Question: How can I reference a resource in another stack from an AWS CloudFormation template?

I want to reference a resource in another AWS CloudFormation stack when I create a template.

Answer: "I want to reference a resource in another AWS CloudFormation stack when I create a template.Short descriptionThe following resolution provides an example of one method to create a cross-stack reference. For additional instructions, see Walkthrough: Refer to resource outputs in another AWS CloudFormation stack.Note: To reference a resource in another AWS CloudFormation stack, you must first create cross-stack references. To create a cross-stack reference, use the export field to flag the value of a resource output for export. Then, use the Fn::ImportValue intrinsic function to import the value in any stack within the same AWS Region and account. AWS CloudFormation identifies exported values by the names specified in the template. These names must be unique to your AWS Region and account.ResolutionThe following steps show how to create an AWS CloudFormation stack named NetworkStack. This stack creates network-related resources and exports named ${AWS::StackName}-SecurityGroupID and ${AWS::StackName}-SubnetID. The ${AWS::StackName} is replaced by NetworkStack after stack creation. The final export names are NetworkStack-SecurityGroupID and NetworkStack-SubnetID.Create a stack to export output values1.    Create an AWS CloudFormation stack using this template.2.    Name the stack NetworkStack.Note: NetworkStack exports the subnet and security group values.Create an Amazon Elastic Compute Cloud (Amazon EC2) instance using an imported subnet and security group1.    Open the AWS CloudFormation console.2.    Choose Create Stack, and then choose Design template.3.    In the Parameters tab of the code editor, choose Template.4.    Copy and paste the following template into the code editor, and then update the template with appropriate values for InstanceType and ImageId:{  "Parameters": {    "NetworkStackParameter": {      "Type": "String"    }  },  "Resources": {    "WebServerInstance": {      "Type": "AWS::EC2::Instance",      "Properties": {        "InstanceType": "t2.micro",        "ImageId": "ami-a1b23456",        "NetworkInterfaces": [          {            "GroupSet": [              {                "Fn::ImportValue": {                  "Fn::Sub": "${NetworkStackParameter}-SecurityGroupID"                }              }            ],            "AssociatePublicIpAddress": "true",            "DeviceIndex": "0",            "DeleteOnTermination": "true",            "SubnetId": {              "Fn::ImportValue": {                "Fn::Sub": "${NetworkStackParameter}-SubnetID"              }            }          }        ]      }    }  }}Important: In the template in step 4, use the NetworkStack resource stack as the value for NetworkStackParameter. The NetworkStack value replaces the correct stack name in the corresponding Fn::ImportValue functions.Note: For examples of import and export templates, see Fn::ImportValue.5.    Choose the Create stack icon, and then choose Next.6.    For Stack name, enter a name for your stack.7.    For Parameters, enter the network stack name (NetworkStack) that you want to cross-reference.8.    Choose Next, choose Next again, and then choose Create.9.    After the stack creation is complete, open the Amazon EC2 console.10.    In the navigation pane, choose Instances, and then choose the instance that you created with the template in step 4.11.    Choose the Description view, and then verify that the security group and subnet are configured.Important: You can't delete the source stack or the source stack's export values while another stack is importing these values. To update the source stack's export values, first manually replace the actual values in the stacks that are importing the source stack's export values. Then, you can update the export values of the source stack.To list all stacks that are importing an exported output value, run the list-imports command. To list all exports in an AWS Region, use the AWS CloudFormation console or run the list-exports command. The export name must be unique for the account per AWS Region.Related informationHow do I use parameters in AWS Systems Manager Parameter Store to share values between CloudFormation stacks?AWS CloudFormation templatesAWS::EC2::InstanceFollow"


Question: How do I remove an AWS Backup Vault Lock?

I want to delete an AWS Backup Vault Lock for my backup vault.

Answer: "I want to delete an AWS Backup Vault Lock for my backup vault.ResolutionWhen you create a vault lock, you have a choice of two modes: governance or compliance mode. For more information on modes, see Vault lock modes.A vault lock with compliance mode has a grace time period. To delete a vault lock with compliance mode, you must delete the lock before the grace time expires. After the grace time is expired, the vault and its lock are immutable. No user or service can change it. If you try to delete the vault lock after the grace time period, you receive an InvalidRequestException error.To delete a vault lock with governance mode, you must have the appropriate AWS Identity and Access Management (IAM) permissions. The required IAM permission to delete a backup vault is backup:DeleteBackupVaultLockConfiguration.Delete a vault lock using the AWS Backup consoleTo delete a vault lock with governance mode or compliance mode (during grace time), complete the following steps:Open the AWS Backup console.In the navigation pane, under My account, choose Backup vaults. Then, choose Backup Vault Lock.Choose the vault lock you want to remove. Then, choose Manage vault lock.Choose Delete vault lock. A confirmation window appears.Enter confirm in the text box and then choose confirm.If the steps have been completed successfully, then a Success banner appears at the top of the console.Delete a vault lock programmaticallyTo delete your vault lock during grace time using an AWS Command Line Interface (AWS CLI) command, use DeleteBackupVaultLockConfiguration.The following is an example of the DeleteBackupVaultLockConfiguration command:Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.aws backup delete-backup-vault-lock-configuration \--backup-vault-name my_vault_to_lockImportant: Deleting the vault lock doesn't delete the backup vault or recovery point. You can delete the vault or recovery point after the lock is removed.Related informationEnhance the security posture of your backups with AWS Backup Vault LockVault lock removal during grace time (Compliance mode)Follow"


Question: Which log group is causing a sudden increase in my CloudWatch Logs bill?

"My Amazon CloudWatch Logs bill is unusually high, and I want to determine which log group is increasing my CloudWatch Logs costs."

Answer: "My Amazon CloudWatch Logs bill is unusually high, and I want to determine which log group is increasing my CloudWatch Logs costs.Short descriptionSudden increases in CloudWatch Logs bills often result from an increase in ingested or storage data in a particular log group. Use CloudWatch Logs metrics to check data usage, and review your AWS bill to identify the log group that's responsible for bill increases.ResolutionCheck the amount of data that you're ingestingThe IncomingBytes metric shows you the amount of ingested data in your CloudWatch log groups in near real time. This metric can help you to determine the following points:Which log group is the highest contributor towards your billWhether there's a spike in the incoming data to your log groups or a gradual increase due to new applicationsHow much data is pushed during a particular period of timeQuery a small set of log groups using the CloudWatch console1.    Open the Amazon CloudWatch console.2.    In the navigation pane, choose Metrics.3.    For each of your log groups, select the individual IncomingBytes metrics. Then, choose the Graphed metrics tab.4.    For Statistic, choose Sum.5.    For Period, choose 30 Days.6.    Choose the Graph options tab, and then choose Number.7.    At the top right of the graph, choose Custom, and then choose Absolute. Select a start and end date that corresponds with the last 30 days.Query a large set of log groups using the CloudWatch console1.    Open the Amazon CloudWatch console.2.    In the navigation pane, choose All metrics.3.    Choose the Graphed metrics tab. Then, from the Add metric dropdown list, choose Start with an empty expression.4.    Copy the following math expression, and then paste it into the Edit math expression field:SORT(REMOVE_EMPTY(SEARCH('{AWS/Logs,LogGroupName} MetricName="IncomingBytes"', 'Sum', 2592000)),SUM, DESC)After you paste the expression, choose Apply.5.    Choose the Graph options tab, and then choose Number.6.    At the top right of the graph, choose Custom. Then, choose Absolute. Select a start and end date that corresponds with the last 30 days.Note: You can graph up to 500 metrics using this method.Query a large set of log groups using an API callNote: Before you run the following API calls, review the associated costs with making API calls. It's a best practice to distribute the ListMetrics call to avoid throttling. The default limit for ListMetrics is 25 transactions per second. However, you can request a limit increase, if necessary.1.    Make a ListMetrics call. This call finds all log group names that ingested data in the past 14 days. Use the following parameters:Namespace: AWS/LogsMetricName: IncomingBytes2.    Make a GetMetricData call. This call finds the sum of all incoming bytes in a month for every log group name that you get from the ListMetrics call. Use the following parameters:Namespace: AWS/LogsMetricName: IncomingBytesDimensions: As received from the ListMetrics callStartTime: [Date and time 14 days before the current date]EndTime: [Current date and time]Period: [EndTime - StartTime, in seconds]Statistics: Sum3.    To display the log group names with the highest Ingested data amounts, sort the resulting data points in descending order.To be sure that ingested data charges don't exceed a specified limit in the future, create a CloudWatch alarm.Review your storage data usageCheck your most recent AWS bill to see how much storage data you used in the previous billing cycle.Related informationCloudWatch billing and costFollow"


Question: "How do I restore, resize, or create an EBS persistent storage snapshot in Amazon EKS for disaster recovery or when the EBS modification rate is exceeded?"

"I want to use an Amazon Elastic Block Store (Amazon EBS) persistent storage snapshot in Amazon Elastic Kubernetes Service (Amazon EKS) for disaster recovery. How do I create, resize, or restore such a snapshot? Or, I exceeded my Amazon EBS modification rate. But I still need to resize, restore, or create a snapshot of my Amazon EBS persistent storage in Amazon EKS."

Answer: "I want to use an Amazon Elastic Block Store (Amazon EBS) persistent storage snapshot in Amazon Elastic Kubernetes Service (Amazon EKS) for disaster recovery. How do I create, resize, or restore such a snapshot? Or, I exceeded my Amazon EBS modification rate. But I still need to resize, restore, or create a snapshot of my Amazon EBS persistent storage in Amazon EKS.Short descriptionYou're modifying your Amazon EBS persistent storage in Amazon EKS, and you receive the following error:errorCode: Client.VolumeModificationRateExceedederrorMessage: You've reached the maximum modification rate per volume limit. Wait at least 6 hours between modifications per EBS volumeAfter you modify a volume, you must wait at least six hours before you can continue to modify the volume. Make sure that the volume is in the in-use or available state before you modify it again.Your organization might have a Disaster Recovery (DR) objective with a Recovery Time Objective (RTO) that's less than six hours. For RTOs that are less than six hours, create a snapshot and restore your volume using the Amazon EBS Container Storage Interface (CSI) driver.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Use the Amazon EBS CSI driver and external snapshotter to do the following:Create an Amazon EBS snapshot of the PersistentVolumeClaim.Restore the PersistentVolumeClaim.Bind the PersistentVolumeClaim to the workload.Pre-requisites:An existing Amazon EKS cluster with worker nodes. If you don't have one, then create your Amazon EKS cluster.The latest versions of AWS CLI, eksctl, and kubectl.An Amazon EBS CSI driver AWS Identity and Access Management (IAM) role for service accounts.Install the Amazon EBS CSI driver with the external snapshotter1.    Check if you have an existing IAM OpenID Connect (OIDC) provider for your cluster:% cluster_name=ebs% oidc_id=$(aws eks describe-cluster --name cluster_name --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)% aws iam list-open-id-connect-providers | grep $oidc_idNote: Replace cluster_name with your cluster's name.Example output:"Arn": "arn:aws:iam::XXXXXXXXXX:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/B7E2BC2980D17C9A5A3889998CB22B23"Note: If you don't have an IAM OIDC provider, then create one for your cluster.2.    Install the external snapshotter.Note: You must install the external snapshotter before you install the Amazon EBS CSI add-on. Also, you must install the external snapshotter components in the following order:CustomResourceDefinition (CRD) for volumesnapshotclasses, volumesnapshots, and volumesnapshotcontentsmkdir crdcd crdwget https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/client/config/crd/kustomization.yamlwget https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/client/config/crd/snapshot.storage.k8s.io_volumesnapshotclasses.yamlwget https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/client/config/crd/snapshot.storage.k8s.io_volumesnapshotcontents.yamlwget https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/client/config/crd/snapshot.storage.k8s.io_volumesnapshots.yamlkubectl apply -k ../crdRBAC, such as ClusterRole, and ClusterRoleBindingkubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/deploy/kubernetes/snapshot-controller/rbac-snapshot-controller.yamlController deploymentkubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/master/deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml3.    Create your Amazon EBS CSI plugin IAM role using eksctl:eksctl create iamserviceaccount \  --name ebs-csi-controller-sa \  --namespace kube-system \  --cluster cluster_name \  --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \  --approve \  --role-only \  --role-name AmazonEKS_EBS_CSI_DriverRole4.    Add the Amazon EBS CSI add-on using eksctl:eksctl create addon --name aws-ebs-csi-driver --cluster cluster_name --service-account-role-arn arn:aws:iam::account_id:role/AmazonEKS_EBS_CSI_DriverRole --forceNote: Replace account_id with your AWS account ID.5.    Confirm that the Amazon EBS CSI driver and external snapshotter pods are running:% kubectl get pods -A | egrep "csi|snapshot"Create a StatefulSet with Amazon EBS persistent storage1.    Download the manifests from the GitHub website.2.    Create the StorageClass and VolumeSnapshotClass:% kubectl apply -f manifests/classes/Example output:volumesnapshotclass.snapshot.storage.k8s.io/csi-aws-vsc createdstorageclass.storage.k8s.io/ebs-sc created3.    Deploy the StatefulSet on your cluster along with the PersistentVolumeClaim:% kubectl apply -f manifests/app/Example output:service/cassandra createdStatefulSet.apps/cassandra created4.    Verify that the pods are in Running status:% kubectl get podsExample output:NAME         READY  STATUS   RESTARTS  AGEcassandra-0  1/1    Running  0         33mcassandra-1  1/1    Running  0         32mcassandra-2  1/1    Running  0         30m5.    Verify that the PersistenVolumeClaim is bound to your PersisentVolume:% kubectl get pvcExample output:NAME                                              STATUS  VOLUME                                    CAPACITY ACCESS MODES STORAGECLASS  AGEpersistentvolumeclaim/cassandra-data-cassandra-0  Bound   pvc-b3ab4971-37dd-48d8-9f59-8c64bb65b2c8  2Gi      RWO          ebs-sc        28mpersistentvolumeclaim/cassandra-data-cassandra-1  Bound   pvc-6d68170e-2e51-40f4-be52-430790684e51  2Gi      RWO          ebs-sc        28mpersistentvolumeclaim/cassandra-data-cassandra-2  Bound   pvc-d0403adb-1a6f-44b0-9e7f-a367ad7b7353  2Gi      RWO          ebs-sc        26m...Note: Note the names of each PersistentVolumeClaim to compare to the PersistentVolumeClaim names in the snapshot manifest.6.    To test the StatefulSet, write content to the PersistentVolumeClaim:for i in {0..2}; do kubectl exec "cassandra-$i" -- sh -c 'echo "$(hostname)" > /cassandra_data/data/file.txt'; doneCreate a snapshotThe persistentVolumeClaimName in the snapshot manifest must match the name of the PersistentVolumeClaim that you created for each pod in the StatefulSet. For example:apiVersion: snapshot.storage.k8s.io/v1kind: VolumeSnapshotmetadata:  name: cassandra-data-snapshot-0spec:  volumeSnapshotClassName: csi-aws-vsc  source:    persistentVolumeClaimName: cassandra-data-cassandra-01.    Create a snapshot from each PersistenVolumeClaim:% kubectl apply -f manifests/snapshot/Example output:volumesnapshot.snapshot.storage.k8s.io/cassandra-data-snapshot-0 createdvolumesnapshot.snapshot.storage.k8s.io/cassandra-data-snapshot-1 createdvolumesnapshot.snapshot.storage.k8s.io/cassandra-data-snapshot-2 created2.    After the state is completed, verify that the snapshots are available on the Amazon Elastic Compute Cloud (Amazon EC2) console:aws ec2 describe-snapshots --filters "Name=tag-key,Values=*ebs*" --query 'Snapshots[*].{VOL_ID:VolumeId,SnapshotID:SnapshotId,State:State,Size:VolumeSize,Name:[Tags[?Key==`Name`].Value] [0][0]}' --output table---------------------------------------------------------------------------------------------------------------------------------------|                                                          DescribeSnapshots                                                          |+------------------------------------------------------------+-------+-------------------------+------------+-------------------------+|                            Name                            | Size  |       SnapshotID        |   State    |         VOL_ID          |+------------------------------------------------------------+-------+-------------------------+------------+-------------------------+|  ebs-dynamic-snapshot-c6c9cb3c-2dab-4833-9124-40a0abde170d |  2    |  snap-057c5e2de3957d855 |  pending   |  vol-01edf53ee26a615f5  ||  ebs-dynamic-snapshot-1c1ad0c5-a93a-468f-ab54-576db5d630d4 |  2    |  snap-02bf49a3b78ebf194 |  completed |  vol-0289efe54525dca4a  ||  ebs-dynamic-snapshot-760c48e7-33ff-4b83-a6fb-6ef13b8d31b7 |  2    |  snap-0101c3d2efa40af19 |  completed |  vol-0fe68c9ac2f6375a4  |+------------------------------------------------------------+-------+-------------------------+------------+-------------------------+Restore the snapshotYou can restore a PersistentVolumeClaim from a snapshot that's created from an existing PersistentVolumeClaim using the same name of the PersistentVolumeClaim. When you recreate the StatefulSet, the PersistentVolumeClaim dynamically provisions a PersistentVolume and is automatically bound to the StatefulSet pods. The StatefulSet PersistenVolumeClaim name format is: PVC\_TEMPLATE\_NAME-STATEFULSET\_NAME-REPLICA\_INDEX.To restore a snapshot follow these steps:1.    Delete the existing StatefulSet workload:kubectl delete -f manifests/app/Cassandra_statefulset.yamlNote: Deleting the workload also deletes the StatefulSet pods. The snapshot that you created acts as a backup.Example output:statefulset.apps "cassandra" deleted2.    Forcefully delete the PersistentVolumeClaim:for i in {0..2}do  kubectl delete pvc cassandra-data-cassandra-$i --forcedoneNote: Deleting the PersistentVolumeClaim also deletes the PersistentVolume.3.    Restore the PersistentVolumeClaim from the snapshot using the same name of the PersistentVolumeClaim that you created:kubectl apply -f manifests/snapshot-restore/Example output:persistentvolumeclaim/cassandra-data-cassandra-0 createdpersistentvolumeclaim/cassandra-data-cassandra-1 createdpersistentvolumeclaim/cassandra-data-cassandra-2 created4.    Verify that each PersistentVolumeClaim is in Pending status:kubectl get pvcExample output:NAME                         STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGEcassandra-data-cassandra-0   Pending                                      ebs-sc         24scassandra-data-cassandra-1   Pending                                      ebs-sc         23scassandra-data-cassandra-2   Pending                                      ebs-sc         22s5.    Recreate the StatefulSet with the original manifest:kubectl apply -f manifests/app-restore/Note: To resize the storage, define the StatefulSet with a new storage size.Example output:StatefulSet.apps/cassandra created6.    Check the content of the Amazon EBS storage to confirm that the snapshot and restore work:for i in {0..2}; do kubectl exec "cassandra-$i" -- sh -c 'cat /cassandra_data/data/file.txt'; donecassandra-0cassandra-1cassandra-2Resize the PersistentVolumeClaimYou can modify the .spec.resources.requests.storage of the PersistentVolumeClaim to automatically reflect the size that you defined in the StatefulSet manifest:for i in {0..2}do  echo "Resizing cassandra-$i"  kubectl patch pvc cassandra-data-cassandra-$i -p '{ "spec": { "resources": { "requests": { "storage": "4Gi" }}}}'doneNote: 4Gi is an example storage size. Define a storage size that's suitable for your use case.Confirm that the new storage size is reflected on the Amazon EC2 console and in the pods:% aws ec2 describe-volumes --filters "Name=tag-key,Values=*pvc*" --query 'Volumes[*].{ID:VolumeId,Size:Size,Name:[Tags[?Key==`Name`].Value] [0][0]}' --output table-------------------------------------------------------------------------------------------|                                     DescribeVolumes                                     |+------------------------+--------------------------------------------------------+-------+|           ID           |                         Name                           | Size  |+------------------------+--------------------------------------------------------+-------+|  vol-01266a5f1f8453e06 |  ebs-dynamic-pvc-359a87f6-b584-49fa-8dd9-e724596b2b43  |  4    ||  vol-01b63a941450342d9 |  ebs-dynamic-pvc-bcc6f2cd-383d-429d-b75f-846e341d6ab2  |  4    ||  vol-041486ec92d4640af |  ebs-dynamic-pvc-fa99a595-84b7-49ad-b9c2-1be296e7f1ce  |  4    |+------------------------+--------------------------------------------------------+-------+% for i in {0..2}do  echo "Inspecting cassandra-$i"  kubectl exec -it cassandra-$i -- lsblk  kubectl exec -it cassandra-$i -- df -hdone...Run the following Kubectl commands to clean up your StatefulSetTo delete the resources that you created for your StatefulSet, run the following kubectl commands:app-restorekubectl delete -f manifests/app-restoresnapshot-restorekubectl delete -f manifests/snapshot-restoresnapshotkubectl delete -f manifests/snapshotclasseskubectl delete -f manifests/classesCassandrakubectl delete -f manifests/app/Cassandra_service.yamlRelated informationModifyVolumeFollow"


Question: How do I troubleshoot issues with my CloudFront distribution's connection to a custom origin over HTTPS?

"I configured my Amazon CloudFront distribution to connect to a custom origin using HTTPS. Now, I receive the "CloudFront could not connect to Origin" error with the HTTP status code 502 (Bad Gateway)."

Answer: "I configured my Amazon CloudFront distribution to connect to a custom origin using HTTPS. Now, I receive the "CloudFront could not connect to Origin" error with the HTTP status code 502 (Bad Gateway).ResolutionVerify that the CloudFront distribution's Origin Domain Name matches the certificate domain nameVerify that the Origin Domain Name specified on your CloudFront distribution matches a domain name on your origin SSL/TLS certificate. The distribution's Origin Domain Name can match either of the following:The domain name specified as the certificate's Common Name (CN)The domain name specified in the certificate's Subject Alternative Name (SAN)If the Origin Domain Name doesn't match any domain name associated with your certificate, then CloudFront returns the HTTP status code 502 (Bad Gateway).Check for any missing intermediary certificate authoritiesUse an SSL checker to test whether your origin's certificate chain is available and doesn't need any intermediary certificate authorities.If you're using Elastic Load Balancing as your custom origin and must update the certificate chain, then do the following:Upload the certificate again with the correct certificate chain.-or-Use AWS Certificate Manager (ACM) to request a public certificate that secures your domain. ACM is fully integrated with Elastic Load Balancing.Test your origin's supported protocol policy and ciphersFor the SSL handshake to succeed, your origin must support the ciphers that CloudFront uses.If your origin protocol policy has SSLv3 turned on, then CloudFront uses only SSLv3 to communicate to your origin from the command line or Windows terminal.Note: OpenSSL is usually available by default on Linux and macOS systems. OpenSSL for Windows is available on the OpenSSL website.To test if your origin supports the ciphers that CloudFront uses, run the following OpenSSL commands.If your origin protocol policy is set to SSLv3, then run:echo | openssl s_client -ssl3 -cipher 'ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES256-SHA AES128-SHA DES-CBC3-SHA RC4-MD5 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA' -connect your.origin.domain:443If your origin is using TLS, then test your origin for each protocol using these commands:For TLS, run:echo | openssl s_client -tls1 -cipher 'ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES256-SHA AES128-SHA DES-CBC3-SHA RC4-MD5 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA' -connect your.origin.domain:443 -servername your.origin.domainFor TLS 1.1, run:echo | openssl s_client -tls1_1 -cipher 'ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA AES256-SHA AES128-SHA DES-CBC3-SHA RC4-MD5 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA' -connect your.origin.domain:443 -servername your.origin.domainFor TLS 1.2, run:echo | openssl s_client -tls1_2 -cipher 'ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 AES256-SHA AES128-SHA DES-CBC3-SHA RC4-MD5 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA' -connect your.origin.domain:443 -servername your.origin.domainNote: Set the value of -servername to the origin domain name. Or, if you're using CloudFront to forward the Host header, set -servername to the CNAME from the CloudFront request.If you successfully connect to the origin, then you see output from the preceding commands that's similar to the following. The output confirms that your connection is successfully established using the SSL or TLS version and supported ciphers.New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA256Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session:Protocol : TLSv1.2Cipher : ECDHE-RSA-AES128-SHA256....Timeout : 7200 (sec)Verify return code: 0 (ok)----DONENote: For more troubleshooting guidance on 502 errors, see HTTP 502 status code (Bad Gateway).Related informationRequiring HTTPS for communication between CloudFront and your custom originFollow"


Question: How can I configure my EC2 Spot Instances so that the root EBS volume won’t be deleted when I terminate the instance?

I want to configure my Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances so that the root Amazon Elastic Block Store (Amazon EBS) volume isn't deleted when I terminate the instance.

Answer: "I want to configure my Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances so that the root Amazon Elastic Block Store (Amazon EBS) volume isn't deleted when I terminate the instance.ResolutionBy default, when EC2 Spot Instances are terminated, all EBS volumes attached to that instance are deleted because the DeleteOnTermination attribute is set to true.To change the DeleteOnTermination attribute for a new Spot requestOpen the Amazon EC2 console, and then choose Spot Requests from the navigation pane.Choose Request Spot Instances.Choose an Availability Zone, and then choose Next.In EBS volumes, clear Delete.After you clear the Delete box, finish creating your Spot request. Any new instances that are launched when this Spot request is fulfilled will have DeleteOnTermination set to false.Note: EBS volumes with DeleteOnTermination set to false incur charges and remain in your EBS volume console. You must manually delete the volume. For more information, see Amazon EBS pricing.To change the DeleteOnTermination attribute for a running Spot InstanceUse the modify-instance-attribute command in the AWS Command Line Interface (AWS CLI) to configure the root EBS volume to persist on termination.Related informationSpot InstancesFollow"


Question: "What are the least privileges required for a user to perform creates, deletes, modifications, backup, and recovery for an Amazon RDS DB instance?"

I want to limit the access that I give my AWS Identity and Access Management (IAM) users to an Amazon Relational Database Service (Amazon RDS) DB instance. How can I grant IAM users the least privileges required to perform a specific action for an Amazon RDS DB instance?

Answer: "I want to limit the access that I give my AWS Identity and Access Management (IAM) users to an Amazon Relational Database Service (Amazon RDS) DB instance. How can I grant IAM users the least privileges required to perform a specific action for an Amazon RDS DB instance?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.1.    Open the IAM console, and then choose Users from the navigation pane.2.    Choose Add user, and then enter a User name.3.    For Access type, choose AWS Management Console access, and then  create a password for using the Amazon RDS console. To provide access to the AWS Command Line Interface (AWS CLI), choose Programmatic access.Important: For Programmatic access, be sure to download the access key ID and the secret access key by choosing Download.csv. You need the keys to create the security tokens later.4.    Review the permissions and tags, and then choose Create user. This creates an IAM user with the IAMUserChangePassword policy.5.    Create IAM policies for the actions that you want to perform in Amazon RDS.6.    Return to the IAM console, and then  choose Users from the navigation pane.7.    Choose the IAM user that you created.8.    From the Permissions tab, choose Add inline policy.9.    Choose the JSON tab, and then  enter one or more of the following policies based on your use case.Note: The following policies provide the least privileges required to perform the specified actions. You might see errors (such as IAMUser is not authorized to perform: rds:Action) in the Amazon RDS console because this privilege isn't present in the policy. Most often, this error occurs for Describe actions. The error is expected, and it doesn't affect your ability to perform those actions. To avoid this error, you can modify the following example IAM policies, or you can perform actions by using the AWS CLI.Creating and deleting RDS DB instancesThe following policy allows users to create RDS DB instances without encryption activated:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:DescribeVpcAttribute",        "ec2:DescribeSecurityGroups",        "ec2:DescribeInternetGateways",        "ec2:DescribeAvailabilityZones",        "ec2:DescribeVpcs",        "ec2:DescribeAccountAttributes",        "ec2:DescribeSubnets",        "rds:Describe*",        "rds:ListTagsForResource",        "rds:CreateDBInstance",        "rds:CreateDBSubnetGroup"      ],      "Resource": "*"    }  ]}The following policy allows users to create RDS DB instances with encryption activated:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:DescribeVpcAttribute",        "ec2:DescribeSecurityGroups",        "ec2:DescribeInternetGateways",        "ec2:DescribeAvailabilityZones",        "ec2:DescribeVpcs",        "ec2:DescribeAccountAttributes",        "ec2:DescribeSubnets",        "rds:Describe*",        "rds:ListTagsForResource",        "rds:CreateDBInstance",        "rds:CreateDBSubnetGroup",        "kms:ListAliases"      ],      "Resource": "*"    }  ]}Note: To use a customer managed key for encryption instead of the default AWS managed key, you must authorize the use of a customer managed key.The following policy allows users to delete RDS DB instances:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "rds:DeleteDBInstance",        "rds:DescribeDBInstances"      ],      "Resource": "*"    }  ]}The following policy allows users to create and delete RDS DB instances:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:DescribeVpcAttribute",        "ec2:DescribeSecurityGroups",        "ec2:DescribeInternetGateways",        "ec2:DescribeAvailabilityZones",        "ec2:DescribeVpcs",        "ec2:DescribeAccountAttributes",        "ec2:DescribeSubnets",        "rds:Describe*",        "rds:ListTagsForResource",        "rds:CreateDBInstance",        "rds:CreateDBSubnetGroup",        "rds:DeleteDBInstance"      ],      "Resource": "*"    }  ]}Stopping and starting RDS DB instancesThe following policy allows users to stop and start RDS DB instances:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "rds:StopDBInstance",        "rds:StartDBInstance",        "rds:Describe*"      ],      "Resource": "*"    }  ]}Performing backup and recovery (creating DB snapshots, restoring DB instance from DB snapshots, and point in time restore)The following policy allows users to create DB snapshots:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "rds:Describe*",        "rds:CreateDBSnapshot"      ],      "Resource": "*"    }  ]}The following policy allows users to restore RDS DB instances using DB snapshots:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:Describe*",        "rds:Describe*",        "rds:RestoreDBInstanceFromDBSnapshot"      ],      "Resource": "*"    }  ]}The following policy allows users to perform point in time recovery:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:Describe*",        "rds:Describe*",        "rds:RestoreDBInstanceToPointInTime"      ],      "Resource": "*"    }  ]}Modifying RDS DB instancesThe following policy allows users to change DB instance class type, allocated storage, storage type, and instance version:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:Describe*",        "rds:Describe*",        "rds:ModifyDBInstance"      ],      "Resource": "*"    }  ]}Activating Enhanced Monitoring and Performance InsightsThe following policy allows users to activate Enhanced Monitoring. Be sure to replace AccountID with each account that is receiving the enhanced monitoring role:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "iam:GetRole",        "iam:ListRoles",        "rds:ModifyDBInstance",        "rds:Describe*",        "ec2:Describe*"      ],      "Resource": "*"    },    {      "Effect": "Allow",      "Action": [        "iam:PassRole"      ],      "Resource": "arn:aws:iam::AccountID:role/rds-monitoring-role"    }  ]}Note: When used with an iam:PassRole, a wildcard (*) is overly permissive because it allows iam:PassRole permissions on all resources. Therefore, it's a best practice to specify the Amazon Resource Names (ARNs), as shown in the example earlier.The following policy allows users to activate Performance Insights:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "rds:ModifyDBInstance",        "ec2:Describe*",        "rds:Describe*",        "pi:*"      ],      "Resource": "*"    }  ]}Creating, modifying, and deleting DB parameter groups and DB option groupsThe following policy allows users to create, modify, or delete DB parameter groups and option groups:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "ec2:Describe*",        "rds:Describe*",        "rds:CreateDBParameterGroup",        "rds:ModifyDBParameterGroup",        "rds:DeleteDBParameterGroup",        "rds:CreateOptionGroup",        "rds:ModifyOptionGroup",        "rds:DeleteOptionGroup"      ],      "Resource": "*"    }  ]}Viewing Amazon CloudWatch metrics from the Amazon RDS consoleThe following policy allows users to view CloudWatch metrics from the Amazon RDS console:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "rds:Describe*",        "cloudwatch:GetMetricData",        "cloudwatch:GetMetricStatistics"      ],      "Resource": "*"    }  ]}10.    Choose Review policy.11.    Enter a Name for your policy, and then choose Create policy.Related informationIdentity and access management for Amazon RDSHow do I allow users to authenticate to an Amazon RDS MySQL DB instance using their IAM credentials?Follow"


Question: Why is my Elastic Beanstalk environment in the invalid state?

I want to troubleshoot the error "Environment is in an invalid state for this operation. Must be ready" while in an AWS Elastic Beanstalk environment.

Answer: "I want to troubleshoot the error "Environment is in an invalid state for this operation. Must be ready" while in an AWS Elastic Beanstalk environment.Short descriptionWhen you receive this error, make sure that there is no ongoing operation in the environment. If there is an ongoing operation, then you must either wait for the update to complete or cancel the in-progress updates according to your requirements. You can start your updates over when the environment becomes ready again. If there is no ongoing operation in the environment and you are still receiving the error, then your environment might be in an Unrecoverable state. This state prevents further operations from being performed in the environment. If you need further help returning the environment to the Available state, contact AWS Support. However, there are things you can check before you contact AWS Support.ResolutionElastic Beanstalk creates an AWS CloudFormation stack in the backend to manage the resources associated with the environment. You can check this stack in the CloudFormation console with the name awseb-(env-ID)-stack.When the Elastic Beanstalk environment goes into anUnrecoverable state, the CloudFormation stack shows a *_FAILED status. Before the AWS Support team can change the environment to Available, the stack must show a *_COMPLETE status.To correct the *_FAILED status of your CloudFormation stack, do the following steps according to the stack status:"UPDATE_ROLLBACK_FAILED" status1.    Navigate to the CloudFormation console. Then, identify the resource that failed to update during the rollback from the respective stack events.2.    Bring the stack to the UPDATE_ROLLBACK_COMPLETE status by selecting the Continue Update Rollback option from the CloudFormation console.3.    In the Continue update rollback dialog box, expand Advanced troubleshooting. In the Resources to skip - optional section, select the resource that failed to update.4.    Choose Continue update rollback. The stack now shows the UPDATE_ROLLBACK_COMPLETE status.5.    Contact the AWS Support team to change the environment to an Available state.6.    When the environment is in Available status, you can perform further updates on the environment."DELETE_FAILED" status1.    Navigate to the CloudFormation console. Then identify the resource that failed to delete from the respective stack events.2.    Manually delete the resource that failed to delete. For example, if the resource that failed to delete is a security group, then delete it from the Amazon Elastic Compute Cloud (Amazon EC2) console.3.    Delete the CloudFormation stack from the CloudFormation console. The stack now shows a DELETE_COMPLETE status.4.    Contact the Elastic Beanstalk support team to change the environment to an Available state.5.    When the environment is the Available state, you can rebuild or terminate the environment."CREATE_FAILED" statusIf your stack has this status, it's a best practice to create a new Elastic Beanstalk environmen, and then terminate the current one. This is because the state of the stack isn't stable enough perform a rollback. It's a best practice to not perform further updates on the current environment.Before terminating the current environment, try the following:Leverage saved configurations if you want to have similar configurations for your new environment.Perform blue/green deployments and when the new environment is working correctly, perform the CNAME Swap between the URLs of the two environments.Follow"


Question: How do I troubleshoot call failures from an Amazon Connect instance?

My Amazon Connect instance is producing inbound and outbound Call failure errors.

Answer: "My Amazon Connect instance is producing inbound and outbound Call failure errors.ResolutionTo troubleshoot inbound Call failure errors from an Amazon Connect instanceConfirm that the number on the instance is attached to a contact flow by doing the following:In the Amazon Connect console, choose Routing.Choose Phone Numbers.Choose Phone Number, and then verify that the number generating the error is assigned to a published contact flow.Note: The MisconfiguredPhoneNumbers metric shows the number of failed calls because the phone number isn’t associated with a flow.Confirm that the Allow incoming calls check box is selected in your instance's Telephony Options page settings. Fore instructions, see step 4 in Step 2: Create an instance.Confirm that the instance isn't over its concurrent call quota by doing the following:In the Amazon CloudWatch console, choose Metrics from the left sidebar.From list of services, choose Connect.Locate the instance ID that's generating the error.Check the CallsBreachingActiveCallsQuota metric box next to the instance ID.If the CallsBreachingActiveCallsQuota metric populates, then the concurrent active call limit is breached.Note: To see the number of calls that are rejected because the rate of calls per second exceeds your concurrent call quota, review the following metrics:CallsPerIntervalThrottledCalls-or-If you're unsure about the percentage of your instance's concurrent call quota being exhausted, then do the following:Check the concurrent calls percentage metric box.Confirm that the concurrent calls percentage is below 1%.The concurrent calls percentage metric ranges from 0-1. 1 means that the active calls limit is 100% used.For more information, see Monitoring your instance using CloudWatch.Note: The default concurrent calls quota is 10. To increase your instance’s concurrent calls quota, use the Amazon Connect service quotas increase form. You must sign in to your AWS account to access the form. Amazon Connect might lower these default limits to prevent fraud or malicious use.Confirm that the Call failure error isn't on the source telecom-carrier side by doing the following:Call the number that's generating the error using different telecom carriers.If the number is reachable from one carrier, but not another, then the issue is on the source carrier's side.To troubleshoot outbound Call failure errors from an Amazon Connect instanceConfirm that the country code of the number generating the error message is on the Countries you can call by default list .Note: To allow calling to additional countries, submit a service quota increase request. You must sign in to your AWS account to access the form. The countries listed in the default Contact Control Panel (CCP) are the countries that are allowed for your Connect instance.Confirm that the number dialed is in E.164 format on Wikipedia.Note: Make sure to remove any leading and trailing digits. For example, you must remove the "0" long-distance code that often appears before the United Kingdom's country code.Confirm that the Allow outgoing calls check box is selected in your instance's Telephony Options page settings. Fore instructions, see step 4 in Step 2: Create an instance.Confirm that the instance isn't over its concurrent call quota. (See step 3 of the To troubleshoot inbound Call failure errors from an Amazon Connect Instance section of this article.)Confirm that the user has the permission CCP: Outbound in their security profile.Confirm that the Outbound Queue has the Outbound caller ID number configured in the Outbound caller configuration. Confirm that the Call failure error isn't on the destination number's side by doing the following:Call the number that's generating the error using a number outside of Amazon Connect.If the destination number can’t be reached outside of Amazon Connect, then the issue is on the destination number’s side.Related informationUse CloudWatch metrics to calculate concurrent call quotaFollow"


Question: How do I resolve the error "Failed to receive X resource signal(s) within the specified duration" in AWS CloudFormation?

"In AWS CloudFormation, I receive the following error message: "Failed to receive X resource signal(s) within the specified duration." How can I resolve this error?"

Answer: "In AWS CloudFormation, I receive the following error message: "Failed to receive X resource signal(s) within the specified duration." How can I resolve this error?Short descriptionYou get this error when an Amazon Elastic Compute Cloud (Amazon EC2) instance, Auto Scaling group, or a WaitCondition doesn't receive success signals from one or more instances in the time period specified by the CreationPolicy attribute.This error can occur in one of the following scenarios:Scenario 1: The cfn-signal script isn't installed on one or more instances of the AWS CloudFormation stack.Scenario 2: There are syntax errors or incorrect values in the AWS CloudFormation template.Scenario 3: The value of the Timeout property for the CreationPolicy attribute is too low.Scenario 4: The cfn-signal isn't sent from the Amazon EC2 instance.Note: The troubleshooting scenarios for this error apply only to AWS CloudFormation stacks created with Linux instances. The scenarios don't apply to Windows instances. For more information, see How to troubleshoot stack creating issues.ResolutionBefore following the steps in the troubleshooting scenarios, set the Rollback on failure option for your AWS CloudFormation stack to No.Scenario 1: The cfn-signal script isn't installed on one or more instances of the AWS CloudFormation stackTo confirm that the cfn-signal script is installed on the instance that is configured to send signals to AWS CloudFormation resources, complete the following steps:1.    Connect to your Linux instance using SSH.2.    Confirm that the cfn-signal script is installed using either of the following commands.To confirm that the cfn-signal script is located in your directory, run the following command:$ sudo find / -name cfn-signal/opt/aws/bin/cfn-signal/opt/aws/apitools/cfn-init-1.4-30.amzn2/bin/cfn-signalTo confirm that the AWS CloudFormation helper scripts package that contains the cfn-signal script is installed, run the following command:$ sudo rpm -q aws-cfn-bootstrapaws-cfn-bootstrap-1.4-30.amzn2.noarchImportant: The preceding command works only on distributions that use the RPM Package Manager.Note: By default, AWS CloudFormation helper scripts are installed on Amazon Linux Amazon Machine Images (AMIs). If AWS CloudFormation helper scripts aren't installed, see CloudFormation helper scripts reference for installation instructions.Scenario 2: There are syntax errors or incorrect values in the AWS CloudFormation templateTo confirm that the UserData property is configured to signal the AWS CloudFormation resources specified by the CreationPolicy attribute, complete the following steps:1.    In a code editor, open the AWS CloudFormation template for your stack, and then find the UserData property section.2.    Check for errors, including syntax errors, missing spaces, misspellings, and other typos.3.    Confirm that the values for the stack, resource, and Region properties are correct.Note: If you use a bootstrap script that includes the UserData property and calls the cfn-signal script, then check the bootstrap script for syntax errors or incorrect values.If you signal within the cfn-init commands key, look for information about the signal in the cfn-init logs. To search for errors in the cloud-init logs or cfn-init logs, connect to your Amazon EC2 instance using SSH. Then, look for detailed error or failure messages by searching for the keyword "error" or "failure" in the following logs:/var/log/cloud-init-output.log/var/log/cloud-init.log/var/log/cfn-init.log/var/log/cfn-init-cmd.log/var/log/cfn-wire.logTo parse all instances of the words "error" or "failure" in any /var/log/cfn or /var/log/cloud-init files, run the following command:grep -ni 'error\|failure' $(sudo find /var/log -name cfn\* -or -name cloud-init\*)Note: The preceding command returns the file name, line number, and error message.Scenario 3: The value of the Timeout property for the CreationPolicy attribute is too lowThe value of the Timeout property is defined by the CreationPolicy attribute. To confirm that the value is high enough for tasks to run before the cfn-signal script sends signals to AWS CloudFormation resources, complete the following steps.Important: The following steps work only if the instance isn't terminated (for example, by an Auto Scaling group). You already set the Rollback on failure option of your AWS CloudFormation stack to No. This option means that there is no failure rollback, and the instance won't be terminated until you delete the stack. You can connect to the instance using SSH, and then continue with the following troubleshooting steps.1.    In a code editor, open the AWS CloudFormation template for your stack, and then find the value of the Timeout property.Note: The value of the Timeout property is the maximum amount of time AWS CloudFormation waits for a signal before returning an error.2.    To get an estimate of when the cfn-signal script is triggered, connect to the instance using SSH, and then run the following command:less /var/log/cfn-init.logThe log file shows a timestamp when the SUCCESS signal is sent to AWS CloudFormation resources. See the following example:2019-01-11 12:46:40,101 [DEBUG] Signaling resource EC2Instance in stack XXXX with unique ID i-045a536a3dfc8ccad and status SUCCESS3.    Open the AWS CloudFormation console.4.    To see the resource failure timestamp for the "Failed to receive X resource signal(s) within the specified duration" event, choose the Events view.5.    For Status Reason, expand the row for the event with the status reason "Failed to receive X resource signal(s) within the specified duration."6.    Compare the signaling timestamp to the resource failure timestamp.Note: Notice that the signal was sent after the Amazon EC2 resource failed to be created. The signal is sent before the Amazon EC2 resource is created or fails to be created.Scenario 4: The cfn-signal isn't sent from the Amazon EC2 instanceThe SignalResource API is useful when you want to send signals from anywhere other than from an Amazon EC2 instance.For example, you can use an AWS Lambda function to call the SignalResource API and then send the signal to the AWS CloudFormation stack. In such a scenario, check your Lambda logs with Amazon CloudWatch Logs. These logs help you figure out why the signal isn't sent to the AWS CloudFormation stack.Follow"


Question: What are best practices for migrating my ElastiCache for Redis cluster?

What best practices should I use when migrating my Amazon ElastiCache for Redis cluster?

Answer: "What best practices should I use when migrating my Amazon ElastiCache for Redis cluster?Short descriptionAmazon ElastiCache currently supports offline methods using backup to migrate an ElastiCache Redis cluster within a Region, across Regions in the same account, or across accounts.Note: For information on migrating a Redis cluster on an Amazon Elastic Compute Cloud (Amazon EC2) instance to ElastiCache, see Online migration to ElastiCache.ResolutionMigrate an ElastiCache Redis cluster within a Region1.    Create an ElastiCache backup of your ElastiCache for Redis cluster. Review the backup constraints before creating your backup.2.    Creating a new Redis cluster by restoring for the backup.Note: This method can be used to migrate an ElastiCache for Redis cluster to a different Availability Zone within a Region. Or, you can use it to turn on in-transit encryption or at-rest encryption for an existing cluster.Migrate an ElastiCache Redis cluster to a different Region1.    Create an ElastiCache backup of your ElastiCache for Redis cluster. Review the backup constraints before creating your backup.2.    Create an Amazon Simple Storage Service (S3) bucket in the same AWS Region as the Redis cluster.3.    Grant ElastiCache access to the S3 bucket.4.    Export the ElastiCache Backup to the S3 bucket.5.    Create anS3 bucket in your destination Region.6.    Install and configure the AWS Command Line Interface (AWS CLI).Configure the AWS CLI by running the following command:aws configureEnter access keys (access key ID and secret access key) of your AWS Identity and Access Management (IAM) user or role.7.    Use the AWS CLI to copy the .rdb backup file from the source Region's S3 bucket to the destination Region's S3 bucket:aws s3 cp s3://SourceBucketName/BackupName.rdb  s3://DestinationBucketName/BackupName.rdb --acl bucket-owner-full-control   --source-region SourceRegionName --region DestinationRegionName8.    In the destination Region, go to the Amazon S3 console and grant ElastiCache read access to the .rdb file.9.    Create an ElastiCache for Redis cluster by seeding the cluster with the .rdb file.Migrate an ElastiCache Redis cluster to a different account1.    Create a backup of your cluster. Review the backup constraints before creating your backup.2.    Create an Amazon S3 bucket in the same AWS Region as the Redis cluster.3.    Grant ElastiCache access to the S3 bucket.4.    Export the ElastiCache backup to the S3 bucket.5.    Create an S3 bucket in your destination account. The bucket must be in the same Region as the Redis cluster.6.    Install and configure the AWS Command Line Interface (AWS CLI).Configure the AWS CLI by running the following command:aws configureEnter access keys (access key ID and secret access key) of your source account's AWS Identity and Access Management (IAM) user or role.7.    Copy the .rdb backup file from the source account's S3 bucket to the destination account's S3 bucket.Note: If the source and destination Regions are different, copy the .rdb file using the following command:aws s3 cp s3://SourceAccountBucketName/BackupName.rdb  s3://DestinationAccountBucketName/BackupName.rdb --acl bucket-owner-full-control  --source-region SourceRegionName --region DestinationRegionName8.    In the destination account, open the Amazon S3 console and grant ElastiCache read access to the .rdb file.9.    Create an ElastiCache for Redis cluster by seeding the cluster with the .rdb file.Follow"


Question: Why am I receiving the error "Your requested instance type is not supported in your requested Availability Zone" when launching an EC2 instance?

I received the error message "Your requested instance type is not supported in your requested Availability Zone" when launching an Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I determine which Availability Zone to use?

Answer: "I received the error message "Your requested instance type is not supported in your requested Availability Zone" when launching an Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I determine which Availability Zone to use?Short descriptionSome Availability Zones don't support particular instance types. If you receive the error "Your requested instance type is not supported in your requested Availability Zone," do the following:Determine which Availability Zones support your instance type.Retry the request and specify an Availability Zone that supports your chosen instance type. Or, submit the request without specifying an Availability Zone.Note: This error is different from an insufficient instance capacity error. For information on insufficient capacity errors, see Insufficient instance capacity.ResolutionDetermine which Availability Zones support your instance typeFrom the Amazon EC2 console:Open the Amazon EC2 console.Choose the Region where you want to launch the instance.Select Instance Types.For Filter instance types, enter your preferred instance type.Select your preferred instance type.Under Networking, review the Availability Zones listed under Availability Zones.From the AWS Command Line Interface (AWS CLI):Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Use the describe-instance-type-offerings command and include filters for the Availability Zone and the instance type you want to launch. Add additional filters as needed. The following example command filters the search results by Availability Zone, instance type, and Region. For more information on the describe-instance-type-offerings command, see describe-instance-type-offerings in the AWS CLI Command Reference.# aws ec2 describe-instance-type-offerings --location-type availability-zone  --filters Name=instance-type,Values=c5.xlarge --region af-south-1 --output tableNote: Availability Zone names might not map to the same location across accounts. For more information, see Availability Zones. Use the location-type availability-zone-id command to have the output list Availability Zone IDs. You can use the Availability Zone ID to validate the Availability Zone mapping on your account.Retry the requestWhen launching the instance, choose a supported Availability Zone during instance launch. You can launch an instance to an Availability Zone using the old launch wizard, new launch wizard, or using AWS CLI. Or, don't specify an Availability Zone in your request. If you don't specify an Availability Zone, Amazon EC2 chooses an Availability Zone for you that supports your instance type.Follow"


Question: How do I troubleshoot data loading errors while using the COPY command in Amazon Redshift?

"I tried to use the COPY command to load a flat file. However, I'm experiencing data loading issues or errors in Amazon Redshift. How do I troubleshoot this?"

Answer: "I tried to use the COPY command to load a flat file. However, I'm experiencing data loading issues or errors in Amazon Redshift. How do I troubleshoot this?Short descriptionUse the STL_LOAD_ERRORS table to identify any data loading errors that occur during a flat file load. The STL_LOAD_ERRORS table can help you track the progress of a data load, recording any failures or errors along the way. After you troubleshoot the identified issue, reload the data in the flat file while using the COPY command.Tip: If you're using the COPY command to load a flat file in Parquet format, you can also use the SVL_S3LOG table. The SVL_S3LOG table can be used to identify any data loading errors.ResolutionNote: The following steps use an example dataset of cities and venues.1.    Check the data in your sample flat file to confirm that the source data is valid.For example:7|BMO Field|Toronto|ON|016|TD Garden|Boston|MA|023|The Palace of Auburn Hills|Auburn Hills|MI|028|American Airlines Arena|Miami|FL|037|Staples Center|Los Angeles|CA|042|FedExForum|Memphis|TN|052|PNC Arena|Raleigh|NC  ,25   |059|Scotiabank Saddledome|Calgary|AB|066|SAP Center|San Jose|CA|073|Heinz Field|Pittsburgh|PA|65050In this example demo.txt file, five fields are used, separated by a pipe character. For more information, see Load LISTING from a pipe-delimited file (default delimiter).2.    Open the Amazon Redshift console.3.    Create a sample table using the following DDL:CREATE TABLE VENUE1(VENUEID SMALLINT,VENUENAME VARCHAR(100),VENUECITY VARCHAR(30),VENUESTATE CHAR(2),VENUESEATS INTEGER) DISTSTYLE EVEN;4.    Create a view to preview the relevant columns from the STL_LOAD_ERRORS table:create view loadview as(select distinct tbl, trim(name) as table_name, query, starttime,trim(filename) as input, line_number, colname, err_code,trim(err_reason) as reasonfrom stl_load_errors sl, stv_tbl_perm spwhere sl.tbl = sp.id);This view can help you identify the cause of the data loading error.5.    Use the COPY command to load the data:copy Demofrom 's3://your_S3_bucket/venue/'iam_role 'arn:aws:iam::123456789012:role/redshiftcopyfroms3'delimiter '|' ;Note: Replace your_S3_bucket with the name of your S3 bucket. Then, replace arn:aws:iam::123456789012:role/redshiftcopyfroms3 with the Amazon Resource Name (ARN) for your AWS Identity and Access Management (IAM) role. This IAM role must be able to access data from your S3 bucket. For more information, see Parameters.6.    Query the load view to display and review the error load details of the table:testdb=# select * from loadview where table_name='venue1';tbl | 265190table_name | venue1query | 5790starttime | 2017-07-03 11:54:22.864584input | s3://your_S3_bucket/venue/venue_pipe0000_part_00line_number | 7colname | venuestateerr_code | 1204reason | Char length exceeds DDL lengthIn this example, the exception is caused by the length value, which must be added to the venuestate column. The (NC ,25 |) value is longer than the length defined in the VENUESTATE CHAR(2) DDL.You can resolve this exception in two different ways:If the data is expected to exceed the defined length of the column, then review and update the table definition to modify the column length.-or-If the data isn't properly formatted or transformed, then modify the data in file to use the correct value.The output from this query includes the following important information:The file causing the error.The column causing the error.The line number in the input file.The reason for the exception.7.    Modify the data in your load file to use the correct values (the length must align with the defined column length):7|BMO Field|Toronto|ON|016|TD Garden|Boston|MA|023|The Palace of Auburn Hills|Auburn Hills|MI|028|American Airlines Arena|Miami|FL|037|Staples Center|Los Angeles|CA|042|FedExForum|Memphis|TN|052|PNC Arena|Raleigh|NC|059|Scotiabank Saddledome|Calgary|AB|066|SAP Center|San Jose|CA|073|Heinz Field|Pittsburgh|PA|650508.    Reload the data load:testdb=# copy Demofrom 's3://your_S3_bucket/sales/'iam_role 'arn:aws:iam::123456789012:role/redshiftcopyfroms3' delimiter '|' ;INFO:  Load into table 'venue1' completed, 808 record(s) loaded successfully.Note: The STL_LOAD_ERRORS table can hold only a limited amount of logs (typically for around 4 to 5 days). Also, standard users can view only their own data when querying the STL_LOAD_ERRORS table. To view all the table data, you must be a superuser.Related informationAmazon Redshift best practices for designing tablesAmazon Redshift best practices for loading dataSystem tables for troubleshooting data loadsWorking with recommendations from Amazon Redshift AdvisorFollow"


Question: What are some use cases for using an object ACL in Amazon S3?

I want to delegate access to my Amazon Simple Storage Service (Amazon S3) objects using an access control list (ACL). What are some use cases for using an object or bucket ACL?

Answer: "I want to delegate access to my Amazon Simple Storage Service (Amazon S3) objects using an access control list (ACL). What are some use cases for using an object or bucket ACL?ResolutionAmazon S3 access control lists (ACLs) enable you to manage access to S3 buckets and objects. Every S3 bucket and object has an ACL attached to it as a subresource. The ACLs define which AWS accounts or groups are granted access along with the type of access. When you submit a request against a resource, Amazon S3 checks the corresponding ACL to confirm that you have the required access permissions.Most use cases where access is granted to objects or buckets no longer require ACLs. However, in some cases, using an ACL might be more appropriate. For example, here are some use cases for when you might need to use an ACL to manage bucket or object access:An object ACL is the only way to grant access to objects that are not owned by the bucket owner. By default, when another AWS account uploads an object to your S3 bucket, that account (the object writer) owns the object. Additionally, the object writer has access to the object, and can grant other users access to it using ACLs.Object ACLs can be used when you need to manage permissions at the object level. For example, if you need to delegate access to an entire folder you can use a bucket policy. However, if the access permissions vary by object, granting permissions to individual objects using a bucket policy might not be practical. Therefore, an object ACL might be more appropriate for managing object access.If you want to own new objects written to your bucket by other AWS accounts (and your ACL isn't disabled), apply the bucket owner preferred setting. With this setting, new objects that are written with the bucket-owner-full-control ACL are automatically owned by the bucket owner (and not the object writer). All other ACL behaviors remain in place.Note: To disable an ACL, use the bucket owner enforced setting for S3 Object Ownership. When ACLs are disabled, you can easily maintain a bucket with objects uploaded (cross-account) by different AWS accounts using bucket policies. If your bucket uses the bucket owner enforced setting for S3 Object Ownership, requests to set or update ACLs fail, returning the AccessControlListNotSupported error code. However, requests to read ACLs will still be supported.Bucket ACLs can be used to grant permissions to AWS services like Amazon CloudFront to perform certain actions to your bucket. For example, when you create or update a CloudFront distribution and enable CloudFront logging, CloudFront updates the bucket ACL. This update gives the awslogsdelivery account FULL_CONTROL permissions to write logs to your bucket. For more information, see Permissions required to configure standard logging and to access your log files.Applying ACLs to objectsExample 1If you're uploading an object to a bucket in a different AWS account, use the bucket-owner-full-control canned ACL:aws s3api put-object --bucket destination_bucket --key dir-1/myfile --body dir-1/myfile --acl bucket-owner-full-controlThe bucket-owner-full-control canned ACL provides access to the bucket owner's account.Note: Amazon S3 supports a set of predefined ACLs known as canned ACLs (such as the bucket-owner-full-control ACL used in this example).Example 2The object uploader can also add an ACL to grant read permissions to other AWS accounts:aws s3api put-object --bucket destination_mybucket --key dir/myfile --body dir/myfile --grant-read emailaddress=user1@amazon.com,id=canonical-id-of-accountNote: You can only specify a grantee using email addresses in the following AWS Regions: N. Virginia, N. California, Oregon, Singapore, Sydney, Tokyo, Ireland, and São Paulo.Example 3You can also update the ACL of an existing object:aws s3api put-object-acl --bucket destination_bucket --key dir/myfile --acl bucket-owner-full-controlExample 4Amazon S3 has a set of predefined groups. You can use object ACLs to grant permissions to the users who are part of these predefined groups.For example, you can grant object access to any authenticated AWS user by granting access to theAuthenticated Users group:aws s3api put-object --bucket destination_mybucket --key dir/myfile --body dir/myfile --grant-read uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsersNote: Before granting access to the Authenticated Users group, disable the Block Public Access settings for ACLs at both the account and bucket level. Otherwise, you'll get an Access Denied error. To troubleshoot ACL-related Access Denied errors, see A user with permission to add objects to my Amazon S3 bucket is getting Access Denied errors. Why?Related informationHow do I troubleshoot 403 Access Denied errors from Amazon S3?Managing access with ACLsWhen to use an ACL-based access policy (bucket and object ACLs)Follow"


Question: How do I troubleshoot timeout issues when I query CloudTrail data using Athena?

"When I use Amazon Athena to query my AWS CloudTrail data, my queries take a long time to run or they time out."

Answer: "When I use Amazon Athena to query my AWS CloudTrail data, my queries take a long time to run or they time out.ResolutionCloudTrail logs can grow in size over time even if you partition the CloudTrail table to reduce the run time of the queries. Queries against a highly partitioned table have a higher planning time and do not complete quickly.To resolve the timeout issue, you can manually create a CloudTrail table using partition projection. This allows Athena to dynamically calculate the value of CloudTrail tables instead of scanning through a large list of partitions. With partition projection, you don't need to manage partitions because partition values and locations are calculated from configuration.To create a CloudTrail table partitioned by timestamp with partition projection, see Creating the table for CloudTrail logs in Athena using partition projection.To create a CloudTrail table for multiple accounts that's partitioned by year, month, and day with partition projection, use a command similar to the following:CREATE EXTERNAL TABLE ctrail_pp_ymd (eventversion STRING,useridentity STRUCT<               type:STRING,               principalid:STRING,               arn:STRING,               accountid:STRING,               invokedby:STRING,               accesskeyid:STRING,               userName:STRING,sessioncontext:STRUCT<attributes:STRUCT<               mfaauthenticated:STRING,               creationdate:STRING>,sessionissuer:STRUCT<               type:STRING,               principalId:STRING,               arn:STRING,               accountId:STRING,               userName:STRING>>>,eventtime STRING,eventsource STRING,eventname STRING,awsregion STRING,sourceipaddress STRING,useragent STRING,errorcode STRING,errormessage STRING,requestparameters STRING,responseelements STRING,additionaleventdata STRING,requestid STRING,eventid STRING,resources ARRAY<STRUCT<               ARN:STRING,               accountId:STRING,               type:STRING>>,eventtype STRING,apiversion STRING,readonly STRING,recipientaccountid STRING,serviceeventdetails STRING,sharedeventid STRING,vpcendpointid STRING)PARTITIONED BY (account string, region string, year string, month string, day string)ROW FORMAT SERDE  'com.amazon.emr.hive.serde.CloudTrailSerde'STORED AS INPUTFORMAT  'com.amazon.emr.cloudtrail.CloudTrailInputFormat'OUTPUTFORMAT  'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://doc_example_bucket/AWSLogs/'TBLPROPERTIES (  'projection.enabled'='true',  'projection.day.type'='integer',  'projection.day.range'='01,31',  'projection.day.digits'='2',  'projection.month.type'='integer',  'projection.month.range'='01,12',  'projection.month.digits'='2',  'projection.region.type'='enum',  'projection.region.values'='us-east-1,us-east-2,us-west-2',  'projection.year.type'='integer',  'projection.year.range'='2015,2021',  'projection.account.type'='enum',   'projection.account.values'='111122223334444,5555666677778888',    'storage.location.template'='s3://doc_example_bucket/AWSLogs/${account}/CloudTrail/${region}/${year}/${month}/${day}')Be sure to replace the following in the preceding query:ctrail_pp_ymd with the name of the CloudTrail tabledoc_example_bucket with the name of the Amazon Simple Storage Service (Amazon S3) bucket where you want to create the CloudTrail table1111222233334444 and 5555666677778888 with the account IDs of accounts that you want to create the CloudTrail table forus-east-1,us-east-2,us-west-2 with the Region that you want to create the CloudTrail table forTable attributes and properties based on your use caseProjection ranges based on your use case (for example, if your CloudTrail data is available only from year 2018, then replace the projection range for partition column year with '2018,2021')To create a CloudTrail table for multiple accounts under the same organization , use a command similar to the following:CREATE EXTERNAL TABLE ctrail_pp_ymd_org (eventversion STRING,useridentity STRUCT<               type:STRING,               principalid:STRING,               arn:STRING,               accountid:STRING,               invokedby:STRING,               accesskeyid:STRING,               userName:STRING,sessioncontext:STRUCT<attributes:STRUCT<               mfaauthenticated:STRING,               creationdate:STRING>,sessionissuer:STRUCT<               type:STRING,               principalId:STRING,               arn:STRING,               accountId:STRING,               userName:STRING>>>,eventtime STRING,eventsource STRING,eventname STRING,awsregion STRING,sourceipaddress STRING,useragent STRING,errorcode STRING,errormessage STRING,requestparameters STRING,responseelements STRING,additionaleventdata STRING,requestid STRING,eventid STRING,resources ARRAY<STRUCT<               ARN:STRING,               accountId:STRING,               type:STRING>>,eventtype STRING,apiversion STRING,readonly STRING,recipientaccountid STRING,serviceeventdetails STRING,sharedeventid STRING,vpcendpointid STRING)PARTITIONED BY (account string, region string, year string, month string, day string)ROW FORMAT SERDE  'com.amazon.emr.hive.serde.CloudTrailSerde'STORED AS INPUTFORMAT  'com.amazon.emr.cloudtrail.CloudTrailInputFormat'OUTPUTFORMAT  'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://doc_example_bucket/AWSLogs/doc_example_orgID/'TBLPROPERTIES (  'projection.enabled'='true',  'projection.day.type'='integer',  'projection.day.range'='01,31',  'projection.day.digits'='2',  'projection.month.type'='integer',  'projection.month.range'='01,12',  'projection.month.digits'='2',  'projection.region.type'='enum',  'projection.region.values'='us-east-1,us-east-2,us-west-2',  'projection.year.type'='integer',  'projection.year.range'='2010,2100',  'projection.account.type'='enum',   'projection.account.values'='111122223334444,5555666677778888',    'storage.location.template'='s3://doc_example_bucket/AWSLogs/doc_example_orgID/${account}/CloudTrail/${region}/${year}/${month}/${day}')Note: If you need to query the CloudTrail data before year 2010, then be sure to update the year range in projection.year.range.Be sure to replace the following in the above query:ctrail_pp_ymd_org with the name of the CloudTrail tabledoc_example_bucket with the name of the Amazon S3 bucket where you want to create the CloudTrail tabledoc_example_orgID with your organization ID1111222233334444 and 5555666677778888 with the account IDs of accounts that you want to create the CloudTrail table forus-east-1, us-east-2, and us-west-2 with the Regions where you want to create the CloudTrail tableTable attributes and properties based on your use caseProjection ranges based on your use case (for example, if your CloudTrail data is available only from year 2018, then replace the projection range for partition column year with '2018,2021')When you run your queries, be sure to include restrictive conditions on the partition columns in your queries. This allows Athena to scan less data and speeds up query processing.For example, you can run a command similar to the following to find out which user made the GetObject request to the S3 bucket. The table in this query uses the year, month, and day partitioning strategy.Note: Be sure to have event logging activated for Amazon S3 in CloudTrail.SELECT useridentity.arn, eventtime  FROM "ctrail_pp_ymd"where eventname = 'GetObject'and year = '2021'and month = '05'and region = 'us-east-1'and cast(json_extract(requestparameters, '$.bucketName')as varchar) ='doc_example_bucket'Be sure to replace the following in the above query:ctrail_pp_ymd with the name of the CloudTrail tabledoc_example_bucket with the name of the S3 bucket where you want to create the CloudTrail tableRestrictive conditions based on your use caseIf you have timeout issues even after implementing the above steps, then you can request a service quota increase.Related informationQuerying AWS CloudTrail logsFollow"


Question: How do I create a DHCP options set for my AWS directory?

I want to create Dynamic Host Configuration Protocol (DHCP) options set for my AWS Directory Service directory. How can I do this?

Answer: "I want to create Dynamic Host Configuration Protocol (DHCP) options set for my AWS Directory Service directory. How can I do this?Short DescriptionBy default, Amazon Virtual Private Cloud (Amazon VPC) uses AWS DNS instead of your directory service DNS. It's a best practice that you create a DHCP options set for your AWS Directory Service directory. Then, assign the DHCP options set to the VPC that your directory runs in. This allows any instances in that VPC to point to the specified domain and for DNS servers to resolve their domain names.ResolutionTo create a DHCP options set for your AWS directory, follow the instructions to Create a DHCP Options Set.Follow"


Question: Why am I experiencing a data delivery failure with Kinesis Data Firehose?

I'm trying to send data from Amazon Kinesis Data Firehose to my Amazon OpenSearch Service domain. Why am I experiencing a data delivery failure?

Answer: "I'm trying to send data from Amazon Kinesis Data Firehose to my Amazon OpenSearch Service domain. Why am I experiencing a data delivery failure?Short descriptionA failed delivery between Kinesis Data Firehose and Amazon OpenSearch Service can be caused by the following reasons:Invalid delivery destinationNo incoming dataDisabled Kinesis Data Firehose logsLack of proper permissionsAWS Lambda function invocation issuesOpenSearch Service domain health issuesResolutionInvalid delivery destinationConfirm that you have specified a valid Kinesis Data Firehose delivery destination and that you are using the correct ARN. You can check whether your delivery was successful by viewing the DeliveryToElasticsearch.Success metric in Amazon CloudWatch. A DeliveryToElasticsearch.Success metric value of zero is confirmation that the deliveries are unsuccessful. For more information about the DeliveryToElasticsearch.Success metric, see Delivery to OpenSearch Service in Data delivery CloudWatch metrics.No incoming dataConfirm that there is incoming data for Kinesis Data Firehose by monitoring the IncomingRecords and IncomingBytes metrics. A value of zero for those metrics means that there are no records reaching Kinesis Data Firehose. For more information about the IncomingRecords and IncomingBytes metrics, see Data ingestion through direct PUT in Data ingestion metrics.If the delivery stream uses Amazon Kinesis Data Streams as a source, then check the IncomingRecords and IncomingBytes metrics of the Kinesis data stream. These two metrics indicate whether there is incoming data. A value of zero confirms that there are no records reaching the streaming services.Check the DataReadFromKinesisStream.Bytes and DataReadFromKinesisStream.Records metrics to verify whether data is coming from Kinesis Data Streams to Kinesis Data Firehose. For more information about the data metrics, see Data ingestion through Kinesis Data Streams. A value of zero can indicate a failure to deliver to OpenSearch Service rather than a failure between Kinesis Data Streams and Kinesis Data Firehose.You can also check to see if the PutRecord and PutRecordBatch API calls for Kinesis Data Firehose are called properly. If you aren't seeing any incoming data flow metrics, check the producer that is performing the PUT operations. For more information about troubleshooting producer application issues, see Troubleshooting Amazon Kinesis Data Streams producers.Disabled Kinesis Data Firehose logsMake sure that Logging is enabled for Kinesis Data Firehose. Otherwise, the error logs result in a delivery failure. Then, check for the /aws/kinesisfirehose/delivery-stream-name log group name in CloudWatch Logs.In the Kinesis Data Firehose role, the following permissions are required:{     "Action": [          "logs:PutLogEvents"     ]},{     "Resource": [          "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name"     ]}Verify that you have granted Kinesis Data Firehose access to a public OpenSearch Service destination. If you are using the data transformation feature, then you must also grant access to AWS Lambda.Lack of proper permissionsThere are several permissions required depending on the configuration of Kinesis Data Firehose.To deliver records to an Amazon Simple Storage Service (Amazon S3) bucket, the following permissions are required:{           "Effect": "Allow",     "Action": [          "s3:AbortMultipartUpload",          "s3:GetBucketLocation",          "s3:GetObject",          "s3:ListBucket",          "s3:ListBucketMultipartUploads",          "s3:PutObject"     ],           "Resource": [                  "arn:aws:s3:::bucket-name",          "arn:aws:s3:::bucket-name/*"     ]    }Note: To use this policy, the Amazon S3 bucket resource must be present.If your Kinesis Data Firehose is encrypted at rest, the following permissions are required:{     "Effect": "Allow",     "Action": [          "kms:Decrypt",          "kms:GenerateDataKey"     ],     "Resource": [          "arn:aws:kms:region:account-id:key/key-id"     ],     "Condition": {          "StringEquals": {               "kms:ViaService": "s3.region.amazonaws.com"          },          "StringLike": {               "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucket-name/prefix*"          }     }}To allow permissions for OpenSearch Service access, you can update your policy like this:{     "Effect": "Allow",     "Action": [          "es:DescribeElasticsearchDomain",          "es:DescribeElasticsearchDomains",          "es:DescribeElasticsearchDomainConfig",          "es:ESHttpPost",          "es:ESHttpPut"     ],     "Resource": [          "arn:aws:es:region:account-id:domain/domain-name",          "arn:aws:es:region:account-id:domain/domain-name/*"     ]},{     "Effect": "Allow",     "Action": [          "es:ESHttpGet"     ],     "Resource": [          "arn:aws:es:region:account-id:domain/domain-name/_all/_settings",          "arn:aws:es:region:account-id:domain/domain-name/_cluster/stats",          "arn:aws:es:region:account-id:domain/domain-name/index-name*/_mapping/type-name",          "arn:aws:es:region:account-id:domain/domain-name/_nodes",          "arn:aws:es:region:account-id:domain/domain-name/_nodes/stats",          "arn:aws:es:region:account-id:domain/domain-name/_nodes/*/stats",          "arn:aws:es:region:account-id:domain/domain-name/_stats",          "arn:aws:es:region:account-id:domain/domain-name/index-name*/_stats"     ]}If you are using Kinesis Data Streams as a source, update your permissions like this:{     "Effect": "Allow",     "Action": [          "kinesis:DescribeStream",          "kinesis:GetShardIterator",          "kinesis:GetRecords",          "kinesis:ListShards"     ],     "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name"}To configure Kinesis Data Firehose for data transformation, you can update your policy like this:{     "Effect": "Allow",      "Action": [          "lambda:InvokeFunction",           "lambda:GetFunctionConfiguration"      ],     "Resource": [          "arn:aws:lambda:region:account-id:function:function-name:function-version"     ]}AWS Lambda function invocation issuesCheck the Kinesis Data Firehose ExecuteProcessing.Success and Errors metrics to be sure that Kinesis Data Firehose has invoked your function. If Kinesis Data Firehose hasn't invoked your Lambda function, then check the invocation time to see if it is beyond the timeout parameter. Your Lambda function might require a greater timeout value or need more memory to complete in time. For more information about invocation metrics, see Using invocation metrics.To identify the reasons that Kinesis Data Firehose isn't invoking the Lambda function, check the Amazon CloudWatch Logs group for /aws/lambda/lambda-function-name. If data transformation fails, then the failed records are delivered to the S3 bucket as a backup in the processing-failed folder. The records in your S3 bucket also contain the error message for failed invocation. For more information about resolving Lambda invocation failures, see Data transformation failure handling.OpenSearch Service domain health issuesCheck the following metrics to confirm that OpenSearch Service is in good health:CPU utilization: If this metric is consistently high, the data node might be unable to respond to any requests or incoming data. You might need to scale your cluster.JVM memory pressure: If the JVM memory pressure is consistently above 80%, the cluster might be triggering memory circuit breaker exceptions. These exceptions can prevent the data from being indexed.ClusterWriteBlockException: This indexing block occurs when your domain is under high JVM memory pressure or if more storage space is needed. If a data node doesn't have enough space, then new data cannot be indexed. For more information about troubleshooting OpenSearch Service issues, see Amazon OpenSearch Service troubleshooting.Follow"


Question: How can I troubleshoot a State Manager association that failed or that is stuck in pending status?

"I created a State Manager association scheduled to run on my managed Amazon Elastic Compute Cloud (Amazon EC2) instance. However, the association status is failed or stuck in pending."

Answer: "I created a State Manager association scheduled to run on my managed Amazon Elastic Compute Cloud (Amazon EC2) instance. However, the association status is failed or stuck in pending.ResolutionAWS Systems Manager State Manager association is a configuration assigned to your managed instances. The configuration defines the state that you want to maintain on your instances.When you create a State Manager association, Systems Manager binds the schedule, targets, document, and parameter information that you specify to the managed instances. The association status is initially pending while the system tries to reach all targets and immediately apply the state specified in the association.Troubleshoot an association stuck in pending/failed statusIf the State Manager association remains stuck in pending or failed state, first confirm that the latest version of SSM Agent is installed.Then, verify the status of the resource where the association is applied, and view the history to confirm if there were any invocations.From the Systems Manager console State Manager Associations page, choose the hyperlinked Association id for the association that is stuck in pending or failed state.Choose the Execution history tab to view the invocation history.If the history lists invocations, choose the hyperlinked Execution id to see the resource type, status, and other details. Then, proceed to the Identify the cause of the failure section of this article.If there aren't any invocations listed in the history, verify that the instance is a managed instance. From the Systems Manager console, the instance must be listed under Managed instances, and the SSM Agent ping status must be Online.To troubleshoot managed instances, see Why is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?Identify the cause of the failureIf the history lists invocations, from Execution ID Association execution targets page, select the target instance Resource ID, and then choose Output. The output displays details and an error message about why the association failed.For Systems Manager Automation document errors, see Troubleshooting Systems Manager Automation.For Run Command document errors, see Troubleshooting Systems Manager Run Command.Note: The output differs depending on the Systems Manager document that you use. For more information, see AWS Systems Manager documents.Review SSM Agent logsReview the SSM Agent logs for more details about the Run Command document failure:For Linux and macOS, locate the logs in the following directories:/var/log/amazon/ssm/amazon-ssm-agent.log/var/log/amazon/ssm/errors.log/var/log/amazon/ssm/audits/amazon-ssm-agent-audit-YYYY-MM-DDNote: SSM Agent stderr and stdout files write to the /var/lib/amazon/ssm directory.For Windows, locate the logs in the following directories:%PROGRAMDATA%\Amazon\SSM\Logs\amazon-ssm-agent.log%PROGRAMDATA%\Amazon\SSM\Logs\errors.log%PROGRAMDATA%\Amazon\SSM\Logs\audits\amazon-ssm-agent-audit-YYYY-MM-DDRelated informationUnderstanding automation statusesAWS Systems Manager State ManagerFollow"


Question: "How do I calculate bandwidth and set a CloudWatch alarm for AWS Direct Connect, AWS Site-Site VPN, or Transit Gateway connections?"

"I have an AWS Direct Connect, AWS Site-to-Site VPN Connection, or an AWS Transit Gateway connection. I want to use Amazon CloudWatch metrics to calculate bandwidth and set up a bandwidth-based notification."

Answer: "I have an AWS Direct Connect, AWS Site-to-Site VPN Connection, or an AWS Transit Gateway connection. I want to use Amazon CloudWatch metrics to calculate bandwidth and set up a bandwidth-based notification.Short descriptionUse CloudWatch metrics to calculate bandwidth for an AWS Direct Connect connection, AWS Site-to-Site VPN, or AWS Transit Gateway connection. Then, create a CloudWatch alarm with an Simple Notification Service (Amazon SNS) notification to be alerted when bandwidth exceeds the values that you set.Important: Bandwidth calculation is approximate and doesn’t provide exact bandwidth usage up to the moment. A CloudWatch metrics-based alarm is effective for connections that exceed bandwidth for a duration of 15 minutes or more.Based on the type of connection that you have, see the related Resolution section to calculate the bandwidth and set up the CloudWatch alarm. You can also set up Amazon SNS notifications for the CloudWatch alarm.ResolutionDirect Connect connectionAccess the CloudWatch console.In the navigation pane, choose Metrics. Then, choose All metrics.Under All Metrics, choose DX. Then, choose Connection metrics.Select ConnectionBpsIngress and ConnectionBpsEgress for the Direct Connect connection that you want to measure.Choose the Graphed metrics tab and set following:Statistics: MaximumPeriod: 5 minutesChoose Add Math. From the dropdown list, choose Start with an empty expression.After you choose Start with an empty expression, a math expression box appears. In this box, enter (m1+m2).This formula calculates total bandwidth. The variables represent the following values:m1 = ConnectionBpsIngress (in bits per second)m2 = ConnectionBpsEgress (in bits per second)Choose Apply.In the graphed metrics section, the expression that you added and the metrics in the expression are listed. To see the representation in the graph section, select only the expression that you added: (m1+m2).The Output result is in bits per second.Configure your CloudWatch alarm for Direct Connect connections. Use the math expression that you calculated in the previous step for Metric. When creating the alarm, set the following values:For Select metric, re-enter the expression from the steps in the Calculate bandwidth for a Direct Connect connection section of this article. Select only the expression that you created.In the Conditions section, set bandwidth value that you want to monitor as a condition. For example, to be notified when bandwidth reaches 100Mbps, enter Greater/Equal(>=) 1,000,000,00.In the Additional configuration section, set Datapoints to alarm to 3 out of 3.[Optional] Set up Amazon SNS notifications for the CloudWatch alarm.Site-to-Site VPN connectionAccess the CloudWatch console.In the navigation pane, choose Metrics. Then, choose All metrics.Under All Metrics, choose VPN. Then, choose VPN tunnel metrics.Select TunnelDataIn and TunnelDataOut metrics for the VPN tunnel that you want to measure.Choose the Graphed metrics tab and set following parameters:Statistics: SUMPeriod: 5 minutesChoose Add Math. From the dropdown list, choose Start with an empty expression.After you choose Start with an empty expression, a math expression box appears. In this box, enter (m1+m2)*8/300.This formula converts bytes to bits, divides by time in seconds to calculate output in bits per second. The variables represent the following values:m1 = TunnelDataIn (in bytes)m2 = TunnelDataOut (in bytes)Choose Apply.In the graphed metrics section, the expression that you added and the metrics in the expression are listed. To see the representation in the graph section, select only the expression you added: (m1+m2)*8/300. The Output result is in bits per second.Configure your CloudWatch alarm for VPN connections. Use the math expression that you calculated in the previous step for Metric. When creating the alarm, set the following values:For Select metric, re-enter the expression from the steps in the Calculate bandwidth for a Site-to-Site VPN connection section of this article. Select only the expression that you created.In the Conditions section, set bandwidth value you want to monitor as a condition. For example, to be notified when bandwidth reaches 100Mbps, enter Greater/Equal(>=) 1,000,000,00.In the Additional configuration section**,** set Datapoints to alarm to 3 out of 3.[Optional] Set up Amazon SNS notifications for the CloudWatch alarm.Transit Gateway attachmentThe following procedure calculates bandwidth on a Transit Gateway VPC attachment. You can use a similar calculation on different types of attachments.Access the CloudWatch console.In the navigation pane, choose Metrics. Then, choose All metrics.Under All Metrics, choose Transit Gateway. Then, choose Per-TransitGatewayAttachment Metrics.Select BytesIn and BytesOut metrics for the Transit Gateway attachment that you want to measure.Choose the Graphed metrics tab, and then set following parameters:Statistics: SUMPeriod: 5 minutesChoose Add Math. From the dropdown list, choose Start with an empty expression.After you choose Start with an empty expression, a math expression box displays. In this box, enter (m1+m2)*8/300.This formula converts bytes to bits, divided by time in seconds to calculate output in bits per second. The variables represent the following values:m1 = BytesIn (in bytes)m2 = BytesOut (in bytes)Choose Apply.In the graphed metrics section, the expression that you added and the metrics in the expression are listed. To see the representation in the graph section, select only the expression you added: (m1+m2)*8/300. The Output result is in bits per second.Create a CloudWatch alarm based on a metric math expression. Use the math expression that you calculated in the previous step for Metric. When creating the alarm, set the following values:Set the following values when creating the alarm:For Select metric, re-enter the expression from the steps in the Calculate bandwidth for a Transit Gateway attachment section. Select only the expression that you created.In the Conditions section, set bandwidth value that you want to monitor as a condition. For example, to be notified when bandwidth reaches 100Mbps, enter Greater/Equal(>=) 1,000,000,00.In the Additional configuration section**,** set Datapoints to alarm to 3 out of 3.[Optional] Set up Amazon SNS notifications for the CloudWatch alarm.Related informationVPN tunnel metrics and dimensionsAWS Direct Connect metrics and dimensionsAWS Transit Gateway metricsFollow"