Question: How can I resolve the publish operation error in Amazon SNS?

"I get an error in Amazon Simple Notification Service (Amazon SNS). The error happens when I'm using a subnet, and I try to publish my SNS topic from a cross-account Amazon Elastic Compute Cloud (Amazon EC2) instance."

Answer: "I get an error in Amazon Simple Notification Service (Amazon SNS). The error happens when I'm using a subnet, and I try to publish my SNS topic from a cross-account Amazon Elastic Compute Cloud (Amazon EC2) instance.Short descriptionIf you receive an authorization error when you call the Publish operation, then complete the steps in the Verify EC2 instance IAM role and SNS topic access policy permissions section.If you have issues with an SNS topic that's using server-side encryption and you receive a "KMSAccessDenied" error, then complete the steps in the Verify KMS key settings and EC2 IAM role permissions section.Note: If your EC2 instance can't connect to the internet with an internet gateway, see Why can't my Amazon EC2 instance connect to the internet using an internet gateway?ResolutionVerify EC2 instance IAM role and SNS topic access policy permissionsMisconfigured AWS Identity and Access Management (IAM) role permissions for your EC2 instance and Amazon SNS topic access policy can cause the following error:"An error occurred (AuthorizationError) when calling the Publish operation: User: arn:aws:iam::111122223333:role/cross-acc-ec2-sns-publish-role/i-0123456789f804d is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-2:123456789012:cross-account-ec2-sns."To resolve this error, see How do I publish to an Amazon SNS topic from a cross-account Amazon EC2 instance using an IAM EC2 role?Verify KMS key settings and EC2 IAM role permissionsIf permissions for the IAM role of your EC2 instance and the AWS Key Management Service (AWS KMS) key policy of your AWS KMS key (KMS key) are incorrect, you can receive the following error:An error occurred (KMSAccessDenied) when calling the Publish operation: null (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: IDNumber; Proxy: null)Note: The preceding error occurs only when your SNS topic uses server-side encryption.To resolve the error, check your KMS key settings and AWS KMS key policy permissions:1.    Confirm that your KMS key is enabled.2.    Confirm that your EC2 instance IAM role is allowed to perform kms:GenerateDataKey* and kms:Decrypt in the AWS KMS key policy. This is the key policy of the KMS key that's used for server-side encryption on your SNS topic. For example:{  "Effect": "Allow",  "Principal": {    "AWS": "arn:aws:iam::111122223333:role/cross-acc-ec2-sns-publish-role"  },  "Action": [    "kms:GenerateDataKey*",    "kms:Decrypt"  ],  "Resource": "*"}3.    Confirm that kms:GenerateDataKey* and kms:Decrypt permissions are attached to the IAM role of your EC2 instance.Note: It's a best practice to provide the least privileges needed. Therefore, be sure to replace the Resource value with your KMS Key ARN in the following IAM role policy:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Allow",      "Action": [        "kms:Decrypt",        "kms:GenerateDataKey*"      ],      "Resource": "*"    }  ]}Follow"


Question: How do I optimize costs using AWS Trusted Advisor?

I want to know how to use Trusted Advisor for optimizing my costs.

Answer: "I want to know how to use Trusted Advisor for optimizing my costs.ResolutionTrusted Advisor inspects your AWS infrastructure across all AWS Regions, and then presents a summary of check results.To view the Cost Optimization results and potential monthly savings with Trusted Advisor, open the Trusted Advisor console. Then, choose Cost Optimization in the navigation pane to view the potential monthly savings, cost optimization checks, and related recommendations. You can see 14 checks in the Cost Optimization pillar. You can weigh the status and recommendations provided against your requirements, and then act on or ignore the recommendations based on your business needs.Potential monthly savingsHere are a few things to keep in mind when reviewing the potential monthly savings:The potential monthly savings indicate the total amount that you can save each month, if you act on all recommendations across all the checks in the pillar.Your actual total savings might be less than the potential monthly savings, because some checks provide overlapping recommendations for the same resources.To avoid the overlap, act on the recommendations of one of the checks, and then refresh to see the updated recommendations on similar checks.The potential monthly savings are an estimate of how much you might possibly save. Actual cost savings might vary depending on your decision to purchase instances or nodes, such as Reserved Instances (RIs), Reserved Nodes, or Spot Instances.Cost optimization checks for underutilized resourcesThe following cost optimization checks inspect the utilization of resources and flag resources with low utilization:Amazon RDS Idle DB Instances inspects your Amazon Relational Database Service (Amazon RDS) configuration for any DB instances that are idle. You see the yellow icon for this check result if an active DB instance did not have a connection in the last 7 days. You can take a snapshot, and then delete or stop the instance.Idle Load Balancers inspects your Elastic Load Balancing (ELB) configuration for inactive load balancers. You see the yellow icon for this check result if you have a load balancer that is not being actively used.Low Utilization Amazon EC2 Instances recommends stopping or terminating Elastic Compute Cloud (Amazon EC2) instances with low utilization. You can also choose to scale your instances using Amazon EC2 Auto Scaling.Unassociated Elastic IP Addresses identifies the Elastic IP addresses in your account that are not associated with a running EC2 instance. Elastic IP addresses that aren't attached to a running instance incur charges. You can either associate the Elastic IP address with a running instance, or release it to reduce costs.Underutilized Amazon EBS Volumes inspects your Amazon Elastic Block Store (Amazon EBS) volume configurations for underused volumes. You can create a snapshot of the underused volumes and delete them to reduce your costs.Underutilized Amazon Redshift Clusters checks your Amazon Redshift configuration for underused clusters. You can create a snapshot of the cluster and shut it down. You can also choose to downsize the cluster.Cost optimization checks for reservationsThe following cost optimization checks provide reservation and savings plan recommendations:Amazon EC2 Reserved Instance Lease Expiration checks for Amazon EC2 RIs that are due for expiration in the next 30 days or has already expired in the last 30 days. You can choose to purchase new RIs based on this information.Amazon EC2 Reserved Instances Optimization, Amazon ElastiCache Reserved Node Optimization, Amazon OpenSearch Reserved Instance Optimization, Amazon Redshift Reserved Node Optimization, and Amazon Relational Database Service (RDS) Reserved Instance Optimization checks inspect the usage of respective resources for the last 30 days. These checks provide recommendations on purchase of RIs and Reserved Nodes based on usage to help you reduce costs. You can see the Cost Explorer page for recommendations on the number and type of RIs that you need to purchase to maximize your savings.Savings Plan checks your compute usage for the last 30 days, and then provides Savings Plans recommendations.Here are a few things to consider when reviewing the reservation recommendations:The reservation and Savings Plan recommendations are provided based on the data from Cost Explorer.You can purchase reservations or Savings Plans in Cost Explorer based on Trusted Advisor recommendations.The reservation recommendations aren't available to linked accounts in organizations.The recommendations are provided based on your compute usage for the last 30 days.Other cost optimization checksThe Amazon Route 53 Latency Resource Record Set check inspects the Route 53 latency record sets that are configured inefficiently. This check recommends that you create a latency record set for each Region if you have resources in multiple Regions.Related informationHow do I start using Trusted Advisor?Follow"


Question: How do I create an AMI that is based on my EBS-backed EC2 instance?

"I want to create a backup or launch multiple copies of my Amazon Elastic Compute Cloud (Amazon EC2) instance, or I received a maintenance notification suggesting that I create an Amazon Machine Image (AMI) of my instance."

Answer: "I want to create a backup or launch multiple copies of my Amazon Elastic Compute Cloud (Amazon EC2) instance, or I received a maintenance notification suggesting that I create an Amazon Machine Image (AMI) of my instance.ResolutionAmazon Machine Images (AMIs) are archival copies of instances that you can use to launch other instances. You can use custom AMIs to launch multiple copies of an Amazon EC2 instance that is backed by an Amazon Elastic Block Store (Amazon EBS). You can also use a custom AMI as a backup solution.By default, when you create an AMI from an instance, snapshots are made of each EBS volume attached to the instance. AMIs can launch with multiple EBS volumes attached. This allows you to replicate both an instance's configuration and the state of all the EBS volumes that are attached to that instance.Note: Instances created from AMIs don't retain or copy any data stored in instance store volumes. The source instance that you create the AMI from retains all data that's stored in the instance store.To create an AMIIf your instance is running Linux, then follow the instructions at Create an Amazon EBS-Backed Linux AMI.If your instance is running Windows, then see Create a custom Windows AMI.Note: To maintain data consistency, your instance reboots during the AMI creation process. During the reboot, the public IP address and instance store volumes for your instance remain the same. You can choose the NoReboot option when creating an AMI to prevent the EC2 instance from rebooting. This option can affect the filesystem integrity of the AMI.Related information(Linux) Amazon Machine Images (AMIs)(Windows) Amazon Machine Images (AMI)Shared AMIsHow can I restrict access to launch Amazon EC2 instances from only tagged AMIs?Controlling access during AWS requestsFollow"


Question: Why did GuardDuty report the finding HIDDEN_DUE_TO_SECURITY_REASONS?

Amazon GuardDuty findings or AWS CloudTrail logs display the user name as "HIDDEN_DUE_TO_SECURITY_REASONS".

Answer: "Amazon GuardDuty findings or AWS CloudTrail logs display the user name as "HIDDEN_DUE_TO_SECURITY_REASONS".ResolutionSuccessful and failed sign-in attempts for Identity and Access Management (IAM) users and federated users to the AWS Management Console are logged in CloudTrail logs. As a security best practice, AWS doesn't log the entered IAM user name text when the sign-in failure is caused by an incorrect user name. The user name text shows a GuardDuty finding or CloudTrail log entry as "HIDDEN_DUE_TO_SECURITY_REASONS", similar to the following sign-in failure event log example.For more information, see Logging user sign-in events.Related informationSecurity best practices in IAMCloudTrail userIdentity elementFollow"


Question: How do I add a promotional code to my AWS account?

I received a promotional code or credit for AWS services. I want to add it to my AWS account.

Answer: "I received a promotional code or credit for AWS services. I want to add it to my AWS account.ResolutionYou can add a promotional code to your AWS account by doing the following:Open the Credits page of the Billing and Cost Management console.Choose Redeem credit.For Promotion code, enter the promotion code as it appears.For Security code, enter the code shown in the CAPTCHA.Choose Redeem credit.If the promotional code was entered correctly, is valid, hasn't expired, and hasn't been previously redeemed, it is added automatically to your AWS account.If you're a part of the AWS Partner Network (APN) and have questions on earning or redemption of credits, contact the APN team.Related informationRedeem your AWS promotional creditFollow"


Question: How do I troubleshoot common connection errors for my Amazon RDS for Oracle instance?

I'm unable to connect to my Amazon Relational Database Service (Amazon RDS) for Oracle instance. I want to troubleshoot the error message that I'm getting.

Answer: "I'm unable to connect to my Amazon Relational Database Service (Amazon RDS) for Oracle instance. I want to troubleshoot the error message that I'm getting.Short descriptionBefore troubleshooting the connection error, do the following:Check the state of your Amazon RDS for Oracle DB instance. If the instance is in any state other than available,storage optimization, or backing-up, then you can't connect to the instance.Verify that you can connect to the database instance over the database port.Note: By default, Oracle uses port 1521.telnet example-endpoint 1521If you can't establish a connection using telnet, then troubleshoot the issue based on the instructions provided in How do I resolve problems when connecting to my Amazon RDS DB instance?ResolutionVerify that your connection string is accurate.A typical connect descriptor looks similar to the following:$ sqlplus admin/xxxx@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=myexampledb.xxxx.us-east-1.rds.amazonaws.com)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))With Easy Connect, the connection string looks similar to the following:$ sqlplus 'admin@myexampledb.xxxx.us-east-1.rds.amazonaws.com:1521/ORCL'Use the following troubleshooting options based on the error message you get:ORA-01017: invalid username/password; logon deniedCheck the user credentials provided in the connection string. Be sure that these credentials are accurate.ORA-12545: Connect failed because target host or object does not existVerify that the host name (RDS endpoint) is accurate using the NLSLOOKUP command:nslookup example-database.xxxx.us-east-1.rds.amazonaws.com Server: xx.xx.xx.xx Address: xx.xx.xx.xx#53ORA-12170: TNS:Connect timeout occurred-or-ERROR: Connection reset by peerThe most common reasons for these errors are the following:There are issues with the network, connection establishment, or firewall.Communication with the client failed to complete within the allotted time interval.The database is down.The sqlnet.ora parameter is invalid.To troubleshoot these errors, verify the syntax of the connection string by running the TNSPING command on the client side:$ tnsping example-connection-stringIf the syntax of the connection string is accurate, then the output looks similar to the following:$ cat $ORACLE_HOME/network/admin/tnsnames.oraOutput :ORCL=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST= example-database.xxxx.us-east-1.rds.amazonaws.com)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)))$ tnsping ORCLTNS Ping Utility for Linux: Version 12.1.0.2.0 - Production on 16-NOV-2021 09:16:04Copyright (c) 1997, 2014, Oracle. All rights reserved.Used parameter files:Used TNSNAMES adapter to resolve the aliasAttempting to contact (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=example-database.xxxx.us-east-1.rds.amazonaws.com)(PORT=1521))CONNECT_DATA=(SERVICE_NAME=ORCL)))OK (20 msec)If there is an error with the syntax, then the output looks similar to the following:$ tnsping ORCLTNS Ping Utility for Linux: Version 12.1.0.2.0 - Production on 16-NOV-2021 09:23:47Copyright (c) 1997, 2014, Oracle. All rights reserved.Used parameter files:TNS-03505: Failed to resolve nameYou can also run the TRCROUTE command to check the syntax of the connection string:$ trcroute example-connection-stringIf the syntax of the connection string is accurate, then the output looks similar to the following:Trace Route Utility for Linux: Version 12.1.0.2.0 - Production on 16-NOV-2021 09:16:25Copyright (c) 1995, 2014, Oracle. All rights reserved.Route of TrcRoute:------------------Node: Client            Time and address of entry into node:-------------------------------------------------------------16-NOV-2021 09:16:25 ADDRESS= PROTOCOL=TCP  HOST=example-database.xxxx.us-east-1.rds.amazonaws.com  PORT=1521Node: Server            Time and address of entry into node:-------------------------------------------------------------16-NOV-2021 14:16:25 ADDRESS= PROTOCOL=TCP  HOST=example-database.xxxx.us-east-1.rds.amazonaws.com PORT=1521If there is an error with the syntax, then the output looks similar to the following:$ trcroute ORCLTrace Route Utility for Linux: Version 12.1.0.2.0 - Production on 16-NOV-2021 09:25:06Copyright (c) 1995, 2014, Oracle.  All rights reserved.TNS-03505: Failed to resolve nameTo further troubleshoot these errors, do the following:Be sure that the security group for your RDS DB instance allows the appropriate incoming traffic to your database.If the application connects from an on-premises network, then make sure that the firewall rules are updated to allow connections to and from the RDS instance.The JDBC Thin driver connection doesn't go through the Oracle Net layer. Therefore, if you're using the Oracle JDBC Thin driver, perform the equivalent of SQL*Net Client Tracing with Oracle JDBC Thin Driver. For more information, see Oracle documentation for Doc ID 793415.1.If you're using the JDBC Thick or OCI client, then turn on sqlnet tracing on the server side. To turn on tracing on the server side, modify the custom parameter group attached to the instance. In this case, a reboot is not required. If you're using the default parameter group, then create a custom parameter group, modify the following parameters, and then modify the instance to use the newly created parameter group. In this case, a reboot is required.sqlnetora.trace_level_server=16sqlnetora.diag_adr_enabled=OFFImportant: Turning on server-level tracing might have a few potential impacts. A large number of trace files might be generated quickly. In rare cases, the listener or even the database might need to be restarted to stop tracing after the troubleshooting is completed. The process also requires close monitoring. Therefore, it's a best practice to turn on tracing during non-peak business hours or under isolated conditions when no other user is connecting to the database. Also, be sure that the server has sufficient disk space available. The parameter values mentioned in this article are examples. You can modify these values according to your use case. For more information, see Modifying connection properties using sqlnet.ora parameters.Turn on sqlnet tracing on the client side. Then, reproduce the error and capture the details in the trace files. Create a backup of the sqlnet.ora file, and then modify the following parameters in the file:TRACE_LEVEL_CLIENT = 16TRACE_FILE_CLIENT = client.trcTRACE_DIRECTORY_CLIENT = /var/log/sqlnetTRACE_TIMESTAMP_CLIENT = ONTRACE_UNIQUE_CLIENT = ONDIAG_ADR_ENABLED= OFFTo turn off tracing, remove the tracing parameters from the sqlnet.ora file. Even after the tracing parameters are removed, the tracing for the already connected sessions on the server side is stopped only after the client session is closed.If you get the error because of a slow network, then configure the following parameters on the client side and server side. This allows more time to establish the connection:Client side:SQLNET.INBOUND_CONNECT_TIMEOUTSQLNET.SEND_TIMEOUTSQLNET.RECV_TIMEOUTServer side:sqlnetora.sqlnet.inbound_connect_timeoutsqlnetora.sqlnet.send_timeoutsqlnetora.sqlnet.recv_timeoutFor example, if you use the value 600 for all parameters, then the connection time is set to 10 minutes.ORA-12505: TNS:listener does not currently know of SID given in connect descriptorBe sure that the SID provided in the connection string matches the value of DBNAME that's under the Configuration tab on the Amazon RDS console. By default, the SID and DBNAME for an RDS for Oracle instance is ORCL.ORA-12504: TNS:listener was not given the SERVICE_NAME in CONNECT_DATABe sure to use either the SID or SERVICE_NAME clause under the CONNECT_DATA section in the connection string. The value of SERVICE_NAME provided in the connection string is same as the value of DBNAME that's under the Configuration tab on the Amazon RDS console. By default, the SERVICE_NAME value for an RDS for Oracle instance is ORCL.ORA-12538: TNS:no such protocol adapterBe sure that the PROTOCOL section of your connect descriptor is accurate. By default, the value of PROTOCOL is TCP.ORA-12560: TNS:protocol adaptor errorThis error indicates that you're trying to connect to the wrong SID or a database that's not running. Check the status of the RDS DB instance. Run the tnsping command to test the syntax and connectivity of the connection string:$ tnsping example-connection-stringORA-00018: maximum number of sessions exceededThis error indicates that too many sessions are connected to the database. To troubleshoot this error, do the following:1.    If you are connected to the database, then run the following query to find the number of sessions connected:SELECT COUNT(*) TOTAL FROM v$session;Run the following query to view the current utilization, maximum utilization, and the configured limits for the sessions and processes parameters in the RDS instance:SELECT RESOURCE_NAME, CURRENT_UTILIZATION, MAX_UTILIZATION, LIMIT_VALUEFROM V$RESOURCE_LIMIT WHERE RESOURCE_NAME IN ( 'sessions', 'processes');2.    End the unwanted sessions so that the other sessions can connect to the database.Run the following query to view the SID and serial number of individual sessions to be terminated:col username format a15col osuser format a15col program format a40col machine format a40SELECT s.osuser,s.sid,s.serial#,p.spid "RDS OS PID",s.program,s.machine,s.process "CLIENT OS PID",s.STATUS,s.SQL_ID,s.CURRENT_QUEUE_DURATIONFROM v$session s, v$process pWHERE s.paddr = p.addr AND s.machine LIKE '%<client machine>%'AND s.STATUS='ACTIVE';Note: Modify the WHERE clause according to your use case.Run the following command to end unwanted sessions in your RDS for Oracle instance:begin    rdsadmin.rdsadmin_util.disconnect(        sid => example-sid,        serial => example-serial_number);end;For more information, see Terminating a session.3.    To increase the value of the sessions and processes parameters, edit the custom parameter group, and modify these parameters. The sessions parameter is not defined in the parameter group and uses the default values for the engine.The default number of sessions in Oracle 19c is calculated as follows:Number of sessions = (1.5 * number of processes) + 22.The default value for the processes parameter is defined as LEAST({DBInstanceClassMemory/9868951}, 20000). The number of processes is calculated as the total memory (MB) in host /10 or 20,000, whichever is less.For more information on modifying a parameter group, see Modifying parameters in a DB parameter group.Because these parameters are static, you must reboot your instance after you update these parameters.Related informationWhy can't I connect to my Amazon RDS for Oracle database instance?Follow"


Question: Why is Elastic Load Balancing unequally routing my load balancer traffic?

"I've configured my load balancer to route traffic equally between instances or across Availability Zones. However, Elastic Load Balancing (ELB) routes more traffic to one instance or Availability Zone than the others. Why is this happening and how can I fix it?"

Answer: "I've configured my load balancer to route traffic equally between instances or across Availability Zones. However, Elastic Load Balancing (ELB) routes more traffic to one instance or Availability Zone than the others. Why is this happening and how can I fix it?Short descriptionELB might unequally route traffic to your targets if:Clients are routing requests to an incorrect IP address of a load balancer node with a DNS record that has an expired TTL.Sticky sessions (session affinity) are enabled for the load balancer. Sticky sessions use cookies to help the client maintain a connection to the same instance over a cookie's lifetime, which can cause imbalances over time.Available healthy instances aren’t evenly distributed across Availability Zones.Instances of a specific capacity type aren’t equally distributed across Availability Zones.There are long-lived TCP connections between clients and instances.The connection uses a WebSocket.ResolutionConfirm traffic imbalanceAnalyze ELB access logs, if available, to confirm the traffic imbalance. Use command line tools to find the number of requests that are routed by the load balancer to specific applications.For Application Load Balancers:awk '{print $5}' *.log | awk -F ":" '{print $1}' | sort | uniq -c | sort -rFor Classic Load Balancers:awk '{print $4}' *.log | awk -F ":" '{print $1}' | sort | uniq -c | sort -rELB adds individual files for each ELB node to your bucket. You can compare the number of lines in your access log files over a specific time period.Flush the DNS cacheRouting based on out-of-date DNS entries results in an imbalanced RequestCount pattern across different Availability Zones. For more information, see Application Load Balancer metrics or Classic Load Balancer metrics. Flush your client's DNS cache to be sure that it uses current DNS records for load balancer nodes.Note: When cross-zone load balancing is enabled, then the load balancer can still evenly balance requests at the instance level.For Linux clients using nscd for DNS caching, run one of the following commands:sudo /etc/init.d/nscd restart# service nscd restart# service nscd reloadFor Linux clients using dnsmasq for DNS caching, run one of the following commands:$ sudo /etc/init.d/dnsmasq restart# service dnsmasq restartFor Linux clients using BIND for DNS caching, run one of the following commands:# /etc/init.d/named restart# rndc restart# rndc execFor Windows clients, run the following command:ipconfig /flushdnsNote: If you cleared your client’s DNS cache but still experience caching issues, then be sure that your client application isn’t caching DNS records.Check the configuration of sticky sessionsIf you use duration-based session stickiness, then configure an appropriate cookie expiration time for your specific use case. For more information, see:Sticky sessions (Application Load Balancers)Duration-based session stickiness (Classic Load Balancers)If you set session stickiness from individual applications, then use session cookies instead of persistent cookies where possible. For more information, see Application-controlled session stickiness (Classic Load Balancers).Check healthy instance distribution across Availability ZonesIf there's an unequal number of available healthy instances in your Availability Zones and cross-zone load balancing is disabled, then ELB must balance requests across fewer instances in the affected Availability Zones. The remaining healthy instances process a higher number of requests to compensate, which can negatively impact performance.Note: A traffic load imbalance across instances or Availability Zones doesn’t necessarily mean that resource utilization is also imbalanced. For example, an imbalance can happen when one or more instances that are behind a load balancer process requests faster than the others.Maintain an equal number of instances in each enabled Availability Zone. To add more instances as load balancer targets, see:Register targets with your target group (Application Load Balancers)Register or deregister targets (Network Load Balancers)Register or deregister EC2 instances for Your Classic Load BalancerFor Classic Load Balancers and Network Load Balancers, consider enabling cross-zone load balancing to distribute requests at the instance level instead of the Availability Zone level. For more information, see Cross-zone load balancing (Network Load Balancers) or Configure cross-zone Load Balancing for your Classic Load Balancer. Cross-zone load balancing is always enabled for Application Load Balancers.Check instance type distributionA Classic Load Balancer with HTTP or HTTPS listeners might route more traffic to higher-capacity instance types. This distribution aims to prevent lower-capacity instance types from having too many outstanding requests. For more information, see Instance types. It’s a best practice to use similar instance types and configurations to reduce the likelihood of capacity gaps and traffic imbalances.A traffic imbalance might also occur if you have instances of similar capacities running on different Amazon Machine Images (AMIs). In this scenario, the imbalance of the traffic in favor of higher-capacity instance types is desirable.Check for long-lived TCP connectionsElastic Load Balancing routes TCP traffic using a round-robin algorithm. Long-lived TCP connections between clients and instances cause uneven traffic load distribution by design. As a result, new instances take longer to reach connection equilibrium. Be sure to check your metrics for long-lived TCP connections that might be causing issues. Also note that with TCP listeners, the load balancer distributes traffic only at the connection level. This means, for example, that clients that are frequently reusing connections for sending and receiving multiple HTTP requests might produce unbalanced traffic at the instance level. Consider moving to a Layer 7 load balancer if your application supports higher layer network protocols such as HTTP, HTTPS, WebSocket, or HTTP2.Check your load balancer’s RequestCount patterns and other relevant metrics. For more information, see:Application Load Balancer metricsCloudWatch metrics for your Network Load BalancerClassic Load Balancer metricsCheck for WebSocket connectionsClients using load balancers with WebSocket connections use a 1:1 connection between the client and target. This connection remains stuck to the target during the duration of the WebSocket connection, causing unequal traffic distribution. Application Load Balancers provide native support for WebSockets. Only new HTTP requests that are upgraded to WebSockets go to the new targets. WebSockets also work with Classic Load Balancers and Network Load Balancers with layer 4 listener.For more information, see Listener configuration.Follow"


Question: How do I fix the circular dependency between an AWS Lambda permission and target group resources in AWS CloudFormation?

I want to fix the circular dependency between an AWS Lambda permission (AWS::Lambda::Permission) and target group resources (AWS::ElasticLoadBalancingV2::TargetGroup) in AWS CloudFormation.

Answer:
"I want to fix the circular dependency between an AWS Lambda permission (AWS::Lambda::Permission) and target group resources (AWS::ElasticLoadBalancingV2::TargetGroup) in AWS CloudFormation.Short descriptionYou get a circular dependency if you provide AWS::Lambda::Permission to AWS::ElasticLoadBalancingV2::TargetGroup instead of LoadBalancer to restrict access to your Lambda function. This is because the Lambda permission must exist before you associate the Lambda function to the target group that you want to create. When you create the Lambda permission, you must associate the permission with an AWS Principal and SourceARN (in this case, a target group). That's why the target group must exist before creating the Lambda permission. To fix this circular dependency, you can use a Lambda-backed custom resource.Resolution1.    Create a file named index.py that includes the following:Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.Permission is hereby granted, free of charge, to any person obtaining a copy of thissoftware and associated documentation files (the "Software"), to deal in the Softwarewithout restriction, including without limitation the rights to use, copy, modify,merge, publish, distribute, sublicense, and/or sell copies of the Software, and topermit persons to whom the Software is furnished to do so.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHTHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTIONOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THESOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.def handler(event, context):     return {      "statusCode": 200,      "statusDescription": "HTTP OK",      "isBase64Encoded": False,      "headers": {         "Content-Type": "text/html"      },      "body": "
Hello from Lambda!
"    }Note: The AWS Lambda function in index.py displays an HTML page with the message "Hello from Lambda!" when the function is invoked.2.    Add the index.py file to an archive file named website.zip.3.    To create a .zip file of index.py, run the following command:$zip website.zip index.py4.    Create a file called cfnresponse.py based on the AWS CloudFormation template on AWS GitHub.5.    Create a filled called custom.py based on the following:Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.Permission is hereby granted, free of charge, to any person obtaining a copy of thissoftware and associated documentation files (the "Software"), to deal in the Softwarewithout restriction, including without limitation the rights to use, copy, modify,merge, publish, distribute, sublicense, and/or sell copies of the Software, and topermit persons to whom the Software is furnished to do so.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHTHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTIONOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THESOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.import loggingimport boto3, json, botocoreimport cfnresponse#Define logging properties for 'logging'log = logging.getLogger()log.setLevel(logging.INFO)#Main Lambda function to be executeddef lambda_handler(event, context):    try:        if event['RequestType'] == "Create" or event['RequestType'] == "Update":            # print the event type sent from cloudformation            log.info ("'" + str(event['RequestType']) + "' event was sent from CFN")            # Imput Parameters            TargetGroupARN = event['ResourceProperties']['TargetGroupARN']            LambdaFunctionARN = event['ResourceProperties']['LambdaFunctionARN']            log.info("TargetGroup ARN value is:" + TargetGroupARN)            log.info("Lambda Function ARN value is:" + LambdaFunctionARN)            responseData = {}            # ELBV2 initilize            client = boto3.client('elbv2')            # Initilize Vars            response = ''            error_msg = ''            # Make the 1st API call to get the Lambda policy and extract SID of the initial permissions that were created by the CFN template.            try:                response = client.register_targets(                    TargetGroupArn=TargetGroupARN,                    Targets=[                        {                            'Id': LambdaFunctionARN                        },                    ]                )            except botocore.exceptions.ClientError as e:                error_msg = str(e)            if error_msg:                log.info("Error Occured:" + error_msg)                response_msg = error_msg                # TODO: SIGNAL BACK TO CLOUDFORMATION                log.info("Trying to signal FAILURE back to cloudformation.")                responseData = {"Message" : response_msg, "Function" : context.log_stream_name}                cfnresponse.send(event, context, cfnresponse.FAILED, responseData)            else:                response_msg = "Successfully Added Lambda(" +  LambdaFunctionARN + ") as Target"                log.info(response_msg)                # TODO: SIGNAL BACK TO CLOUDFORMATION                log.info("Trying to signal SUCCESS back to cloudformation.")                responseData = {"Message" : response_msg, "Function" : context.log_stream_name}                cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)                        # log the end of the create event            log.info ("End of '" + str(event['RequestType']) + "' Event")        elif "Delete" in str(event['RequestType']):            # print the event type sent from cloudformation            log.info ("'Delete' event was sent from CFN")                        # TODO: DELETE THINGS            log.info("TODO: DELETE THINGS")                        # TODO: SIGNAL BACK TO CLOUDFORMATION            log.info("Trying to signal SUCCESS back to cloudformation.")            responseData = {"Function" : context.log_stream_name}            cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)                        # log the end of the Delete event            log.info ("End of 'Delete' Event")        else:            log.info ("RequestType sent from cloudformation is invalid.")            log.info ("Was expecting 'Create', 'Update' or 'Delete' RequestType(s).")            log.info ("The detected RequestType is : '" + str(event['RequestType']) + "'")                        #TODO: SIGNAL BACK TO CLOUDFORMATION            log.info("Trying to signal FAILURE back to cloudformation due to invalid request type.")            responseData={"Function" : context.log_stream_name}            cfnresponse.send(event, context, cfnresponse.FAILED, responseData)                            except Exception as e:        log.info ("Function failed due to the following error:")        print (e)                #TODO: SIGNAL BACK TO CLOUDFORMATION        log.info("Trying to signal FAILURE back to cloudformation due to the error.")        responseData={"Function" : context.log_stream_name}        cfnresponse.send(event, context, cfnresponse.FAILED, responseData)Note: The Lambda function in custom.py performs the RegisterTargets API call and signals AWS CloudFormation on completion of that API call.6.    Add the cfnresponse.py and custom.py files to an archive file named custom.zip. For example:zip custom.zip cfnresponse.py custom.pyNote: The custom.py file uses the Boto3 API call RegisterTargets. This API call registers the specified targets with the specified target group. For more information, see the register_targets Python snippet from the Boto3 website. The cfnresponse.py file contains a function that pushes logs and notifications to Amazon CloudWatch and AWS CloudFormation.7.    Create an AWS CloudFormation template using the following YAML template:Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.Permission is hereby granted, free of charge, to any person obtaining a copy of thissoftware and associated documentation files (the "Software"), to deal in the Softwarewithout restriction, including without limitation the rights to use, copy, modify,merge, publish, distribute, sublicense, and/or sell copies of the Software, and topermit persons to whom the Software is furnished to do so.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHTHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTIONOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THESOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.AWSTemplateFormatVersion: 2010-09-09Description: HelloWorld Lambda function template for Application Load Balancer Lambda as targetParameters:  # VPC in which the LoadBalancer and the LoadBalancer SecurityGroup will be created  VpcId:      Type: AWS::EC2::VPC::Id  # Subnets in which the LoadBalancer will be created.  Subnets:    Type: List<AWS::EC2::Subnet::Id>  # Name of the TargetGroup  TargetGroupName:     Type: String    Default: 'MyTargets'  # Name of the S3 bucket where custom.zip and website.zip are uploaded to   S3BucketName:    Type: String    Default: you-s3-bucket-nameResources:  LambdaExecutionRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Version: '2012-10-17'        Statement:        - Effect: Allow          Principal:            Service:            - lambda.amazonaws.com          Action:          - sts:AssumeRole      Path: "/"      Policies:      - PolicyName: root        PolicyDocument:          Version: '2012-10-17'          Statement:          - Effect: Allow            Action:            - '*'            Resource: '*'  # Lambda function which displays an HTML page with "Hello from Lambda!" message upon invocation  HelloWorldFunction1234:    Type: 'AWS::Lambda::Function'    Properties:      Code:        S3Bucket: !Ref S3BucketName        S3Key: website.zip      FunctionName: testLambda      MemorySize: 128      Handler: index.handler      Timeout: 30      Runtime: python3.7      Role: !GetAtt LambdaExecutionRole.Arn  LoadBalancer:    Type: AWS::ElasticLoadBalancingV2::LoadBalancer    Properties:      Scheme: internet-facing       Subnets: !Ref Subnets      SecurityGroups:      - !Ref LoadBalancerSecurityGroup  HttpListener:    Type: 'AWS::ElasticLoadBalancingV2::Listener'    Properties:      DefaultActions:      - TargetGroupArn: !Ref TargetGroup        Type: forward      LoadBalancerArn: !Ref LoadBalancer      Port: 80      Protocol: HTTP  LoadBalancerSecurityGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupDescription: Allow http to client host      VpcId: !Ref VpcId      SecurityGroupIngress:      - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0  HelloWorldFunctionInvokePermission:    Type: AWS::Lambda::Permission    Properties:      FunctionName: !GetAtt HelloWorldFunction1234.Arn      Action: 'lambda:InvokeFunction'      Principal: elasticloadbalancing.amazonaws.com      SourceArn: !Sub         - >-          arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:${TGFullName}        - TGFullName: !GetAtt TargetGroup.TargetGroupFullName  TargetGroup:    Type: AWS::ElasticLoadBalancingV2::TargetGroup    Properties:      Name: !Ref TargetGroupName      TargetType: lambda  # Custom resource for Lambda function - "HelloWorldFunction1234"  HelloWorld:    DependsOn: [TargetGroup, HelloWorldFunctionInvokePermission]    Type: Custom::HelloWorld    Properties:      ServiceToken: !GetAtt TestFunction.Arn      # Input parameters for the Lambda function      LambdaFunctionARN: !GetAtt HelloWorldFunction1234.Arn      TargetGroupARN: !Sub         - >-          arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:${TGFullName}        - TGFullName: !GetAtt TargetGroup.TargetGroupFullName  # Lambda function that performs RegisterTargets API call  TestFunction:    Type: AWS::Lambda::Function    Properties:      Code:        S3Bucket: !Ref S3BucketName        S3Key: custom.zip      Handler: custom.lambda_handler      Role: !GetAtt LambdaExecutionRole.Arn      Runtime: python3.7      Timeout: '5'Outputs:  Message:    Description: Message returned from Lambda    Value: !GetAtt       - HelloWorld      - Message8.    Pass in your values for the S3BucketName, Subnets, VpcId, and TargetGroupName parameters to the AWS CloudFormation stack that you created using the template in step 7.9.    Create the stack.10.    After all the API calls are completed, go to the Outputs section of the AWS CloudFormation console, and then look for the following message:Successfully Added Lambda(arn:aws:lambda:us-east-1:123456789:function:testLambda) as TargetFollow"


Question: How long does it take to create a backup for my RDS for SQL Server instance?

I want to create a backup for my Amazon Relational Database (Amazon RDS) for Microsoft SQL Server DB instance. How long does the backup process take?

Answer: "I want to create a backup for my Amazon Relational Database (Amazon RDS) for Microsoft SQL Server DB instance. How long does the backup process take?ResolutionThe time it takes to create a backup for your DB instance depends on the database workload. Higher database workload increases the number of incremental changes in the volume, which result in a longer backup time.In Amazon RDS for SQL Server, you can back up your DB instances using RDS automated backups, manual  RDS DB snapshots and native SQL backups.RDS automated backups and manual DB snapshots: These are storage volume snapshots of your DB instance that back up the entire DB instance. The first backup of a DB instance contains the data for the full DB instance. Subsequent backups of the same DB instance are incremental, meaning that only the data that changed after your most recent snapshot is saved.Native SQL backups: You can create full and differential backups of your DB instance, and then store the file in Amazon Simple Storage Service (Amazon S3) buckets. You can also create backups of individual databases on your DB instance.In some scenarios, your DB instance might require a full backup instead of an incremental backup. This might be the case after a Multi-Availability Zone failover or after you turn on RDS automated backups. Creating a full backup might take considerably longer. Other factors that increase back up time including the following:CPU and memory availabilityDisk I/ODatabase activitySize of the databaseCheck the progress of a native backup or restoreTo check the progress of native backup or restore, get the Task ID after you perform the backup or restore statement. Or, use the following script to identify all of the completed and pending tasks for a particular database. In the following command, replace database_name with the correct name for your database.exec msdb.dbo.rds_task_status @db_name='database_name'To track the status of the job, use the following SQL statement as a guide. In the following command, replace task_id with the correct ID for your task.exec msdb..rds_task_status @task_id= 5For more information, see Setting up for native backup and restore.Check the progress of a manual DB snapshotTo check the progress of manual DB snapshot, do the following:Open the RDS console.Select Snapshots.Select the snapshot you want to check the progress for, then select the Progress tab.Note: You can't check the progress of an RDS automated backup from the RDS console or using the AWS Command Line Interface (AWS CLI). Contact AWS Support for this information.Follow"


Question: What browsers are supported for use with the AWS Management Console?

Is my browser supported for use with the AWS Management Console?

Answer: Is my browser supported for use with the AWS Management Console?ResolutionThe AWS Management Console supports the following browsers:BrowserVersionGoogle ChromeLatest three major versionsMozilla FirefoxLatest three major versionsMicrosoft EdgeLatest three major versionsApple Safari for macOSLatest three major versionsRelated informationWhat is the AWS Management Console?Follow


Question: Why aren't changes on my Amazon S3 bucket showing on the Storage Gateway file share?

"I made changes to my Amazon Simple Storage Service (Amazon S3) bucket, such as uploading a new file or removing an existing file. However, the changes aren't propagating to my AWS Storage Gateway file share. How can I fix this?"

Answer: "I made changes to my Amazon Simple Storage Service (Amazon S3) bucket, such as uploading a new file or removing an existing file. However, the changes aren't propagating to my AWS Storage Gateway file share. How can I fix this?Short descriptionStorage Gateway updates the file share cache automatically when you write files to the cache locally using the file share. However, Storage Gateway doesn't automatically update the cache when you upload a file directly to Amazon S3. When you do this, you must perform a RefreshCache operation to see the changes on the file share. If you have more than one file share, then you must run the RefreshCache operation on each file share.You can refresh the cache using the Storage Gateway console and the AWS Command Line Interface (AWS CLI).ResolutionUsing the Storage Gateway consoleTo refresh the cache using the Storage Gateway console, see Refreshing objects in your Amazon S3 bucket. Using the AWS CLI1.    Run the list-file-shares command:$ aws storagegateway list-file-sharesNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.2.    Copy the Amazon Resource Number (ARN) of the file share with the cache that you want to refresh. Then, run the refresh-cache command and enter the ARN as the value for --file-share-arn:$ aws storagegateway refresh-cache --file-share-arn arn:aws:storagegateway:eu-west-1:12345678910:share/share-FFDEE12To automate the RefreshCache operation, see How can I automate the RefreshCache operation on Storage Gateway?Follow"


Question: How do I create a config rule for unsupported resource types using AWS Config?

I want to create a config rule for a resource type that isn’t supported by AWS Config. How can I do that?

Answer: "I want to create a config rule for a resource type that isn’t supported by AWS Config. How can I do that?Short descriptionAWS Config allows you to create config rules to verify whether AWS resources comply with a specified configuration. By default, AWS Config supports a limited number of AWS resource types. However, you can also create a custom config rule for resource types that aren’t supported by AWS Config.When a custom config rule is deployed, an AWS Lambda function is created to evaluate the resources. You can create a Lambda function that will evaluate an unsupported resource type and return the compliance result to the custom config rule.ResolutionNote: The following steps and code example create a custom config role to evaluate Amazon Cognito, which is an unsupported resource.PrerequisitesCreate an AWS Identity and Access Management (IAM) role for the Lambda function to allow Lambda to make the necessary API calls.1.    Open the IAM console, and then choose Roles from the navigation pane.2.    Choose Create role.3.    For Choose a use case, under Common use cases, choose Lambda.4.    Choose Next: Permissions.5.    Choose Create policy.Note: The Create policy page opens in a new tab. You’ll return to the original tab later in this process.6.    Choose the JSON tab, and then enter the following policy:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Allow",      "Action": [        "config:PutEvaluations",        "cognito-idp:ListUserPools"      ],      "Resource": "*"    }  ]}7.    Choose Next: Tags, and then choose Next: Review.8.    For Name, enter a policy name.9.    Choose Create policy.10.    Return to the Create role tab from step 5, and then choose the refresh icon on the right side of the policy list.11.    Find and select the new policy name, and then choose Next: Tags.12.    Choose Next: Review.13.    For Role name, enter lambda-role.14.    Choose Create role.Create a Lambda function for the custom config rule1.    Open the Lambda console.2.    Choose Create function.3.    Choose Author from scratch.For Function name, enter a name.For Runtime, select Python 3.8.4.    For Permissions, expand Change default execution role.For Execution role, choose Use an existing role.For Existing role, choose the role that you created to allow Lambda to make the necessary API calls in the Prerequisites section of this article.5.    Choose Create function.6.    For Code source, open the lambda_function.py file in the Lambda console, replace the default code with the following, and then choose Deploy.Note: The following code example finds all the Amazon Cognito UserPools that have MFA: OFF, and marks the results as NON_COMPLIANT. For information and resources to customize this guidance for other unsupported services and objectives, see the article section PutEvaluations API and AWS::::Account resource type value.// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.// SPDX-License-Identifier: MIT-0import jsonimport boto3def lambda_handler(event,context):  cognito = boto3.client('cognito-idp')  userpools = cognito.list_user_pools(    MaxResults=5    )  userpool_list = userpools['UserPools']  userpool_ids = []    for i in userpool_list:    userpool_ids.append(i['Id'])    evaluations = []  orderingtime = json.loads(event['invokingEvent'])['notificationCreationTime']    for j in userpool_ids:     userpool_describe = cognito.describe_user_pool(        UserPoolId = j      )     userpool_MFA = userpool_describe['UserPool']['MfaConfiguration']     if userpool_MFA == 'OFF':       evaluations.append(          {          'ComplianceResourceType': 'AWS::::Account',          'ComplianceResourceId': j,          'ComplianceType': 'NON_COMPLIANT',          'Annotation': 'Test',          'OrderingTimestamp': orderingtime          }        )     else:       evaluations.append(          {          'ComplianceResourceType': 'AWS::::Account',          'ComplianceResourceId': j,          'ComplianceType': 'COMPLIANT',          'Annotation': 'Test',          'OrderingTimestamp': orderingtime          }        )    result_token = event['resultToken']  config = boto3.client('config')  response = config.put_evaluations(              Evaluations = evaluations,              ResultToken = result_token,              TestMode = False            )The preceding code performs three major steps:Lists all resources to create an inventory.Evaluates each resource in the inventory against the specified configuration.Returns the compliance status based on the evaluation using the PutEvaluations API call to AWS Config.Create a custom periodic config ruleYou must now create a custom periodic config rule in AWS Config. Then, associate the custom rule with the Lambda function that you created in the previous section. For instructions, see Creating a custom rule.Important: Note the ARN of the new custom config rule for a later step.Authorize the AWS Config service to invoke the Lambda function1.    Open the Lambda console, and then choose Functions  from the navigation pane.2.    Choose the hyperlinked Function name for your Lambda function to open the function details.3.    From the Configuration tab, choose Permissions.4.    For Resource-based policy, choose Add permissions.For Policy statement, choose AWS service.For Service, choose Other.For Principal, enter config.amazonaws.com.For Source ARN, enter the ARN of the custom config rule that you created in the previous section. Note: To find the custom config rule ARN, open the AWS Config console, and then choose Rules from the navigation pane. Choose the hyperlinked rule Name, and then copy the Config rule ARN.For Action, choose lambda:InvokeFunction.For Statement ID, enter a unique ID.5.    Choose Save.PutEvaluations API and AWS::::Account resource type valueThe steps and examples in this article find all the Amazon Cognito UserPools that have MFA: OFF, and mark the results as NON_COMPLIANT. However, you can modify the process to meet your specific requirements with any unsupported resource type. You can find more code examples that use the AWS::::Account resource type on the aws-config-rules GitHub page.The PutEvaluations API call includes the following parameters:{   "Evaluations": [     {      "Annotation": "string",     "ComplianceResourceId": "string",     "ComplianceResourceType": "string",     "ComplianceType": "string",     "OrderingTimestamp": number    }   ],   "ResultToken": "string",   "TestMode": boolean}For unsupported resource types, you must enter AWS::::Account as the value for ComplianceResourceType. The AWS::::Account resource type reports on the whole account instead of a specific resource.Example:{  'ComplianceResourceType': 'AWS::::Account',  'ComplianceResourceId': 'Resource Id',  'ComplianceType': 'COMPLIANT'|'NON_COMPLIANT',  'Annotation': 'string',  'OrderingTimestamp': number}If an unsupported resource is entered as the ComplianceResourceType value instead of AWS::::Account, then you get the following errors:On the console: "No results available"Lambda CloudWatch logs: ""Error: ClientError: An error occurred (InternalFailure) when calling the PutEvaluations operation (reached max retries: 4)"Cloudtrail (PutEvaluations API): "Error: ClientError: An error occurred (InternalFailure) when calling the PutEvaluations operation (reached max retries: 4)Note the following when you use the AWS::::Account resource type value:1.    A configuration item isn’t recorded for this resource type.2.    A compliance configuration item under AWS::Config::ResourceCompliance isn’t recorded for this resource type.3.    A resource timeline isn’t available for this resource type.4.    In the AWS Management Console, the Manage Resource button is unavailable for this resource type.Related informationCreating an AWS Lambda function for a custom config ruleFollow"


Question: How can I resolve the errors that I received for the failing CloudWatch canary I created in my VPC?

My Amazon CloudWatch canary in a virtual private cloud (VPC) receives an error and fails.

Answer: "My Amazon CloudWatch canary in a virtual private cloud (VPC) receives an error and fails.Short descriptionCreating a canary in a VPC also creates an AWS Lambda function with an elastic network interface in the specified VPC subnets. These elastic network interfaces have no public IP addresses by default, even if they're added to public subnets. To write logs to Amazon Simple Storage Service (Amazon S3) and publish data points to CloudWatch, the canary must have access to the following endpoints:Amazon S3 endpointCloudWatch Monitoring endpointIf your canary has problems accessing either of these endpoints, then you receive one of the following error messages:TimeoutError: Navigation Timeout Exceeded:30000ms exceeded: You receive this error if a response from your monitored endpoint exceeds the timeout period that's configured for the page.goto method. For example, suppose that your configuration is "const response = await page.goto(URL, {waitUntil: 'domcontentloaded', timeout: 30000});". Because the timeout is 30 seconds, a response that exceeds 30 seconds results in this error.-or-You receive this error if a security group, network access control list (ACL), or routing table doesn't allow access to the canary's endpoint.No test result returned. Connection timed out after 30000ms and No artifacts were uploaded: You receive these errors if your canary doesn't have access to either CloudWatch Monitoring or Amazon S3 endpoints. If there are no data points in canary metrics, then your canary doesn't have access to CloudWatch Monitoring. If there are data points in canary metrics, then your canary has access to CloudWatch Monitoring but not Amazon S3. Note that 30000ms reflects the timeout period that's configured on the canary.At any point, you can test your canary's internet connectivity with the VPC Reachability Analyzer.ResolutionResolve "Navigation timeout" errorsConfirm that the security group that's attached to the canary has these properties:It must have an outbound rule that allows connections between the configured port and the IP address of the monitored endpoint.It must allow outbound traffic to port 443. Note that Amazon S3 and CloudWatch Monitoring endpoints are reachable through HTTPS. If necessary, add an outbound rule using HTTPS (TCP port 443) for Type and 0.0.0.0/0 for Destination.The network ACL in the canary subnet must allow inbound and outbound access.For inbound access: Allow ephemeral ports to access the source address and port of your endpoint IP address. Allow ephemeral ports to access 0.0.0.0/0 for port 443.For outbound access: Allow access to the Destination address and port of your endpoint IP address. Allow the Destination access to 0.0.0.0/0 for port 443.Confirm that your endpoint responds within the configured timeout period.To find your endpoint respond time, run the following command:time curl http/(s)://[your Endpoint IP/DNS]:PortIn the canary code, change the heartbeat timeout to exceed your endpoint respond time:const response = await page.goto(URL, {waitUntil: 'domcontentloaded', timeout: 30000});Resolve "No artifacts were uploaded" or "No test result returned" errorsAdd the canary to private subnets with 0.0.0.0/0 as the network address translation (NAT) gateway or NAT instance:1.    Create a NAT gateway.2.    Update the canary's private subnet routing table. For information on using NAT Gateways as a destination in a route table, see Routing to a NAT device.-or-Add the canary to private subnets with the VPC endpoints for Amazon S3 and CloudWatch Monitoring:1.    Create a gateway endpoint for the Amazon S3 endpoint.Note: For Service name, search for Amazon S3, and then select com.amazonaws.region.s3.2.    Create an interface endpoint for the CloudWatch Monitoring endpoint. Be sure to select the Enable DNS name check box.Note: For Service name, search for monitoring, and then select com.amazonaws.[region].monitoring. Be sure to select the Enable DNS name check box.Follow"


Question: How do I implement Redis keyspace notifications in ElastiCache?

How do I implement Redis keyspace notifications in Amazon ElastiCache?

Answer: "How do I implement Redis keyspace notifications in Amazon ElastiCache?Short descriptionRedis keyspace notifications allow you to subscribe to PubSub channels. Through the channel, clients receive published events when a Redis command or data alteration occurs. These notifications are useful when an application must respond to changes that occur to the value stored in a particular key or keys. You can also follow dataset changes using Redis keyspace notifications. The keyspace notifications feature is available in versions 2.8.6 and later.When a command runs that triggers a Redis keyspace notification, the following two events occur that monitoring clients respond to:Keyspace notificationKey-event notificationThe keyspace channel receives the name of the event, and the key-event channel receives the name of the key as a message.Important: The following resolution applies only to Redis (cluster mode disabled) clusters. The resolution doesn't apply to Redis (cluster mode enabled) clusters. For information on keyspace notifications for both types of clusters, see Redis keyspace notifications on the Redis site.ResolutionActivate Redis keyspace notificationElastiCache turns off Redis keyspace notifications by default. You can activate keyspace notifications in a custom cache parameter group using the notify-keyspace-events parameter. The notify-keyspace-events value uses multiple parameters to determine which channel to use (keyspace events or key-event events) and the information to post to these channels. For more information, see Redis 2.8.6 added parameters.1.    Open the ElastiCache console.2.    To see a list of all available parameter groups, choose Parameter Groups in the navigation pane.3.    Select the parameter group that you want to modify.Note: You can't modify a default parameter group. If the parameter groups listed are all default, create a new parameter group by choosing Create Parameter Group, select a Family, and then choose Create.4.    Choose Edit Parameters.5.    Scroll to notify-keyspace-events, and then enter AKE in the Value field. For more information on allowed values, see Redis 2.8.6 added parameters.6.    Choose Save Changes. The changes take effect immediately without restarting the cluster.Note: Be sure to assign the new modified parameter group to your Redis cluster.Generate events using redis-cliIf you're using redis-cli, you can run the following command to see how a given command generates events:#./redis-cli -c -h testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com -p 6379 --csv psubscribe '__key*__:*'Run any set of commands to create some keyspace events. The following commands set value and expire time as 3 sec for key Redis and subscriber for expired events../redis-cli -c -h testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com -p 6379testdisabled.xm4oz6.ng.0001.use1.cache.amazonaws.com:6379>testdisabled.xm4oz6.ng.0001.use1.cache.amazonaws.com:6379> SET key1 value1 ex 5testdisabled.xm4oz6.ng.0001.use1.cache.amazonaws.com:6379>In a separate session, verify that the events generate. The following is sample output from the events:# ./redis-cli -h testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com -p 6379 --csv psubscribe '*'Reading messages... (press Ctrl-C to quit)"psubscribe","*",1"pmessage","*","__keyspace@0__:key1","set""pmessage","*","__keyevent@0__:set","key1""pmessage","*","__keyspace@0__:key1","expire""pmessage","*","__keyevent@0__:expire","key1""pmessage","*","__keyspace@0__:key1","expired""pmessage","*","__keyevent@0__:expired","key1"In this output example, the first event indicates that you successfully subscribed to a channel. The number 1 represents the number of channels that you currently subscribe to.The second event is a keyspace notification. The keyspace channel __keyspace@0__:key1 contains the name of the event " set" as a message.The third event is a key-event notification. The keyevent channel __keyevent@0__:set contains the name of the key " key1" as a message.After 5 seconds, you can watch the expired message in the output. There are subtle differences in the messages. One message is __keyevent@0__:expire while another message is __keyevent@0__:expired.Each message read from the PubSub instance is a dictionary with the following keys:Type - One of the following: subscription, unsubscribe, psubscribe, punsubscribe, message, pmessagePattern - The pattern that matches the channel of the published message (except for the pmessage type, which does not match in all cases)Channel - The channel that the message is posted to or the channel that the message is subscribed toData - Message dataGenerate events using Redis-py1.    Subscribe to notifications. The following example subscribes to all keyspace notifications and prints received events. Use the appropriate script for either Python2 or Python3.For Python2:# cat subscribe.py import redisimport datetimeimport timer = redis.Redis(host='testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com', port=6379, db=0)#Subscribing for events matching pattern "__key*__:*"p = r.pubsub()p.psubscribe('__key*__:*')print('Starting message loop')while True:    message = p.get_message()    if message:        print datetime.datetime.now(), message    else:        time.sleep(0.01)For Python3:import redisfrom datetime import datetimeimport timer = redis.Redis(host = 'testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com', port = 6379, db = 0)#Subscribing for events matching pattern "__key*__:*p = r.pubsub()p.psubscribe('__key*__:*')print('Starting message loop')while True:    message = p.get_message()    if message:        print (datetime.now(), message)    else:        time.sleep(0.01)Note: Lower values or the absence of sleep causes the client to constantly poll the channel, potentially overloading the server. Higher values cause more memory usage on the server side. The preceding example sets time.sleep to (0.01).2.    Set or expire keys.In a separate session, connect to the cluster and run the createkey.py command. Set the key key2 with value value2 and expire time as 3 seconds.# cat createkey.pyimport redis  r = redis.Redis(host='testdisabled.xxxxx.ng.0001.use1.cache.amazonaws.com', port=6379, db=0)  r.set('key2,’value2’)  r.expire('key2’,3)Run the subscribe.py command in a separate session. The following is an example output:# python2 subscribe.pyStarting message loop2020-08-17 18:16:23.902762 {u'pattern': None, u'type': 'psubscribe', u'channel': '__key*__:*', u'data': 1L}2020-08-17 18:16:50.375281 {u'pattern': '__key*__:*',    u'type': 'pmessage', u'channel': '__keyspace@0__:key2', u'data': 'set'}2020-08-17 18:16:50.375365 {u'pattern': '__key*__:*', u'type': 'pmessage', u'channel': '__keyevent@0__:set', u'data': 'key2'}2020-08-17 18:16:50.375442 {u'pattern': '__key*__:*',    u'type': 'pmessage', u'channel': '__keyspace@0__:key2', u'data': 'expire'}2020-08-17 18:16:50.375499 {u'pattern': '__key*__:*', u'type': 'pmessage', u'channel': '__keyevent@0__:expire', u'data': 'key2'}2020-08-17 18:16:53.458622 {u'pattern':    '__key*__:*', u'type': 'pmessage', u'channel': '__keyspace@0__:key2', u'data': 'expired'}2020-08-17 18:16:53.458856 {u'pattern': '__key*__:*', u'type': 'pmessage', u'channel': '__keyevent@0__:expired', u'data': 'key2'}Your Redis key expire listener is ready.Follow"


Question: How do I troubleshoot RDS for SQL Server Windows Authentication issues with AWS Managed Microsoft AD?

I have AWS Directory Service for Microsoft Active Directory configured for my AWS account. I'm having issues creating an Amazon Relational Database Service (Amazon RDS) for a Microsoft SQL Server DB instance.

Answer: "I have AWS Directory Service for Microsoft Active Directory configured for my AWS account. I'm having issues creating an Amazon Relational Database Service (Amazon RDS) for a Microsoft SQL Server DB instance.Short descriptionWhen creating an Amazon RDS for SQL Server DB instance, you might encounter one of the following issues:The Microsoft Managed AD is unavailable.I receive an error that says "Failed to join a host to a domain" or the Directory Status on the RDS console shows "Failed".I can't log in to the DB instance using Windows Authentication.Windows Authentication for RDS for SQL Server DB instances is supported across multiple AWS accounts and Amazon Virtual Private Clouds (Amazon VPCs). A single AWS Managed Microsoft Active Directory can be shared across multiple AWS accounts and VPCs to easily manage directory-aware database workloads. However, this is true only if the RDS for SQL Server DB instances are in the same AWS Region as the AWS Managed Microsoft AD.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.The AWS Managed Microsoft AD isn't listed or is unavailable when creating a DB instanceImportant: The managed domain type must be AWS Managed active directory for the AWS Managed Microsoft AD to be listed in the Amazon RDS console.When the AWS Managed Microsoft AD is in a different Region than the instance, then that directory isn't listed when creating or modifying a DB instance. To resolve this issue, be sure that the DB instance is in same AWS Region as your Directory Service.Confirm that the RDS DB instance and the Directory Service are in the same Region:1.    Open the Amazon RDS console, and choose Databases from the navigation pane.2.    Choose the DB instance that you want to connect to the directory.3.    From the Summary section, review the Region associated with your DB instance.4.    Confirm that the Directory Service is in the same AWS Region as the DB instance by checking the AWS Directory Service console.If your AWS Managed Microsoft AD is in a different AWS account than the DB instance, share the Microsoft Managed AD with the AWS account. You can then list the Directory Service while creating or modifying the DB instance.1.    Start sharing the directory with the AWS account that the DB instance will be created in. Follow the steps in Sharing your AWS Managed Microsoft AD directory for seamless EC2 domain-join in the AWS Directory Service Administration Guide.2.    Sign in to the AWS Directory Service console using the account for the DB instance. Verify that the domain has the SHARED status before continuing.3.    Sign in to the AWS Directory Service console using the account for the DB instance, not the Directory ID value. Use this directory ID to join the DB instance to the domain.Error received when joining a DB instance to a domain or Directory Status on the RDS console shows "Failed"When joining a DB instance to a domain, you might receive the following error message:"Failed to join a host to a domain. Domain membership status for instance XXXXXXX has been set to Failed."Or, the Directory status might appear as Failed.1.    Confirm that the RDS for SQL Server instance security group is configured to allow the correct outbound traffic.TCP and UDP Port 53TCP and UDP Port 88TCP and UDP Port 135TCP and UDP Port 389TCP and UDP Port 445TCP and UDP Port 464TCP Port 636TCP Port 3268TCP Port 3269TCP Port 9389TCP Ports 49152-65535UDP Port 123UDP Port 1382.    Confirm that the AWS Managed Microsoft AD security group is configured to allow the correct inbound traffic. A security group is created when you create an AWS Managed Microsoft AD. For the list of inbound and outbound rules added to this security group, see What gets created in the AWS Directory Service Administration Guide.3.    You might have your DB instance and the AWS Managed Microsoft AD in different VPCs or in different accounts. If so, make sure that there is a correct route for the DB instance to reach the AWS Managed Microsoft AD. Also, make sure that there is a correct route for the Microsoft Managed AD to reach the DB instance. For more information. see  RDS Support for cross-account and cross-VPC domain joins (video).After identifying and addressing potential causes for the domain join failure, do the following to unjoin and then join the domain to the DB instance:1.    Open the Amazon RDS console, and then choose Databases from the navigation pane.2.    Select the DB instance that failed to join the domain, and then choose Modify.3.    From the Microsoft SQL Server Windows Authentication section, for Directory, choose None.4.    Choose Apply immediately. After the modification is complete, the DB instance reboots automatically.5.    To rejoin the directory, choose Databases from the navigation pane.6.    Select the DB instance, and choose Modify.7.    From the Microsoft SQL Server Windows Authentication section, for Directory, choose your directory from the list.8.    Choose Apply immediately. After the modification is complete, the DB instance reboots again.An error occurred (InvalidParameterCombination) when calling the ModifyDBInstance operation: IAM role provided is not valid, please check that the role exists and has the correct policiesWhen using the AWS CLI to attach a Directory Service to your DB instance, use the default IAM role rds-directoryservice-access-role. If you use a custom role, then attach the default policy AmazonRDSDirectoryServiceAccess to the custom role. Doing this resolves the IAM role provided is not valid error.Unable to log in to the DB instance using Windows AuthenticationLogging in using Windows Authentication requires a SQL login on the instance for the AWS Managed Microsoft AD user or group. The SQL login uses the DB instance's primary user credentials. If you use groups or users in your on-premises Microsoft Active Directory, you must create a trust relationship.1.    Log in to your DB instance as the primary user using SQL Server Management Studio (SSMS).2.    Use T-SQL to create the Windows Authentication login:CREATE LOGIN [Domain Name\user or group] FROM WINDOWS WITH DEFAULT_DATABASE = [master], DEFAULT_LANGUAGE = [us_english];Note: Creating a Windows Authentication login on an RDS for SQL Server instance is supported only when using T-SQL. You can't use the GUI to create a login in SQL Server Management studio.3.    Connect to the DB instance using Windows Authentication.Related informationUsing Windows Authentication with an Amazon RDS for SQL Server DB instanceControlling access with security groupsCan't connect to an Amazon RDS DB instanceJoining your Amazon RDS DB Instances across accounts to a single shared domainMigrating Microsoft SQL Server databases to the AWS CloudFollow"


Question: How do I make my Lambda function idempotent?

I want to make my AWS Lambda function code idempotent to prevent inconsistencies and data loss in my application.

Answer: "I want to make my AWS Lambda function code idempotent to prevent inconsistencies and data loss in my application.Short descriptionIn programming, idempotency refers to the capacity of an application or component to identify repeated events and prevent duplicated, inconsistent, or lost data. Making your AWS Lambda function idempotent requires designing your function logic to treat duplicated events correctly.Idempotent function logic can help reduce the following issues:Unnecessary API callsCode processing timeData inconsistencyThrottlesLatencyResolutionTo make your function idempotent, the function's code must properly validate input events and identify if the events were processed before. Your application's functionality dictates the best way to write the code.Use the following example function logic and best practices for guidance.Idempotent Lambda function logic exampleNote: The following example Lambda function logic applies to most use cases.1.    Extract the value of a unique attribute of the input event. (For example, a transaction or purchase ID.)2.    Check if the attribute value exists in a control database. (For example, an Amazon DynamoDB table.)3.    Depending on the results, complete the following step:If a unique value exists, then end the action without producing an error.-or-If a unique value doesn't exist, then proceed with the action that you originally designed.Note: Adding AWS services to your architecture might incur additional costs. For more information, see Amazon DynamoDB pricing and AWS Pricing.4.    If the unique value doesn’t exist after the function work finishes, then include the record in the control database.5.    Finish the action.Note: If you use Java or Python runtimes for your function, then review the Python and Java idempotency modules on the AWS Lambda Powertools GitHub page.Lambda function idempotency best practicesPlan your idempotency features before developing your application.When your Lambda code processes a duplicate event, make sure that it ends without producing an error.Note: Throwing errors can cause further retries, either by Lambda or by another service that invokes your function.Change the Lambda function timeout setting, so that the full runtime is handled correctly.Note: Using a separate service to persist data and control duplicated events might require API calls to HTTPS endpoints. API calls to HTTPS endpoints might then require more runtime than the default 3 seconds.Test and optimize your function as much as possible. Simulate a real scenario and rate of requests.Note: It's critical to test and optimize idempotent function logic to help prevent potential side effects such as, timeouts, excessive latency, or bottlenecks.Store session data using a service that's easily scalable and provides high throughput, such as DynamoDB.Note: When making API calls to Amazon Elastic Compute Cloud (Amazon EC2), the service offers the parameter clientToken. This parameter makes sure that a mutating API request successfully completes its workflow only once, even if you initiate multiple retries with the same clientToken.Related informationLambda programming modelCreate a Lambda function with the consoleMaking retries safe with idempotent APIsFollow"


Question: Why aren't the updated parameter values taking effect after I change the parameter values in an Amazon RDS parameter group?

"I modified the values of a few parameters in the parameter group for my Amazon Relational Database Service (Amazon RDS) DB instance. However, the updated values aren't taking effect."

Answer: "I modified the values of a few parameters in the parameter group for my Amazon Relational Database Service (Amazon RDS) DB instance. However, the updated values aren't taking effect.ResolutionThis happens because the parameter that you updated in the parameter group for your Amazon RDS DB instance is a static parameter. DB instance parameters are either static or dynamic. When you update the value of a static parameter and save the updates to the DB parameter group, the parameter changes don't take effect immediately. You must manually reboot the associated DB instance for the parameter group changes to take effect.When you update a dynamic parameter, the parameter changes are applied to your DB instance immediately. In this case, you don't have to reboot the DB instance.To check if the parameter that you're trying to modify is static or dynamic, do the following:Open the Amazon RDS console.In the navigation pane, choose Parameter groups.In the list of parameter groups displayed, choose the parameter group that you need to modify.For the parameter that you need to modify, check the column Apply type.This column displays whether the parameter is dynamic or static.You can also run the following AWS Command Line Interface (AWS CLI) command to verify whether a parameter is static or dynamic. This command returns the list of parameters in a parameter group along with Apply type:aws rds describe-db-parameters --db-parameter-group-name test_parameter_group --query "Parameters[*].[ParameterName,ApplyType]"Be sure to replace test_parameter_group with the name of your custom parameter group.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.If the parameter that you modified is static, the RDS console shows the DB parameter group with a status of pending-reboot. To check the status of the parameter group, do the following:Open the Amazon RDS console.In the navigation pane, choose Databases, and then choose the DB instance.Choose the Configuration tab.You can view the parameter group associated with the instance and status of the parameter group in this tab.You can also run the following AWS CLI command to verify the status of a parameter group:aws rds describe-db-instances --db-instance-identifier instance_identifier --query "DBInstances[*]".[DBInstanceIdentifier,DBParameterGroups]Be sure to replace instance_identifier with the name of your RDS instance.If the parameter that you're modifying is static, then reboot the instance for the parameter changes to take effect. For more information, see Rebooting a DB instance.Rebooting a DB instance results in a momentary outage. During this outage, the DB instance status is set to rebooting status. After the instance is rebooted successfully, the changes to the static parameters take effect on the associated RDS instance. The status of the parameter group changes from pending-reboot to in-sync.Note: When you associate a new DB parameter group with a DB instance, the RDS console shows the DB parameter group with a status of pending-reboot. You must reboot the instance for the modified static and dynamic parameters to be applied. However, if you modify dynamic parameters in the newly associated DB parameter group, these changes are applied immediately without a reboot.Related informationHow do I modify the values of an Amazon RDS DB parameter group?Working with parameter groupsFollow"


Question: How do I activate MFA in WorkSpaces?

I want to activate multi-factor authentication (MFA) for my Amazon WorkSpaces client. What steps do I need to take?

Answer: "I want to activate multi-factor authentication (MFA) for my Amazon WorkSpaces client. What steps do I need to take?ResolutionTo activate MFA for your WorkSpaces client, you first must make sure that your setup meets the following prerequisites:Server: Your Remote Authentication Dial-In User Service (RADIUS) server is set up on-premises or in the cloud.Traffic: You've allowed inbound traffic from the RADIUS server IP or TCP port 1812 to AWS Directory Service for Microsoft Active Directory or AD Connector.Shared secret: You've set up a shared secret code so that the RADIUS server users can connect to AWS Managed Microsoft AD or AD Connector.To learn more about the prerequisites for setting up AWS Managed Microsoft AD, see AWS Managed Microsoft AD prerequisites.To learn more about the prerequisites for setting up AD Connector, see AD Connector prerequisites.After you meet your prerequisites, activate MFA.For instructions on activating MFA for AWS Managed Microsoft AD, see Enable multi-factor authentication for AWS Managed Microsoft AD.For instructions on activating MFA for AD Connector, see Enable multi-factor authentication for AD Connector.Related informationWhy is MFA failing on my AWS Managed Microsoft AD directory or my AD Connector?Follow"


Question: How can I delete DNS query logging for a specific domain in Route 53?

How can I delete DNS query logging for a specific domain in Amazon Route 53?

Answer: "How can I delete DNS query logging for a specific domain in Amazon Route 53?Short descriptionTo delete DNS query logging for a specific domain, you must first obtain the query logging ID. You can find the query logging ID using:The AWS Command Line Interface (AWS CLI), orAWS Tools for PowerShellThe query logging ID is not available from the Route 53 console.ResolutionNote: In the following commands, replace all placeholder text with the corresponding values for your configuration. If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Delete DNS query logging for a specific domain using the AWS CLI1.    Get information about Route 53 DNS query logging associated with a specific hosted zone created for a domain:aws route53 list-query-logging-configs --hosted-zone-id [your hosted zone ID]Example output:{    "QueryLoggingConfigs": [        {            "HostedZoneId": "Z11BNGDQEO95SY",            "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:745401294438:log-group:route53log:*",            "Id": "7d9a464b-b0b4-4493-afaf-1c33b1dd4a11"        }    ]}In the previous example, 7d9a464b-b0b4-4493-afaf-1c33b1dd4a11 is the query logging ID. 2.    Using the query logging ID, get query logging information associated with your specific domain name:aws route53 get-query-logging-config --id [your query logging ID]Example output:{    "QueryLoggingConfig": {        "HostedZoneId": "Z11BNGDQEO95SY",        "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:745401294438:log-group:route53log:*",        "Id": "7d9a464b-b0b4-4493-afaf-1c33b1dd4a11"    }}3.    Delete query logging associated with your specific domain name:aws route53 delete-query-logging-config --id 7d9a464b-b0b4-4493-afaf-1c33b1dd4a11Note: After running the previous command, you won't receive a confirmation message indicating that the query logging was deleted. To confirm the deletion, check the Route 53 console.Delete DNS query logging for a specific domain using AWS Tools for PowerShell1.    Get information about Route 53 DNS query logging associated with a specific hosted zone created for a domain:PS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell> Get-R53QueryLoggingConfigList  -HostedZoneId  [your hosted zone ID]Id                                   HostedZoneId   CloudWatchLogsLogGroupArn--                                   ------------   -------------------------35ab59c0-4952-48ee-aa71-990f249c1abb Z11BNGDQEO95SY arn:aws:logs:us-east-1:745401294438:log-group:route53log:*2.    Using the query logging ID, get query logging information associated with your specific domain name:PS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell> Get-R53QueryLoggingConfig -Id 35ab59c0-4952-48ee-aa71-990f249c1abbId                                   HostedZoneId   CloudWatchLogsLogGroupArn--                                   ------------   -------------------------35ab59c0-4952-48ee-aa71-990f249c1abb Z11BNGDQEO95SY arn:aws:logs:us-east-1:745401294438:log-group:route53log:*3.    Delete query logging associated with your specific domain name:PS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell> Remove-R53QueryLoggingConfig -Id 35ab59c0-4952-48ee-aa71-990f249c1abbConfirmAre you sure you want to perform this action?Performing the operation "Remove-R53QueryLoggingConfig (DeleteQueryLoggingConfig)" on target "35ab59c0-4952-48ee-aa71-990f249c1abb".[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): YPS C:\Program Files (x86)\AWS Tools\PowerShell\AWSPowerShell>Related informationLogging DNS queriesStopping query logginglist-query-logging-configsdelete-query-logging-configAWS Tools for PowerShell - Amazon Route 53Follow"


Question: How do I troubleshoot email server issues on my EC2 Windows instance?

I can't send emails from my Amazon Elastic Compute Cloud (Amazon EC2) instance over Simple Mail Transfer Protocol (SMTP).

Answer: "I can't send emails from my Amazon Elastic Compute Cloud (Amazon EC2) instance over Simple Mail Transfer Protocol (SMTP).Short descriptionWhen you use SMTP to send email from your instance, you might encounter several common problems:Your security groups or network access control lists (network ACL) block SMTP traffic on ports 25, 587, or 465.Note: By default, outbound traffic is blocked on port 25 (SMTP) for all Amazon EC2 instances and AWS Lambda functions. To send outbound traffic on port 25, request the removal of this restriction. For more information, see How do I remove the restriction on port 25 from my Amazon EC2 instance or AWS Lambda function?The instance's public IP address changes after you stop and start the instance.Your outbound messages are flagged as spam.Emails aren't delivered to a specific domain.Outbound emails are delayed.You can't send emails even though you can receive them.ResolutionYour security groups or network ACLs block SMTP traffic on ports 25, 587, or 465To verify that traffic is blocked, use Test-NetConnection or the telnet utility to check for connectivity at the SMTP port.If traffic is blocked at the SMTP port, then make sure that the following configurations are correct:The security group outbound (egress) rules must allow traffic to the SMTP server on TCP port 25, 587, or 465.The network ACL outbound (egress) rules must allow traffic to the SMTP server on TCP port 25, 587, or 465.The network ACL inbound (ingress) rules must allow traffic from the SMTP server on TCP ports 1024-65535.The firewall and antivirus application on your Windows instance must allow traffic to the SMTP server on TCP port 25, 587, or 465.The EC2 instance must have internet connectivity.The instance's public IP address changes after you stop and start the instanceYour instance is automatically assigned a public IP address. However, this address changes whenever you stop and start the instance. To avoid this, make sure that the mail server instance has an Elastic IP address assigned to it.Your outbound messages are flagged as spamIf you're missing DKIM authentication, SPF records, or a reverse DNS record set, then your outbound messages might be flagged as spam. It's a best practice to set up these records to prevent outbound emails from being flagged as spam. For more information on reverse DNS records, see the following resources:Configurable reverse DNS for Amazon EC2's Elastic IP addressesHow do I activate reverse DNS functionality for Amazon Route 53 with a PTR record?How do I troubleshoot issues with the PTR record that I'm using for reverse DNS in Route 53?Emails aren't delivered to a specific domainIf you can't send emails to a specific domain, then follow these steps:Check whether the recipient domain is blocking your IP address.Make sure that your emails aren't too large for the destination to accept. Even if you don't have a size restriction on sent mail, the recipient might have limits on incoming mail size. The standard email size setting is 22 MB.Outbound emails are delayedIf your emails are delayed, then follow these steps:Check whether the delayed emails are going to one specific address or domain.Check your email server configuration to make sure that nothing has changed.Check whether the email queue is slow on your server, or if emails leave your server on time but are slow to arrive at the destination.If emails are stacking in the queue on your server, make sure that there aren't performance issues on your SMTP server.If the problem is at the destination, make sure that your emails aren't too large for the destination to accept. Even if you don't have a size restriction on sent mail, the recipient might have limits on incoming mail size. The standard email size setting is 22 MB.Use an email header analyzer tool to analyze the message header for diagnostic information.You can't send emails even though you can receive themThis issue occurs when you don't configure the authentication that the outgoing (SMTP) server requires.Follow"