Question: How do I resolve processing errors in Amazon Neptune Bulk Loader?

"I'm trying to use Amazon Neptune Bulk Loader to load data from an Amazon Simple Storage Service (Amazon S3) bucket. However, some of the requests fail. How do I troubleshoot this?"

Answer: "I'm trying to use Amazon Neptune Bulk Loader to load data from an Amazon Simple Storage Service (Amazon S3) bucket. However, some of the requests fail. How do I troubleshoot this?Short descriptionTo troubleshoot data requests that keep failing, check the status of each job. Then, identify the failed jobs by doing the following:Use the default Bulk Loader API for each individual load and check each job's status.Use an admin script and an automated script in one job. You can create and run the automated script on a Linux or UNIX system.Note these limitations:The Neptune Bulk Loader API doesn't provide a snapshot view of all load operations.If AWS Identity and Access Management (IAM) authorization is enabled on the Neptune cluster, then the requests to the Bulk Load API must be signed.The Bulk Loader API caches information only on the last 1024 load jobs. It only stores error details for the last 10,000 errors per job.ResolutionUse the default Bulk Loader API1.    Retrieve the loader IDs:$ curl -G  'https://neptunedemo-cluster.cluster-cw7ehemc1eeo.us-east-1.neptune.amazonaws.com:8182/loader'|jq{  "status": "200 OK",  "payload": {    "loadIds": [      "c32bbd24-99a7-45ee-972c-21b7b9cab3e2",      "6f6342fb-4ea3-452c-ac69-b4d117e37d5a",      "647114a6-6ed4-4018-896c-e84a08fcf864",      "521d33fa-7050-44d7-a961-b64ef4e2d1db",      "d0d4714e-7cf8-415e-89f5-d07ed2732bf2"    ]  }}2.    Check each job's status, one by one, to verify that the job was successful:curl -G 'https://neptunedemo-cluster.cluster-cw7ehemc1eeo.us-east-1.neptune.amazonaws.com:8182/loader/c32bbd24-99a7-45ee-972c-21b7b9cab3e2?details=true&errors=true&page=1&errorsPerPage=3'|jq{  "status": "200 OK",  "payload": {    "feedCount": [      {        "LOAD_COMPLETED": 2      }    ],    "overallStatus": {      "fullUri": "s3://demodata/neptune/",      "runNumber": 5,      "retryNumber": 0,      "status": "LOAD_COMPLETED",      "totalTimeSpent": 3,      "startTime": 1555574461,      "totalRecords": 8,      "totalDuplicates": 8,      "parsingErrors": 0,      "datatypeMismatchErrors": 0,      "insertErrors": 0    },    "errors": {      "startIndex": 0,      "endIndex": 0,      "loadId": "c32bbd24-99a7-45ee-972c-21b7b9cab3e2",      "errorLogs": []    }  }}Use an admin scriptYou can use an admin script to identify a failed Neptune Bulk Loader job in your production process. The admin script generates an output in the following format for all load jobs:Startime-loadid:status,S3location,ErrorsNote: The admin script can be used from any Linux system that has access to the Neptune cluster.Create and run the automated script on a Linux or UNIX system1.    Create the script using a text editor:$ vi script2.    Be sure that you replace cluster-endpoint:Port with the appropriate values:cluster_ep="https://cluster-endpoint:Port/loader"for loadId in $(curl --silent -G "${cluster_ep}?details=true" | jq '.payload.loadIds[]');do        clean_loadId=$(echo -n ${loadId} | tr -d '"')        time=$(date -d@$(curl --silent -G "${cluster_ep}/${clean_loadId}?details=true" | jq '.payload.overallStatus.startTime'))        echo -n $time '-'        echo -n ${clean_loadId}: $(curl --silent -G "${cluster_ep}/${clean_loadId}?details=true" | jq '.payload.overallStatus.status')        echo -n ',S3 LOCATION': $(curl --silent -G "${cluster_ep}/${clean_loadId}?details=true" | jq '.payload.overallStatus.fullUri')        echo -n ',ERRORS': $(curl --silent -G "${cluster_ep}/${clean_loadId}?details=truei&errors=true&page=1&errorsPerPage=3" | jq '.payload.errors.errorLogs')        echodone3.    Save the script, and then provide permissions for the script to run:chmod +x script4.    Install the dependent library:sudo yum install jq5.    Run the script:$ ./scriptThis is example output:Thu Apr 18 08:01:01 UTC 2019 -c32bbd24-99a7-45ee-972c-21b7b9cab3e2: "LOAD_COMPLETED",S3 LOCATION: "s3://demodata/neptune/",ERRORS: nullFri Apr 5 07:04:00 UTC 2019 -6f6342fb-4ea3-452c-ac69-b4d117e37d5a: "LOAD_COMPLETED",S3 LOCATION: "s3://demodata/neptune/",ERRORS: nullFri Apr 5 07:01:30 UTC 2019 -647114a6-6ed4-4018-896c-e84a08fcf864: "LOAD_COMPLETED",S3 LOCATION: "s3://demodata/neptune/",ERRORS: nullTue Mar 19 17:36:02 UTC 2019 -521d33fa-7050-44d7-a961-b64ef4e2d1db: "LOAD_COMPLETED",S3 LOCATION: "s3://demodata/neptune/",ERRORS: nullTue Mar 19 17:35:45 UTC 2019 -d0d4714e-7cf8-415e-89f5-d07ed2732bf2: "LOAD_COMPLETED",S3 LOCATION: "s3://demodata/neptune/",ERRORS: nullRelated informationExample: Loading data into a Neptune DB instanceNeptune Loader Get-Status APIFollow"


Question: Why is some EC2 instance capacity missing on my Outpost?

I'm using AWS Outposts to run multiple Amazon Elastic Compute Cloud (Amazon EC2) instances. Why is the number of EC2 instances running on my Outpost less than the actual capacity?

Answer: "I'm using AWS Outposts to run multiple Amazon Elastic Compute Cloud (Amazon EC2) instances. Why is the number of EC2 instances running on my Outpost less than the actual capacity?Short descriptionThe following Amazon CloudWatch metrics report the number of specific EC2 instance types available and used on your Outpost:AvailableInstanceType_CountUsedInstanceType_CountIn some cases, the AvailableInstanceType_Count metric is zero. But, the number of EC2 instances running on your Outposts doesn't equal the actual capacity shown by the UsedInstanceType_Count metric.ResolutionThis discrepancy happens when using AWS-managed services on your Outpost. Examples of AWS-managed services are Application Load Balancers or Amazon Relational Database Service (Amazon RDS). When used on Outposts, these types of services consume EC2 capacity but their associated instances aren't visible in your EC2 Dashboard. The UsedInstanceType_Count metric is the sum of your instances and any AWS-managed services instances running on your Outpost.View the RDS Management console to confirm the number of RDS instances running on your Outpost.Related informationWorking with Amazon RDS on AWS OutpostsSubnets for your load balancerFollow"


Question: How do I choose the appropriate EC2 instance type for my workload?

What steps should I take to determine which Amazon Elastic Compute Cloud (Amazon EC2) instance is best for my workload?

Answer: "What steps should I take to determine which Amazon Elastic Compute Cloud (Amazon EC2) instance is best for my workload?Short descriptionAmazon EC2 offers a range of instance types with different levels of CPU, memory, storage, and networking capacity. To determine which instance type you need for your use case, gather details about the system requirements of the application or software that you plan to run on your instance. These details should include the following:Operating SystemNumber of CPU coresAmount of system memory (RAM)Storage spaceGPU coresNetwork bandwidth requirementResolutionDetermine the use case for the instance and then review the different EC2 instance families.To learn more about the different use cases that a particular EC2 instance family can serve, see Instance types.Amazon offers the following instance type families:General PurposeCompute OptimizedMemory OptimizedAccelerated ComputingStorage OptimizedChoose the Amazon EC2 instance family and appropriate size for your instanceUse the system requirements you gathered and the instance family that best serves your needs to choose a specific instance type. Instance type names are comprised of the family name and the instance size. For example, the t2.micro instance is from the T2 family and is micro-sized.Every instance type has the following hardware specifications:Default vCPUs: The number of virtual CPUs for the instance. For more information, see Optimize CPU options.Memory (GiB): For more information, see Amazon EC2 high memory instances.Instance storage (GB): The local instance store volumes that are available to the instance. The data in an instance store isn't permanent. Data on instance store volumes is deleted if the instance is stopped or terminated. For more information, see Amazon EC2 instance store.Amazon Elastic Block Store (Amazon EBS)-Optimized available: Indicates whether the instance type supports EBS optimization. An EBS-optimized instance provides additional, dedicated throughput for Amazon EBS I/O. This provides improved performance for your Amazon EBS volumes and enables instances to use provisioned IOPs fully. For more information, see Amazon EBS–optimized instances.Network Performance: Indicates the performance level of the rate of data transfer. You can enable enhanced networking that provides higher bandwidth, higher packet-per-second (PPS) performance, and consistently lower inter-instance latencies. For more information, see How do I enable and configure enhanced networking on my EC2 instances?Find and launch your selected instance typeYou can find your selected instance type using the Amazon EC2 console or AWS Command Line Interface (AWS).  You can launch your instance from a selected Amazon Machine Image (AMI) using any available launch option.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Additional considerationsRoot volume: Every EC2 instance is backed by Amazon EBS or instance store volume. Select an AMI based on which type of root volume you need. For more information, see Storage for the root device.Purchasing options: Amazon EC2 supports On-Demand Instances (the default), Spot Instances, and Reserved Instances. For more information, see Instance purchasing options. For detailed pricing of each EC2 instance type, see Amazon EC2 pricing and the AWS Pricing Calculator.Changing Instance Type (Scalability): If your system requires more CPU or memory than is available on your current EC2 instance type, then you can resize the instance. For more information, one of the following:What steps do I need to take before changing the instance type of my EC2 Linux instance?How do I resize my EC2 Windows instance or change the EC2 Windows instance type?Get recommendations for an instance type: For already running EC2 instances, you can use AWS Compute Optimizer for recommendations to help you improve performance, save money, or both. You can use these recommendations to decide whether to move to a new instance type.Monitor your EC2 instance: Monitor your instances to make sure you're getting the most reliability, availability, and performance. For more information, see Monitor Amazon EC2.Manage a fleet of EC2 instances: AWS Systems Manager enables you to remotely and securely manage the configuration of your Amazon EC2 instances, and your on-premises instances and virtual machines (VMs) in hybrid environments, including VMs from other cloud providers. For more information, see the AWS Systems Manager User Guide.Follow"


Question: How do I delete or terminate an Amazon ECS service?

I want to delete or terminate an Amazon Elastic Container Service (Amazon ECS) using the console.

Answer: "I want to delete or terminate an Amazon Elastic Container Service (Amazon ECS) using the console.ResolutionTo delete an Amazon ECS service, do the following:Access the Amazon ECS console.Select the AWS Region for your ECS service.In the navigation pane, choose Clusters.On the Clusters page, select the cluster for the service.On the Cluster: name page, choose the Services tab.Select the services, and then choose Delete.When prompted, enter delete me. Then, choose Delete.The service automatically scales down to zero.Important: Elastic Load Balancing or service discovery resources associated with the service aren't affected by the service deletion. To delete your Elastic Load Balancing resources, see Delete an Application Load Balancer or Delete a Network Load Balancer, depending on your load balancer type.Related informationWhy is the Amazon ECS container instance that I terminated still registered with its cluster?Follow"


Question: How can I utilize user data to automatically run a script with every restart of my Amazon EC2 Linux instance?

I want to utilize user data to run a script every time my Amazon Elastic Compute Cloud (Amazon EC2) instance is restarted. How can I do that?

Answer: "I want to utilize user data to run a script every time my Amazon Elastic Compute Cloud (Amazon EC2) instance is restarted. How can I do that?Short descriptionBy default, user data scripts and cloud-init directives run only during the first boot cycle when an EC2 instance is launched. However, you can configure your user data script and cloud-init directives with a mime multi-part file. A mime multi-part file allows your script to override how frequently user data is run in the cloud-init package. Then, the file runs the user script. For more information on mime multi-part files, see Mime Multi Part Archive on the cloud-init website.Note: It's a best practice to create a snapshot of your instance before proceeding with the following resolution.ResolutionWarning: Before starting this procedure, review the following:Stopping and starting the instance erases any data on instance store volumes. Be sure that you back up any data on the instance store volumes that you want to keep. For more information, see Determine the root device type of your AMI.If your EC2 instance has an auto-assigned public IPv4 address, then stopping and starting the instance causes the IPv4 address to change. If you need the instance to have a static public IPv4 address, consider using an Elastic IP address. Elastic IP addresses persist after an instance stop and start.1.    Make sure that the latest version of cloud-init is installed and functioning properly on your EC2 instance.2.    For security reasons, create an IAM policy to restrict the users who are allowed to add or remove user data through the ModifyInstanceAttribute API.3.    Open the Amazon EC2 console.4.    Stop your instance.5.    Choose Actions, choose Instance Settings, and then choose Edit User Data.6.    Copy your user script into the Edit user data box, and then choose Save.The following example is a shell script that writes "Hello World" to a testfile.txt file in a /tmp directory.Content-Type: multipart/mixed; boundary="//"MIME-Version: 1.0--//Content-Type: text/cloud-config; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: attachment; filename="cloud-config.txt"#cloud-configcloud_final_modules:- [scripts-user, always]--//Content-Type: text/x-shellscript; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: attachment; filename="userdata.txt"#!/bin/bash/bin/echo "Hello World" >> /tmp/testfile.txt--//--By default, cloud-init allows only one content type in user data at a time. However, this example shows both text/cloud-config and text/x-shellscript content-types in a mime-multi part file.The text/cloud-config content type overrides how frequently user data is run in the cloud-init package by setting the SCRIPTS-USER parameter to ALWAYS.The text/x-shellscript content type provides the actual user script to be run by the cloud-init cloud_final_modules module. In this example, there is only one line to be run, which is /bin/echo "Hello World." >> /tmp/testfile.txt.Note: Replace the line /bin/echo "Hello World." >> /tmp/testfile.txt with the shell script that you want to run during the instance boot.7.    Start your EC2 instance again, and validate that your script runs correctly.Related informationRun commands on your Linux instance at launchRun commands on your Windows instance at launchAWS Systems Manager AutomationUser-Data FormatsFollow"


Question: Why is my query running slow in Amazon RDS for MySQL?

I'm trying to troubleshoot slow running queries in Amazon Relational Database Service (Amazon RDS) for MySQL. Why is this happening and how can I improve query performance?

Answer: "I'm trying to troubleshoot slow running queries in Amazon Relational Database Service (Amazon RDS) for MySQL. Why is this happening and how can I improve query performance?Short descriptionTo improve query performance, consider the following factors:Resource utilization (such as CPU, memory, and storage)Workload analysisQuery tuning and monitoringResolutionResource utilization (such as CPU, memory, and storage)To understand the root cause of any database performance issues, check all the server-wide resources that your instance is using. You can monitor your workload and survey when the query performance was normal compared to when the query began to take too long to run.Use Amazon CloudWatch metrics to monitor these resources over a period of time that include days when performance was considered normal. You can also view performance metrics in the Amazon RDS console to monitor database performance.You can also check your instance status to identify any other active or scheduled processes that might be impacting database performance. In the Amazon RDS console, check the events that occurred while your database was performing poorly.Workload analysisTo analyze the workload contributing to resource consumption, use Performance Insights. Performance Insights will provide a graphic analysis of all your queries and any waits that are contributing to increased resource consumption.Performance Insights uses workload as its main metric instead of using the number of vCPUs for an instance. If your current workload exceeds the vCPU limit, then your server is overloaded. If your server is overloaded, check the queries that are contributing to your workload and identify ways to optimize your queries. Then, consider modifying your instance class.Your Performance Insights workload can also be broken down into wait events. Investigate the top resource consuming waits by slicing the DB load by the number of wait events. The thicker color bands in the load chart indicate the wait types contributing the most to the workload. For more information, see Monitoring DB load with Performance Insights on Amazon RDS.You can also use the slow query log (enabled in your custom parameter group) to identify slow running queries.You can then use the Amazon CloudWatch metrics to check if the amount of work done on your instance has increased. For example:Database connections: The number of client sessions that are connected to the DB instance.Network receive throughput (MB/second): The rate of network traffic to and from the DB instance.Write and read throughput: The average number of megabytes read from or written to disk per second.Write and read latency: The average time for a read or write operation in milliseconds.IOPS (read and write): The average number of disk read or write operations per second.Free storage space (MB): The amount of disk space not currently used by the DB instance.The latency metrics indicate the amount of time taken to complete read or write disk I/O operation. The correlation of the latency metrics with either increased database connections or throughput metrics could indicate workload as the reason for slow query execution. For more information about identifying usage factors, see How do I view what is using storage in an Amazon RDS DB instance that's running MySQL?You can also use Enhanced Monitoring to retrieve the list of operating systems involved in your workload and the underlying system metrics. By default, the monitoring interval for Enhanced Monitoring is 60 seconds. It's a best practice to set this to 1-5 second intervals for more granular data points.Query optimizationAfter the long-running query has been identified from a slow query log or Performance Insights, consider ways to improve your query performance. To tune a query, consider the following approaches:To find the states where the most time is spent, profile your slower queries. For more information, see SHOW PROFILE statement on the MySQL website.Run the SHOW FULL PROCESSLIST command along with Enhanced Monitoring. When used together, you can review the list of operations that are currently being performed on the database server.Use the SHOW ENGINE INNODB STATUS command to obtain nformation about transaction processing, waits, and deadlocks.Find any blocking queries and resolve the blocking. For more information, see Why was a query to my Amazon RDS for MySQL DB instance blocked when there is no other active session?Publish MySQL logs to Amazon CloudWatch. Logs are rotated every hour to maintain the 2% of the allocated storage space threshold. They are then purged if they're more than two weeks old or if their combined size exceeds the 2% threshold.Set an Amazon CloudWatch alarm so that you can monitor your resource usage and be alerted whenever thresholds are exceeded.Find the execution plan for the query and check whether the query is using appropriate indexes. You can optimize your query using the EXPLAIN plan and review details about how MySQL runs the query.Keep your query statistics updated with the ANALYZE table statement. Query optimizers can sometimes choose poor execution plans because of outdated statistics. This can lead to poor performance of a query because of inaccurate cardinality estimates of both table and indexes.MySQL 8.0 now uses an EXPLAIN ANALYZE statement. The EXPLAIN ANALYZE statement is a profiling tool for your queries that shows you where MySQL spends time on your query and why. With EXPLAIN ANALYZE, MySQL plans, instruments, and runs the query while counting rows and measuring the time spent at various points of the execution plan. When the query completes, EXPLAIN ANALYZE will print the plan and its measurements instead of the query result.In MySQL version 8, be aware that lock waits are listed in the Performance Schema of the data_lock_waits table. For example:SELECT  r.trx_id waiting_trx_id,  r.trx_mysql_thread_id waiting_thread,  r.trx_query waiting_query,  b.trx_id blocking_trx_id,  b.trx_mysql_thread_id blocking_thread,  b.trx_query blocking_queryFROM       performance_schema.data_lock_waits wINNER JOIN information_schema.innodb_trx b  ON b.trx_id = w.blocking_engine_transaction_idINNER JOIN information_schema.innodb_trx r  ON r.trx_id = w.requesting_engine_transaction_id;For more information, see Using InnoDB transaction and locking information on the MySQL website.Related informationTuning Amazon RDS for MySQL with Performance InsightsHow can I troubleshoot and resolve high CPU utilization on my Amazon RDS for MySQL, MariaDB, or Aurora for MySQL instances?Follow"


Question: How do I troubleshoot Amazon ECR issues with Amazon EKS?

I can't pull images from Amazon Elastic Container Registry (Amazon ECR) when I use Amazon Elastic Kubernetes Service (Amazon EKS).

Answer: "I can't pull images from Amazon Elastic Container Registry (Amazon ECR) when I use Amazon Elastic Kubernetes Service (Amazon EKS).Short descriptionYou can't pull images from Amazon ECR because of one of the following reasons:You can't communicate with Amazon ECR endpoints.You don't have the appropriate permissions in your worker node's node instance role.You haven't created interface VPC endpoints.To resolve these issues, use one or more of the following resolution sections, depending on your use case.ResolutionTroubleshoot communication between worker nodes and Amazon ECR endpointsIf your worker nodes can't communicate with the Amazon ECR endpoints, then you receive the following error message:Failed to pull image "ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag": rpc error: code = Unknown desc = Error response from daemon: Get https://ACCOUNT.dkr.ecr.REGION.amazonaws.com/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)To resolve this error, confirm the following:The subnet for your worker node has a route to the internet. Check the route table associated with your subnet.The security group associated with your worker node allows outbound internet traffic.The ingress and egress rule for your network access control lists (ACLs) allows access to the internet.Update the instance IAM role of your worker nodesSuppose that your worker node's instance AWS Identity and Access Management (IAM) role doesn't have the required permission to pull images from Amazon ECR. Then, you get the following error from your Amazon EKS pod:Warning  Failed     14s (x2 over 28s)  kubelet, ip-000-000-000-000.us-west-2.compute.internalFailed to pull image "ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag": rpc error: code = Unknown desc = Error response from daemon: Get https://ACCOUNT.dkr.ecr.REGION.amazonaws.com/v2/imagename/manifests/tag: no basic auth credentialsWarning  Failed     14s (x2 over 28s)  kubelet, ip-000-000-000-000.us-west-2.compute.internal  Error: ErrImagePullNormal   BackOff    2s (x2 over 28s)   kubelet, ip-000-000-000-000.us-west-2.compute.internal  Back-off pulling image "ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag"Warning  Failed     2s (x2 over 28s)   kubelet, ip-000-000-000-000.us-west-2.compute.internal  Error: ImagePullBackOffTo resolve this error, confirm that your worker nodes use the AmazonEC2ContainerRegistryReadOnly AWS Identity and Access Management (IAM) managed policy. Or, update the Amazon Elastic Compute Cloud (Amazon EC2) instance profile of your worker nodes with the following IAM permissions:"ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:GetRepositoryPolicy","ecr:DescribeRepositories","ecr:ListImages","ecr:DescribeImages","ecr:BatchGetImage","ecr:GetLifecyclePolicy","ecr:GetLifecyclePolicyPreview","ecr:ListTagsForResource","ecr:DescribeImageScanFindings"Important: It's a best practice to use the AmazonEC2ContainerRegistryReadOnly policy instead of creating a duplicate policy.The updated instance IAM role gives your worker nodes the permission to access Amazon ECR and pull images through the kubelet. The kubelet is responsible for fetching and periodically refreshing Amazon ECR credentials. For more information, see Kubernetes images (from the Kubernetes website).Confirm that your repository policies are correctRepository policies are a subset of IAM policies that control access to individual Amazon ECR repositories. IAM policies are generally used to apply permissions for the entire Amazon ECR service, but can also control access to specific resources.1.    Open the Amazon ECR console for your primary account.2.    Navigate to the AWS Region that contains the ECR repository.3.    On the navigation pane, choose Repositories, and then choose the repository that you want to check.4.    On the navigation pane, choose Permissions, and then check if your repository has the correct permissions.This example policy allows a specific IAM user to describe the repository and the images within the repository:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ECR Repository Policy",      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::123456789012:user/MyUsername"      },      "Action": [        "ecr:DescribeImages",        "ecr:DescribeRepositories"      ]    }  ]}Confirm that your repository policies allow access if your EKS is in different AWS accountIf you don't have access to container images in another AWS account, then the kubelet fails with the following error:Failed to pull image "cross-aws-account-id:.dkr.ecr.REGION.amazonaws.com/repo-name:image-tag": rpc error: code = Unknown desc = Error response from daemon: pull access denied for arn:aws:ecr:REGION:cross-aws-account-id:repository/repo-name, repository does not exist or may require 'docker login': denied: User: arn:aws:sts::<aws-account-containing-eks-cluster>:assumed-role/<node-instance-role-for-worker-node is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:REGION:cross-aws-account-id:repository/repo-nameThe following example policy allows the instance IAM role in one AWS account to describe and pull container images from an ECR repository in another AWS account:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::123456789012:role/eksctl-cross-account-ecr-access-n-NodeInstanceRole"      },      "Action": [        "ecr:GetAuthorizationToken",        "ecr:BatchCheckLayerAvailability",        "ecr:GetDownloadUrlForLayer",        "ecr:GetRepositoryPolicy",        "ecr:DescribeRepositories",        "ecr:ListImages",        "ecr:DescribeImages",        "ecr:BatchGetImage",        "ecr:GetLifecyclePolicy",        "ecr:GetLifecyclePolicyPreview",        "ecr:ListTagsForResource",        "ecr:DescribeImageScanFindings"      ],      "Resource": "*"    }  ]}Note: Use the ARN of the instance IAM role in the ECR policy, not instance profile ARN.Create interface VPC endpointsTo pull images from Amazon ECR, you must configure interface VPC endpoints. See the Creating the VPC Endpoints for Amazon ECS section of Amazon ECR interface VPC endpoints (AWS PrivateLink).Confirm that your Fargate pod execution role is configured correctlyIf your Fargate CoreDNS pod is stuck in the ImagePullBackOff state when you retrieve images from Amazon hosted repositories, then you receive the following error message:Warning   Failed           27s (x2 over 40s)  kubelet            Failed to pull image "151284513677.dkr.ecr.eu-central-1.amazonaws.com/coredns:latest ": rpc error: code = Unknown desc = failed to pull and unpack image "151284513677.dkr.ecr.eu-central-1.amazonaws.com/coredns:latest ": failed to resolve reference "151284513677.dkr.ecr.eu-central-1.amazonaws.com/coredns:latest ": pulling from host 151284513677.dkr.ecr.eu-central-1.amazonaws.com failed with status code [manifests latest]: 401 UnauthorizedTo troubleshoot this error, be sure that you set up the Fargate pod execution role to use the AmazonEKSFargatePodExecutionRolePolicy. Be sure that a trust policy that's similar to the following is also attached to the role:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Condition": {        "ArnLike": {          "aws:SourceArn": "arn:aws:eks:example-region:1111222233334444:fargateprofile/example-cluster/*"        }      },      "Principal": {        "Service": "eks-fargate-pods.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}Note:Be sure to replace the following in the policy:example-region with the name of your AWS Region1111222233334444 with the account numberexample-cluster with the name of your clusterFollow"


Question: How do I delete an AWS Directory Service directory?

I want to delete my AWS Directory Service directory.

Answer: "I want to delete my AWS Directory Service directory.ResolutionFor instructions on how to delete a directory, see Delete your directory. Before you get started, note the following:If you delete a Microsoft Active Directory (AD) directory or a Simple AD, all the directory data and snapshots are deleted and can't be recovered. Any instances that are joined to the directory aren't affected, but you can't log in to them using your directory credentials.You might need to perform additional steps to delete your directory based on the AWS applications connected to the directory (if any). This includes disabling AWS Management Console access, if you previously enabled it.Related informationHow to administer AWS Managed Microsoft ADAWS Directory Service FAQsFollow"


Question: How do I resolve the AccessDeniedException error when I use the create-group AWS CLI command to create QuickSight groups?

I get the following error message when I try to create Amazon QuickSight groups using the create-group AWS CLI command:"An error occurred (AccessDeniedExeption) when calling the CreateGroup operation: Group operations are not enabled for this account"

Answer: "I get the following error message when I try to create Amazon QuickSight groups using the create-group AWS CLI command:"An error occurred (AccessDeniedExeption) when calling the CreateGroup operation: Group operations are not enabled for this account"Short descriptionThe CreateGroup operation error occurs when you use Active Directory Connector (AD Connector) to sign in to Amazon QuickSight. QuickSight manages only the identities that are created and maintained in QuickSight. If AD Connector is set up, then AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) groups are used to map users to admin, author, and reader roles. You can't use the create-group AWS Command Line Interface command to create QuickSight managed groups when managing users through AWS Managed Microsoft AD.ResolutionUse AWS Managed Microsoft AD to create groupsYou can create at least three groups after you establish your Active Directory:Amazon QuickSight adminsAmazon QuickSight authorsAmazon QuickSight readersNote: Only the Enterprise edition of QuickSight supports AD Connector and AWS Managed Microsoft AD. To learn more about using AWS Managed Microsoft AD users and groups, see Best practices for AWS Managed Microsoft AD.Use AWS CLI Command to create groupsTo create and manage QuickSight groups using the AWS CLI, you must unsubscribe from QuickSight. Then re-subscribe, and change the tool you use to identify and access QuickSight.Note: Unsubscribing deletes all QuickSight users, data, and assets.Related informationCreating and managing groups using the Amazon QuickSight consoleCan I use AWS Directory Service for Microsoft Active Directory to authenticate users in Amazon QuickSight?Follow"


Question: Why was the wrong certificate returned when invoking my API Gateway custom domain name?

"I tried to make an API request to my Amazon API Gateway custom domain name, but the wrong certificate was returned. How do I fix this?"

Answer: "I tried to make an API request to my Amazon API Gateway custom domain name, but the wrong certificate was returned. How do I fix this?Short descriptionThere are two types of custom domain names that you can create for API Gateway APIs: Regional or (for REST APIs only) edge-optimized.For Regional custom domain names, API Gateway creates a Regional domain name. You must set up a DNS record to map the custom domain name to the hostname similar to "d-example.execute-api.<region>.amazonaws.com".For edge-optimized custom domain names, API Gateway creates an Amazon CloudFront distribution. You must set up a DNS record to map the custom domain name to the CloudFront distribution name similar to "distribution-id.cloudfront.net".In the following scenario, the SSL certificate *.example.com or www.example.com was uploaded to the custom domain name www.example.com. An API request to www.example.com returns an error similar to the following:From a browser:"This server could not prove that it is www.example.com; its security certificate is from *.execute-api.us-east-1.amazonaws.com. This may be caused by a misconfiguration or an attacker intercepting your connection."From curl:"curl: (60) SSL: no alternative certificate subject name matches target hostname 'www.example.com'. curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above."ResolutionMake sure that the CNAME or A record of the custom domain name points to the API Gateway domain name and not to the API Gateway stage URL.1.    Run the following openssl command to verify that the SSL certificate is returned by the custom domain:openssl s_client -connect www.example.com:443 -servername www.example.comExample output:subject=/CN=*.execute-api.us-east-1.amazonaws.com2.    Run the following dig command on the custom domain:dig www.example.comThe dig command output has either a CNAME record pointing to the API Gateway stage URL, or an A record pointing to the IP address.3.    Check the DNS record for the domain www.example.com with your domain registrar to determine where it's pointing to. If your domain is registered with Amazon Route 53, then see Checking DNS responses from Route 53.4.    To confirm that the DNS records are mapped correctly, open the API Gateway console. In the navigation pane, choose Custom domain names, and then choose your custom domain.5.    From Domain details, choose Configuration, and then check the API Gateway domain name. The custom domain name must be mapped to the API Gateway domain name. Regional custom domain names use a prefix similar to "d-example.execute-api.<region>.amazonaws.com". Edge-optimized custom domain names use a prefix similar to "distribution-id.cloudfront.net".6.    If the CNAME record points to the API Gateway stage URL instead of the API Gateway domain name, then update the CNAME record. Change the CNAME record to point to your API Gateway domain name instead of the stage URL. If your custom domain name is registered with a third party, then contact your domain registrar. If your custom domain name is registered with Route 53, then see Editing records.7.    If you invoked the API within an Amazon Virtual Private Cloud (Amazon VPC) endpoint, then check the CNAME or A record mapping for the custom domain name. If private DNS is turned on, then the API request returns a 4xx error. Because the API request is routing through the VPC endpoint and mapped to a CNAME or A record, the request fails.Related informationHow can I set up a custom domain name for my API Gateway API?How can I resolve certificate expired or "invalid certificate" errors when invoking an API Gateway API using a custom domain name?Follow"


Question: Why are the forecasted costs in my Billing and Cost Management console unexpectedly high?

The forecasted costs in my AWS Billing and Cost Management console predict an unexpectedly high bill for me.

Answer: "The forecasted costs in my AWS Billing and Cost Management console predict an unexpectedly high bill for me.ResolutionMost AWS services bill on demand, meaning that your overall bill steadily increases over the course of a month. However, some services or features bill a larger amount at one time, usually on or near the first of the month.Your forecasted usage for the rest of the month might appear to be higher than you expect. This is because your average daily cost is higher at the beginning of the month. As the month progresses, the forecast shows a more accurate prediction of your final monthly bill.Related informationHow do I reduce my AWS bill?What is AWS Billing?Follow"


Question: How do I increase the max connections of my Amazon Aurora DB instance?

I want to increase the max connections for my Amazon Aurora PostgreSQL-Compatible Edition or MySQL-Compatible Edition DB instance.

Answer: "I want to increase the max connections for my Amazon Aurora PostgreSQL-Compatible Edition or MySQL-Compatible Edition DB instance.ResolutionIncrease the maximum number of connections to your Aurora MySQL-Compatible or Aurora PostgresSQL-Compatible DB instance by using the following methods.Set a larger value for max_connections using a custom parameter groupSet a larger value for the max_connections parameter by using a custom cluster-level or instance-level parameter group. Increasing the max_connections parameter doesn't cause any outage. Even though you can increase the value of max_connections beyond the default value, it's not a best practice. This is because the DB instance might run into issues when workload increases. An increase in the number of connections can increase the memory usage, and DB instances running low on memory might crash. This is true especially for smaller DB instances.If you increase the max_connections value, then be sure to monitor the usage of resources. Also, consult with your DBA about the increase. It's a best practice to keep the default value, or scale up to a larger instance class when more connections are required. With Aurora, you can use the LEAST function to determine the max_connections:LEAST({DBInstanceClassMemory/9531392},5000)This function selects the math equation with the DBInstanceClass until it's equal to or over 5,000. This means it's scaled automatically with an instance class change, and then adjusted accordingly to the memory on the instance. For more information, see Maximum connections to an Aurora PostgreSQL DB instance.Change a default parameter group to a custom parameter groupIf your DB cluster or instance uses a default parameter group, then change the default parameter group to a custom parameter group. You can do this at either the cluster-level or instance-level. Be sure to associate the custom DB parameter group with your Aurora cluster or instance, and then reboot the instance. After the new custom parameter group is associated with your DB instance, you can modify the max_connections parameter value.Note: Changing the parameter group can cause an outage. For more information, see Working with DB cluster parameter groups.Scale up your instance classScale your DB instance up to a DB instance class with more memory. Scaling up Amazon Relational Database Service (Amazon RDS) instances, including Amazon Aurora instances, impacts the account’s billing. To learn more, see DB instance billing for Aurora.Note: Downtime occurs when you modify an Amazon Aurora DB cluster.Considerations for Aurora ServerlessFor Amazon Aurora Serverless v1, the max_connections aren't configurable in a parameter group or by you. Instead, max_connections depends on the Aurora Capacity Units (ACU) that's associated with the cluster. For more information, see Determining the maximum number of database connections for Aurora Serverless v1.For Aurora Serverless v2, setting max_connections can cause the instance to scale up. This happens because the memory allocation is taken up from the current number of connections on the instance. This forces a scaling point, and then increases the memory and CPU allocation to the instance. This memory increase happens at the cost of increasing current active connections to meet the max_connections allocated.Note: Setting max_connections can increase the billing for your instance because Aurora Serverless is bound by an ACU/hour cost. For more information about Aurora Serverless pricing, see Amazon Aurora pricing.Related informationHow do I increase the max connections of my Amazon RDS for MySQL or Amazon RDS for PostgreSQL instance?Follow"


Question: How do I download an invoice for my monthly AWS charges?

I want to download a copy of the previous month's invoice of my AWS charges for record-keeping purposes.

Answer: "I want to download a copy of the previous month's invoice of my AWS charges for record-keeping purposes.ResolutionYou can download your invoice from the Bills page of the AWS Billing and Cost Management console:New Bills page experienceOn the Bills page, select a month from the Select billing period.Under the AWS bill summary section, confirm that the Bill status is showing as Issued.Choose the Invoices tab.Choose the Invoice ID to download a PDF of your monthly invoice.Earlier Bills page experienceChoose a month from the Date dropdown list.Under Total, choose Amazon Web Services, Inc. - Services Charges.Choose Invoice .Additional considerationsThe PDF invoice shows the information that's associated with your payment method (name, address, and so on) and not the information that's associated with your AWS account. The invoice lists only charges, and doesn't show whether the invoice was paid.Note: If you made one-time purchases, then additional invoices are available for each of these purchases under the New Purchases and Adjustments section. For example, a one-time purchase might be an Amazon Elastic Compute Cloud (Amazon EC2) Reserved Instance.To get a PDF copy of your monthly invoice sent to the email that's associated with your account, see Getting an invoice emailed to you.You can use Cost Explorer to review and analyze your AWS bills. For more information, see How can I use Cost Explorer to analyze my spending and usage?To get a value-added tax (VAT) invoice instead, see How do I get a VAT invoice from AWS?Related informationHow do I change billing information on the PDF version of the AWS invoice that I receive by email?How do I update the address associated with my AWS account?Viewing your monthly chargesFollow"


Question: "When does AWS release new SOC reports, and how can I download the latest report using AWS Artifact?"

I want access to the latest AWS System and Organization Controls (SOC) reports. The SOC reporting period isn't current. When are new SOC reports going to be available?

Answer: "I want access to the latest AWS System and Organization Controls (SOC) reports. The SOC reporting period isn't current. When are new SOC reports going to be available?Short descriptionSOC reports are audits performed over a time period and don't expire. AWS auditors perform SOC audits twice a year over a period of 6 months: Oct 1–Mar 31 and Apr 1–Sept 30. When the audit period is over, AWS auditors prepare the audit report and release the report in May and November. You can also download the SOC Continued Operations Letter, which states that AWS continues to maintain the security controls and system environment audited and described in the latest SOC reports.Note: AWS publishes a Continued Operations Letter SOC report instead of a bridge or gap letter. For more information, see Compliance reports.ResolutionTo access SOC 1 and 2 reports and the Continued Operations Letter, see Downloading reports in AWS Artifact. If you can't download the SOC reports or Continued Operations Letter, then see Tips to troubleshoot common issues.Note: The SOC 3 report is publicly available as a whitepaper. For more information and to download, see the AWS SOC 3 section in AWS System and Organization Controls (SOC) reports FAQs.Important: Share AWS Artifact documents only with those you trust. AWS Artifact reports have a unique, traceable watermark that's specific to you. Don't email reports or share them online. Instead, use a secure authenticated sharing service with auditing capabilities, such as Amazon WorkDocs.Related informationAWS Artifact FAQsHow can I download and share AWS Artifact documents with regulators and auditors, or with others in my company?Follow"


Question: How can I perform a major version upgrade in my Aurora PostgreSQL-Compatible global database?

I want to perform a major version upgrade of my Amazon Aurora Global Cluster. Or I am unable to failover in Aurora Global Cluster because of version mismatch.

Answer: "I want to perform a major version upgrade of my Amazon Aurora Global Cluster. Or I am unable to failover in Aurora Global Cluster because of version mismatch.Short descriptionBy performing a major version upgrade of an Amazon Aurora global database, you upgrade the global database cluster instead of the clusters that it contains. The upgrade process upgrades all DB clusters that make up your Aurora global database at the same time. It's important that you test your application on the upgraded version before performing the upgrade in your production Aurora global database. The upgrade process requires downtime, and it's recommended that you perform the upgrade during your planned maintenance window.ResolutionTurn off rds.global_db_rpo using the Amazon RDS consoleIf your global DB cluster has a recovery point objective (RPO) set, then reset the rds.global_db_rpo parameter before you upgrade to a new major version. Major version upgrades fail if RPO is turned on, and you receive an error similar to this:"Error: We're sorry, your request to modify global database GlobalCluster-GCTest has failed. Primary cluster cannot have RPO setting enabled during major version upgrade."Use these steps to turn off the rds.global_db_rpo using the Amazon Relational Database Service (Amazon RDS) console.Note: This parameter is turned off by default. So, if you haven't turned RPO on, then skip these steps.Log in to the Amazon RDS console.In the navigation pane, choose Parameter groups.Choose your primary DB cluster parameter group.Choose Edit parameters.Choose the box next to the rds.global_db_rpo parameter.Choose Reset.Under Reset parameters in DB parameter group, choose Reset parameters.For more information on how to reset a parameter using the console, see Modifying parameters in a DB cluster parameter group.Turn off rds.global_db_rpo using the AWS CLIYou can also use the AWS Command Line Interface (AWS CLI) to turn off the RPO by running the reset-db-cluster-parameter-group command.For Linux, macOS, or Unix:aws rds reset-db-cluster-parameter-group \    --db-cluster-parameter-group-name global_db_cluster_parameter_group \    --parameters "ParameterName=rds.global_db_rpo,ApplyMethod=immediate"For Windows:aws rds reset-db-cluster-parameter-group ^    --db-cluster-parameter-group-name global_db_cluster_parameter_group ^    --parameters "ParameterName=rds.global_db_rpo,ApplyMethod=immediate"Perform a major version upgrade using the consoleBefore following these steps, make sure to follow the recommendations in Before upgrading your production DB cluster to a new major version.Log in to the Amazon RDS console.In the navigation pane, choose Databases, and then choose the global Aurora cluster that you want to upgrade.Note: Make sure to choose the top level item under Databases. To confirm this, choose Role, and confirm that you see Global database.Choose Modify.On the Modify DB cluster page, for Engine version, choose the latest version.Choose Continue, and then review the summary of modifications.To apply the changes immediately, choose Apply immediately. Choosing this option might cause an outage.Choose Modify Cluster to save your changes.Perform a major version upgrade using the AWS CLITo start the upgrade for your Aurora global database, run the modify-global-cluster command using the AWS CLI:aws rds modify-global-cluster --global-cluster-identifier <cluster global identifier> --engine-version <engnie_version> --allow-major-version-upgradeLimitations for upgrading Aurora global databasesThe following limitations apply to upgrading Aurora global databases:You can't apply a custom parameter group to the global database cluster while you're performing a major version upgrade of that Aurora global database. Create your custom parameter groups in each Region of the global cluster, and then apply them manually to the regional clusters after the upgrade.With an Aurora global database based on PostgreSQL, you can't perform a major version upgrade of the Aurora DB engine if RPO is turned on. For information about the RPO feature, see Managing RPOs for Aurora PostgreSQL–based global databases.Related informationUpgrading the Aurora PostgreSQL DB engine to a new major versionUpgrading an Amazon Aurora global databaseMajor upgrades for global databasesFollow"


Question: How do I monitor the usage of my AWS API calls using Amazon CloudWatch?

"I receive a "Rate exceeded" error message when I try to create, update, or access an AWS service. How can I monitor the number of AWS API calls I make using Amazon CloudWatch metrics to prevent "Rate exceeded" errors?"

Answer: "I receive a "Rate exceeded" error message when I try to create, update, or access an AWS service. How can I monitor the number of AWS API calls I make using Amazon CloudWatch metrics to prevent "Rate exceeded" errors?Short descriptionThere is a limit on the number of AWS API calls that you can make per second. After you exceed this limit, you receive a Rate exceeded error, and further API calls are throttled. For more information on determining the API call that is causing a Rate exceeded error, see How can I find which AWS API call is causing a "Rate Exceeded" error?If you are using API calls in automation, it's a best practice to monitor your usage to avoid Rate exceeded errors. Amazon CloudWatch collects metrics that track the usage of some AWS services. These metrics correspond to AWS service quotas. Follow the steps in this article to graph these metrics and visualize your usage.ResolutionUse this method to check and monitor your usage for all AWS resources that publish usage metrics. This example uses the PutMetricData.Check the default limits of the PutMetricData API call in the CloudWatch service quotas documentation. You can also check your account applied limit using the Service Quotas console.Open the CloudWatch console.In the navigation pane, choose Metrics, and then choose All metrics.Usage metrics are published under the Namespace AWS/Usage. Choose this namespace, and then filter for the API call you want to graph. In this case, choose PutMetricData.Choose the metric CallCount. This metric gives a count of the number of times that an API operation is made.Choose Graphed metrics, and then choose the time range that you want to check your usage for. In this case, choose the range where you received a Rate exceeded error.For Period, choose 1 minute, and for Statistic choose SUM. This gives the total number of API calls made every minute. Note: Most API calls have a limit on the number of API calls made per second. This is measured as Transactions per Second (TPS). For PutMetricData, the limit is 150 TPS.To view your current usage, choose Add math, and then choose Start with empty expression.In a new row, enter the following:SERVICE_QUOTA(m1)Related informationCloudWatch usage metricsVisualizing your service quotasFollow"


Question: Why is my burst balance value low in my RDS DB instance? How do I troubleshoot this issue?

My Amazon Relational Database Service (Amazon RDS) for PostgreSQL DB instance has a low burst balance. I want to prevent this from happening.

Answer: "My Amazon Relational Database Service (Amazon RDS) for PostgreSQL DB instance has a low burst balance. I want to prevent this from happening.ResolutionAmazon RDS DB instances use Amazon Elastic Block Store (Amazon EBS) volumes for storage.Provisioned IOPS SSD (io1) volumes provide consistent IOPS performance. General Purpose SSD (gp2) volumes depend on the storage size allocated to the DB instance. The IOPS for a gp2 volume is the size of the volume in gibibytes multiplied by 3, with a minimum of 100 IOPS (at 33.33 GiB and below) and a maximum of 16,000 IOPS (at 5,334 GiB and above). For example, if your volume has 100 GiB, then your volume has baseline performance of 300 IOPS.Regardless of the size, a gp2 volume has an initial I/O credit balance of 5.4 million I/O credits. This is enough to sustain the maximum burst performance of 3,000 IOPS for at least 30 minutes. When a volume requires more than the baseline performance I/O level, the volume draws on the I/O credit balance to perform at the required level.When the burst balance of a volume is depleted, the volume returns to its baseline performance values. Users aren’t charged extra when the burst balance is depleted. The volume stays at its baseline until IOPS use is lower than the baseline. The burst balance can then begin to refill.Any gp2 volume larger than 1 TiB has a baseline performance that is greater than the burst performance of 3,000 IOPS. For such volumes, burst is irrelevant because the baseline performance is better than the 3,000 IOPS burst performance.However, depending on the amount of storage requested, Amazon RDS automatically stripes across multiple Amazon EBS volumes to enhance performance. Therefore, a total allocated storage of 1 TiB might be striped to multiple smaller volumes, and each volume has a burst performance of 3,000 IOPS.To identify the number of volumes for an RDS instance, turn on Enhanced Monitoring and check the number of volumes in the Physical Devices console.Troubleshooting a low burst balance valueFollow these steps to troubleshoot a low burst balance:Verify that the SQL queries need to be optimized by turning on Performance Insights for Amazon RDS.Warning: Consult with your organization’s database administrator, if needed. To learn about database engines that you can use with Performance Insights, see Monitoring DB Load with Performance Insights on Amazon RDS.If the workload is running as expected or tuning the SQL queries is not fixing the issue, determine whether you need to increase the DB instance storage size to achieve a higher IOPS capacity. Amazon RDS doesn’t allow you to reduce your amount of storage after it has been allocated. Increase the storage capacity only after all other tuning options are verified.Scale up your storage class to improve performance or change the storage type from gp2 to io1 and assign the required IOPS.Specify the amount of storage that you want to allocate. Then, specify the amount of dedicated IOPS that you want.If you notice throttling of IOPS or throughput on a DB instance, scale up the instance class to get a higher throughput or IOPS capacity.Note: Review and choose the instance class that's best suited for your needs because io1 volumes are expensive when compared to gp2.Troubleshooting enhanced modeling for micro-burstingFor more information about micro-bursting in EBS volumes, see How do I troubleshoot the latency of Amazon EBS volumes caused by an IOPS bottleneck in my Amazon RDS instance and review the Micro-bursting section.Related informationI/O credits and burst performanceUnderstanding Burst vs. Baseline Performance with Amazon RDS and GP2How do I troubleshoot the latency of Amazon EBS volumes caused by an IOPS bottleneck in my Amazon RDS instance?Follow"


Question: How do I enforce using TLS 1.2 or later for my Amazon S3 buckets?

My customers use earlier TLS versions. I want to enforce using a recent TLS version when they access content that’s stored in my Amazon Simple Storage Service (Amazon S3) buckets.

Answer: "My customers use earlier TLS versions. I want to enforce using a recent TLS version when they access content that’s stored in my Amazon Simple Storage Service (Amazon S3) buckets.Short descriptionIt's a best practice to use modern encryption protocols for data in transit. To enforce the use of TLS version 1.2 or later for connections to Amazon S3, update your bucket's security policy.Note: If your customers don’t use TLS version 1.2 or later, then they can't access content that's stored in your S3 buckets.ResolutionUse a resource-based policy that's attached to your bucket to enforce using TLS 1.2 or later for all connections to your S3 buckets.To attach a bucket policy that requires TLS versions 1.2 or later, complete the following steps:Open the Amazon S3 console.Select the bucket from the list.Choose the Permissions tab.Under Bucket Policy, choose Edit.Add a policy to deny access to the encryption protocols that you want to prevent. For example, use the following policy to deny all HTTPS requests that use TLS versions that are earlier than 1.2:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "EnforceTLSv12orHigher",      "Principal": {        "AWS": "*"      },      "Action": ["s3:*"],      "Effect": "Deny",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET"      ],      "Condition": {        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }    }  ]}The preceding policy enforces HTTPS to increase security for your data in transit. If your workload requires HTTP traffic to Amazon S3, then use the preceding policy with the following condition. This condition allows HTTP traffic and blocks HTTPS traffic from TLS versions 1.2 and earlier:"Condition": {        "Bool": {            "aws:SecureTransport": "true"        },        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }Confirm that you're using modern encryption protocols for S3To test your new policy, use the following example curl command to make HTTPS requests that use a specific legacy protocol:curl https://${BUCKET\_NAME}.s3.us-east-1.amazonaws.com/image.png -v --tlsv1.0 --tls-max 1.0The example curl command returns Access Denied because Amazon S3 detects that your request isn't using TLS version 1.2 or later.Note: By default curl sends an anonymous request. If your bucket is private, then you receive a 403 Access Denied error for any TLS version. When using curl to test, generate an Amazon S3 presigned URL to gain access to your private objects.It's a best practice to use AWS CloudTrail Lake to identify earlier TLS connections to AWS service endpoints. You can configure the CloudTrail Lake event data store to capture management events or data events.Follow"


Question: Why am I getting the OptionsRequestDenied error when I upload a file using the Amazon S3 console?

"When I upload a file to my Amazon Simple Storage Service (Amazon S3) bucket using the Amazon S3 console, I get the error OptionsRequestDenied."

Answer: "When I upload a file to my Amazon Simple Storage Service (Amazon S3) bucket using the Amazon S3 console, I get the error OptionsRequestDenied.ResolutionOptionsRequestDenied is a client-side error that might occur when you access your S3 bucket using the Amazon S3 console. Check the following points for your client:Browser extensions: Ad blockers and similar extensions that are installed on a web browser might block traffic from Amazon S3.Firewalls: Any proxies or firewalls on your client might block traffic from Amazon S3.Network connectivity problems: An intermittent network connection problem might interrupt the connection to Amazon S3.Tip: To isolate your client's issue, upload files using an AWS Command Line Interface (AWS CLI) command instead. For example, use aws s3 cp. If you receive errors when you run AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Related informationUploading objectsFollow"


Question: How do I set up AD FS on an Amazon EC2 Windows instance to work with federation for an Amazon Cognito user pool?

I want to use Active Directory Federation Services (AD FS) as Security Assertion Markup Language 2.0 (SAML 2.0) identity provider (IdP) with an Amazon Cognito user pool. How do I set up AD FS on an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance?

Answer: "I want to use Active Directory Federation Services (AD FS) as Security Assertion Markup Language 2.0 (SAML 2.0) identity provider (IdP) with an Amazon Cognito user pool. How do I set up AD FS on an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance?Short descriptionUse Server Manager to set up an AD FS server and domain controller on an EC2 Windows instance.ResolutionBefore you begin, see the instructions in How do I set up AD FS as a SAML identity provider with an Amazon Cognito user pool? You need an Amazon Cognito user pool with an app client to complete the setup in this article.You also need a domain name that you own. If you don't own a domain, you can register a new domain with Amazon Route 53 or another Domain Name System (DNS) service.Configure and launch an EC2 Windows instanceOpen the Amazon EC2 console.From the console dashboard, choose Launch Instance to start the Launch Instance wizard.On the Choose an Amazon Machine Image (AMI) page, choose an AMI for Windows Server, such as the Microsoft Windows Server 2016 Base AMI. For more information, see Finding a Windows AMI.On the Configure Security Group page, create a security group for your instance, and then add the following rules to the security group: Type: RDP Source: an IP address in CIDR notation (a.b.c.d/z), or a CIDR block Note: For the IP address or block you specify in Source, it's a best practice to use a set of known allowed IP addresses. Type: HTTP Source: AnywhereType: HTTPS Source: AnywhereFor more information, see Amazon EC2 security groups for Windows instances and Adding rules to a security group.On the Review Instance Launch page, choose Launch.In the Select an existing key pair or create a new key pair dialog box, follow the instructions to choose an existing key pair or create a new key pair. For more information, see Amazon EC2 key pairs and Linux instances. Important: Save the private key .pem file for your key pair. You use it to connect to your EC2 Windows instance.Choose Launch Instances.Associate an Elastic IP address with your EC2 Windows instanceIf you haven't already done so, allocate an Elastic IP address to your AWS account.Associate your Elastic IP address with your EC2 Windows instance so that you have a persistent public IP address for it.Create a record for your domain using your Elastic IP addressThe domain that you use for Active Directory Domain Services (AD DS) must have an A (IPv4 address) record with an Elastic IP address as the value. Create this record for your domain using the Elastic IP address associated with your EC2 Windows instance.For more information, see Creating records by using the Amazon Route 53 console.Install AD DS, web server (IIS), and AD FS on your EC2 Windows instanceConnect to your EC2 Windows instance.In Windows, open Server Manager, and then use the Add Roles and Features Wizard to install the following roles:Active Directory Domain ServicesActive Directory Federation ServicesWeb Server (IIS)For more information about using the wizard, see Install or uninstall roles, role services, or features on the Microsoft website.Configure AD DS on your EC2 Windows instanceIn Server Manager, use the Active Directory Domain Services Configuration Wizard to configure AD DS. For more information, see Installing AD DS by using Server Manager on the Microsoft website. Follow the instructions under To install AD DS by using Server Manager, beginning with step 9. Note: In the wizard, on the Deployment Configuration page, enter your domain (for example, example.com).After your configuration finishes installing, Windows notifies you that you're about to be signed out. This is expected. Wait a few minutes for the server to restart, and then connect to your EC2 Windows instance again.Configure http site binding in IISIn Server Manager, use IIS to edit the http site binding for your website. For more information, see How to add binding information to a site on the Microsoft website.Important: When editing the http binding in IIS, for Host name, enter your domain name (for example, example.com). However, don't change IP address (All Unassigned) or Port (80).Configure your EC2 Windows instance to allow file downloadsFor more information, see How do I configure an EC2 Windows instance to allow file downloads using Internet Explorer?Request a digital certificate for your domainYou need an SSL server certificate for HTTPS binding for your IIS website. Request a third-party certificate for your domain by downloading and then using a trusted third-party certificate creation tool that you prefer.For more information, see Choosing a certificate on the Microsoft website.(Optional) Configure HTTPS site binding in IISIf the certificate creation tool that you used doesn't add https site binding in IIS automatically, then add the site binding yourself, as you did for http previously.For more information, see Create an SSL binding on the Microsoft website.Configure AD FS on your EC2 Windows instanceIn Server Manager, use the AD FS Federation Server Configuration Wizard to configure the EC2 Windows instance as a federation server. For more information, see Windows Server 2008 or 2008 R2 Domain Controllers on the Microsoft website.Note: On the Specify Service Account page of the wizard, when you get to the Select User or Service Account dialog box, select the user named Administrator, and then enter the password that you used for Remote Desktop to connect to the EC2 Windows instance.Create a user in Active DirectoryUse the Active Directory Users and Computers tool to create a new user in Active Directory. Add the new user to the group Administrators.For more information, see Create a user and add to a group on the Microsoft website.Add an email address for your Active Directory userAfter creating a new user, in the Active Directory Users and Computers tool, double-click Users to open the list of users.In the list of users, find the user that you created. Right-click on the user to open the context menu, and then choose Properties.In the Properties window, for the user name, for E-mail, enter a valid email address for the user. This email address is included in the SAML assertion later.For more information, see General property page on the Microsoft website.Add a claims-aware relying party trust in AD FSNote: For this part, you need information from your Amazon Cognito user pool in the Amazon Cognito console. For more information, see Adding SAML identity providers to a user pool.In Server Manager, use the Add Relying Party Trust Wizard to add a claims-aware relying party trust.On the Configure URL page of the wizard, select Enable support for the SAML 2.0 WebSSO protocol. For Relying party SAML 2.0 SSO service URL, enter an assertion consumer endpoint URL, formatted as follows: https://yourDomainPrefix.auth.region.amazoncognito.com/saml2/idpresponseNote: Replace yourDomainPrefix with your Amazon Cognito user pool's domain prefix. Replace region with the user pool's AWS Region (for example, "us-east-1").On the Configure Identifiers page of the wizard, for Relying party trust identifier, enter this URN: urn:amazon:cognito:sp:yourUserPoolIDNote: Replace yourUserPoolID with your Amazon Cognito user pool's ID (for example, "us-east-1_g2zxiEbac").For more information, see To create a claims aware relying party trust manually on the Microsoft website.Edit your application's claims issuance policy in AD FSAdd a rule to the trust you created to send LDAP attributes as claims. Use the Add Relying Party Trust Wizard to add the rule. On the Configure Rule page, do the following:For Claim rule name, enter Email.For Attribute store, choose Active Directory.For LDAP Attribute, choose E-Mail-Addresses.For Outgoing Claim Type, choose E-Mail Address.For more information, see To create a rule to send LDAP attributes as claims for a relying party trust in Windows Server 2016 on the Microsoft website.Note: To have both the Email ID and Name ID claims appear as the user's email address in the SAML assertion in the SAML response, map the incoming email address from Active Directory to the outgoing Name ID claim. If you use that approach, then create a rule to send LDAP attributes as claims instead. For more information, see To create a rule to send LDAP attributes as claims for Windows Server 2012 R2 on the Microsoft website.Test the SAML IdP metadata URL for your serverEnter this metadata document endpoint URL in your web browser after replacing example.com with your domain:https://example.com/federationmetadata/2007-06/federationmetadata.xmlIf you're prompted to download the file federationmetadata.xml, everything is configured correctly. Note the URL that you used here, or download the .xml file. You need either the URL or the file to configure SAML in the Amazon Cognito console. For more information, see Integrating third-party SAML identity providers with Amazon Cognito user pools.Configure AD FS as SAML IdP in Amazon CognitoAfter you complete all the steps in this article, continue setup in the Amazon Cognito console. For more information, see How do I set up AD FS as a SAML identity provider with an Amazon Cognito user pool?Related informationAdding user pool sign-in through a third partyTutorial: Getting started with Amazon EC2 Windows instancesFollow"


Question: How do I resolve the error "MySQL server has gone away" when connecting to my Amazon RDS MySQL DB instance?

"I tried to query an Amazon Relational Database Service (Amazon RDS) DB instance that is running MySQL, and I received one of the following error messages: "MySQL server has gone away" or "Lost connection to server during query.""

Answer: "I tried to query an Amazon Relational Database Service (Amazon RDS) DB instance that is running MySQL, and I received one of the following error messages: "MySQL server has gone away" or "Lost connection to server during query."Short descriptionIf the server timed out and closed the connection, you might receive one of the following errors:CR_SERVER_GONE_ERROR - The client couldn't send a question to the server.CR_SERVER_LOST - The client didn't get an error when writing to the server, but the client didn't get a full answer (or any answer) to the question.For more information, see the MySQL documentation for MySQL server has gone away.ResolutionSee the following causes for and related resolutions for these errors:If a connection is idle for too long, then the connection might be terminated incorrectly from the client. To resolve this issue, verify that application timeouts are shorter than the MySQL timeouts, and be sure that your applications close idle connections.If a connection times out, then increase the timeouts for MySQL by increasing the wait_timeout and interactive_timeout parameters by using a custom parameter group. For more information, see Working with DB parameter groups.If the query that is generating the error is retrieving a large dataset, then increase the max_allowed_packet size parameter by using a custom parameter group. For more information, see Modifying parameters in a DB parameter group.Note: For Amazon Aurora, you can modify the parameters and set them in a cluster parameter group to apply at the entire cluster level. Setting it in a DB parameter group applies the parameters only at the instance level. For Amazon Lightsail MySQL database, you must check if parameters are available for modification before modifying them using the command line interface (CLI). For more information, see Updating database parameters in Amazon Lightsail. For Lightsail instance or server local MySQL database or Amazon Elastic Compute Cloud (Amazon EC2) MySQL, you can set the parameter in the config file. You can also set global xxx, similar to how it is set in a normal on-premise MySQL environment.If the error occurs only when returning large datasets, the client might be using a large MTU value of 9001. To resolve this issue, reduce the client TCP/IP MTU value. For information on changing your client MTU value, see Configuring the MTU of an Instance.If any init_connect parameters are set to a value that doesn't allow the parameter to be processed, associated client connections can fail. Be sure that all init_connect parameters are processed correctly. Be sure that users have EXECUTE permissions for any procedures referenced as an init_connect parameter.If all connections are dropping at the same time, confirm that other connections are still working when this issue occurs. To resolve this issue, verify the MySQL DB instance is not crashing or failing over by viewing Amazon RDS events and reviewing your MySQL error logs.Related informationConnecting to a DB Instance running the MySQL database engineModifying an Amazon RDS DB instanceFollow"


Question: How can I delegate OpenSearch Service access across AWS accounts using IAM roles?

I want to share the Amazon OpenSearch Service resources in my AWS account with users in a different account.

Answer: "I want to share the Amazon OpenSearch Service resources in my AWS account with users in a different account.Short descriptionComplete the following steps to allow users to use an AWS Identity and Access Management (IAM ) role to access your domain resources:Create a role in Account A that's allowed to access the target domain.Create a user under Account B that's allowed to assume a role in Account A.Grant access to users in Account B to switch roles to access the target domain.Note: Account A is the account where the target domain resides. Account B is the account where users access the central logging station from.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.Create a role and grant permissions to manage your domainCreate an IAM role, and grant permissions to allow users to manage your domain.In this example, a role named CrossAccount-test is created and grants full permissions to manage the domain test.{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Action": [               "es:*"          ],          "Resource": "arn:aws:es:<Region>:<Account A-ID>:domain/test/*"     }]}Edit the trust relationship of the roleEdit the trust relationship of the role. In this example it's CrossAccount-test.Note: Replace Account B-ID and User Name with the ID for account B and your user name.{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Principal": {               "Service": "es.amazonaws.com",               "AWS": ["arn:aws:iam::<Account B-ID>:root", "arn:aws:iam::<Account B-ID>:user/<User Name>"]          },          "Action": "sts:AssumeRole"     }]}Grant access to users in Account BIn Account B, create a user or group with the following permissions:Note: Replace Account A-ID with the ID for Account A.{     "Version": "2012-10-17",     "Statement": {          "Effect": "Allow",          "Action": "sts:AssumeRole",          "Resource": "arn:aws:iam::<Account A-ID>:role/<CrossAccount-test>"     }}Adding this policy statement allows the AssumeRole API action on the CrossAccount-test role in Account A.Edit the OpenSearch Service access policy to allow the role to access the domainAllow this role to access your domain.Edit the OpenSearch Service access policy and enter the following information:{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Principal": {               "AWS": [                    "arn:aws:iam::<Account A-ID>:role/<CrossAccount-test>"               ]          },          "Action": "es:*",          "Resource": "arn:aws:es:<region>:<Account A-ID>:domain/<Domain Name>/*"     }]}Switch roles to test accessSwitch roles to test the access:Copy the CrossAccount-test ARN to your clipboard.Use the AWS Management Console to log in to Account B.From the User tab, chose Switch Role in the dropdown list.On the Switch Role page, enter the account ID for Account A and the role name. In this example, the role name is CrossAccount-test.Choose Switch Role.Note: If Account B works in the Account A environment at the command line, then you can use the AWS CLI to switch roles. For more information, see Switch roles (AWS CLI).Related informationCross-account policy evaluation logicIdentity and access management in Amazon OpenSearch ServiceFollow"


Question: How do I troubleshoot DNS resolution issues with Route 53 Resolver endpoints?

I can't resolve DNS records using an inbound or outbound endpoint  in Amazon Route 53.

Answer: "I can't resolve DNS records using an inbound or outbound endpoint  in Amazon Route 53.ResolutionTroubleshoot inbound endpointsComplete the following steps to be sure that DNS resolvers on your network can forward DNS queries to Route 53 Resolver using your inbound endpoint:If your on-premises DNS server must forward DNS queries to the inbound endpoint for your domains, then create a conditional forwarding rule. The conditional forwarding rule must be created on your on-premises DNS server. This configuration applies to private hosted zones and public domains.Confirm that you have connectivity to the inbound resolver endpoint IP addresses over the AWS Direct Connect connection or VPN. This step validates whether you can reach the inbound resolver endpoint IP address from your on-premises network. Use the following telnet command to test connectivity between the inbound endpoint resolver IP address on port 53: telnet <inbound endpoint resolver IP address> 53.Check the security group associated with the inbound resolver endpoint. The security group must allow traffic on TCP and UDP port 53 from your on-premises DNS server IP address.Confirm that custom network access control lists (network ACLs) used with the subnet where the inbound endpoint was created allow the following:Inbound UPD and TCP traffic from the on-premises DNS server on port 53.Outbound UDP and TCP traffic to the on-premises DNS server on destination port range 1024-65535.Confirm that the route table associated with the subnet where the inbound endpoint resolver was created includes a route to the on-premises network. You can configure the route through a Direct Connect connection or VPN. This route allows the inbound endpoint resolver to return a DNS query response.To validate the domain resolution, complete a domain name lookup from the on-premises DNS server or localhost.For Windows: nslookup <private hosted zone domain name>For Linux or macOS: dig <private hosted zone domain name>If the previous commands fail to return a record, then you can bypass your on-premises DNS server. Send the DNS query directly to the inbound resolver endpoint IP address using the following commands.For Windows: nslookup <private hosted zone domain name> @ <inbound endpoint IP address>For Linux or macOS: dig <private hosted zone domain name> @ <inbound endpoint IP address>Confirm that your on-premises DNS server sends only recursive queries. Route 53 inbound resolver doesn't support iterative queries.If you're resolving in a private hosted zone, then confirm that your inbound resolver endpoints and private hosted zone are associated with the correct VPC.Troubleshoot outbound endpointsComplete the following steps to be sure that Route 53 Resolver conditionally forwards queries to resolvers on your network using your outbound endpoint:Confirm that you're using an Amazon provided DNS. Custom DNS servers on instances in your VPC must route private DNS queries to the IP address of the Amazon-provided DNS servers of your VPC. The Amazon-provided DNS servers IP address is the IP address at the base of the VPC network range plus two.Confirm the egress rule of the security group associated with the outbound resolver endpoint. The egress rule must allow UDP and TCP port 53 traffic to the IP addresses of your on-premises DNS server.Confirm that custom rules for network ACLs corresponding to the subnets where the outbound endpoint interfaces were created allow the following:Outbound UDP and TCP traffic to the on-premises DNS server on port 53.Inbound UDP and TCP traffic from the on-premises DNS server on ephemeral port range 1024-65535.Confirm that the route table associated with the subnet of the outbound resolver endpoint has a route to your on-premises DNS server. The route can be configured through a Direct Connect connection or VPN.Determine whether your on-premises DNS servers are protected by a firewall. If the servers are protected by a firewall, then confirm that the firewall allows traffic from the outbound resolver endpoint IP addresses.Note that a Resolver rule that routes traffic to your network for the same domain name takes precedence over private hosted zones.Note that Resolver routes outbound DNS queries using the rule that contains the most specific domain name. For more information, see How Resolver determines whether the domain name in a query matches any rules.If you're using a shared rule, confirm that the shared rule is associated with your VPC.Use VPC Flow Logs to capture flow information on the network interfaces used by the resolvers. Filter by the resolver's name to view logs for the resolver's elastic network interface.Follow"


Question: How do I resize my EC2 Windows instance or change the EC2 Windows instance type?

I want to change or add some resources to my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance. How do I change the specifications of my instance?

Answer: "I want to change or add some resources to my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance. How do I change the specifications of my instance?Short descriptionYou can change instance types to do the following:Increase or decrease the number of CPU cores.Increase or decrease the amount of RAM.Enable Amazon Elastic Block Store (Amazon EBS) optimization.Enable enhanced networking.Change GPU cores.ResolutionTo resize your EC2 instance, choose an instance type that meets your CPU, RAM, and feature requirements.Consider the following before resizing your EC2 Windows instance:If you launch instances from Amazon Machine Images (AMIs), install the required drivers for the destination instance type. This needs to be done for custom Windows AMIs and Amazon-provided Windows AMIs created before August 2018. Status checks fail if the instance doesn't have the required drivers.For instances created from AMIs after August 2018 install or upgrade the  required drivers for the destination instance type.Verify that your current instance type is  compatible with the new instance type that you choose.If the current instance has an  instance store volume, any data on the instance store volume is lost when the instance is stopped. Be sure to  back up the data on your instance before you stop the instance.If you're not using an  Elastic IP address, the public IP address is released when you stop the instance.It's a best practice to maintain backups of your instances and data. Consider creating an AMI or  creating snapshots of your EBS volumes before you change the instance type.If your instance is part of an Auto Scaling group,  change the launch configuration to launch the new instance type. On the Copy Launch Configuration page, choose the new instance type.Related informationStatus checks for your instancesTroubleshoot instance launch issuesHow do I move my EC2 instance to another subnet, Availability Zone, or VPCCreating a launch configurationModify the supported instance types (Change instance types on the same Dedicated Host)Follow"


Question: How can I retrieve Secrets Manager secrets using Lambda functions in a Amazon VPC?

My AWS Lambda function configured in an Amazon Virtual Private Cloud (Amazon VPC) can't access AWS Secrets Manager.

Answer: "My AWS Lambda function configured in an Amazon Virtual Private Cloud (Amazon VPC) can't access AWS Secrets Manager.Short descriptionLambda functions run in a secure Amazon VPC with access to AWS services and the internet. The Lambda service owns this Amazon VPC, and it isn’t connected to your default Amazon VPC.Lambda functions that are connected to your Amazon VPC can access the internet only when you configure your Amazon VPC to provide access. The network interfaces that Lambda creates within your Amazon VPC use private IP addresses and can’t connect to the internet using an internet gateway.For more information, see Internet and service access for VPC-connected functions.Note: It's a best practice not to place Lambda functions in an Amazon VPC unless the function must access other resources in the Amazon VPC.ResolutionFollow these steps to verify your Lambda network configuration and permission settings.Lambda network configurationTo allow a Lambda function that's connected to an Amazon VPC to access Secrets Manager, take one of the following actions:Give your function internet access by placing the function in private subnets and routing the outbound traffic to a NAT gateway in a public subnet. The NAT gateway has a public IP address and connects to the internet through the VPC's internet gateway.-or-Set up an Amazon VPC interface endpoint for Secrets Manager. Your Amazon VPC then connects Secrets Manager from your Lambda function without internet access. Make sure that the Amazon VPC endpoint security group allows port 443 inbound traffic from the Lambda security group or IP address range. And, the Lambda security group allows port 443 outbound traffic to the Amazon VPC endpoint security group or IP address range.Note: If you use AWS PrivateLink VPC endpoints, then make sure that you configure the DHCP options with your Amazon VPC for Domain Name System (DNS). For more information, see DNS attributes for your Amazon VPC.Lambda execution role permissionsGrant permissions to the Lambda execution role to access Secrets Manager secrets. Use the GetSecretValue API call to get the Secrets Manager secret. For more information, see Example: Permission to retrieve secret values.(Optional) AWS Key Management Service (AWS KMS) permissionsIf the Secrets Manager secret is encrypted with an AWS KMS customer managed key instead of the managed key aws/secretsmanager, then additional configuration is required. Make sure to allow the Decrypt API action permission as either the Lambda execution role or the AWS KMS key policy.Related informationHow do I troubleshoot permissions issues with Lambda?Follow"


Question: Why are contacts waiting a long time in the queue in Amazon Connect?

I want to know why a contact isn't being routed to the appropriate queue or is waiting in the queue for a long time.

Answer: "I want to know why a contact isn't being routed to the appropriate queue or is waiting in the queue for a long time.Short descriptionThe following are the most common reasons why contacts aren't routing to agents or are waiting in the queue for a long time:Misconfigured routing profilePriority and delayAgents aren't accepting the contactsConsider the following example to understand how contacts can route to agents:In this example, a contact is placed in queue A in your contact center.If queue A is assigned to routing profile A, then the agents that are associated with that routing profile receive the contact.If none of the agents that are associated with routing profile A are in an available status, then the contact keeps waiting in the queue.If multiple agents are available, then the agent who is idle the longest receives the contact.If multiple contacts are available, then the contact that is waiting for the longest time is routed to an agent. However, if priority and delay are configured then the contact's position in queue can be changed to route to an agent sooner.ResolutionMisconfigured routing profileYou can verify the configuration of your routing profile using the AWS Command Line Interface (AWS CLI) or Amazon Connect instance.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Using the AWS CLITo verify the configuration of your routing profile using AWS CLI, do the following:1.    Run the following command to list the routing profiles, and get the routing profile IDs.Note: Replace instance-id with your Amazon Connect instance ID and aws-region with the AWS Region that your instance is located in.aws connect list-routing-profiles --instance-id <instance-id> --region <aws-region>You receive an output similar to the following:{    "RoutingProfileSummaryList": [        {            "Id": "routing-profile-id",            "Arn": "Routing-Profile ARN",            "Name": "RoutingProfile"        }        ]        }2.    Run the following command to describe the routing profile, and then check if the channel is activated in the routing settings configuration.Note: Replace instance-id with your Amazon Connect instance ID and aws-region with the AWS Region your instance is located in. Replace profile-id with the routing profile Id identified in step 1.aws connect describe-routing-profile --instance-id <instance-id> --routing-profile-id <profile-id> --region <aws-region>You receive an output similar to the following:{"RoutingProfile": {        "InstanceId": "<instance-id>",        "Name": "Basic Routing Profile",        "RoutingProfileArn": "<routing-profile-arn>,        "RoutingProfileId": "<routing-profile-id>",        "Description": "A simple routing profile.",        "MediaConcurrencies": [            {                "Channel": "CHAT", //Channel activated in routing profile settings                "Concurrency": 2 //how many chat conversations that an agent can have simultaneously            },            {                "Channel": "TASK",                "Concurrency": 1            },            {                "Channel": "VOICE",                "Concurrency": 1            }        ],        "DefaultOutboundQueueId": "<outbound-queue-id>",        "Tags": {}    }}For an agent to have the contact routed, the routing profile for an agent must have the Channel activated in the routing profile settings. In the preceding example, the "CHAT" channel is activated.3.    Run the following command to list the queues associated to the routing profile:Note: Replace instance-id with your Amazon Connect instance ID and aws-region with the AWS Region your instance is located in. Replace profile-id with the routing profile Id identified in step 1.aws connect list-routing-profile-queues --instance-id <instance-id> --routing-profile-id <profile-id> --region <aws-region>You receive an output similar to the following:{    "RoutingProfileQueueConfigSummaryList": [        {            "QueueId": "queue-id",            "QueueArn": "queue-arn",            "QueueName": "QueueName",            "Priority": 1, // Priority set for the queue<            "Delay": 0, //Delay set for the Queue            "Channel": "CHAT" // Channel activated for the queue        }        ]        }Using the Amazon Connect instanceTo verify the configuration of your routing profile using Amazon Connect instance, do the following:Log in to your Amazon Connect instance using your access URL (https://alias.awsapps.com/connect/login -or- https://domain.my.connect.aws).Important: You must log in as a user that has sufficient permissions required to view historical metrics reports.In the navigation menu, choose User, and then choose Routing profiles.Choose the Routing profile that is configured for the agent.ForSet channels and concurrency, review theChannels that are turned on. For example, check if the channel forChat is turned on.ForQueues, verify that the queue and its channel are turned on. You can also see thePriority andDelay (seconds) for the queue.For an agent to have a contact routed, the queue must be associated to the routing profile with the channel activated.Both the queue and associated routing profile must be configured for an agent's routing profile to get the contacts for the queue. If the routing profiles are correct but contacts are waiting in the queue, then review for priority and delay settings.Priority and delayThe flow block for change routing priority / age can change a contact's position in queue. If a contact's queue position is changed, then that might contribute to them waiting in the queue for a long time.To check if a contact's position in queue is changed, do the following:Activate flow logging for your instance to track the contact block Change routing priority / age.Search the flow logs to locate the log event for the contact that you want to review.Review the log entry to check if the contact's AbsolutePosition (priority) or TimeOffset (age) is changed**.**The following is an example log with the contact's priority set to 5:{    "ContactId": "<contact-id>",    "ContactFlowId": "contact-flow-id",    "ContactFlowName": "chat",    "ContactFlowModuleType": "UpdateRoutingPriority",    "Timestamp": "2022-12-20T14:02:49.898Z",    "Parameters": {        "AbsolutePosition": "5" //Priority Set    }}For example, if contact A's priority is set to 5 and contact B's priority is set to 1, then contact B is routed earlier. This example situation can happen even when contact A's call is received first. The AbsolutePosition can raise the priority of a contact, compared to other contacts in the queue, by using a higher priority, such as 1.The following is an example log with the contact's age set to add one minute:{    "ContactId": "<contact-id>",    "ContactFlowId": "contact-flow-id",    "ContactFlowName": "chat",    "ContactFlowModuleType": "UpdateRoutingPriority",    "Timestamp": "2022-12-20T14:14:13.794Z",    "Parameters": {        "TimeOffset": "60" //+ve age set in seconds, if -ve the value would be -60    }}For example, if a contact has a TimeOffset of 60, then that contact is routed earlier than calls in the same queue. This includes calls that are received in the same minute time frame.The TimeOffset adds or subtracts seconds or minutes from the amount of time that the current contact spends in queue. Contacts are routed to agents on a first-come, first-served basis. Changing a contact's amount of time in queue changes their position in queue when compared to other contacts in the same queue.For additional information on how priority and delay work together, see Queues: priority and delay.Agents aren't accepting the contactsUse the following methods to verify if agents are missing contacts for active or completed contacts:Active contactsFirst, review the Real Time metrics to see how many agents are available using the agent activity Available metric and Agent non-response metric. If Agent non-response is high, then this means that the missed contacts by the agents are high. However, be aware that contacts abandoned by the customer are also included in this metric.Then, review the agent activity audit report to analyze if the agent was routed a contact and if it was missed. When the agent is offered the contact, a Joining Customer status is present in the agent audit report. If the agent misses the contact, then a Contact Missed status is present.Completed contactsFirst, check the contact records for the contact and review the queue information to see the value of AgentConnectionAttempts. The AgentConnectionAttempts provides the number of times that the contact is routed to agents.Note: AgentConnectionAttempts doesn't refer to the number of agents. It refers to only the number of times the contact was routed to an agent. For example, if there are only two agents available and they collectively missed the contact 10 times, then the AgentConnectionAttempts is 10.Then, to check which agents the contact is routed to, review the agent activity audit report for the contact ID that was missed. When the agent is offered the contact, a Joining Customer status is present in the agent audit report. If the agent misses the contact, then a Contact Missed status is present.Follow"