Question: How do I convert the boot mode of an EC2 Windows instance from Legacy BIOS to UEFI or UEFI Secure Boot?

I want to change the boot mode of my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance from Legacy Bios to UEFI or UEFI Secure boot.

Answer: "I want to change the boot mode of my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance from Legacy Bios to UEFI or UEFI Secure boot.ResolutionPre-requisitesA working EC2 instance running Windows Server 2019 or 2022 with an attached Amazon Elastic Block Store (Amazon EBS) volume.Verify that your instance type supports UEFI.Review the considerations for instance type default boot modes.The boot mode of the OS must be Legacy. To verify, connect to the instance using Windows Remote Desktop Protocol (RDP). Then, check the BIOS Mode in System Information.Note: The existing instance or the root volume are unusable post conversion. It's a best practice to create backup of your data before performing these resolution steps. You can create backups by creating an AMI or a snapshot.Convert boot mode from Legacy Bios to UEFIStep 1. Change the instance root volume to GPT partition:Note: The mbr2gpt tool is used to complete this step. This tool is available on Windows 2019 and 2022. To convert Windows Server 2016 or 2012 or 2012 R2 OS to UEFI boot, detach the root volume. Then, attach the root volume to a rescue instance that's running Windows Server 2019 or 2022.1.    Log in or use RDP to connect to the existing Windows 2019 or 2022 instance. Or, launch a new instance.2.    Run the diskpart command to identify the disk number:From the command prompt, enter diskpart and then press Enter.From the diskpart prompt, enter list disk and then press Enter.Use the resulting list to identify the root volume.Note: By default, Disk 0 is attached as the root volume to the existing instance. For Windows Server 2016, 2012, and 2012 R2, the disk number differs from Disk 0, depending on the drive mapping.3.    Run the command prompt with administrator privileges.4.    Run the following command to validate the disk:C:\Users\Administrator> mbr2gpt /validate /disk:0 /allowFullOSThe following is an example of the expected output:MBR2GPT: Attempting to validate disk 0MBR2GPT: Retrieving layout of diskMBR2GPT: Validating layout, disk sector size is: 512 bytesMBR2GPT: Validation completed successfully5.    Run the following command to convert the MBR partition to GPT:C:\Users\Administrator> mbr2gpt /convert /disk:0 /allowFullOSThe following is an example of the expected output:MBR2GPT will now attempt to convert disk 0.If conversion is successful the disk can only be booted in GPT mode.These changes cannot be undone! MBR2GPT: Attempting to convert disk 0MBR2GPT: Retrieving layout of diskMBR2GPT: Validating layout, disk sector size is: 512 bytesMBR2GPT: Trying to shrink the system partitionMBR2GPT: Creating the EFI system partitionMBR2GPT: Installing the new boot filesMBR2GPT: Performing the layout conversionMBR2GPT: Migrating default boot entryMBR2GPT: Adding recovery boot entryMBR2GPT: Fixing drive letter mappingMBR2GPT: Conversion completed successfullyMBR2GPT: Before the new system can boot properly you need to switch the firmware to boot to UEFI mode!6.    Shut down the instance from the console or from within the instance.Step 2. Create a snapshot of the root volumeAmazon EC2 consoleFor more information, see Create a snapshot.AWS Command Line Interface (AWS CLI)Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI. Or, you can run the commands using AWS CloudShell.In the following example command, replace region, volume-id, and description with the correct values for your use case. Make sure that you input the volume-id and description correctly, as shown in the following example.aws ec2 create-snapshot --region <region> --volume-id <vol-0xxxxxxxxxxxxx> --description <add text>Monitor the snapshot process until snapshot creation completes. Then, note the snapshot-id.aws ec2 describe-snapshots --region <region> --snapshot-ids <snap-xx>Step 3. Create an AMI from the snapshotAmazon EC2 console1.    Open the EC2 console.2.    Under Elastic Block Store, select Snapshots.3.    Choose your snapshot, and then choose Actions, Create image.4.    In the Create image from EBS snapshot dialog box, complete the following fields:Name and Description: Enter a name and description of your choice.Architecture: x86_64Virtualization type: Hardware Assisted Virtualization (HVM)Root device name: /dev/sda1Kernel ID: Use the default kernel ID.RAM disk ID: Use the default RAM disk ID.Boot Mode: UEFI5.    Select Create.AWS CLIRun the following command. In the following example command, replace region, description, name, and snapshotID with the appropriate values for your use case.aws ec2 register-image --region <region> --description <description> --name <ami-new_ami_xxx> --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-0xxxxxxxx,DeleteOnTermination=true}" --architecture x86_64 --root-device-name /dev/sda1 --virtualization-type hvm --ena-support --boot-mode uefiThe following is an example of the expected output:{"ImageId": "ami-new_ami_xxx"}Step 4. Verify that the boot mode of the new AMI is UEFIFor more information, see Determine the boot mode parameter of an AMI.Step 5. Launch a new instance using the new AMIFor more information, see How do I launch an EC2 instance from a custom AMI? All new instances launched from this AMI inherit the same boot mode.Step 6. Verify that the boot mode of the instance is UEFIConnect to your new instance using RDP, and then verify the boot mode. For more information, see Determine the boot mode of the operating system.Note: Terminate the existing instance or delete the root volume that you ran the mbr2gpt commands on. The existing instance isn't usable after conversion.Convert an instance's boot mode from Legacy Bios to UEFI Secure BootNote: You can customize the UEFI Secure Boot variables during AMI creation. For more information, see How the AWS binary blob is created.1.    Modify the instance's root volume to GPT partition as shown in Step 1. Change the instance root volume to GPT partition.2.    Create a snapshot of the root volume.3.    Create an AMI from the snapshot. During AMI creation, specify the uefi-data string to turn on UEFI Secure Boot.Run the following AWS CLI command to turn on UEFI Secure Boot without TPM support:In the following example command, replace region, description, name, and snapshotID with the appropriate values for your use case.aws ec2 register-image --region <region> --description <description> --name <ami-new_ami_xxx> --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-0xxxxxxxx,DeleteOnTermination=true}"--architecture x86_64 --root-device-name /dev/sda1 --virtualization-type hvm--ena-support --boot-mode uefi --uefi-data QU1aTlVFRkmbIrz8AAAAAHj5a7fZ9+2cZVRc3ZaucXd3J8EDBJIAgQCB4BYgOCR4cPfgTkio4BCCFRY8eOHuTrAQ3N1D0O7T93yj++59zh33jvP17e5xqn7Vj2fU2FBrr7nmO59dqP/BofjL639lb3+J3qTt3hjbmP0xMUMEDk/REf4YUCMgqCpw/fUd8P/OBfj4//gC/lH3/wbD8H9pEP8xNVSQVvjjq/4zl8C/n7//+Y5pf++a/0HN7n8rIvAZ0H/VDOif7biFiAAP4/+5w/g/s+z8UQBNjf+SAyH890x9/u4O/p/qfv65l/qPPUcDLjhwueP/j9zxfyo4/+2VUkCp+Tuf/Q9KzndPeKStT1vW2GpnaT9G/sCcoupWxHpkbvV+l3oKJSafghyaWrcszv/IraNVt6t5FaVlm2y8qN3ywLjop4aNKq927o7PbVye8ofTXZ9QZ622l4zOAron2ZGvelBm0TH3LqJWhk59P5QcnmNHYlw966V18lOv3WkyWVwR5TMrC1g7Lhokg6aL5pentkmOxAQbadDeRWzDaGVi7MuclSXSxdON1jI5vhFCnCMZ2Q6H5p2FjMQK9V/vLiAT5I9jbp2eJ4RU+6mFm8tQRmeVEYkGcFiiutdDFI29q1vRu2FeYQLIeArGXslbfddD8o97uaFaPjS3onO1+LqXkx0VSCFIwtsVM3arbxkfzweMnrtSolqMx2oZslML9exzLw2uSjvrjYwNeRWSUQa+0B4xTAuosCi1ETxuWHvGsiyYheWKdk7xKnnCg2sUlXpnJBwx7SvBEeoCzJfLpAYtlZmx47eHzbI2OdojTggR8gB05pgb9jsuTXyPQvpoKFLfWqwQedyBggPLatFIZvS7CRb/cenUI3oOB901SR0MRwUtmG9QwCHj01Oa1s66mFi8cOnY0K1yhuSmpP7OeKiB8WSGCQZDoyuB+zvRE+m69MT0fi1/+4cFKMPuUGMaHV9gGRD/axlgQftbZQCN4F/LwMUfZQBjvOPfWJT/Sc3Hf9IDDn/vmv/d4Pjb1wzPhOGZ8P/kJgXu1v1zu3XAkfKfkY2ZGnt4qP71+TvAQwBF9//9gYJ/4LHRf+PhQv2fKNT/Kw+3wOAWGNwC+6+zwIB8wPSV4hcer0BWM2uFQOeafmiZ2PHWDsNiBjsZy24mLBTI13EcJ81hoKR6dLt8mtSkdsSZ4ijOnvJee4G5yu9xYKcE5JfSSoJaeOzZiLUndkZp3Zkrz7bxBD3Rv0uJ7nb+fkqXBuSFfrSxfThVMIp/yFXjvkKIvCn+I9ffRD4f7ay3HAGNAvQbC/xncThZadNEWa3S69cRpuZsdwM+XpJ9a0QP30Wzd2CD9luCCaP+7ISSE1KxzfPdEu3STRkrNiyGe9eO54zvhuVgD0DPcIda5kyYNfyMQfgafX0niaLSP1IyxH/tQJgvBnm9mY4J5CNORs9XQ9oFBlHTMONXBm9aUB3Lg5M0gr2k5jRll+euQOthVxAF7dhOM+WuEhl3eWdeQxBVUbAg6bXex2GURO5oTSBfsYYmgN9srRWa+DAWPZ2l2hpqhr5iCKEte8TBMbjlIAfk0ylM9rTI2+MqeY6wzNHLpXL1MumrtdJ+K3z4dtgx+LoVyP/UKX2FIYW28t7kajEEnzdjkMj9BQfjJx38Mr02nXUi0H7yo/QLqq2o3pPqEHVe+YbwQN8GhAucuu6lxMEGbaZBPhsgb3bSkkEdjDRuXOfEk/TL0DCZzobCLlbFm5PHen2+B2EXyOuxfICIOoaIiuaU/IxOUej0gjje03pCfmXUzx2addQDWp/3PM3wVySOh+nyg15gC776Wuqeh2sd3RHcy0tL7WLzqwrI19OO2qojYJjYMzMj5+Xbi94lpAeHk7ZoKRC1TYXd9j4D8jiLjAjnPr4XRsp7jz4iNTt8eoL1lLkPcuNH+Rw3rgyHEsjHo6TjSTzujikbc3OMX7N39n9HJDx3cb7RzK2UTMtrFAHkkdYZrfoOTBHF6XM0d5tmxMtzjl+l7H2Kf/O4RFuW56gGyNvd3mLrIcpEeccpEoznF2UNQBnCw5dR0yPR+rVZpmBlQD4NoURxwkuiO2hO9kSyxa2t1V6A+HRsQXU0oE+kqjgEdD9OT6z/PF/ldsnNebRtfENEvsqOTaL/Rf9RfDa15EHVGRTIH7uXqqTOQSI307P1WyuUBZIUUUoSzfi5npbJaSk9UgXVU9w2RdcdqoNXdUfCdfOvl3czO9QQBJZj6itszrE0UplB9TpIO+A4R4vbQaeqx0SVQpPt05a0sT2hUW8fetGvxk0t0PXAFs5WD2/zCB1o8q+YVjueMK7QMeKccdOquPxUPRoRagDt/y8Lg187L+gOsQ7kKll7Yc6g8UZSme28FF/p2OkrGADV96NQsZ6a02dxxSRX2FHyb+W83pvtNnBoLtZL4rlzvp+DAHnv3n4NkyF8RPoqDMNamPto0VhQxzN5rddPW4mPuXY6PYH8JoKQQRMeilbAJoKaRyXsLEvr0I4Uwpjro2NktcyKdgPkaSrn+o57iIbzKmM/EDveciZA8FfRGe1nNNgsuG18ncmAvNjQ/f6KXaknA2vMdfc7Do3m9HWEH5v/SFI0fO717DzTGshb7r/g726iMe8Ri/gZu71PFEea0ixd2dbN/a5bLiUr4zmQX1bg09Ukc5QVjYpxruBeolZa2uEpZKS64f7Ml35miDEC5DfasIUrA3bDNRF3c9gfB0wr6FK1qYTfs37psLFb+ZX1CZCfG3i61IK3WlaOEjbulHEpc9Zmr5Wt0+R935+ORLkI1gG6v7TuHPE5yFYjKlxiW9xQ8gYL3rBP599YjlWXmgih8BkAeWHI4e81Nr+sZMV3sdhcVIZLiptLPbzyq/HFne87pJ+C1oOcOoInnk3qsRpuYU5axXffNM6QqSlTFIFdV1h2CI3LGqj+5n/rdaXaoS/M+zFvuPWWtmV7n4OvPYoEkk9i8Sq3xgHIf1A/mCO9eDm0lrvFztcguU72dBz/XG4gb9PpZTtUJwEbyCdzC6bk5fyKGLOsUySsk9W1pll/bly2VylFM0DhI2TqDaoX0O9IzybE+u4kEWC+0c/VWdM4fQ2dqjDt7vzvT9oSgL7fcaeWkdOb3jOeL/TM16/2nSTkyU9UR4Zy26wEc9sZvYiBvL42KqVVyNbjCGkH8onfO5ZsdT4S/am543P0A4RGL71A9Q75XJ49LjK86e4HsiE2Zt5jnGGcmSHr4Q+mOIzofB8Lw4A86rQvqaOAxht7Pbyp4JSqVkeOWhUkgTiPXY4nvx1aSED7LdqOXvGYnUqJ2W8os/b8gQ/FGleLUb1ft4Xbehp1EgcJkMeoZ4rY2qJWYrh7RmqsZlXmm5jKZXOwXOjQtdBKmR6dA+Qx2Q7Fo36xrtNaTDs+yd9veJnAzSZzZCcYRiZChidRXQzif0cW4IdQvsd1vkjN8w3btdexkSNWvfoYBfPPfVAPUQDyWK7b2LQO29DxExcW2yqV7koxPx0rwYeYde3WKjOuToag+qU2FWPfEUso52aQHxooac11+8UKeuykvl2JQEjCv5IH5PGzs1JG1HinbvVOx3TMTAb3aMPEE74OUBC8jeXgkVNLAfIk7ryVDwhv5Z5tIVWz0iUOctoLjFudxfIe0SJBH8ThooP4j0sfHXXTh5egUkP4d34hoV8qmR7itijwKeKzG9jmfQHy1DEQ0vwJ5zVitnwP5kZjmnXNhRKNS85Lp5sW9lDCyVogTxul3XpTOxv1cGCfzihR+JfADN4J+cozg3Ktp5wZ4fmg+5eeHBJ6sGB4PI8YKA3DKwkQCA1FhOEK3okmmbWq++zFAvn7OMHf0kKPTIjKrL6u7tQuXMy/w8AN1AsXuiM3v698JwPqZwegGsrZvJOkkO7gt/okn61REJiKvPUi+qfYEEYxxEH9NSdT0naWdVoHVDNyi8e7bPVC/0ThQvbm/FFLK31TR1IikOce/hAd4MA8urkkTSVqObnLO9M0o9hQ60f5s3UAkayICsjzUXF06qm2pPJWDMTWxWVSkortF2kcRDzokKlvTCCgAvVH/MX8CYGpHbbDRYY/+9Oauej29AkvRJgIhj/bve5OmgCtHwHcbE7thzQfOF9Rl/LiFCxM1tGM3cdbXM6W0y7vYv0SAuQf8YzTMpQvIn9iI+IrsMfCGp5HehOhvh7fe8BTBmt3VQXxXnxrQeF8xVzoL2TCrWwWjsnXy2EQ7LuQOa+wklTDJCD/2GzqbYve7yhJb0HCGBHGx5vQVPuQNKwjnT2rUA+rXAEg/8T2rf4Ct7TbInXfwNnqF49ZtdJkzZbaSze0xyIInnEVoHqh4tJUWsIZG1QcSDr2MHdYFNWvonuZeDOx6UBS83IfdL4S3rCR7nPYosAh1UmilzTmHlNryLxar0Ps5Gklcy4TBO0/IpsbOwLRgq2fPlJ2vw22CE8mkxg9H8ZUU8xEehur4qwDqu9C9w5rM3W/Z0pY1Jt6BT8Vfc64YtAgNbfZ81jCj5sNdD4Ux+qy1akpiytYwUbMbUQUvqPl1cIP2tB5IEnbZHQK+wjkJUIC6W0L9fIFvD2yOI1SsFwd+vRj85RkIj1Fg2AdSaggfnS/3L2FX5n8p5nWSfAa/zzOGRViipQ14kGFWgNrmjuonw2zVpp+M6EnHOeP7oLkZVCpK/stj10CE6Na4kFk2BaoXr+waGbFmWrNsA526SIeLF8wjfTTdrZv1hoxsHc1KLQ4BeUhd9Qm5eLV1yh7nsTEfOtqs3o8D8jxDUpOSUXbrjr5y4G81jpE+HLgJVOj22Ap38VeeISGKau6ywGmV+DUWcp4fAIof4u5ZHJk7LaN2fti0uMrbPZwP+P8MDPrGX2HNHFqVwMobzGgS+mvl3+HpGD5cgFJx2F5aNL+nGkf8fPInt+0xEAxqP99M9SR7d6sg9RyW7LiINCc+L3BDo10WZhmAba+cnb1FHQ+NKHH0KqkkH7EFdOVhK1A0FHNtizaxFK9ZUMUuTJX9r0I1K992xigmEFu51sgfLng3Ifbyz+WTp7sEtBpzxv27ScfaH8z/0qcsddG+UTps6SB0P31PXkDSvHOjUGlovAzd0Tk4yPQedJ57JyGvfHllsb+nY771yCL58mJAVTGd4xccQEPu6JB+5tt/faY2PtQnItKP5er6xwGpZXlqHBi4npauoE5GZlYZRC/PcqvtdA+0AWtcCCDQVyNthZ36SVUeeN4dBtkDn3CgbxDpjTWcbGQ5ttirNvymVZWfuUtrF2hNu1wRIGJCG61QiDv1GYf6LPzKSkxKYG6q8QlmoQOdXxnuNogRuKbeS9DUyCQ9yA3JWAMz68sd57IP9uNm2YzdXyF6Zcs6KVNZ6zw2BWUJ3gEBUG7H9aHjTWrWYh2i31aIC18pzbn+Op+ibulbTQzqH/xqNzrK+yZwRRjWCb35yqpPPzCnC2kKD9gF7Z5oh7Phw/k/eQGKjD5RWi8ymliezVru6UOs2r0+ejlDCliXjuoItwH5XtFMNnvzDbDv8xSrkl0lPZjOCcxeI6ysbBTVUPZhgVA91eEkofQo4/8SQMQ3U0XnhPeqSzz5FMdmffHXJzW30IQQXn1e2S5KQwtqrWvjK3EJrLM/Oj8idOWxzHaEDP2g06GA9B5ODp2EuctpY4Zidva3AuFJY6Qy5f+1WcsE5nt170jssOg81WMydlV55pX9bxNXDjJa4Ylp3K374VaEz3p+K/xyG+5l4E8xMwKeiAn8oQlo+Yev+zq8qRWTo9sdDhOtR6iMyb/lTqIT6QhSWz+oNcVLFTUEW2yU3tZeOOm1L/5QKTAva9n2ArIxzl4/PZ5k5DwXnjrc4qBtrlvaDjXeU/v9wgLaEK91+lTIJ+wqhqnOu4/225894FdM4Iokp5mTTtkDDeizTurYAQTtH4Sg6r2pT5tbUK6NI9O/QXj04qln+IZCx/eeh+35HiErID4HCpMKSlj3JP3011qXEUxKa43z72WVsfY2f3d3jAHgNZDYn4njHCS/qDewAp1VpkUJsPd0TUo53RNhWywwijwYBXUj7AxrO++l5gtUZgulD0LtNx6nuswrp+z3Dgo5qMYl+EE4jUyC9I0N8sjCqn7JBQg5xnklPQ24vnW9mInlj9DEfiAfGqpituU9dlkfmJzo5FkaqYSymKUbPt+tFssVuDHuyegfvwza3o/L61Rt5Dvd9dkk8UD60erDFo3zih21iNRJOmuoDw5bWyu5oGhC9n9461F4fIQ5Gzxp+cFKFBP6A/UGV8m1QIg/2X8GX4DBXYL/0XM56yOQgGKvXZh6RxcVsbsqjCr7G0uIA+d8ajpaMzUEPyOcVGnw9OWU3xFtO1dTGIluFvFG2cKyicLWMb7Jmcla4RSEzLiM+wpzssLc2qdy76fZOwzOldGgfK3YpG1iBYZ5cR5vW/ND9XlZGusa5HdFua0y2+nLKoy9UD5du1k1UaIt3QQHqKP98r0q+KdxG52vDJzXVEZYYUdtbkTUD78DC1Z52MUwyVuUSvX9TU9q6XnMzv3LyiehrY+TOr4oHlBPeIs8sN6k8++NP62Za9oeyPVyY4fHBDEXEVjr9qWyIH6iwbX3wR3/Pj6VclfzOsnkFXk1x5DHywcCJLRqMuumC+D8o3GEcJ7W9NaBOO3rqU0rQ4c7IcBlec351nfiPWREguGOoF803ODX4NsXzl8oiuvA5xl9NzXCk8+/bL2cbt89vZ9DRXoepp+mYusbSs1T1vasTjQIdsrIl/5DVrkdprvxQ1hdkiB9qu2F4k6rXG+JKfVRk4FZxWlUfZ2Tt6W9biQJ/rNkuRWkaB5n6reyS5BDm3RKnm3ddQoplCG2eiJsmttNprhCk1XKui80cFN2I0zbPj+5Apyc0wbLs5YHGSTG7nAVe8Z34p9Fj4Bml+kmebUCq1SZ1pIvvQlR7WiGHp6337MTiCGirp7ZIUJlGf2CyAQlu7gunTkhFfYwaASCWQYm2OX/nP5rU+celQ9QXnRwIdduzpGruYIL90h38im3SX0dCrbAyyPeEg/qczRYTCQHybOet46yPP0/Y6vAwFy2FD/VRAqa/3vkRocz+KTTQk2UD6ZQjhqIxs9cdWgQauAfnlhgWuOGSf7cU2BvvnYQVkSVN9nzCOr7odgWIS2ClStNv74xfIyQOStM1NKHUdmjhID9RmQnxV8fYPDX6UYNHF8FxqDPIYR+7bouCcB46I077n15QtQXrGA9LUyKKxgaaLrJRvG5+rCpYSe04qE7tX69vh54rfu5yAeUhRSoDKIcxWg2ejTdFlEUtu575x4y9WjEyz9hScTdJ5ZVKsJ34Xt5fC+6MazOkf9GM/EhfJGq7ajta5tuMvoBShfWrG9dkxjJGlbSdkOD/7CJl3Ib2/vt6GMp57qqzFN/wi0f64kQU6jGjpja/dChwKHzO1bSfTS+2840WEj+amn3c3NQH49xJ7YzzOZu1cl65Q/cZd/bCbP3nv9DUlXpti1yOBZD5Dfvnsf0oYBU9Kz9n9xNolBLjPlCZt1t1yXG5G5S6U3B/Xj+0E55nJvMPNUrLpWCRYQ6tmzYhaRSMlKRCKZ2T748oDqxf7U4sHxnuYXDs/9R/TJxqUidMkQvhXsmht0DfsSLCfQ/PGo8lxNBFdD3jKauLgNcpDfmS6JkzP3TQxbF+3SFxdDFJRvZ9oKVmm8lQjLwxXvs2TXOT3R51rcrr0x/VXEUXfWJg/kT+gn3nRuxROIP+v1oc2aLuhfdtB5xw9b+Dhp7S5nFB0H5E8/2E47fogXeZ2lwtWUixXPOF9i8YNVUu+d8NBTtXczoPy/B/X1U5WMJ+52kscmXSiVaQnByExLn7hfoRWU1Vc139qD8g0y9PdDCGnnPD++ODqs23xdd2jYoP74aTzQv9Mq2wmZFtQvQ/0fK5UaIw154vBFctZ+fZzIR/SGDOsDr2bUu22P7lxQ/xgVJXpWWPb8JZWcICsSn2sh0ZvyeUY0JetjmSESRnXQPFcDA/GngEFru9gpX4Xeact61DhllXtd4VLB8FF/e7oGqN9EwRZpF9qq/l00zVb7USAwp/1c2WItjwRGm5+Hol4hD7q/CCUzBnxiUBbOFXVkZZWsfNvVlMnt9XMb96cyYuOwYweAPFu4xxFP1Geb/nPEblEj5ST9IvyT67I2ZSkSCKdYHT0paF4P7beipysfn9vk1rhZtt1jEcleit7oGiOM4dBRWbMA7T/ik32L7M4eMf7DisIpo9S6WEpRMKknhQnLbgMeUhrzG0BeBYnkevUyPHGkB+vF5Gwlkcy90UfXLJ8ORqhvF7LDvUDzFH2OW4HGSK+d+uefWWmvrCRVENYEi5TO6VoTpauP8CKEQeerqeKMSd+XDwmiG90cHiiQ+YcNd+yaySnZ5Bfma9/CZoF8Lka+n1rjL3VOBf/L+O2FBeqLsv6qyHdCQr1HNEQbNKA8p3ECwwYx3eBJsHrXjIDreIqWmRPszvUNFz/1i2xddXZQf92frCCOGlNt06x5bS6o2Xc4cTR0z8V0RJqL+c2i4dIgKP+Z3I+uCVyxKb1SSg9Ej0EJm4/FKhygpbSHal7d2D++D7p/f2YQ0Q6TvStfNuYmONVwoHhcZHWCkiHWYs17P0YuvBNUv1ZZnUqLnPAN5Gm8vl4gHcbNDlUHnm7dD/pW/ywDw7gUNN9fZ7Zt3UdXRPfxokkVMotz4Q32XmL9VVJDC8lkIxbeBvEHYU0RUGKzd5tOJEmaXL8XT1p/UXdxX5rUHes1mG+agvaHs81PP+062uYv5eX0MRlTjYk9q5WyR7+tyC8oGBEiNYJ8kgkWwphB3Udp7wUUzfFYTpD8ajfQVAofuuPFXroZXZHyAHlmEh4SSZWKO+Vr1xFsk1D3+8FUMFVUkhiHfRbyhciaZFC/40SVZ2xeVf/AH/OIIoQg206j9LtdgnPY9jtsQiUPBlDePhd55/c1jQohe4XnoDkilVenv4IYGhV4+Tk6lv77x2pQPpass6eMuiZblc4YiwHVNNkOqWdSpJqx3cVLaNmgvx4MAOU5FVQ0HhamCjybmCLcRk2My/TurW+8uDACHmgVLYbgpQP5y4bHaSfx62csTpUqORgP0vFwof6HakldliQ1qHrIpy9A9dHv5BrvjqG5teU1tPlVuCHdjWb+1tBTI9m3UopFd8Wg+Yvi7MonLDWuz6gcUfKwmISEVCzExGoSZDpF05zppH5M0H6oF3H0lUUwQ5Ri5hvyqF/lFfTiDN3m6Hft5EztPSYmQdC8HsFPMZ5Ii7icCFOM0VyMm3mlteTzatU8rnZW4kPmR1nToPPD61nMV1SLuMPlbml2H4ItLTO3UjTK5XNGLNPZxIe6QHmU7Km20lLnrhkO63oXs4n+EmJj4Bu/DoQJUnysfWbNyj4gX+pZLm76mrol6Z2MTCkdRJ7pPeok09Ascg303IHkdsMC6OoNsMFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwV+/PdPVA59tJQ3IlmXF3rkq+bZ1UmFutBfZlDkFAhFbCcx6e8xf0QJ4O8pEcy9NaAZsEoT51dkNvaTjUQZ8bv+cqbaQT0TpWBJRHjfiLsarObMQEpixVXZDKDKReraeqBThY7lbN1ntFgPodNgn1jRH5dApffdHmJe97TsUPGkcpj713PeLIayBJ6iA/YW+sX9PJjqBwbzdts89gjy1lKrZQ5C3lqEmP620rw+fvoPyhpLMj+ZVLvlzr6BMpk5MyTt1c1px2hmuVjZl67VzmpL/1s4az6MhoxISk/88/a/gv/QCQAw==Run the following AWS CLI command to turn on TPM Support along with UEFI Secure Boot:aws ec2 register-image --region <region> --description <description> --name <ami-new_ami_xxx> --block-device-mappings "DeviceName=/dev/sda1,Ebs={SnapshotId=snap-0xxxxxxxx,DeleteOnTermination=true}"--architecture x86_64 --root-device-name /dev/sda1 --virtualization-type hvm--ena-support --boot-mode uefi --tpm-support v2.0 --uefi-data QU1aTlVFRkmbIrz8AAAAAHj5a7fZ9+2cZVRc3ZaucXd3J8EDBJIAgQCB4BYgOCR4cPfgTkio4BCCFRY8eOHuTrAQ3N1D0O7T93yj++59zh33jvP17e5xqn7Vj2fU2FBrr7nmO59dqP/BofjL639lb3+J3qTt3hjbmP0xMUMEDk/REf4YUCMgqCpw/fUd8P/OBfj4//gC/lH3/wbD8H9pEP8xNVSQVvjjq/4zl8C/n7//+Y5pf++a/0HN7n8rIvAZ0H/VDOif7biFiAAP4/+5w/g/s+z8UQBNjf+SAyH890x9/u4O/p/qfv65l/qPPUcDLjhwueP/j9zxfyo4/+2VUkCp+Tuf/Q9KzndPeKStT1vW2GpnaT9G/sCcoupWxHpkbvV+l3oKJSafghyaWrcszv/IraNVt6t5FaVlm2y8qN3ywLjop4aNKq927o7PbVye8ofTXZ9QZ622l4zOAron2ZGvelBm0TH3LqJWhk59P5QcnmNHYlw966V18lOv3WkyWVwR5TMrC1g7Lhokg6aL5pentkmOxAQbadDeRWzDaGVi7MuclSXSxdON1jI5vhFCnCMZ2Q6H5p2FjMQK9V/vLiAT5I9jbp2eJ4RU+6mFm8tQRmeVEYkGcFiiutdDFI29q1vRu2FeYQLIeArGXslbfddD8o97uaFaPjS3onO1+LqXkx0VSCFIwtsVM3arbxkfzweMnrtSolqMx2oZslML9exzLw2uSjvrjYwNeRWSUQa+0B4xTAuosCi1ETxuWHvGsiyYheWKdk7xKnnCg2sUlXpnJBwx7SvBEeoCzJfLpAYtlZmx47eHzbI2OdojTggR8gB05pgb9jsuTXyPQvpoKFLfWqwQedyBggPLatFIZvS7CRb/cenUI3oOB901SR0MRwUtmG9QwCHj01Oa1s66mFi8cOnY0K1yhuSmpP7OeKiB8WSGCQZDoyuB+zvRE+m69MT0fi1/+4cFKMPuUGMaHV9gGRD/axlgQftbZQCN4F/LwMUfZQBjvOPfWJT/Sc3Hf9IDDn/vmv/d4Pjb1wzPhOGZ8P/kJgXu1v1zu3XAkfKfkY2ZGnt4qP71+TvAQwBF9//9gYJ/4LHRf+PhQv2fKNT/Kw+3wOAWGNwC+6+zwIB8wPSV4hcer0BWM2uFQOeafmiZ2PHWDsNiBjsZy24mLBTI13EcJ81hoKR6dLt8mtSkdsSZ4ijOnvJee4G5yu9xYKcE5JfSSoJaeOzZiLUndkZp3Zkrz7bxBD3Rv0uJ7nb+fkqXBuSFfrSxfThVMIp/yFXjvkKIvCn+I9ffRD4f7ay3HAGNAvQbC/xncThZadNEWa3S69cRpuZsdwM+XpJ9a0QP30Wzd2CD9luCCaP+7ISSE1KxzfPdEu3STRkrNiyGe9eO54zvhuVgD0DPcIda5kyYNfyMQfgafX0niaLSP1IyxH/tQJgvBnm9mY4J5CNORs9XQ9oFBlHTMONXBm9aUB3Lg5M0gr2k5jRll+euQOthVxAF7dhOM+WuEhl3eWdeQxBVUbAg6bXex2GURO5oTSBfsYYmgN9srRWa+DAWPZ2l2hpqhr5iCKEte8TBMbjlIAfk0ylM9rTI2+MqeY6wzNHLpXL1MumrtdJ+K3z4dtgx+LoVyP/UKX2FIYW28t7kajEEnzdjkMj9BQfjJx38Mr02nXUi0H7yo/QLqq2o3pPqEHVe+YbwQN8GhAucuu6lxMEGbaZBPhsgb3bSkkEdjDRuXOfEk/TL0DCZzobCLlbFm5PHen2+B2EXyOuxfICIOoaIiuaU/IxOUej0gjje03pCfmXUzx2addQDWp/3PM3wVySOh+nyg15gC776Wuqeh2sd3RHcy0tL7WLzqwrI19OO2qojYJjYMzMj5+Xbi94lpAeHk7ZoKRC1TYXd9j4D8jiLjAjnPr4XRsp7jz4iNTt8eoL1lLkPcuNH+Rw3rgyHEsjHo6TjSTzujikbc3OMX7N39n9HJDx3cb7RzK2UTMtrFAHkkdYZrfoOTBHF6XM0d5tmxMtzjl+l7H2Kf/O4RFuW56gGyNvd3mLrIcpEeccpEoznF2UNQBnCw5dR0yPR+rVZpmBlQD4NoURxwkuiO2hO9kSyxa2t1V6A+HRsQXU0oE+kqjgEdD9OT6z/PF/ldsnNebRtfENEvsqOTaL/Rf9RfDa15EHVGRTIH7uXqqTOQSI307P1WyuUBZIUUUoSzfi5npbJaSk9UgXVU9w2RdcdqoNXdUfCdfOvl3czO9QQBJZj6itszrE0UplB9TpIO+A4R4vbQaeqx0SVQpPt05a0sT2hUW8fetGvxk0t0PXAFs5WD2/zCB1o8q+YVjueMK7QMeKccdOquPxUPRoRagDt/y8Lg187L+gOsQ7kKll7Yc6g8UZSme28FF/p2OkrGADV96NQsZ6a02dxxSRX2FHyb+W83pvtNnBoLtZL4rlzvp+DAHnv3n4NkyF8RPoqDMNamPto0VhQxzN5rddPW4mPuXY6PYH8JoKQQRMeilbAJoKaRyXsLEvr0I4Uwpjro2NktcyKdgPkaSrn+o57iIbzKmM/EDveciZA8FfRGe1nNNgsuG18ncmAvNjQ/f6KXaknA2vMdfc7Do3m9HWEH5v/SFI0fO717DzTGshb7r/g726iMe8Ri/gZu71PFEea0ixd2dbN/a5bLiUr4zmQX1bg09Ukc5QVjYpxruBeolZa2uEpZKS64f7Ml35miDEC5DfasIUrA3bDNRF3c9gfB0wr6FK1qYTfs37psLFb+ZX1CZCfG3i61IK3WlaOEjbulHEpc9Zmr5Wt0+R935+ORLkI1gG6v7TuHPE5yFYjKlxiW9xQ8gYL3rBP599YjlWXmgih8BkAeWHI4e81Nr+sZMV3sdhcVIZLiptLPbzyq/HFne87pJ+C1oOcOoInnk3qsRpuYU5axXffNM6QqSlTFIFdV1h2CI3LGqj+5n/rdaXaoS/M+zFvuPWWtmV7n4OvPYoEkk9i8Sq3xgHIf1A/mCO9eDm0lrvFztcguU72dBz/XG4gb9PpZTtUJwEbyCdzC6bk5fyKGLOsUySsk9W1pll/bly2VylFM0DhI2TqDaoX0O9IzybE+u4kEWC+0c/VWdM4fQ2dqjDt7vzvT9oSgL7fcaeWkdOb3jOeL/TM16/2nSTkyU9UR4Zy26wEc9sZvYiBvL42KqVVyNbjCGkH8onfO5ZsdT4S/am543P0A4RGL71A9Q75XJ49LjK86e4HsiE2Zt5jnGGcmSHr4Q+mOIzofB8Lw4A86rQvqaOAxht7Pbyp4JSqVkeOWhUkgTiPXY4nvx1aSED7LdqOXvGYnUqJ2W8os/b8gQ/FGleLUb1ft4Xbehp1EgcJkMeoZ4rY2qJWYrh7RmqsZlXmm5jKZXOwXOjQtdBKmR6dA+Qx2Q7Fo36xrtNaTDs+yd9veJnAzSZzZCcYRiZChidRXQzif0cW4IdQvsd1vkjN8w3btdexkSNWvfoYBfPPfVAPUQDyWK7b2LQO29DxExcW2yqV7koxPx0rwYeYde3WKjOuToag+qU2FWPfEUso52aQHxooac11+8UKeuykvl2JQEjCv5IH5PGzs1JG1HinbvVOx3TMTAb3aMPEE74OUBC8jeXgkVNLAfIk7ryVDwhv5Z5tIVWz0iUOctoLjFudxfIe0SJBH8ThooP4j0sfHXXTh5egUkP4d34hoV8qmR7itijwKeKzG9jmfQHy1DEQ0vwJ5zVitnwP5kZjmnXNhRKNS85Lp5sW9lDCyVogTxul3XpTOxv1cGCfzihR+JfADN4J+cozg3Ktp5wZ4fmg+5eeHBJ6sGB4PI8YKA3DKwkQCA1FhOEK3okmmbWq++zFAvn7OMHf0kKPTIjKrL6u7tQuXMy/w8AN1AsXuiM3v698JwPqZwegGsrZvJOkkO7gt/okn61REJiKvPUi+qfYEEYxxEH9NSdT0naWdVoHVDNyi8e7bPVC/0ThQvbm/FFLK31TR1IikOce/hAd4MA8urkkTSVqObnLO9M0o9hQ60f5s3UAkayICsjzUXF06qm2pPJWDMTWxWVSkortF2kcRDzokKlvTCCgAvVH/MX8CYGpHbbDRYY/+9Oauej29AkvRJgIhj/bve5OmgCtHwHcbE7thzQfOF9Rl/LiFCxM1tGM3cdbXM6W0y7vYv0SAuQf8YzTMpQvIn9iI+IrsMfCGp5HehOhvh7fe8BTBmt3VQXxXnxrQeF8xVzoL2TCrWwWjsnXy2EQ7LuQOa+wklTDJCD/2GzqbYve7yhJb0HCGBHGx5vQVPuQNKwjnT2rUA+rXAEg/8T2rf4Ct7TbInXfwNnqF49ZtdJkzZbaSze0xyIInnEVoHqh4tJUWsIZG1QcSDr2MHdYFNWvonuZeDOx6UBS83IfdL4S3rCR7nPYosAh1UmilzTmHlNryLxar0Ps5Gklcy4TBO0/IpsbOwLRgq2fPlJ2vw22CE8mkxg9H8ZUU8xEehur4qwDqu9C9w5rM3W/Z0pY1Jt6BT8Vfc64YtAgNbfZ81jCj5sNdD4Ux+qy1akpiytYwUbMbUQUvqPl1cIP2tB5IEnbZHQK+wjkJUIC6W0L9fIFvD2yOI1SsFwd+vRj85RkIj1Fg2AdSaggfnS/3L2FX5n8p5nWSfAa/zzOGRViipQ14kGFWgNrmjuonw2zVpp+M6EnHOeP7oLkZVCpK/stj10CE6Na4kFk2BaoXr+waGbFmWrNsA526SIeLF8wjfTTdrZv1hoxsHc1KLQ4BeUhd9Qm5eLV1yh7nsTEfOtqs3o8D8jxDUpOSUXbrjr5y4G81jpE+HLgJVOj22Ap38VeeISGKau6ywGmV+DUWcp4fAIof4u5ZHJk7LaN2fti0uMrbPZwP+P8MDPrGX2HNHFqVwMobzGgS+mvl3+HpGD5cgFJx2F5aNL+nGkf8fPInt+0xEAxqP99M9SR7d6sg9RyW7LiINCc+L3BDo10WZhmAba+cnb1FHQ+NKHH0KqkkH7EFdOVhK1A0FHNtizaxFK9ZUMUuTJX9r0I1K992xigmEFu51sgfLng3Ifbyz+WTp7sEtBpzxv27ScfaH8z/0qcsddG+UTps6SB0P31PXkDSvHOjUGlovAzd0Tk4yPQedJ57JyGvfHllsb+nY771yCL58mJAVTGd4xccQEPu6JB+5tt/faY2PtQnItKP5er6xwGpZXlqHBi4npauoE5GZlYZRC/PcqvtdA+0AWtcCCDQVyNthZ36SVUeeN4dBtkDn3CgbxDpjTWcbGQ5ttirNvymVZWfuUtrF2hNu1wRIGJCG61QiDv1GYf6LPzKSkxKYG6q8QlmoQOdXxnuNogRuKbeS9DUyCQ9yA3JWAMz68sd57IP9uNm2YzdXyF6Zcs6KVNZ6zw2BWUJ3gEBUG7H9aHjTWrWYh2i31aIC18pzbn+Op+ibulbTQzqH/xqNzrK+yZwRRjWCb35yqpPPzCnC2kKD9gF7Z5oh7Phw/k/eQGKjD5RWi8ymliezVru6UOs2r0+ejlDCliXjuoItwH5XtFMNnvzDbDv8xSrkl0lPZjOCcxeI6ysbBTVUPZhgVA91eEkofQo4/8SQMQ3U0XnhPeqSzz5FMdmffHXJzW30IQQXn1e2S5KQwtqrWvjK3EJrLM/Oj8idOWxzHaEDP2g06GA9B5ODp2EuctpY4Zidva3AuFJY6Qy5f+1WcsE5nt170jssOg81WMydlV55pX9bxNXDjJa4Ylp3K374VaEz3p+K/xyG+5l4E8xMwKeiAn8oQlo+Yev+zq8qRWTo9sdDhOtR6iMyb/lTqIT6QhSWz+oNcVLFTUEW2yU3tZeOOm1L/5QKTAva9n2ArIxzl4/PZ5k5DwXnjrc4qBtrlvaDjXeU/v9wgLaEK91+lTIJ+wqhqnOu4/225894FdM4Iokp5mTTtkDDeizTurYAQTtH4Sg6r2pT5tbUK6NI9O/QXj04qln+IZCx/eeh+35HiErID4HCpMKSlj3JP3011qXEUxKa43z72WVsfY2f3d3jAHgNZDYn4njHCS/qDewAp1VpkUJsPd0TUo53RNhWywwijwYBXUj7AxrO++l5gtUZgulD0LtNx6nuswrp+z3Dgo5qMYl+EE4jUyC9I0N8sjCqn7JBQg5xnklPQ24vnW9mInlj9DEfiAfGqpituU9dlkfmJzo5FkaqYSymKUbPt+tFssVuDHuyegfvwza3o/L61Rt5Dvd9dkk8UD60erDFo3zih21iNRJOmuoDw5bWyu5oGhC9n9461F4fIQ5Gzxp+cFKFBP6A/UGV8m1QIg/2X8GX4DBXYL/0XM56yOQgGKvXZh6RxcVsbsqjCr7G0uIA+d8ajpaMzUEPyOcVGnw9OWU3xFtO1dTGIluFvFG2cKyicLWMb7Jmcla4RSEzLiM+wpzssLc2qdy76fZOwzOldGgfK3YpG1iBYZ5cR5vW/ND9XlZGusa5HdFua0y2+nLKoy9UD5du1k1UaIt3QQHqKP98r0q+KdxG52vDJzXVEZYYUdtbkTUD78DC1Z52MUwyVuUSvX9TU9q6XnMzv3LyiehrY+TOr4oHlBPeIs8sN6k8++NP62Za9oeyPVyY4fHBDEXEVjr9qWyIH6iwbX3wR3/Pj6VclfzOsnkFXk1x5DHywcCJLRqMuumC+D8o3GEcJ7W9NaBOO3rqU0rQ4c7IcBlec351nfiPWREguGOoF803ODX4NsXzl8oiuvA5xl9NzXCk8+/bL2cbt89vZ9DRXoepp+mYusbSs1T1vasTjQIdsrIl/5DVrkdprvxQ1hdkiB9qu2F4k6rXG+JKfVRk4FZxWlUfZ2Tt6W9biQJ/rNkuRWkaB5n6reyS5BDm3RKnm3ddQoplCG2eiJsmttNprhCk1XKui80cFN2I0zbPj+5Apyc0wbLs5YHGSTG7nAVe8Z34p9Fj4Bml+kmebUCq1SZ1pIvvQlR7WiGHp6337MTiCGirp7ZIUJlGf2CyAQlu7gunTkhFfYwaASCWQYm2OX/nP5rU+celQ9QXnRwIdduzpGruYIL90h38im3SX0dCrbAyyPeEg/qczRYTCQHybOet46yPP0/Y6vAwFy2FD/VRAqa/3vkRocz+KTTQk2UD6ZQjhqIxs9cdWgQauAfnlhgWuOGSf7cU2BvvnYQVkSVN9nzCOr7odgWIS2ClStNv74xfIyQOStM1NKHUdmjhID9RmQnxV8fYPDX6UYNHF8FxqDPIYR+7bouCcB46I077n15QtQXrGA9LUyKKxgaaLrJRvG5+rCpYSe04qE7tX69vh54rfu5yAeUhRSoDKIcxWg2ejTdFlEUtu575x4y9WjEyz9hScTdJ5ZVKsJ34Xt5fC+6MazOkf9GM/EhfJGq7ajta5tuMvoBShfWrG9dkxjJGlbSdkOD/7CJl3Ib2/vt6GMp57qqzFN/wi0f64kQU6jGjpja/dChwKHzO1bSfTS+2840WEj+amn3c3NQH49xJ7YzzOZu1cl65Q/cZd/bCbP3nv9DUlXpti1yOBZD5Dfvnsf0oYBU9Kz9n9xNolBLjPlCZt1t1yXG5G5S6U3B/Xj+0E55nJvMPNUrLpWCRYQ6tmzYhaRSMlKRCKZ2T748oDqxf7U4sHxnuYXDs/9R/TJxqUidMkQvhXsmht0DfsSLCfQ/PGo8lxNBFdD3jKauLgNcpDfmS6JkzP3TQxbF+3SFxdDFJRvZ9oKVmm8lQjLwxXvs2TXOT3R51rcrr0x/VXEUXfWJg/kT+gn3nRuxROIP+v1oc2aLuhfdtB5xw9b+Dhp7S5nFB0H5E8/2E47fogXeZ2lwtWUixXPOF9i8YNVUu+d8NBTtXczoPy/B/X1U5WMJ+52kscmXSiVaQnByExLn7hfoRWU1Vc139qD8g0y9PdDCGnnPD++ODqs23xdd2jYoP74aTzQv9Mq2wmZFtQvQ/0fK5UaIw154vBFctZ+fZzIR/SGDOsDr2bUu22P7lxQ/xgVJXpWWPb8JZWcICsSn2sh0ZvyeUY0JetjmSESRnXQPFcDA/GngEFru9gpX4Xeact61DhllXtd4VLB8FF/e7oGqN9EwRZpF9qq/l00zVb7USAwp/1c2WItjwRGm5+Hol4hD7q/CCUzBnxiUBbOFXVkZZWsfNvVlMnt9XMb96cyYuOwYweAPFu4xxFP1Geb/nPEblEj5ST9IvyT67I2ZSkSCKdYHT0paF4P7beipysfn9vk1rhZtt1jEcleit7oGiOM4dBRWbMA7T/ik32L7M4eMf7DisIpo9S6WEpRMKknhQnLbgMeUhrzG0BeBYnkevUyPHGkB+vF5Gwlkcy90UfXLJ8ORqhvF7LDvUDzFH2OW4HGSK+d+uefWWmvrCRVENYEi5TO6VoTpauP8CKEQeerqeKMSd+XDwmiG90cHiiQ+YcNd+yaySnZ5Bfma9/CZoF8Lka+n1rjL3VOBf/L+O2FBeqLsv6qyHdCQr1HNEQbNKA8p3ECwwYx3eBJsHrXjIDreIqWmRPszvUNFz/1i2xddXZQf92frCCOGlNt06x5bS6o2Xc4cTR0z8V0RJqL+c2i4dIgKP+Z3I+uCVyxKb1SSg9Ej0EJm4/FKhygpbSHal7d2D++D7p/f2YQ0Q6TvStfNuYmONVwoHhcZHWCkiHWYs17P0YuvBNUv1ZZnUqLnPAN5Gm8vl4gHcbNDlUHnm7dD/pW/ywDw7gUNN9fZ7Zt3UdXRPfxokkVMotz4Q32XmL9VVJDC8lkIxbeBvEHYU0RUGKzd5tOJEmaXL8XT1p/UXdxX5rUHes1mG+agvaHs81PP+062uYv5eX0MRlTjYk9q5WyR7+tyC8oGBEiNYJ8kgkWwphB3Udp7wUUzfFYTpD8ajfQVAofuuPFXroZXZHyAHlmEh4SSZWKO+Vr1xFsk1D3+8FUMFVUkhiHfRbyhciaZFC/40SVZ2xeVf/AH/OIIoQg206j9LtdgnPY9jtsQiUPBlDePhd55/c1jQohe4XnoDkilVenv4IYGhV4+Tk6lv77x2pQPpass6eMuiZblc4YiwHVNNkOqWdSpJqx3cVLaNmgvx4MAOU5FVQ0HhamCjybmCLcRk2My/TurW+8uDACHmgVLYbgpQP5y4bHaSfx62csTpUqORgP0vFwof6HakldliQ1qHrIpy9A9dHv5BrvjqG5teU1tPlVuCHdjWb+1tBTI9m3UopFd8Wg+Yvi7MonLDWuz6gcUfKwmISEVCzExGoSZDpF05zppH5M0H6oF3H0lUUwQ5Ri5hvyqF/lFfTiDN3m6Hft5EztPSYmQdC8HsFPMZ5Ii7icCFOM0VyMm3mlteTzatU8rnZW4kPmR1nToPPD61nMV1SLuMPlbml2H4ItLTO3UjTK5XNGLNPZxIe6QHmU7Km20lLnrhkO63oXs4n+EmJj4Bu/DoQJUnysfWbNyj4gX+pZLm76mrol6Z2MTCkdRJ7pPeok09Ascg303IHkdsMC6OoNsMFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwVw/u6sFdPbirB3f14K4e3NWDu3pwV+/PdPVA59tJQ3IlmXF3rkq+bZ1UmFutBfZlDkFAhFbCcx6e8xf0QJ4O8pEcy9NaAZsEoT51dkNvaTjUQZ8bv+cqbaQT0TpWBJRHjfiLsarObMQEpixVXZDKDKReraeqBThY7lbN1ntFgPodNgn1jRH5dApffdHmJe97TsUPGkcpj713PeLIayBJ6iA/YW+sX9PJjqBwbzdts89gjy1lKrZQ5C3lqEmP620rw+fvoPyhpLMj+ZVLvlzr6BMpk5MyTt1c1px2hmuVjZl67VzmpL/1s4az6MhoxISk/88/a/gv/QCQAw==4.    Run the following command to verify the boot mode of the new AMI:aws ec2 describe-images --image-id ami-077eabcxxxxaxdfx --query "Images[*].{BootMode:BootMode,TpmSupport:TpmSupport}"If the AMI has UEFI Secure Boot and TPM Support turned on, then the output appears as shown in the following example:[  {    "BootMode": "uefi",    "TpmSupport": "v2.0"  }]If the AMI has UEFI Secure Boot turn on, the output appears as follows:[  {    "BootMode": "uefi",    "TpmSupport": "null"  }]5.    Launch an instance from the new AMI. Make sure that you use an instance type that supports UEFI and TPM.6.    To verify the secure boot and TPM state, connect to the instance using RDP. Then, run the following commands in AWS PowerShell administrator mode.If the instance supports UEFI Secure Boot and Secure Boot is turned on, the following cmdlet returns $True. Otherwise, the response is $False.PS> Confirm-SecureBootUEFIRun the following command to check for the TpmPresent attribute. If TPM is present on the instance, then the response is $True. Otherwise, the response is $False.PS> Get-TpmNote:NitroTPM and UEFI Secure Boot are independent features that can be turned on independently at AMI creation.After a TPM is activated for an AMI, it can't be deactivated.UEFI supports Secure Boot.NitroTPM provides measured boot.Follow"


Question: How can I configure self-managed Microsoft AD Multi-AZ Amazon FSx permissions?

I want to create a Multi-AZ Amazon FSx for Windows File Server share using a self-managed AWS Directory Service for Microsoft Active Directory. How do I configure permissions to do that?

Answer: "I want to create a Multi-AZ Amazon FSx for Windows File Server share using a self-managed AWS Directory Service for Microsoft Active Directory. How do I configure permissions to do that?ResolutionFSx for Windows File Server offers Single-AZ and Multi-AZ file system deployments. With self-managed Microsoft AD, you can build Single-AZ 1 file shares a limited number of times without configuring the permissions. To create Multi-AZ or Single-AZ 2 shares, however, you must create a service account and delegate the required permissions.PrerequisitesDNS servers for the self-managed Microsoft AD must be reachable within the same virtual private cloud (VPC) that you use for the file share.You must be able to create and grant permissions to a service account within the self-managed Microsoft AD.You must use a fully qualified domain name (FQDN) for the self-managed Microsoft AD. Single Label Domain isn’t supported.Create a self-managed Microsoft AD userSign in as a domain account with permissions to create users in self-managed Microsoft AD.Open Active Directory Users and Computers.Open the context (right-click) menu for the organizational unit (OU) that you want to create the service account in, and then choose New, User.Note: You can use any OU for the service account. If you want to use a different OU to create Amazon FSx objects, the user must have read access to both OUs.Fill out the New Object – User name and user logon name fields, and then choose Next.Create a password for the user, and then choose Next.Important: It's a best practice to not select Password never expires, as this can result in a security risk with service accounts using old passwords. When Password never expires is cleared, the account is subject to the default domain policy. Be sure to update the service account credentials when the password expires.Choose Finish to create the user.Delegate permissions to the service accountOpen Active Directory Users and Computers.Select the OU that you want to create Amazon FSx computer objects in. If you don't specify this during creation, the default Domainname\Computers OU is used.Note: If you don't use the default OU, note the distinguishedName for a later step. From Active Directory Users and Computers, choose View, Advanced Features. Open the context (right-click) menu for the OU that you want to use, and then choose Properties. The distinguishedName is available on the Attribute Editor tab.Open the context (right-click) menu for the OU that you use for Amazon FSx, and then choose Delegate Control.Choose Next.For Selected users and groups, select the service account that you created above, and then choose Next.Choose Create a custom task to delegate, and then choose Next.Choose Only the following objects in the folder, and then select Computer objects.Select Create selected objects in this folder and Delete selected objects in this folder.Choose Next.For Permissions, select:Reset passwordRead and write account restrictionsValidated write to DNS host nameValidated write to service principal nameChoose Next, and then choose Finish.Create the file systemOpen the Amazon FSx console, and then choose Create file system.Choose Amazon FSx for Windows File Server, and then choose Next.For File system details, choose Deployment type Multi-AZ, and then specify the Storage Capacity and Throughput capacity that you need.For Network & security, select the VPC for your self-managed Microsoft AD. Then, select two preferred subnets.For Windows authentication, choose Self-managed Microsoft Active Directory, and then enter the details for the service account that you created above.If you don't use the default Computers OU, enter the distinguishedName of the OU that you noted when delegating permissions to the service account.For Delegated file system administrators group, enter the group name if you don't use the default Domain Admins group.For Encryption, use the default settings, or select different encryption options as needed.For Backup and maintenance, choose your preferences. The default settings result in zero downtime during the normal maintenance window, because Amazon FSx fails over to the second server.Choose Next.Review the Summary.Important: The summary indicates whether an attribute can be edited after the file system is created. This is the last chance to changes any attributes that can;t be edited after creation.Choose Create file system.The file system creation is now initiated. The process can take a few hours, depending on the size of the share. When complete, a green banner appears at the top of the Amazon FSx console to indicate that the file share is now available.Related informationAvailability and durability: Single-AZ and Multi-AZ file systemsFollow"


Question: How can I improve the transfer performance of the sync command for Amazon S3?

"I'm using the AWS Command Line Interface (AWS CLI) sync command to transfer data on Amazon Simple Storage Service (Amazon S3). However, the transfer is taking a long time to complete."

Answer: "I'm using the AWS Command Line Interface (AWS CLI) sync command to transfer data on Amazon Simple Storage Service (Amazon S3). However, the transfer is taking a long time to complete.ResolutionTry the following approaches for improving the transfer time when you run the sync command:Note: The sync command compares the source and destination buckets to determine which source files don't exist in the destination bucket. The sync command also determines which source files were modified when compared to the files in the destination bucket. Then, the sync command copies the new or updated source files to the destination bucket. The number of objects in the source and destination bucket can impact the time it takes for the sync command to complete the process. It's important to understand how transfer size can impact the duration of the sync or the cost that you can incur from requests to S3.Running multiple instances of the AWS CLITo copy a large amount of data, you can run multiple instances of the AWS CLI to perform separate sync operations in parallel. For example, you can run parallel sync operations for different prefixes:aws s3 sync s3://source-AWSDOC-EXAMPLE-BUCKET/folder1 s3://destination-AWSDOC-EXAMPLE-BUCKET/folder1             aws s3 sync s3://source-AWSDOC-EXAMPLE-BUCKET/folder2 s3://destination-AWSDOC-EXAMPLE-BUCKET/folder2Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Or, you can run parallel sync operations for separate exclude and include filters. For example, the following operations separate the files to sync by key names that begin with numbers 0 through 4, and numbers 5 through 9:Note: Even when you use exclude and include filters, the sync command still reviews all files in the source bucket. This review helps to identify which source files are to be copied over to the destination bucket. If you have multiple sync operations that target different key name prefixes, then each sync operation reviews all the source files. However, because of the exclude and include filters, only the files that are included in the filters are copied to the destination bucket.aws s3 sync s3://source-AWSDOC-EXAMPLE-BUCKET/ s3://destination-AWSDOC-EXAMPLE-BUCKET/ --exclude "*" --include "0*" --include "1*" --include "2*" --include "3*" --include "4*"  aws s3 sync s3://source-AWSDOC-EXAMPLE-BUCKET/ s3://destination-AWSDOC-EXAMPLE-BUCKET/ --exclude "*" --include "5*" --include "6*" --include "7*" --include "8*" --include "9*"For more information on optimizing the performance of your workload, see Best practices design patterns: optimizing Amazon S3 performance.Modifying the AWS CLI configuration value for max_concurrent_requestsTo potentially improve performance, you can modify the value of max_concurrent_requests. This value sets the number of requests that can be sent to Amazon S3 at a time. The default value is 10, and you can increase it to a higher value. However, note the following:Running more threads consumes more resources on your machine. You must be sure that your machine has enough resources to support the maximum number of concurrent requests that you want.Too many concurrent requests can overwhelm a system, which might cause connection timeouts or slow the responsiveness of the system. To avoid timeout issues from the AWS CLI, you can try setting the --cli-read-timeout value or the --cli-connect-timeout value to 0.(Optional) Checking the instance configurationIf you're using an Amazon Elastic Compute Cloud (Amazon EC2) instance to run the sync operation, consider the following:Review the instance type that you're using. Instance types that are larger can provide better results, because they have high bandwidth and Amazon Elastic Block Store (Amazon EBS)-optimized networks.If the instance is in a different AWS Region than the bucket, then use an instance in the same Region. To reduce latency, reduce the geographical distance between the instance and your Amazon S3 bucket.If the instance is in the same Region as the source bucket, then set up an Amazon Virtual Private Cloud (Amazon VPC) endpoint for S3. VPC endpoints can help improve overall performance.Related informationWhat's the best way to transfer large amounts of data from one Amazon S3 bucket to another?Follow"


Question: How can I troubleshoot T-Log full issues on my RDS for SQL Server source when CDC is turned on for my AWS DMS task?

I have an AWS Database Migration Service (AWS DMS) task that has change data capture (CDC) turned on. My task uses Amazon Relational Database Service (Amazon RDS) for SQL Server as a source. I see "SQL Server T-Log full" issues on my AWS DMS task.

Answer: "I have an AWS Database Migration Service (AWS DMS) task that has change data capture (CDC) turned on. My task uses Amazon Relational Database Service (Amazon RDS) for SQL Server as a source. I see "SQL Server T-Log full" issues on my AWS DMS task.Short descriptionIf you're using SQL Server as the source for AWS DMS tasks, then activate MS change data capture (CDC) on your instances to replicate changes. You can use MS-CDC for Amazon RDS SQL Server, on-premises SQL Server, and SQL Server on Amazon Elastic Compute Cloud (Amazon EC2) instances.After you turn on CDC, it uses the fn_dblog() function to track and read ongoing DML changes from the active log file. For every source table, CDC creates a corresponding CDC change table.CDC creates two jobs to track changes:Capture job - Scans T-logs, and then uses the sp_replcmds store procedure to capture and record changes in the corresponding change table.Cleanup job - Cleans change tracking based on retention policy.Run the following stored procedure to view the value set for these settings:EXEC sys.sp_cdc_help_jobsMaxtrans - The maximum number of transactions to process in each scan cycle.Maxscans - The maximum number of scan cycles to run to extract all rows from the log.Pollinginterval - The number of seconds between log scan cycles.On Amazon RDS for SQL Server, transaction log backups are performed every 5 minutes by design. During transaction log backup, SQL Server truncates the inactive portion of the transaction log. This portion contains Log Sequence Numbers (LSNs) that AWS DMS didn't read. As a result, AWS DMS might not locate the required LSNs for replicating the desired data changes.To avoid this issue, AWS DMS has awsdms_truncation_safeguard and pollingInterval options.awsdms_truncation_safeguard: AWS DMS creates a table called awsdms_truncation_safeguard in the source database. This table prevents the truncation of the transaction log by mimicking a transaction in the databaseBut, if AWS DMS delays reading the logs for more than 10 minutes, then the task fails again. To avoid this issue, use the pollingInterval parameter. For more information, see Using a Microsoft SQL Server database as a source for AWS DMS.pollingInterval: The default value is set to 5 seconds for capture jobs. This means that pollingInterval runs every 5 seconds, scans the T-log to read changes, and then marks these logs as replicated. Then, it truncates the logs.It's a best practice to set the pollingInterval value to >=3599. This prevents capture jobs from running too frequently. It also configures the T-logs so that they aren't truncated for a specified amount of time.A highly transactional database can result in a T-Log full state. The task then fails with an error similar to the following one:E: RetCode: SQL_ERROR SqlState: 42000 NativeError: 9002 Message: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]The transactionlog for database 'yourdatabase' is full due to 'REPLICATION'ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Troubleshoot and resolve SQL Server T-Log full issues when CDC is turned onComplete the following steps to troubleshoot and resolve the SQL Server T-Log full issues when CDC is turned on.1.    Check the size of your transaction log files:DBCC SQLPERF(logspace)2.    If the transaction log is full, then run the following command to see log's contents:select name, log\_reuse\_wait\_desc from sys.databases where name = ' db\_name 'Replication: The replication stopped working or isn't reading active transactions.Active_transaction: There's an open transaction.If there's an active transaction, then check list of open transactions:select \* from sys.sysprocesses where open\_tran=1Note: When AWS DMS is in the Running state, you can't shrink the T-Log of a database that has CDC turned on. Instead, stop the task, and then wait for log backup to truncate the transaction logs. Then, shrink the T-Log of the database.Shrink the T-log files and RESTART the taskAfter you clean up the logs, shrink the T-log files, and then restart the task:1.    Stop the task.2.    Check the status of CDC, and then turn off CDC.Check the status of CDC:select b.name,a.run\_date,a.run\_status from msdb.dbo.sysjobhistory as ajoin msdb.dbo.sysjobs as b on a.job\_id=b.job\_idwhere b.name like '%cdc%capture%';Turn off CDC at the database level:exec msdb.dbo.rds_cdc_disable_db '<db_name>'Find tables that are part of CDC:USE db\_nameGOSELECT s.name AS Schema\_Name, tb.name AS Table\_Name, tb.object\_id, tb.type, tb.type\_desc, tb.is\_tracked\_by\_cdcFROM sys.tables tbINNER JOIN sys.schemas s on s.schema\_id = tb.schema\_idWHERE tb.is\_tracked\_by\_cdc = 1Turn off CDC at table level:use <db_name>EXEC sys.sp_cdc_disable_table@source_schema = N'<schema>',@source_name = N'<table>',@capture_instance = N'<schema_table>'3.    Verify that CDC is turned off:select is_cdc_enabled, * from sys.databases where name = 'dbname' Value 1- enabled and 0 -Disabled4.    After you confirm that CDS is turned off, wait for at least 10 minutes, and then shrink your T-logs:use <dbname>SELECT file_id, nameFROM sys.database_files;GOUSE <dbname>GODBCC SHRINKFILE (N'dbname_log' , 0, TRUNCATEONLY)GO5.    Confirm the size of the logs:DBCC SQLPERF(logspace)6.    Turn on CDC again, and then restart the task. Resuming the task might cause missing transactions. Amazon RDS for SQL Server doesn't support accessing the archived T-log.Related informationPrerequisites for using ongoing replication (CDC) from a SQL Server sourceRecommended settings when using Amazon RDS for SQL Server as a source for AWS DMSFollow"


Question: How do I get help with my AWS account and resources?

"I have questions about my AWS resources, account, or bill. How can I get answers to my questions?"

Answer: "I have questions about my AWS resources, account, or bill. How can I get answers to my questions?ResolutionTo get help from AWS, try one of the following resources:AWS DocumentationCheck the documentation for the service you're using. AWS documentation usually includes tutorials for common use-cases and troubleshooting guides.AWS re:PostSee if other AWS users can help. AWS engineers also monitor the forums and provide help on a best-effort basis.AWS SupportAll AWS customers can create cases related to the following:Account and billing queriesService quota increaseIf you need one-on-one technical support, you can upgrade your Support plan. For more information, see How do I change my AWS Support plan?If you have signed up for a Developer, Business, or Enterprise Support plan, you can open a technical support case.If you have an account or billing related question, do the following:Sign in to your AWS account.Open the AWS Support Center.Choose Create case.Select Account and billing support.Enter the required information in the Case details section.Select your preference for Contact options.Note: The options for contact vary based on the type of case and your Support plan.Choose Submit.The following are examples of account and billing related questions:Can you reopen my closed account?Are the services on my account active?Can you help me understand the line items on my AWS bill?If you want to request service quota increases, select Service limit increase in the Create case section, and then enter the required information.Related informationHow do I get technical support from AWS?Compare AWS Support plansFollow"


Question: How do I troubleshoot cross-account logging issues in CloudWatch?

I want to troubleshoot issues with cross-account logging using my Amazon CloudWatch account. How can I do this?

Answer: "I want to troubleshoot issues with cross-account logging using my Amazon CloudWatch account. How can I do this?Short descriptionYou can send CloudWatch logs within your account or to another AWS account in near real-time. Sharing your logs with another AWS account or receiving their logs is called cross-account logging. You can set up cross-account logging using Amazon Kinesis or Amazon Kinesis Data Firehose stream. Or you can stream the data to Amazon OpenSearch using a subscription filter. The CloudWatch console supports all these options. For more information on using cross-account logging, see these articles:Real-time processing of log data with subscriptionsHow do I create, configure, and troubleshoot a subscription filter to Kinesis using the CloudWatch console?Streaming CloudWatch Logs data to Amazon OpenSearch ServiceResolutionTroubleshoot Kinesis Data Stream/Kinesis Data Firehose delivery stream as target1.    Make sure that your Kinesis stream or Kinesis Data Firehose is in an active state. You can view the status on the Kinesis console, or you can use the DescribeStream or DescribeDeliveryStream API calls.2.    Check that the CloudWatch log group Region and the Kinesis data stream Region match.3.    Check that you have created an AWS Identity and Access Management (IAM) role with the correct trust permissions in place. The IAM role must allow your CloudWatch logs to send log events to Kinesis data stream or Kinesis Data Firehose.In this example, the log data recipient account has an AWS account ID of 999999999999. The log data sender AWS account ID is 111111111111. Make sure that Account 111111111111 is allowed in the recipient account trust policy for Kinesis Data Streams or Kinesis Data Firehose stream. This is an example IAM trust policy for Kinesis Data Streams or Kinesis Data Firehose delivery stream:{  "Statement": {    "Effect": "Allow",    "Principal": {      "Service": "logs.region.amazonaws.com"    },    "Condition": {      "StringLike": {        "aws:SourceArn": [          "arn:aws:logs:region:sourceAccountId:*",          "arn:aws:logs:region:recipientAccountId:*"        ]      }    },    "Action": "sts:AssumeRole"  }}This example shows an IAM role policy for Kinesis Data Streams:{  "Statement": [    {      "Effect": "Allow",      "Action": "kinesis:PutRecord",      "Resource": "arn:aws:kinesis:region:999999999999:stream/RecipientStream"    }  ]} IAM role policy for kinesis Firehose stream. {  "Statement": [    {      "Effect": "Allow",      "Action": [        "firehose:*"      ],      "Resource": [        "arn:aws:firehose:region:999999999999:*"      ]    }  ]}4.    Verify that the Regions and resource ARNs in your IAM policy are correct.5.    Make sure that you don't select Kinesis Firehose when you are configuring the subscription filter for Kinesis Data Streams.6.    After you start streaming, check the metrics for the subscription filter. Confirm that the filter pattern is valid and matches the incoming log events. For more information, see Monitoring with CloudWatch metrics. Use these metrics:ForwardedBytes - The volume of log events in compressed bytes forwarded to the subscription destination.ForwardedLogEvents - The number of log events forwarded to the subscription destinations.7.    To confirm that there are no errors when streaming log events to the destination, check these metrics for destination errors. You might find a datapoint that confirms that the log event received an error when streaming log events to the destination.DeliveryErrors - The number of log events that CloudWatch logs received an error for when forwarding data to the subscription destination.DeliveryThrottling - The number of log events that CloudWatch logs throttled when forwarding data to the subscription destination.8.    If you have a dedicated stream that gives insights for your Kinesis Data Streams functionality, then check the metrics for your Kinesis Data Stream or Kinesis Firehose. For more information, see Monitoring the Amazon Kinesis Data Streams Service with Amazon CloudWatch and Monitoring Kinesis Data Firehose using CloudWatch Metrics.Troubleshoot OpenSearch as destination target1.    Check that the OpenSearch domain allows either public access or VPC access. For more information on creating a domain, see Creating and managing Amazon OpenSearch Service domains.2.    Be sure that the AWS Lambda function has an IAM execution role that has trust relation for lambda.amazonaws.com with this role policy:{  "Version": "2012-10-17",  "Statement": [    {      "Action": [        "es:*"      ],      "Effect": "Allow",      "Resource": "arn:aws:es:region:account-id:domain/target-domain-name/*"    }  ]}3.    If the target OpenSearch domain uses VPC access, check that the role has the AWSLambdaVPCAccessExecutionRole policy attached.Related informationCreate cross account & cross Region CloudWatch dashboardsFollow"


Question: How do I know if I'm using an older CloudFront API version?

I want to know if I'm using an older Amazon CloudFront API version that doesn't support CloudFront's alternate domain name (CNAME) validation process. I want to update my applications that invoke those APIs.

Answer: "I want to know if I'm using an older Amazon CloudFront API version that doesn't support CloudFront's alternate domain name (CNAME) validation process. I want to update my applications that invoke those APIs.ResolutionUse AWS CloudTrail logs and Amazon Athena queries to determine if you're using an older CloudFront API version that doesn't support the CNAME validation process:1.    Turn on CloudTrail logging for your account in the US East (N. Virginia) Region (us-east-1).Note: If you already have CloudTrail logging turned on for the US East (N. Virginia) Region and you don't have a log rotation set up, then you can copy a subset of your current logs into a new prefix. This lets you run an Athena query on a subset of the logs instead of the entire dataset. Athena queries are billed based on each GB of data scanned. This means that it's a best practice to review only the last 30 days of logs to reduce cost.2.    After the CloudTrail logs are being written to an Amazon Simple Storage Service (Amazon S3) bucket, create a table for the logs.3.    Open the Athena console, add the following query to the New query 1 box, and choose Run query:Important: Replace $databaseName.$tableName with the names of your database and table.SELECT apiversion, count() AS TotalFROM "default"."cloudtrail_logs_cloudtrail_awslogs_317431709534_6l2vpmtr_isengard_do_not_delete"WHERE eventsource = 'cloudfront.amazonaws.com'AND parse_datetime(apiversion, 'yyyy_MM_dd') < parse_datetime('2020_05_31', 'yyyy_MM_dd')GROUP BY apiversionORDER BY Total Desc;The query returns a count of the API calls that use earlier CloudFront API versions. If the query returns no results, then your account isn't using an earlier API version.If the previous query did return results, then run this additional query to get more information about each individual API call:Important: Replace $databaseName.$tableName with the names of your database and table.SELECT useridentity.arn, sourceipaddress, eventname, useragent,eventtimeFROM "default"."cloudtrail_logs_cloudtrail_awslogs_317431709534_6l2vpmtr_isengard_do_not_delete"WHERE eventsource = 'cloudfront.amazonaws.com'AND parse_datetime(apiversion, 'yyyy_MM_dd') < parse_datetime('2020_05_31', 'yyyy_MM_dd');This query returns the AWS Identity and Access Management (IAM) identity, source IP address, API call (event), and user agent associated with the API calls. Use this information to determine which applications you want to update with the new CloudFront API versions.Follow"


Question: How do I configure volume mapping or find the volume mapping for my EC2 Windows Server 2016 or later instance?

"I have an Amazon Elastic Compute Cloud (Amazon EC2) Windows Server 2016 or later instance. I want to view the current volume mapping on my instance. Or, I want to configure volume mapping so that I can have a fixed drive letter in the operating system?"

Answer: "I have an Amazon Elastic Compute Cloud (Amazon EC2) Windows Server 2016 or later instance. I want to view the current volume mapping on my instance. Or, I want to configure volume mapping so that I can have a fixed drive letter in the operating system?ResolutionView existing volume mappingsFor information on viewing the existing volume mapping on the instance, see Map disks to volumes on your Windows instance.Configure volume mappings1.    Connect to the instance.2.    Open File Explorer, and then select This PC. Make sure that the disk is online and that it has the label on it.3.    Note the volume name that you want to assign the drive letter to.Note: Your configuration might require a unique name for each drive. If the drive letter is already in use, the mapping fails. Also, be aware that EC2Launch initializes drives that aren't already initialized and partitioned.The following steps are tested for Windows Server 2016 and later:4.    Open **C:\ProgramData\Amazon\EC2-Windows\Launch\Config**. Edit the DriveLetterMappingConfig.json file with any text editor application, such as Notepad.The following example assigns the letter D to Backup volume and the letter E to Logs volume:{     "driveLetterMapping": [        {            "volumeName": "Backup",            "driveLetter": "D"        },        {            "volumeName": "Logs",            "driveLetter": "E"        }    ]}5.    Run the following command in Windows PowerShell to launch the EC2Launch script to initialize the disks:C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeDisks.ps1Add the -Schedule flag to initialize the disks each time the instance boots, as shown in the following example:C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeDisks.ps1 -ScheduleYour new mappings are now set.Follow"


Question: How do I troubleshoot network connectivity from my Amazon SageMaker notebook instance that has direct internet access deactivated?

My Amazon SageMaker notebook instance is in an Amazon Virtual Private Cloud (Amazon VPC) with direct internet access deactivated and I need to troubleshoot network settings.

Answer: "My Amazon SageMaker notebook instance is in an Amazon Virtual Private Cloud (Amazon VPC) with direct internet access deactivated and I need to troubleshoot network settings.ResolutionSageMaker notebook instances can be configured to use the public internet, or an Amazon VPC. When using an Amazon VPC, the SageMaker notebook instance uses the VPC to train or deploy models instead of the public internet.Note: After you create a SageMaker notebook instance, you can’t change the network configuration settings. This applies to both Public internet only and VPC SageMaker notebooks. If your SageMaker notebook requires changes to the network settings, you must Create a new notebook instance.When a notebook instance with direct internet access deactivated is in VPC mode, you can’t train or deploy models from notebooks on this instance unless:Your VPC has a NAT Gateway.Your instance security group allows outbound connections.If you don’t want traffic from the notebook to traverse the internet, use VPC endpoints to connect to services like SageMaker API and SageMaker Runtime. For more information, see Connect to SageMaker though a VPC interface endpoint.Activate internet access from a notebook instance in an Amazon VPC with direct internet deactivated using a NAT GatewayAs a prerequisite, create a private and public subnet in the same Region as the VPC of the notebook instance:1.    Open the Amazon VPC console.2.    In the navigation pane, choose NAT Gateways.3.    Choose Create NAT Gateway and do the following:(Optional) Specify a name for the NAT gateway.Choose the public subnet.For Elastic IP allocation ID, associate an Elastic IP with the NAT gateway. You can allocate an Elastic IP address  if you don’t have one.4.    Choose Create a NAT Gateway.5.    Add the NAT Gateway to the route table of the private subnet.For more information about using SageMaker with your Amazon VPC, see Connect a notebook instance in a VPC to external resources.Perform NAT gateway troubleshooting checksVerify whether your VPC has an existing NAT gateway associated with it.Verify whether your VPC and NAT gateway are in the same region.Verify that your NAT gateway is created within a public subnet.Verify whether the NAT gateway is associated as a target in the route table for a private subnet.Verify that your destination allows inbound and outbound traffic.Verify whether your Amazon VPC’s security group allows outbound connections.For more information about NAT gateways, see NAT gateways.Activate access to AWS services from a notebook instance with direct internet deactivated using a VPC endpointOpen the Amazon VPC console.In the navigation pane, choose Endpoints.Choose Create endpoint.For Service category, choose AWS services.For Service name, select the service.For VPC, select the VPC in the same region as your SageMaker notebook instance.Select the route table associated with the private subnet.Choose Create endpoint.For more information about VPC endpoints, see Access an AWS service using an interface VPC endpoint.Perform VPC endpoint troubleshooting checksVerify that your Amazon VPC has an existing VPC endpoint associated to the AWS service that you want to connect to.Verify that both your Amazon VPC and the AWS service you want to connect to are located in the same region.Verify that the VPC endpoint is associated with a private subnet route table.Related informationCustomize your SageMaker notebook instances with lifecycle configurations and the option to turn off internet accessHow do I set up a NAT gateway for a private subnet in Amazon VPC?Understanding SageMaker notebook instance networking configurations and advanced routing optionsFollow"


Question: Why didn't Amazon Redshift perform any upgrades during the maintenance window?

"I scheduled maintenance for my Amazon Redshift cluster. However, the maintenance did not trigger. Why did this happen?"

Answer: "I scheduled maintenance for my Amazon Redshift cluster. However, the maintenance did not trigger. Why did this happen?ResolutionYour Amazon Redshift cluster might not perform an upgrade during the maintenance window for the following reasons:There are no maintenance tasks to perform: Check to see if there are any scheduled maintenance tasks. If there are none during the scheduled maintenance window, then your cluster operates normally until the next scheduled maintenance window.Your AWS Region has not yet implemented the latest version of Amazon Redshift: In some cases, your cluster might not be upgraded to the newest version of Amazon Redshift during a maintenance window. This depends on your AWS Region and the timing of the patch release. If your AWS Region hasn't implemented the latest version of Amazon Redshift, then your cluster isn't updated.Amazon Redshift is undergoing a hardware update: Maintenance periods are overridden when a mandatory hardware replacement is scheduled on your Amazon Redshift cluster. If a hardware replacement is required, you receive an event notification through the AWS Management Console and SNS subscription as a "Pending" item.For more information, see Overview of managing clusters in Amazon Redshift.Follow"


Question: Why can't I connect to my Amazon EC2 Windows instance with RDP using Fleet Manager?

I can't connect to my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance with Remote Desktop Protocol (RDP) using AWS Systems Manager Fleet Manager.

Answer: "I can't connect to my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance with Remote Desktop Protocol (RDP) using AWS Systems Manager Fleet Manager.Short descriptionYou might have these connection issues with RDP due to the following reasons:Insufficient permissions for the AWS Identity and Access Management (IAM) user or roleConnection request timed outIncorrect username or passwordAccount disabledThe default RDP port (3389) changed on operating system levelLocal or domain account password expiredConnection terminatedConnection disconnected after 60 minutesTarget not connectedSingle sign-on (SSO) login errorResolutionBe sure that the following prerequisites are met:Before using Remote Desktop, verify that the instance meets the requirements for the environment.Make sure that the instance is listed in the Systems Manager console. It must be listed in the Fleet Manager section under Managed nodes. Also, make sure that the AWS Systems Manager Agent (SSM Agent) ping status is Online.To troubleshoot managed instances, see Why is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?Insufficient permissionsThis indicates that the IAM user or role that you use to access the Systems Manager console doesn't have permissions to do the following actions:ssm-guiconnect:CancelConnectionssm-guiconnect:GetConnectionssm-guiconnect:StartConnectionAn Error occurred while calling the StartConnection API operation. AccessDeniedException: User: arn:aws:iam::46xxxxxxxxxxx59:user/ssmtestis not authorized to perform: ssm-guiconnect:StartConnection resource: arn:aws:ec2:us-west-2:46xxxxxxxxx59:instance/*'To fix this issue, configure the required permissions. Then, retry the operation.Connection request timed outYou get this error when SSM Agent is running on an earlier version:An error occurred while establishing the Remote Desktop session. The remote desktop connection request Timed out.To use Remote Desktop using Fleet Manager, verify that the nodes are running SSM Agent version 3.0.222.0 or later. To check the version number of SSM Agent that's installed on a managed node, see Checking the SSM Agent version number. To install or update SSM Agent, see Working with SSM Agent.Incorrect username or password, account disabled, or default RDP Port changed on operating system levelThe Fleet Manager Remote Desktop window might get stuck with the following error message:Its taking longer than expected to render the Remote Desktop connection. Please try again.You might get this error because the IAM user is using the wrong username or password. Check and make sure that the credentials are entered correctly.Verify that the user account isn't disabled in your Active Directory, local user, and group management.Make sure that the RDP port is set to 3389 using the PowerShell command. If not, set it to the default value of 3389.PS> (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber").PortNumberPS>  Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value 3389PS>  Restart-Service TermService -forceLocal or domain account password expiredYou get the following error when the password for a local user or domain user expired:An error occurred: Generic errorTo resolve this error, connect the instance using RDP with a different account. Reset the password for the local account using the lusrmgr.msc tool. If the password for your domain account expired, reach out to the domain admin or respective system admin to reset the password.Connection terminatedYou get the following error when the RDP connection disconnects after it was idle for more than 10 minutes:The connection has been terminated. The connection has been marked as idle.This occurs because of the condition that was applied during the active Remote Desktop connections where the connection disconnects after it was idle for 10 minutes.You get this error only when Remote Desktop Services is stopped or restarted at the OS level on an existing active RDP session:The connection has been terminated. Generic Error.Connection disconnected after 60 minutesThe connection has been Terminated. No ErrorThis is not an error. This happens because of the condition that was applied during the active Remote Desktop connections—by default, a Remote Desktop connection is disconnected after 60 minutes. To prevent the connection from being disconnected, choose Renew session before the connection is disconnected. This resets the duration timer. The connection might also terminate because the Amazon EC2 instance is shutdown or rebooted from the existing active RDP session.Target not connectedYou get the following error when the EC2 Windows instance isn't online or recently entered the booting state:An error occurred while calling the StartConnection API operation. ValidationException: The StartSession API operation didn't succceed: An error occurred (TargetNotConnected)To prevent this error, make sure that the EC2 instance is in the running state after passing both of its status checks.SSO login errorYou get the following error when SSO isn't configured or supported from where the authorization is requested:An error occurred while establishing the Remote Desktop Connection Error. The system cannot create an operating system for the SSO Login. The SSO functionality is not supported on the Domain controllers. You can only connect with username/password method.To resolve this error, use the username and password to connect to the instance. Or, contact the domain admin of your organization.Related informationAWS Systems Manager Fleet ManagerFollow"


Question: "How can I migrate from provisioned Aurora to Aurora Serverless, or from Aurora Serverless to provisioned Aurora?"

"I want to migrate from a provisioned Amazon Aurora DB instance to an Aurora Serverless DB instance, or vice versa. How can I do this?"

Answer: "I want to migrate from a provisioned Amazon Aurora DB instance to an Aurora Serverless DB instance, or vice versa. How can I do this?Short descriptionThere are two methods that can be used to migrate from provisioned to serverless, and serverless to provisioned:Snapshot restore.Logical backup and restore.ResolutionSnapshot restoreOpen the Amazon Relational Database Service (Amazon RDS) console, and then select Databases from the navigation pane.Select the Aurora cluster you want to migrate to provisioned or serverless, then select Actions, and then select Take snapshot. For more information, see Creating a DB cluster snapshot.Navigate to the Snapshots section of the Amazon RDS console.Select Actions, and then select Restore snapshot. For more information, see Restoring from a DB cluster snapshot.Select Provisioned or Serverless, based on what you want to do.Note: Aurora Serverless is available only on specific engine versions. For more information see, Aurora Serverless v1 and Aurora Serverless v2.For Aurora Serverless v1, select Serverless under Capacity type in the DB instance settings. For Serverless v2, select Serverless under DB instance class in the Instance configuration section.For the DB cluster identifier, enter a name for your restored cluster.Specify any other settings. For more information, see Settings for Aurora DB clusters.Select Restore DB Cluster.Logical backup and restoreCreate a new DB clusterOpen the Amazon RDS console, and then choose Databases from the navigation pane.Select Create database.Note: Amazon Aurora isn't available in all AWS Regions. For a list of AWS Regions where Aurora is available, see Region availability.Select Amazon Aurora in the Engine options.In Edition, select one of the following:a. Amazon Aurora with MySQL compatibilityb. Amazon Aurora with PostgreSQL compatibilitySelect your Engine version.Note: Aurora Serverless is available only on specific engine versions. For more information see, Aurora Serverless v1 and Aurora Serverless v2.Specify any other settings. For more information, see Creating a DB cluster.Select Create database.Create a logical backup and restoreConnect to the source DB cluster. If you use PostgreSQL, then run a pg_dump. If you use MySQL, then run a mysqldump.Connect to the new DB cluster. If you use PostgreSQL, then restore the dump on it with pg_restore. If you use MySQL, then restore the dump on it with mysql command.How to avoid data lossTo avoid data loss between the two clusters, stop all write activity on the source cluster until the restoration or migration of the newly created or restored cluster is complete. Stop all write activity before you create the snapshot, mysqldump, or pg_dump.When the new Aurora cluster is available, direct your application or write operations to the cluster to make sure that no write operations are lost.Note: The following example uses the name "example-cluster". For example, rename the old cluster to "example-cluster-old". Then, rename the new cluster to "example-cluster". This allows your applications to connect to the new cluster using the same cluster endpoint. For example, use "example-cluster.cluster-...rds.amazonaws.com" for the writer, and "example-cluster.cluster-ro-...rds.amazonaws.com" for the reader endpoint.Follow"


Question: How do I set up an IAM user and sign in to the AWS Management Console using IAM credentials?

How can I set up an AWS Identity and Access Management (IAM) user and manage IAM policies for users and applications?

Answer: "How can I set up an AWS Identity and Access Management (IAM) user and manage IAM policies for users and applications?Short descriptionIf you're new to IAM, consider the following best practices before getting started:For a general overview of IAM, see What Is IAM?For a tutorial that helps you create a user with administrative permissions for yourself, see Creating your first IAM admin user and group.After you create your IAM user, sign in as that IAM user by following the instructions for How IAM users sign in to AWS.For a list of best practices to improve the security of your IAM resources and account, see Security best practices in IAM.For information on managing IAM policies and adding permissions to an IAM identity (IAM user, group, or role), see Managing IAM policies.ResolutionTo create a new IAM user, follow the instructions for Creating an IAM user in Your AWS Account.Related informationGetting started with IAMBusiness use cases for IAMFollow"


Question: How can I troubleshoot common errors when using the OEM_AGENT option with Amazon RDS for Oracle?

I have an Amazon Relational Database Service (Amazon RDS) DB instance that is running Oracle. I receive an error when I try to use the OEM_AGENT option with my DB instance. How can I troubleshoot and resolve common errors when using the OEM_AGENT option?

Answer: "I have an Amazon Relational Database Service (Amazon RDS) DB instance that is running Oracle. I receive an error when I try to use the OEM_AGENT option with my DB instance. How can I troubleshoot and resolve common errors when using the OEM_AGENT option?Short descriptionAmazon RDS supports the Oracle Enterprise Manager (OEM) Management Agent through use of the OEM_AGENT option. You might receive one of the errors described in this article when using the OEM_AGENT option with your Amazon RDS for Oracle DB instance.Note: Before proceeding with the troubleshooting steps, run the following pre-checks on your DB instance:1.    Check the option group status after adding the OEM_AGENT option to the option group and applying option to the DB instance by running the following AWS Command Line Interface (AWS CLI) command:aws rds describe-db-instances --db-instance-identifier <db-instance-name> --query 'DBInstances[*].[Engine,DBInstanceStatus,OptionGroupMemberships]'Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Verify the output to be sure that the option group status is in-sync. If the option group status is in-sync, then you get the following output:[    [        "oracle-ee",        "available",        [            {                "OptionGroupName": "custom-oracle-option",                "Status": "in-sync"            }        ]    ]]If the option group status is INVALID, then the OEM_AGENT isn't installed successfully due to issues with the network configuration setup and other prerequisites.You can verify the installation status of the OEM_AGENT option by reviewing the Events section of your Amazon RDS DB instance from the AWS Management Console. You can also use the AWS CLI command describe-events.If the events indicate an issue with the installation of the OEM_AGENT option or network configuration, then be sure that the succeeding prerequisites are met.2.    Check your DB instance's network configuration. The security group of your DB instance must allow OMS_HOST to listen to the OEM_AGENT port (default is 3872) and the RDS port (default is 1521).3.    Run a telnet test from the Oracle Management Service (OMS) server to your DB instance on the OEM agent port and database port to check connectivity.4.    Check your network configurations, including network access control lists (ACLs) and route tables. Verifying the configurations rules out the possibility of blockers or an explicit deny.5.    Make sure that the firewall between OMS and RDS allows traffic on both the DB listener port and OEM Agent port.After you complete these checks, check if OEM_AGENT upload is working. For more information on OEM_AGENT prerequisites, see Oracle Management Agent for Enterprise Manager Cloud Control.ResolutionTo troubleshoot issues when using the OEM_AGENT option with your RDS for Oracle instance, review the OEM agent logs after exporting these logs to Amazon CloudWatch. For more information, see Publishing Oracle logs to Amazon CloudWatch Logs.The DB instance doesn't show up in the Auto Discovery of targets on the OEM consoleThis issue occurs when the OMS server can't connect to the underlying host via SSH. This connection is a prerequisite at the OS level for Auto Discovery to work correctly. Unlike the wizard-based Auto Discovery that's used when you add a target Oracle DB instance, you must manually add your Oracle DB instance as the target. For more information on limitations for the Management Agent, see Limitations for Management Agent.Error: Unable to install the Oracle OEM_AGENT because the agent password is incorrect or expiredMake sure that the agent password is correct and that it's not expired. On the OEM server, you can modify the existing agent registration password, or create a new password.Error: Unable to install the Oracle OEM_AGENT because the DB instance cannot reach the OMS hostYou receive this error when the OEM_AGENT fails to install because the OMS host/port can't be reached from the RDS host. To troubleshoot this error, check whether the OMS host can be reached from your DB instance.To validate the network connectivity between the OMS server and OEM_AGENT, test the connection from the RDS for Oracle instance to the OMS server. To do so, you can leverage access control lists (ACL) and UTL_TCP packages.Use the DBMS_NETWORK_ACL_ADMIN package that provides the interface to administer the network ACL.Use the UTL_TCP.CONNECTION. This is a PL/SQL record type that's used to represent a TCP/IP connection.You can also do the following:1.    Launch an Amazon Elastic Compute Cloud (Amazon EC2) instance with the same network setup (SG/ACL) as your DB instance.2.    Run a telnet command from the Amazon EC2 instance to the OMS host on port 4903:telnet OMS_HOST 49033.    Validate the connectivity by running a telnet test in your OEM host from the OMS server to your DB instance:telnet RDS-instance-endpoint 1521 (RDS default port)4.    Check if the RDS host is able to resolve the OMS hostname into an IP address:SQL> SELECT UTL_INADDR.get_host_address('OMS_Host_Name') FROM dual;5.    Run a TCP Traceroute to check where the traffic is blocked.Error: You successfully installed the OEM_AGENT option on your DB instance. Your security group might not be configured correctlyEven if your installation completes correctly, the RDS security group associated with your DB instance might be missing configurations to allow communication between the OMS host and DB instance.To resolve this error, verify that the security group of the agent allows inbound traffic, and that your OMS host belongs to a security group that has access to the agent port. For more information, see Oracle Management Agent for Enterprise Manager Cloud Control.Error: Unable to install the Oracle OEM_AGENT because your OMS host version x.x.x.x is not compatible with the agent version x.x.x.x.You receive this error when there is a compatibility issue between your OEM_AGENT version and the OMS host version. Currently, OEM_AGENT integrates with the OMS when both components are compatible. To resolve this error, choose compatible versions for both OMS host and OEM agent. For information on reviewing the compatibility matrix, see Prerequisites for Management Agent.Error: Your OMS host is using an untrusted third-party certificateYou receive this error when you successfully install the OEM_AGENT option, but your OMS host is using a third-party certificate that isn't trusted. Configure your OMS host with the required trust certifications from your third party.Error: OEM_AGENT option is missing required option settings (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue;You receive this error when OEM_AGENT is missing one of the required settings, and you need to specify this setting. For more information on the required settings for OEM_AGENT, see Option settings for Management Agent.Error: Heartbeat Status: OMS responded illegally [ERROR - Failed to Update Target Type Metadata]You receive this error when the OMS host is replaced after the OEM_AGENT option is attached to Amazon RDS.1.    Clear the agent status, or re-start the OEM_AGENT using the steps in Performing database tasks with the Management Agent.2.    Re-establish your connection with the OMS host.3.    Check for compatibility issues with the OMS version and OEM_AGENT version. Run the following query to check if the table lists the OEM_AGENT version used in the option group:select type_meta_ver from sysman.mgmt_target_type_versions where target_type = 'oracle_emd';4.    If the mgmt_target_type_versions output doesn't contain the OEM_AGENT version used in the option group, install the OEM_AGENT version that is listed in the command output.This error might also indicate that the required OMS side patches and plugins are missing. Be sure that OMS is set up correctly and all the required patches are applied.If the agent is blocked, do the following in the OEM console to resync the agent:Sign in to the Cloud Control console.Choose Setup, choose Manage Cloud Control, and then choose Agents.Choose the agent that you want to resync.From the Agent dropdown list, choose Resynchronization....Select Unblock agent on successful completion of agent resynchronization.Choose Continue.The resync operation is submitted as a job.Check the resynchronization job's status by choosing the job name's link.After the job is completed successfully, verify the status of the agent that you resynchronized and all monitored targets.Note: The DNS server must be functioning continuously for the OEM monitoring to work effectively. The Agent emits heartbeat and pushes status updates to the OMS host. if the OMS host isn't reachable from the agent for an extended period of time, then OMS might consider that the agent and database are down. Therefore, be sure that the DNS server is functioning.To make the Oracle Management Agent upload the OMS associated with it, run the following query. Running this query is equivalent to running the emctl upload agent command.SELECT rdsadmin.rdsadmin_oem_agent_tasks.upload_oem_agent() as TASK_ID from DUAL;To restart the OEM agent after clearing the agent state, run the following query:SELECT rdsadmin.rdsadmin_oem_agent_tasks.restart_oem_agent() as TASK_ID from DUAL;You can deploy only Oracle Management Agent 13c Release 4 (13.4.0.0.0) using the Oracle Enterprise Manager Cloud Control 13c Release 4 (13.4.0.0.0). Fresh deployment of older Oracle Management Agent (13.2 and 13.3) versions aren't supported after OMS is upgraded to 13c Release 4. For more information, see Before you begin installing an Enterprise Manager System.Error: Unable to install the OEM_AGENT option because the agent port conflicts with the OMS port. Update the option settings and try againYou receive this error because you have the wrong configuration for OEM_AGENT to work correctly. You might have specified the same port number for both the OMS port and the OEM_AGENT port. To resolve this error, change either the OMS port or the OEM_AGENT port number.Review the following Management Agent option settings:AGENT_PORT - This port on the DB instance listens for the OMS host. The default is 3872. Your OMS host must belong to a security group that has access to this port.OMS_PORT - This HTTPS port on the OMS Host listens for the Management Agent.To find the HTTPS upload port, connect to the OMS host and run the following command:emctl status oms -detailsError: Unable to install the Oracle OEM_AGENT because your DB instance does not have enough storage. Confirm that option group is supported on your DB instance class and configuration. If so, verify all option group settings and retryYou receive this error when the provisioned storage for your DB instance doesn't have enough available storage as needed according to the OEM_AGENT prerequisites. For more information, see Prerequisites for Management Agent. Increase the storage space, and then re-install the OEM_AGENT option.Error: Filesystem / has X.XX% available spaceYou receive this error because of a limitation to using the OEM_AGENT option with an RDS for Oracle instance. Host metrics and the process list might not reflect the actual system state. Therefore, avoid using OEM to monitor the root file system or mount point file system. For more information, see Limitations for Management Agent.The root file system of an Amazon RDS instance is maintained by the internal automation system. This automation system monitors the root file system at regular intervals to make sure that the file system has adequate space. If insufficient storage is detected, the automation system adds adequate space to the root file system. Because the automation system manages the space in the root file system, you can ignore this error.Related informationOracle Management Agent for Enterprise Manager Cloud ControlPrerequisites for Management AccessPerforming database tasks with the Management AgentFollow"


Question: Why is my Spot Instance terminating even though the maximum price is higher than the Spot price?

Amazon Elastic Compute Cloud (Amazon EC2) is terminating my Spot Instance even though the maximum price I set is higher than the Spot Price. How can I troubleshoot this?

Answer: "Amazon Elastic Compute Cloud (Amazon EC2) is terminating my Spot Instance even though the maximum price I set is higher than the Spot Price. How can I troubleshoot this?ResolutionAmazon EC2 might terminate your Spot Instance even if your maximum price is higher than the Spot price for the following reasons:Lack of Spot Capacity - Amazon EC2 interrupts your Spot Instance when the capacity is needed. Often Amazon EC2 reclaims your instance to repurpose capacity. Your Spot Instance might also be terminated for issues such as host maintenance or hardware decommission.Amazon EC2 can't meet your Spot Instance request constraints - If your request includes a constraint such as a launch group or a specific Availability Zone group, then the Spot Instances are terminated as a group when the constraint can no longer be met.Setting a high maximum price doesn't guarantee Spot Instance availability. For more information, see How Spot Instances work.Note: When Amazon EC2 interrupts a Spot Instance, by default the Spot Instance is terminated. You can change this default behavior to hibernate or stop the instance instead of terminating it. For more information, see Interruption behaviors.To determine why Amazon EC2 interrupted your Spot Instance, do the following:Open the Amazon EC2 console, and then select Spot Requests.Choose the Request ID of the terminated Spot Instance.View the Status field under the Description section to see reason code explaining why the instance was terminated. For example, If Amazon EC2 didn’t have enough Spot Capacity, the Status field says "instance-terminated-no-capacity". For a complete list of reason codes, see Spot request status codes.You can use Spot Instance interruption notices to work around potential interruptions. For more information, see Taking advantage of Amazon EC2 Spot Instance interruption notices.Related informationWhy am I receiving a "no Spot capacity available" error when trying to launch an Amazon EC2 Spot Instance?Spot Instance interruptionsSpot request statusFollow"


Question: How do I troubleshoot Sender ID issues when sending SMS messages in Amazon SNS?

My Amazon Simple Notification Service (Amazon SNS) mobile text messaging (SMS) Sender ID isn’t working—or is getting changed when it’s delivered to recipients. How do I troubleshoot Sender ID issues when sending SMS messages in Amazon SNS?

Answer: "My Amazon Simple Notification Service (Amazon SNS) mobile text messaging (SMS) Sender ID isn’t working—or is getting changed when it’s delivered to recipients. How do I troubleshoot Sender ID issues when sending SMS messages in Amazon SNS?ResolutionTo resolve Sender ID-related issues when sending SMS messages in Amazon SNS, first review this article to identify the specific issue that you’re experiencing. Then, follow the troubleshooting steps listed for that issue.If your Sender ID is different than the one you configured when it's delivered to SMS message recipientsRegister your Sender ID in the country that you’re sending messages to. To register your Sender ID, follow the instructions in Requesting Sender IDs for SMS messaging with Amazon SNS.Note: If you use an unregistered Sender ID to send SMS messages to a country that requires a pre-registered Sender ID, the ID can be changed. For a list of the countries that require a pre-registered Sender ID, see Supported Regions and countries.If your Sender ID is delivered as “NOTICE” to SMS message recipientsSpecify a Sender ID in your publish request using the Amazon SNS console or the AWS SDKs.Note: If you don’t specify a Sender ID when sending SMS messages to countries that require one, NOTICE is displayed as the originating identity. For a list of the countries that require a pre-registered Sender ID, see Supported Regions and countries.If your SMS messages fail or get blocked when using a Sender IDMake sure that your messages comply with the laws and regulations of the country that you're sending messages to. For more information, see Comply with laws and regulations.Confirm if the country that you’re sending messages to requires pre-registered message template or not. For a list of countries that require a pre-registered message template, see Supported Regions and countries.Note: If you’re sending SMS messages to India, you must also pre-register your Sender ID and message templates with the Telecom Regulatory Authority of India (TRAI).Make sure that your Sender ID represents only a brand or trademark that you own.If your messages still fail to send, see How do I troubleshoot mobile text message (SMS) failures in Amazon SNS?Note: Mobile phone carriers regularly audit bulk SMS message senders and can block messages if the messages don’t comply with local laws and regulations. AWS also prohibits SMS Spoofing, where the Sender ID is used to impersonate another person, company, or product. For more information, see SMS best practices.If your Sender ID isn't working in specific countries onlyConfirm if the country that you’re sending messages to supports Sender IDs or not. If the country doesn’t support Sender IDs, your messages will be delivered using one of the other origination numbers that are supported in that country. For a list of countries that support Sender IDs, see Supported Regions and countries.Check if the country that you’re sending messages to requires a pre-registered Sender ID and/or message templates. For a list of countries that require a pre-registered Sender ID and/or message templates, see Supported Regions and countries. To register your Sender ID and/or message templates, follow the instructions in Requesting Sender IDs for SMS messaging with Amazon SNS.Note: Not all countries and regions support Sender IDs. In countries and regions where Sender IDs aren’t supported, SMS messages are delivered using person-to-person (P2P) long codes or other supported origination numbers.Follow"


Question: How can I configure and access ElastiCache for Redis from my Lightsail instance?

I want to connect to Amazon ElastiCache for Redis endpoints from my Amazon Lightsail instance. How do I do this?

Answer: "I want to connect to Amazon ElastiCache for Redis endpoints from my Amazon Lightsail instance. How do I do this?ResolutionTo connect to an ElastiCache for Redis cluster from a Lightsail instance, do the following:(Optional) Create the Lightsail instance and ElastiCache for Redis resources if you haven't already done so.Configure the security group on the cluster to allow the connection.Turn on VPC peering on your Lightsail instance.Connect to the Redis cluster endpoint from the Lightsail instance.(Optional) Create the Lightsail instance and ElastiCache Redis resourcesFor information on creating a Lightsail instance and connecting to the instance, see Create an Amazon Lightsail instance.For information on creating an ElastiCache for Redis cluster, see Create a cluster.Note: Create the Lightsail and ElastiCache resources in the same Region. You must create the ElastiCache resources on the default VPC.Configure the security group on the cluster to allow the connectionMake sure that the security group of the ElastiCache for Redis cluster allows incoming TCP connections on port 6379 from the Lightsail instance's private IP address.To add inbound port 6379 to your ElastiCache for Redis cluster, do the following:1.    Open the Amazon ElastiCache console, and then select the AWS Region where the cluster is located.2.    In the ElastiCache console dashboard, choose Redis.3.    Select your cluster, and then note the security group associated with the cluster.4.    Open the Amazon VPC console and then select the security group you noted in step 3.5.    Add a new custom TCP rule for port 6379 from the source IP. In this case, the source IP is the private IP of the Lightsail instance.Turn on VPC peering on the Lightsail instanceFor information about turning on the VPC peering connection on the Lightsail instance, see Set up Amazon VPC peering to work with AWS resources outside of Amazon Lightsail.Note: Turn on VPC peering for the Region that you created your resources in.Connect to the Redis cluster endpoint from the Lightsail instance1.    Download and install redis-cli on your Lightsail instance. Redis-cli is a utility that you can use to connect to a cluster or replication group from within the instance.To install redis-cli on an Amazon Linux 2 instance:$ sudo yum install gcc$ sudo wget http://download.redis.io/redis-stable.tar.gz$ sudo tar xvzf redis-stable.tar.gz$ cd redis-stable$ sudo makeFor instructions on installing redis-cli on other Linux distribution, see Download and install redis-cli.2.    To connect to the cluster, run the following command. Replace cluster-endpoint and port number with the endpoint of your cluster and your port number. (The default port for Redis is 6379.)$ src/redis-cli -h cluster-endpoint -c -p port numberThe command returns a Redis command prompt similar to the following:cluster-endpoint: port numberNote: You can test the connection from your Lightsail instance to the Redis cluster endpoint by running the telnet command:$ telnet <redis_endpoint> 6379Follow"


Question: How can I find the top talkers or contributors to traffic through the NAT gateway in my VPC?

I noticed higher than usual costs in my AWS bill for a NAT gateway in my Amazon Virtual Private Cloud (Amazon VPC). How can I find the top contributors to traffic through the NAT gateway in my VPC?

Answer: "I noticed higher than usual costs in my AWS bill for a NAT gateway in my Amazon Virtual Private Cloud (Amazon VPC). How can I find the top contributors to traffic through the NAT gateway in my VPC?ResolutionNote: In each of the following commands, replace x.x.x.x with the private IP of your NAT gateway. Replace y.y. with the first two octets of the VPC CIDR range.Confirm that you have VPC Flow Logs turned on your VPC or NAT gateway elastic network interface. Create a flow log to turn on VPC Flow Logs, if necessary. You can publish flow log data to Amazon CloudWatch Logs or Amazon Simple Storage Solution (Amazon S3).To query in CloudWatch logs1.    Open the CloudWatch console.2.    In the navigation pane, choose Logs Insights.3.    From the dropdown list, select the log group for your NAT gateway.4.    To find the instances that are sending the most traffic through your NAT gateway, run the following query:filter (dstAddr like 'x.x.x.x' and srcAddr like 'y.y.') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr| sort bytesTransferred desc| limit 105.    To find traffic going to and from the instances, run the following query:filter (dstAddr like 'x.x.x.x' and srcAddr like 'y.y.') or (srcAddr like 'x.x.x.x' and dstAddr like 'y.y.')| stats sum(bytes) as bytesTransferred by srcAddr, dstAddr| sort bytesTransferred desc| limit 106.    To find the internet destinations that the instances in your VPC communicate with most often, run the following queries.For uploads:filter (srcAddr like 'x.x.x.x' and dstAddr not like 'y.y.') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr| sort bytesTransferred desc| limit 10For downloads:filter (dstAddr like 'x.x.x.x' and srcAddr not like 'y.y.') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr| sort bytesTransferred desc| limit 10To query logs in an S3 bucket using AthenaEither use the Amazon VPC console or the Amazon Athena console to create a table. In this example, default is the database and vpc_flow_logs is the table.1.    To find the instances that are sending the most traffic through your NAT gateway, run the following query:SELECT srcaddr,dstaddr,sum(bytes) FROM "default"."vpc_flow_logs"WHERE srcaddr like 'y.y.%' AND dstaddr like 'x.x.x.x' group by 1,2 order by 3 desclimit 10;2.    To find traffic going to and from the instances, run the following query:SELECT srcaddr,dstaddr,sum(bytes) FROM "default"."vpc_flow_logs"WHERE (srcaddr like 'y.y.%' AND dstaddr like 'x.x.x.x') or (srcaddr like 'x.x.x.x' AND dstaddr like 'y.y.%') group by 1,2 order by 3 desclimit 10;3.    To find the internet destinations that the instances in your VPC communicate with most often, run the following queries.For uploads:SELECT srcaddr,dstaddr,sum(bytes) FROM "default"."vpc_flow_logs"WHERE (srcaddr like 'x.x.x.x' AND dstaddr not like 'y.y.%') group by 1,2 order by 3 desclimit 10;For downloads:SELECT srcaddr,dstaddr,sum(bytes) FROM "default"."vpc_flow_logs"WHERE (srcaddr not like 'y.y.%' AND dstaddr like 'x.x.x.x') group by 1,2 order by 3 desclimit 10;Related informationSample queries (for CloudWatch Logs Insights)Querying Amazon VPC Flow LogsHow do I analyze the Amazon VPC flow logs using Amazon Athena?Using AWS Cost Explorer to analyze data transfer costsFollow"