by inserting rows into the source tables:source=> INSERT INTO reptab1 VALUES(generate_series(1001,2000));INSERT 0 1000source=> INSERT INTO reptab2 SELECT SUBSTR('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789',((random()*(36-1)+1)::integer),1) FROM generate_series(1,50);INSERT 0 50source=> SELECT count(*) FROM reptab1; count-------  2000(1 row)source=> SELECT count(*) FROM reptab2; count-------   100(1 row)Test replication by verifying number of rows in target tablesVerify the number of rows in the target tables to confirm that new inserts are being replicated to the target tables:target=> SELECT count(*) FROM reptab1; count-------  2000(1 row)target=> SELECT count(*) FROM reptab2; count-------   100(1 row)Clean up and turn off logical replicationClean up and turn off logical replication when the replication is complete and is no longer required. Inactive replication slots cause the accumulation of WAL files on the source DB instances. WAL files might fill storage and cause outages.Drop the subscription on the target database:target=> DROP SUBSCRIPTION testsub;NOTICE:  Dropped replication slot "testsub" on publisherDROP SUBSCRIPTIONtarget=> SELECT * FROM pg_subscription;oid | subdbid | subname | subowner | subenabled | subconninfo | subslotname | subsynccommit | subpublications----+---------+---------+----------+------------+-------------+-------------+---------------+-----------------(0 rows)Note: Dropping the subscription also drops the replication slot the subscription created.Verify that the replication slot is dropped from the source database by running the following SELECT query statement on the source:source=> SELECT * FROM pg_replication_slots;slot_name | plugin | slot_type | datoid | database | temporary | active | active_pid | xmin | catalog_xmin | restart_lsn | confirmed_flush_lsn | wal_status | safe_wal_size----------+--------+-----------+--------+----------+-----------+--------+------------+------+--------------+-------------+---------------------+------------+--------------(0 rows)Drop the publication. Verify that the publication is dropped successfully:source=> DROP PUBLICATION testpub;DROP PUBLICATIONsource=> SELECT * FROM pg_publication; oid | pubname | pubowner | puballtables | pubinsert | pubupdate | pubdelete | pubtruncate | pubviaroot-----+---------+----------+--------------+-----------+-----------+-----------+-------------+------------(0 rows)source=> SELECT * FROM pg_publication_tables; pubname | schemaname | tablename---------+------------+-----------(0 rows)Modify rds.logical_replication to 0 in the custom parameter group that is attached to the DB instance. Reboot the DB instance as required if the DB instance is not using logical replication.Review max_replication_slots, max_wal_senders, max_logical_replication_workers, max_worker_processes, and max_sync_workers_per_subscription based on your usage.Note: The following commands check whether there are any inactive replication slots, determine the respective sizes of the slots, and then drop the slots, if required.SELECT slot_name, pg_size_pretty(pg_wal_lsn_diff(pg_current_wal_lsn(),restart_lsn)) AS replicationSlotLag, active FROM pg_replication_slots ;SELECT pg_drop_replication_slot('Your_slotname_name');Related informationPostgreSQL documentation for ReplicationFollow"


Question: How do I perform an in-place upgrade for my EC2 Windows instance?

I want to upgrade my operating system files while keeping my existing configuration and data intact. How can I perform an in-place OS upgrade for my Amazon Elastic Compute Cloud (Amazon EC2) instance?

Answer: "I want to upgrade my operating system files while keeping my existing configuration and data intact. How can I perform an in-place OS upgrade for my Amazon Elastic Compute Cloud (Amazon EC2) instance?Short descriptionThere are two methods for performing an in-place upgrade:Manual in-place upgrade.Automated in-place upgrade using the AWS Systems Manager Service.To minimize downtime, plan your upgrade before you start the upgrade. It's a best practice to maintain backups of your instances and data. Before you upgrade, consider  creating an AMI or  creating snapshots of your Amazon EBS volumes.Note: An in-place upgrade can be faster, but software incompatibilities might produce errors.ResolutionManual in-place upgrade1.    Review and understand the upgrade options, requirements, and prerequisites to confirm that you're ready to upgrade your current version of Windows. Make sure that you're running the latest version of AWS drivers on the EC2 Windows instance that you're upgrading.2.    Based on the network drivers running on your EC2 instance, choose the in-place upgrade steps:Upgrade an instance in-place with AWS PV, Intel Network Adapter, or the Enhanced Networking driversUpgrade an instance in-place with Citrix PV driversNote: To verify which driver your Windows instance uses, select Control Panel, Network Connections and then view Local Area Connection.Alternatively, you can check the output from the pnputil -e command to determine the driver type.3.    Perform required post upgrade tasks.Important Note:During the Windows in-place upgrade process, Windows Server Setup copies and processes files. Several minutes after you trigger the in-place upgrade setup, your Remote Desktop session closes. The length of time to upgrade depends on the number of applications and server roles running on your Windows Server instance. Instance status check 1 of 2 fails until the upgrade process completes.If you have problems upgrading, or the instance continues to fail status checks several hours after initiating the upgrade process, see Troubleshoot an upgrade.Automated in-place upgradeAutomated in-place upgrading using AWS Systems Manager Automation documents is available for Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2016, and SQL Server 2008 R2 with Service Pack 3.For more information, see Perform an automated upgrade.Related informationUpgrade an Amazon EC2 Windows instance to a newer version of Windows ServerHow can I upgrade my EC2 Windows Server instance OS to a newer version?Upgrade and migrate roles and features in Windows ServerFollow"


Question: How do I allow the IP address for my API Gateway API to access my integration firewall?

I want to allow an Amazon API Gateway IP address or address range to access the internet through my firewall.

Answer: "I want to allow an Amazon API Gateway IP address or address range to access the internet through my firewall.Short descriptionUse an AWS Lambda function or Amazon Elastic Compute Cloud (Amazon EC2) instance to allow your IP address to access the internet through your firewall.Complete the steps in the Set up Lambda proxy integration in API Gateway section if:You require less control over your servers.You don't want to allow your proxy to bypass API Gateway and be invoked externally.You require exponential scalability.You don't want to manually manage runtimes and apply security patches.Complete the steps in the Set up EC2 proxy integration in API Gateway section if:You must have more control over your servers.You want to allow your proxy to bypass API Gateway and be invoked externally.You must overcome the memory, timeout, and payload quotas of Lambda.ResolutionSet up Lambda proxy integration in API GatewayUse a Lambda function to set up a proxy between API Gateway and your API Gateway integration.Assign a static IP address to your Lambda function.Build the Lambda proxy integration in API Gateway.Allow the static IP address of the NAT Gateway on the integration firewall.Set up EC2 proxy integration in API GatewayYou must use an EC2 instance to set up a proxy integration between API Gateway and your API Gateway integration.Allocate an Elastic IP address.Associate your Elastic IP address with an instance or network interface.Build an HTTP proxy integration in your API Gateway integration.Important: For Endpoint URL, enter http://YOUR_ELASTIC_IP_ADDRESS/{proxy}. This option allows the request from API Gateway to be proxied to the EC2 instance and then to your integration.Allow your Elastic IP address on the integration firewall.Follow"


Question: How do I cache content in CloudFront based on HTTP headers?

I want to cache content in Amazon CloudFront based on HTTP headers. How can I do this?

Answer: "I want to cache content in Amazon CloudFront based on HTTP headers. How can I do this?Short descriptionTo configure your distribution to cache content based on HTTP headers, do one of the following:Create a cache policy and attach it to a behavior in the distributionEdit the settings of an existing legacy cache behavior in the distributionIt's a best practice to create a new cache policy to cache content. You can customize your configuration more with a new cache policy instead of editing a legacy distribution.Important: You can’t configure CloudFront to cache based on request header value for header types Connection, Host (for Amazon S3 origins), Proxy-Authorization, TE, or Upgrade. For more information, see Selecting the headers to base caching on.ResolutionCreate a cache policyCreate a cache policy using the CloudFront console.Under TTL settings, enter the values for Minimum TTL, Maximum TTL, and Default TTL to manage the amount of time that CloudFront caches objects. By default, the cached files will automatically expire after 24 hours.Under Cache key settings, for Headers, choose Include the following headers.From the Add header dropdown list, select your headers, or select Add custom to add a custom header.Complete all other settings of the cache policy based on the requirements of the behavior that you're attaching the policy to. Then, choose Create.After you create the cache policy, follow the steps to attach the policies to the relevant behavior of your CloudFront distribution.Editing the settings of an existing behaviorOpen CloudFront console, and then choose your distribution.Choose the Behaviors tab. Then, choose the path that you want to cache the content based on selected HTTP headers.Choose Edit.Under Cache key and origin requests, confirm that Legacy cache settings is selected.If Legacy cache settings isn't selected, follow the steps in the previous section to create a cache policy.-or-If Legacy cache settings is selected, do the following:For Headers, select Include the following headers.From the Add header dropdown list, select the headers that you want to cache.To manage the cache duration for the CloudFront cache, under Object Caching, choose Customize. Then specify values in the Minimum TTL, Default TTL, and Maximum TTL fields. For more information, see Object caching.Choose Save Changes.Note: To change the cache duration for an individual file, configure your origin to add a Cache-Control max-age directive, Cache-Control s-maxage directive, or Expires header. For more information, see Using headers to control cache duration for individual objects.For Amazon Simple Storage Service (Amazon S3) origins, add metadata for header values to manage the cache expiration of individual objects. For more information, see Adding headers to your objects using the Amazon S3 console.Related informationWorking with policiesCaching content based on request headersManaging how long content stays in the cache (expiration)Follow"


Question: How do I monitor my Lambda function's memory usage?

I want to monitor the memory usage of my AWS Lambda functions. How do I do that?

Answer: "I want to monitor the memory usage of my AWS Lambda functions. How do I do that?ResolutionYou can use the following AWS services and tools to monitor your Lambda functions' memory usage. For more information on monitoring function metrics, see Monitoring and observability in the Lambda operator guide.Note: To optimize your Lambda function's memory usage, see Profiling functions with AWS Lambda Power Tuning.Amazon CloudWatch Logs InsightsCloudWatch Logs Insights allows you to search and analyze log data for memory usage metrics using a specialized query syntax. For more information and example tutorials, see Analyzing log data with CloudWatch Logs Insights.For an example query that determines the amount of overprovisioned memory, see the Queries for Lambda logs section of Sample queries.Note: Running CloudWatch Logs Insights queries incurs charges to your AWS account. For more information, see Amazon CloudWatch pricing.CloudWatch Lambda InsightsCloudWatch Lambda Insights automatically collects memory usage metrics from the Lambda functions where it's installed. For more information and example tutorials, see Using Lambda Insights.For an example workflow to track and analyze memory usage, see Example workflow to detect function anomalies in the Lambda Developer Guide.For an example log event, see the Example telemetry event in the Using Lambda Insights section of the CloudWatch User Guide.Note: Installing the CloudWatch Lambda extension that's required for CloudWatch Lambda Insights incurs charges to your AWS account. For more information, see the Pricing section of Using Lambda Insights.Amazon CodeGuru Profiler (compatible with Python and Java)The Amazon CodeGuru Profiler integration for AWS Lambda collects performance data on your applications. It's compatible with applications written in Java, Python 3.6 through 3.9, and JVM languages such as Scala and Kotlin.By profiling your applications, you can monitor their metrics and receive recommendations to make them more efficient. For more information on Amazon CodeGuru Profiler, see Profiling your applications that run on AWS Lambda.Related informationOperating Lambda: Using CloudWatch Logs InsightsUnderstanding AWS Lambda behavior using Amazon CloudWatch Logs InsightsFollow"


Question: How do I install AWS Systems Manager Agent (SSM Agent) on an Amazon EC2 Windows instance at launch?

I want to know how to install AWS Systems Manager Agent (SSM Agent) on an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance at launch. I also want to keep the SSM Agent up to date.

Answer: "I want to know how to install AWS Systems Manager Agent (SSM Agent) on an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance at launch. I also want to keep the SSM Agent up to date.Short descriptionBy default, SSM Agent is installed on Windows Server 2012 R2 AMIs published in November 2016 or later. SSM Agent is also installed, by default, on Windows Server 2016, 2019 and 2022 AMIs.You must manually install SSM Agent on Amazon EC2 instances created from other versions of Windows AMIs, including images imported to AWS. You can install SSM Agent by adding user data to an Amazon EC2 Windows instance before the launch. You can keep the SSM Agent up to date by activating SSM Agent auto update under Fleet Manager settings.As of January 14, 2020, Windows Server 2008 is no longer supported for feature or security updates from Microsoft. Legacy AMIs for Windows Server 2008 and 2008 R2 still include version 2 of SSM Agent preinstalled. AWS Systems Manager no longer officially supports 2008 versions, and no longer updates the agent for these versions of Windows Server. SSM Agent version 3.0 might not be compatible with all operations on Windows Server 2008 and 2008 R2. The final officially supported version of SSM Agent for Windows Server 2008 versions is 2.3.1644.0.Important: Before installing SSM Agent, make sure that the following requirements are met:AWS System Manager - Supported Operating SystemsSystems Manager PrerequisitesResolutionInstall SSM Agent to a newly launched instance by adding user data1.    Create an AWS Identity and Access Management (IAM) instance profile to use with SSM Agent.2.    Launch a new Amazon Elastic Compute Cloud (Amazon EC2) instance. Then, configure your instance parameters, such as application and OS images, instance type, key pair, network settings, and storage.3.    Expand the Advanced Details section, in the IAM Instance Profile dropdown list, select the instance profile that you created in step 1.4.    In the User data box, enter the following information:<powershell>$dir = $env:TEMP + "\ssm"New-Item -ItemType directory -Path $dir -Forcecd $dir(New-Object System.Net.WebClient).DownloadFile("https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/windows_amd64/AmazonSSMAgentSetup.exe", $dir + "\AmazonSSMAgentSetup.exe")Start-Process .\AmazonSSMAgentSetup.exe -ArgumentList @("/q", "/log", "install.log") -Wait</powershell>For more information, see User data and the console.5.    Enter the number of instances to be launched.6.    Launch your instances.For Linux, see How do I install AWS Systems Manager Agent (SSM Agent) on an Amazon EC2 Linux instance at launch?Activate SSM Agent auto update1.    Open the AWS Systems Manager console.2.    In the navigation pane, choose Fleet Manager.3.    Choose the Settings tab, and then choose Auto update SSM Agent under Agent auto update.Note: The Auto update SSM Agent setting applies to all of the managed nodes in the Region where this setting is configured.4.    Then, configure your SSM Agent fleet:To change the version of SSM Agent that your fleet updates to, choose Edit under Agent auto update on the Settings tab. Then, enter the version number of SSM Agent you want to update to in Version under Parameters. If not specified, the agent updates to the latest version.To change the defined schedule (by default it's set to run every 14 days), choose Edit under Agent auto update on the Settings tab. Then, configure your preferred schedule using the On Schedule option under Specify schedule based on Cron and rate expressions for associations.To stop automatically deploying updated versions of SSM Agent to managed nodes in your account, choose Delete under Agent auto update on the Settings tab. This deletes the State Manager association that automatically updates SSM Agent on your managed nodes.Related informationAutomating updates to SSM AgentManually installing SSM Agent on EC2 instances for Windows ServerConfigure SSM Agent to use a proxy for Windows Server instancesSetting up AWS Systems ManagerWorking with SSM Agent on EC2 instances for Windows ServerFollow"


Question: How can I host an HTML website as a subdomain in my Lightsail WordPress instance?

I want to create an additional HTML website in my Amazon Lightsail WordPress instance as a subdomain.

Answer: "I want to create an additional HTML website in my Amazon Lightsail WordPress instance as a subdomain.Short descriptionLightsail WordPress instances have the WordPress application pre-installed. To host a subdomain in addition to your current WordPress website, create an additional virtual host in the Apache configuration file.ResolutionThe file paths in the following resolution steps might change depending on the following:The Bitnami stack uses native Linux system packages.The Bitnami stack is a self-contained installation.To identify your Bitnami installation type, run the following command:test ! -f "/opt/bitnami/common/bin/openssl" && echo "Approach A: Using system packages." || echo "Approach B: Self-contained installation."The Bitnami stack uses native Linux system packages1.    Open a new vhost file in the Apache configuration directory with the following command. In the following example command, replace sub.example.com with your subdomain's name:sudo nano /opt/bitnami/apache2/conf/vhosts/sub.example.com-vhost.conf2.    Add the following entries to the configuration file. In the following example, replace sub.example with your subdomain's name, and replace /opt/bitnami/wordpress/sub with the directory where you plan to host the subdomain:<VirtualHost *:80>    ServerName sub.example.com    DocumentRoot "/opt/bitnami/wordpress/sub"    <Directory "/opt/bitnami/wordpress/sub">    Options +MultiViews +FollowSymLinks    AllowOverride All    Require all granted    </Directory></VirtualHost>3.    To turn on HTTPS for the subdomain, purchase and install an SSL certificate for the subdomain. Then, add the following entries at the end of the vhost file /opt/bitnami/apache2/conf/vhosts/sub.example.com-vhost.conf. In the following example, replace ServerName, DocumentRoot, SSLCertificateFile, and SSLCertificateKeyFile with the correct values for your environment:<VirtualHost *:443>    ServerName sub.example.com    DocumentRoot "/opt/bitnami/wordpress/sub"    SSLEngine on    SSLCertificateFile "/opt/bitnami/apache2/conf/bitnami/certs/server.crt"    SSLCertificateKeyFile "/opt/bitnami/apache2/conf/bitnami/certs/server.key"    <Directory "/opt/bitnami/wordpress/sub">    Options +MultiViews +FollowSymLinks    AllowOverride All    Require all granted    </Directory></VirtualHost>4.    Save the file by pressing CTRL+x on the keyboard, then press Y, and then press ENTER.5.    Run the following command to restart the Apache service:sudo /opt/bitnami/ctlscript.sh restart apacheThe Bitnami stack is a self-contained installation1.    Open a new vhost file in the Apache configuration directory with the following command:sudo nano /opt/bitnami/apache2/conf/bitnami/bitnami-apps-vhosts.conf2.    Add the following entries in the file. In the following example, replace sub.example with your subdomain name, and replace /opt/bitnami/apps/wordpress/htdocs/sub with the directory where you plan to host the subdomain:<VirtualHost *:80>    ServerName sub.example.com    DocumentRoot "/opt/bitnami/apps/wordpress/htdocs/sub"    <Directory "/opt/bitnami/apps/wordpress/htdocs/sub">    Options +MultiViews +FollowSymLinks    AllowOverride All    Require all granted    </Directory></VirtualHost>3.    To activate HTTPS for the sub domain, purchase and install an SSL certificate for the subdomain. Then, add the following entries at the end of the vhost file /opt/bitnami/apache2/conf/bitnami/bitnami-apps-vhosts.conf. In the following example, replace ServerName, DocumentRoot, SSLCertificateFile, and SSLCertificateKeyFile with the correct values for your environment:<VirtualHost *:443>    ServerName sub.example.com    DocumentRoot "/opt/bitnami/apps/wordpress/htdocs/sub"    SSLEngine on    SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"    SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"    <Directory "/opt/bitnami/apps/wordpress/htdocs/sub">    Options +MultiViews +FollowSymLinks    AllowOverride All    Require all granted    </Directory></VirtualHost>4.    Save the file by pressing CTRL+x on the keyboard, then press Y, and then press ENTER.5.    Run the following command to restart Apache service:sudo /opt/bitnami/ctlscript.sh restart apacheFollow"


Question: How do I resolve the error "You must be logged in to the server (Unauthorized)" when I connect to the Amazon EKS API server?

I'm using kubectl commands to connect to the Amazon Elastic Kubernetes Service (Amazon EKS) application programming interface (API) server. I received the message "error: You must be logged in to the server (Unauthorized)".

Answer: "I'm using kubectl commands to connect to the Amazon Elastic Kubernetes Service (Amazon EKS) application programming interface (API) server. I received the message "error: You must be logged in to the server (Unauthorized)".Short descriptionYou get this error when the AWS Identity and Access Management (IAM) entity that's configured in kubectl isn't authenticated by Amazon EKS.You are authenticated and authorized to access your Amazon EKS cluster based on the IAM entity (user or role) that you use. Therefore, be sure of the following:You configured kubectl tool to use your IAM user or role.Your IAM entity is mapped to the aws-auth ConfigMap.To resolve this issue, you must complete the steps in one of the following sections based on your use case:You're the cluster creatorYou're not the cluster creatorResolutionIf you receive errors when running AWS Command Line Interface (AWS CLI) commands,  confirm that you're running a recent version of the AWS CLI.You're the cluster creatorYou're the cluster creator if your IAM entity was used to create the Amazon EKS cluster.1.    Run the following query in Amazon CloudWatch Log Insights to identify the cluster creator ARN:First, select the log group for your Amazon EKS cluster (example: /aws/eks/my-cluster/cluster). Then, run the following query:fields @logstream, @timestamp, @message| sort @timestamp desc| filter @logStream like /authenticator/| filter @message like "username=kubernetes-admin"| limit 50Note: Be sure that you turned on Amazon EKS authenticator logs.This query returns the IAM entity that's mapped as the cluster creator:@messagetime="2022-05-26T18:55:30Z" level=info msg="access granted" arn="arn:aws:iam::123456789000:user/testuser" client="127.0.0.1:57586" groups="[system:masters]" method=POST path=/authenticate uid="aws-iam-authenticator:123456789000:AROAFFXXXXXXXXXX" username=kubernetes-admin2.    Be sure that you configured the AWS CLI with the cluster creator IAM entity. To see if the IAM entity is configured for AWS CLI in your shell environment, run the following command:$ aws sts get-caller-identityYou can also run this command using a specific profile:$ aws sts get-caller-identity --profile MY-PROFILEThe output returns the Amazon Resource Name (ARN) of the IAM entity that's configured for AWS CLI.Example:{    "UserId": "XXXXXXXXXXXXXXXXXXXXX",    "Account": "XXXXXXXXXXXX",    "Arn": "arn:aws:iam::XXXXXXXXXXXX:user/testuser"}Confirm that the IAM entity that's returned matches the cluster creator IAM entity. If the returned IAM entity isn't the cluster creator, then update the AWS CLI configuration to use the cluster creator IAM entity.3.    Update or generate the kubeconfig file using the following command:$ aws eks update-kubeconfig --name eks-cluster-name --region aws-regionNote:Replace eks-cluster-name with the name of your cluster.Replace aws-region with the name of your AWS Region.To specify an AWS CLI profile, run the following command:$ aws eks update-kubeconfig --name eks-cluster-name —region aws-region —profile my-profileNote:Replace eks-cluster-name with the name of your cluster.Replace aws-region with the name of your Region.Replace my-profile with the name of your profile.4.    To confirm that the kubeconfig file is updated, run the following command:$ kubectl config view --minify5.    To confirm that your IAM entity is authenticated and that you can access your EKS cluster, run the following command:$ kubectl get svcExample output:NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGEkubernetes      ClusterIP   10.100.0.1     <none>        443/TCP   77dYou're not the cluster creatorYou're not the cluster creator if your IAM entity wasn't used to create the cluster. In this case, you must map your IAM entity to the aws-auth ConfigMap to allow access to the cluster.1.    Be sure that you configured the AWS CLI with your IAM entity. To see the IAM entity that's configured for AWS CLI in your shell environment, run the following command:$ aws sts get-caller-identityYou can also run this command using a specific profile:$ aws sts get-caller-identity --profile my-profileThe output returns the ARN of the IAM entity that's configured for AWS CLI.Example:{    "UserId": "XXXXXXXXXXXXXXXXXXXXX",    "Account": "XXXXXXXXXXXX",    "Arn": "arn:aws:iam::XXXXXXXXXXXX:user/testuser"}Confirm that the IAM entity that's returned is your IAM entity. If the returned IAM entity isn't the one used to interact with your cluster, first update the AWS CLI configuration to use the correct IAM entity. Then, retry accessing your cluster using kubectl. If the issue persists, continue to step 2.2.    If the returned IAM entity isn't the cluster creator, add your IAM entity to the aws-auth ConfigMap. This allows the IAM entity to access the cluster.Only the cluster admin can modify aws-auth ConfigMap. Therefore, do either of the following:Use the instructions in the You're cluster creator section to access the cluster using the cluster creator IAM entity.Ask the cluster admin to perform this action.Check if your IAM entity is in the aws-auth ConfigMap by running the following command:eksctl get iamidentitymapping --cluster cluster-name-or-kubectl describe configmap aws-auth -n kube-systemIf your IAM entity is in the aws-auth ConfigMap, then you can skip to step 3.Map your IAM entity automatically by running the following command:eksctl create iamidentitymapping \    --cluster $CLUSTER-NAME \    --region $REGION \    --arn arn:aws:iam::XXXXXXXXXXXX:user/testuser \    --group system:masters \    --no-duplicate-arns \    --username admin-user1Or, you can map your IAM entity manually by editing the aws-auth ConfigMap:$ kubectl edit configmap aws-auth --namespace kube-systemTo add an IAM user, add the IAM user ARN to mapUsers.Example:mapUsers: |  - userarn: arn:aws:iam::XXXXXXXXXXXX:user/testuser    username: testuser    groups:      - system:mastersTo add an IAM role, add the IAM role ARN to mapRoles.Example:mapRoles: |  - rolearn: arn:aws:iam::XXXXXXXXXXXX:role/testrole    username: testrole    groups:      - system:mastersImportant:The IAM role must be mapped without the path. To learn more about rolearn path requirements, expand the aws-auth ConfigMap does not grant access to the cluster section in Troubleshooting IAM.To specify rolearn for an AWS IAM Identity Center (successor to AWS Single Sign-On) IAM role, remove the path "/aws-reserved/sso.amazonaws.com/REGION" from the Role ARN. Otherwise, the entry in the ConfigMap can't authorize you as a valid user.The system:masters group allows superuser access to perform any action on any resource. For more information, see Default roles and role bindings. To restrict access for this user, you can create an Amazon EKS role and role binding resource. For an example of restricted access for users viewing resources in the Amazon EKS console, follow steps 2 and 3 in Required permissions.3.    Update or generate the kubeconfig file by running the following command. Be sure that the AWS CLI is configured with your IAM entity that's returned in step 1.$ aws eks update-kubeconfig --name eks-cluster-name --region aws-regionNote:Replace eks-cluster-name with the name of your cluster.Replace aws-region with the name of your AWS Region.You can also run this command using a specific profile:$ aws eks update-kubeconfig --name eks-cluster-name —region aws-region —profile my-profileNote:Replace eks-cluster-name with the name of your cluster.Replace aws-region with the name of your AWS Region.Replace my-profile with the name of your profile.4.    To confirm that the kubeconfig file is updated, run the following command:$ kubectl config view --minify5.    To confirm that your IAM user or role is authenticated, try to access the cluster again. For example, you can run the following command to confirm that the error is resolved:$ kubectl get svcExample output:NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGEkubernetes      ClusterIP   10.100.0.1     <none>        443/TCP   77dAdditional troubleshooting tipsIf the error still persists, use the following troubleshooting tips to identify the issue.When you run a kubectl command, a request is sent to the Amazon EKS cluster API server. Then, the Amazon EKS authenticator tries to authenticate this request. Therefore, check EKS authenticator logs in CloudWatch to identify the issue.1.    Be sure that you turned on logging for your Amazon EKS cluster.2.    Open CloudWatch Log Insights.3.    Select the log group for your cluster. Example: "/aws/eks/example-cluster/cluster".4.    Run the following query:fields @timestamp, @message| filter @logStream like /authenticator/| sort @timestamp desc| limit 1000Identify log lines for the same time interval when you got the error by running kubectl commands. You can find more information about the cause of the error in Amazon EKS authenticator logs.If the issue is caused by using the incorrect IAM entity for kubectl, then review the kubectl kubeconfig and AWS CLI configuration. Make sure that you're using the correct IAM entity. For example, suppose that the logs look similar to the following. This output means that the IAM entity used by kubectl can't be validated. Be sure that the IAM entity used by kubectl exists in IAM and the entity's programmatic access is turned on.time="2022-12-26T20:46:48Z" level=warning msg="access denied" client="127.0.0.1:43440" error="sts getCallerIdentity failed: error from AWS (expected 200, got 403). Body: {\"Error\":{\"Code\":\"InvalidClientTokenId\",\"Message\":\"The security token included in the request is invalid.\",\"Type\":\"Sender\"},\"RequestId\":\"a9068247-f1ab-47ef-b1b1-cda46a27be0e\"}" method=POST path=/authenticateIf the issue because your IAM entity isn't mapped in aws-auth ConfigMap, or is incorrectly mapped, then review the aws-auth ConfigMap. Make sure that the IAM entity is mapped correctly and meets the requirements that are listed in the You're not cluster creator section. In this case, the EKS authenticator logs look similar to the following:time="2022-12-28T15:37:19Z" level=warning msg="access denied" arn="arn:aws:iam::XXXXXXXXXX:role/admin-test-role" client="127.0.0.1:33384" error="ARN is not mapped" method=POST path=/authenticateIf the aws-auth ConfigMap was updated and you lost access to the cluster, you can access the cluster using the IAM entity of the cluster creator. This is because the cluster creator doesn’t need to be mapped in the aws-auth ConfigMap.If the cluster creator IAM entity was deleted, first create the same IAM user or role again. Then, access the cluster using this IAM entity by following the steps in You're the cluster creator section.If the cluster creator is an IAM role that was created for an SSO user that was removed, then you can't create this IAM role again. In this case, reach out to AWS Support for assistance.Related informationTurning on IAM user and role access to your clusterHow do I provide access to other IAM users and roles after cluster creation in Amazon EKS?Amazon EKS troubleshootingKubernetes documentation for Using RBAC authorizationFollow"


Question: Can I push server access logs about an Amazon S3 bucket into the same bucket?

I turned on server access logging for my Amazon Simple Storage Service (Amazon S3) bucket. I want to send the logs to the same bucket.

Answer: "I turned on server access logging for my Amazon Simple Storage Service (Amazon S3) bucket. I want to send the logs to the same bucket.ResolutionIt's not a best practice to push server access logs about a bucket into the same bucket. If you configured your server access logs this way, then there would be an infinite loop of logs. This is because when you write a log file to a bucket, the bucket is also accessed, which then generates another log. A log file would be generated for every log written to the bucket, which creates a loop. This would create many logs and increase your storage costs.Follow"


Question: How can I be notified when an AWS resource is non-compliant using AWS Config?

"I created an Amazon EventBridge rule to trigger notifications when AWS resources are non-compliant, but the responses are in JSON format. How can I receive an email with a customized notification?"

Answer: "I created an Amazon EventBridge rule to trigger notifications when AWS resources are non-compliant, but the responses are in JSON format. How can I receive an email with a customized notification?Short descriptionUse an EventBridge rule with a custom event pattern and an input transformer to match an AWS Config evaluation rule output as NON_COMPLIANT. Then, route the response to an Amazon Simple Notification Service (Amazon SNS) topic.ResolutionIn the following example, SNS notifications are received when the ec2-security-group-attached-to-eni managed rule reports AWS resources as NON_COMPLIANT for an Amazon Elastic Compute Cloud (Amazon EC2) security group.Note: You can replace the AWS Config resource type and rule for your specific AWS service and the AWS Config rules.1.    If you haven't already created an Amazon SNS topic, follow the instructions for Getting started with Amazon SNS.Important: The Amazon SNS topic must be in the same Region as your AWS Config service.2.    Open the EventBridge console.3.    Choose Create rule.4.    Name, enter a name for your rule. If needed, enter a Description.5.    For Rule type, choose Rule with an event pattern. Then, choose Next.6.    For Event source, choose AWS events or EventBridge partner events.7.    In the Event pattern pane, choose Custom patterns (JSON editor), and then copy and paste the following example event pattern:{  "source": [    "aws.config"  ],  "detail-type": [    "Config Rules Compliance Change"  ],  "detail": {    "messageType": [      "ComplianceChangeNotification"    ],    "configRuleName": [      "ec2-security-group-attached-to-eni"    ],    "resourceType": [      "AWS::EC2::SecurityGroup"    ],    "newEvaluationResult": {      "complianceType": [        "NON_COMPLIANT"      ]    }  }}8.    Choose Next.9.    For Target types, select AWS service.10.    For Select a target, choose SNS topic.11.    For Topic, choose your SNS topic.12.    Expand Additional settings. Then, for Configure target input, choose Input transformer.Choose Configure input transformer. Under Target input transformer, for the Input Path text box, copy and paste the following example path:{  "awsRegion": "$.detail.awsRegion",  "resourceId": "$.detail.resourceId",  "awsAccountId": "$.detail.awsAccountId",  "compliance": "$.detail.newEvaluationResult.complianceType",  "rule": "$.detail.configRuleName",  "time": "$.detail.newEvaluationResult.resultRecordedTime",  "resourceType": "$.detail.resourceType"}14.    In the Template text box, copy and paste the following example template. Enter the time, rule, resource type, resource ID, AWS account ID and AWS Region, compliance, and resource information as required by your use case."On <time> AWS Config rule <rule> evaluated the <resourceType> with Id <resourceId> in the account <awsAccountId> region <awsRegion> as <compliance> For more details open the AWS Config console at https://console.aws.amazon.com/config/home?region=<awsRegion>#/timeline/<resourceType>/<resourceId>/configuration"15.    Choose Confirm. Then, choose Next.16.    Optionally, you can Add new tag. Then, choose Next.17.    Choose Create rule.18.    After an event type is triggered, you receive an SNS email notification with the custom fields populated from step 13 similar to the following:"On ExampleTime AWS Config rule ExampleRuleName evaluated the ExampleResourceType with Id ExampleResource_ID in the account ExampleAccount_Id in Region ExampleRegion as ExamplecomplianceType. For more details open the AWS Config console at https://console.aws.amazon.com/config/home?region=ExampleRegion#/timeline/ExampleResourceType/ExampleResource_ID/configuration"Related informationHow can I be notified when changes are made to Route 53 hosted zone records?How can I receive custom email notifications when a resource is created in my AWS account using AWS Config service?How can I configure an EventBridge rule for GuardDuty to send custom SNS notifications if specific AWS service event types trigger?Follow"


Question: How can I add or modify extra connection attributes for an AWS DMS endpoint?

How can I add or modify extra connection attributes for an AWS Database Migration Service (AWS DMS) endpoint?

Answer: "How can I add or modify extra connection attributes for an AWS Database Migration Service (AWS DMS) endpoint?Short descriptionExtra connection attributes define the additional endpoint-specific settings for AWS DMS. For example, you can use extra connection attributes to control the timeout settings or time zone settings of your endpoint. To add or modify extra connection attributes for your AWS DMS endpoint, you can use the AWS DMS console or the AWS Command Line Interface (AWS CLI).ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Create a new endpoint with extra connection attributes using the AWS DMS console1.    Open the AWS DMS console and choose the AWS Region that you want to create the endpoint in.2.    ChooseEndpointsfrom the navigation pane.3.    Choose Create endpoint.4.    Choose the Endpoint type and enter the Endpoint configuration details.5.    Expand the Endpoint-specific settings section.6.    In the Extra connection attributes field, enter the name of the extra connection attribute.Note: For multiple extra connection attributes, enter the name and value of each attribute separated with a semicolon and no spaces, for example: encryptionMode=SSE_KMS;maxFileSize=5127.    Optionally, choose a KMS key.8.    Expand the Test endpoint connection section.9.    Choose your VPC and Replication instance.9.    Choose Run test.10.    After the test is successful, choose Create endpoint.Add extra connection attributes to an existing endpoint using the AWS DMS console1.    Open the AWS DMS console, and select the AWS Region that the endpoint is in.2.    Choose Endpoints from the navigation pane, and select the endpoint that you want to modify.3.    Choose Actions, and then choose Modify.4.    Expand the Endpoint-specific settings section, and enter the extra connection attributes.5.    Choose Save.6.    From the Endpoints pane, select the endpoint again.7.    Choose Actions, and then choose Test connection.8.    Select your Replication instance, and choose Run test.Create a new endpoint with extra connection attributes using the AWS CLI1.    Install and configure the AWS CLI. Be sure to set the AWS Region that you want to create the endpoint in.2.    Run the create-endpoint command similar to the following:aws dms create-endpoint--endpoint-identifier <value>--endpoint-type <value>--engine-name <value>--username <value>--password <value>--server-name <value>--port <value>--extra-connection-attributes    encryptionMode=SSE_KMS;maxFileSize=5123.    Test the connectivity of the new endpoint with the replication instance:aws dms test-connection--replication-instance-arn <value>--endpoint-arn <value>Add extra connection attributes to an existing endpoint using the AWS CLI<br>1.    Install and configure the AWS CLI. Be sure to set the AWS Region that the endpoint is in.2.    Run the modify-endpoint command similar to the following:aws dms modify-endpoint--endpoint-arn <value>--extra-connection-attributes encryptionMode=SSE_KMS;maxFileSize=5123.    Test the connectivity of the modified endpoint with the replication instance:aws dms test-connection--replication-instance-arn <value>--endpoint-arn <value>Related informationWorking with AWS DMS endpointsFollow"


Question: Why do I receive a "No Invocations to Execute" message from my Systems Manager maintenance window?

"I created a maintenance window that runs an AWS Systems Manager Automation targeting Amazon Elastic Compute Cloud (Amazon EC2) instance tags. When the automation runs, I receive a "No Invocations to Execute" message."

Answer: "I created a maintenance window that runs an AWS Systems Manager Automation targeting Amazon Elastic Compute Cloud (Amazon EC2) instance tags. When the automation runs, I receive a "No Invocations to Execute" message.Short descriptionWhen you run a maintenance window that targets instances that use Amazon EC2 instance tags, the instance IDs for managed instances resolve when the Automation runs. The instance ID won't resolve as a target if either of the following is true:The target instance isn't reporting as a managed instance when the Automation runsThe target instance is stopped when the maintenance window runsWhen an instance ID can't resolve as a target, then the "No Invocations to Execute" message appears in the output.ResolutionTo target a non-managed instance or an instance that is stopped when the maintenance window runs, follow these steps:Create a new resource group that is limited to Amazon EC2 instances, and then specify your tags. For more information and for instructions to create a tag-based group, see Creating query-based groups in AWS Resource Groups.Update the AWS Identity and Access Management (IAM) policies attached to the Automation role to include read-only access for the resource group.Register the target to a maintenance window. For Targets, choose the tag-based resource group that you created in step 1 of this article.Update the maintenance window Automation task to target the resource group target that you created in the previous step.For the Automation task InstanceId input parameter, enter the pseudo parameter {{RESOURCE_ID}}.Related informationWhy is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?AWS Resource Groups identity-based policy examplesWhy do I receive a "No Instances in Tag" message from my Systems Manager maintenance window?Follow"


Question: "When other AWS accounts upload objects to my Amazon S3 bucket, how can I require that they grant me full control of the objects?"

"I want users from other AWS accounts to be able to upload objects to my Amazon Simple Storage Service (Amazon S3) bucket. However, I want to require that users grant me full control of those objects. How can I do that?"

Answer: "I want users from other AWS accounts to be able to upload objects to my Amazon Simple Storage Service (Amazon S3) bucket. However, I want to require that users grant me full control of those objects. How can I do that?ResolutionAdd a bucket policy that requires users to include the bucket-owner-full-control access control list (ACL) when they upload objects to your bucket.For example, this bucket policy specifies that ExampleUser can upload objects to DOC-EXAMPLE-BUCKET only when the object's ACL is set to bucket-owner-full-control:{    "Id": "Policy1541018284691",    "Version": "2012-10-17",    "Statement": [        {            "Sid": "Stmt1541018283275",            "Action": [                "s3:PutObject",                "s3:PutObjectAcl"            ],            "Effect": "Allow",            "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",            "Condition": {                "StringEquals": {                    "s3:x-amz-acl": "bucket-owner-full-control"                }            },            "Principal": {                "AWS": [                    "arn:aws:iam::111122223333:user/ExampleUser"                ]            }        }    ]}After you add this bucket policy, users must include the required ACL as part of the upload request, similar to the following:aws s3 cp example.jpg s3://DOC-EXAMPLE-BUCKET --acl bucket-owner-full-controlIf users fail to meet the ACL requirement in their upload request, then they receive the error message "An error occurred (AccessDenied) when calling the PutObject operation: Access Denied".For existing objects in your bucket that are owned by other accounts, the object owner can run a put-object-acl command to grant you full control:aws s3api put-object-acl --bucket DOC-EXAMPLE-BUCKET --key example.jpg --acl bucket-owner-full-controlThe bucket-owner-full-control ACL grants the bucket owner full access to an object uploaded by another account, but this ACL alone doesn't grant ownership of the object. To automatically get ownership of objects uploaded with the bucket-owner-full-control ACL, set S3 Object Ownership to bucket owner preferred. After you update S3 Object Ownership, new objects uploaded with the bucket-owner-full-control ACL are automatically owned by the bucket's account.Related informationWhy can't I access an object that was uploaded to my Amazon S3 bucket by another AWS account?Granting cross-account permissions to upload objects while ensuring the bucket owner has full controlTutorial: Delegate access across AWS accounts using IAM rolesMapping of ACL permissions and access policy permissionsFollow"


Question: Why does the MSCK REPAIR TABLE command take a long time to run?

"When I run the MSCK REPAIR TABLE command, a long time elapses before the results appear.-or-When I run the MSCK REPAIR TABLE command, the query times out."

Answer: "When I run the MSCK REPAIR TABLE command, a long time elapses before the results appear.-or-When I run the MSCK REPAIR TABLE command, the query times out.ResolutionYou get this error because Amazon Athena recursively lists prefixes and objects in Amazon Simple Storage Service (Amazon S3) when running the MSCK REPAIR TABLE command. If you have too many Amazon S3 prefixes or objects, then the command might take a long time to complete or time out.To resolve this error, do either of the following:Use an AWS Glue Crawler to add partitions to your Athena tables. For more information, see How crawlers work. Using an AWS Glue Crawler can reduce the time taken to load partitions if you have many Amazon S3 prefixes. For more information, see Incremental crawls in AWS Glue.Add partitions to the table using the ALTER TABLE ADD PARTITION command.Consider using partition projection if your partitions follow predictable patterns. Athena generates partitions in-memory without needing to add them to the AWS Glue Data Catalog or retrieve them from the Data Catalog. Therefore, query processing times might reduce for heavily partitioned tables.Related informationWhy do my Athena queries take a long time to run?Creating tables, updating schema, and adding new partitions in the Data Catalog from AWS Glue ETL jobsFollow"