Question: How do I troubleshoot “Internal Error” messages when stopping an AWS OpsWorks Stacks instance that's in the "stop_failed" state?

"When I try to stop my AWS OpsWorks Stacks instance that's in the "stop_failed" state, I get an "Internal Error" message. How do I troubleshoot the error?"

Answer: "When I try to stop my AWS OpsWorks Stacks instance that's in the "stop_failed" state, I get an "Internal Error" message. How do I troubleshoot the error?Short descriptionOpsWorks Stacks can return an Internal Error message when you're trying to stop an instance that's in the stop_failed state for two reasons:The stack's AWS Identity and Access Management (IAM) service role doesn't have the required permissions.The instance was stopped outside of the OpsWorks Stacks console or the OpsWorks Stacks API.Note: OpsWorks Stacks doesn't recognize start, stop, or restart operations performed in the Amazon Elastic Compute Cloud (Amazon EC2) console. For more information, see Manually starting, stopping, and rebooting 24/7 instances.To resolve the error, first verify that your stack's IAM service role is configured correctly. If the issue isn't permissions related, stop the instance by running the AWS Command Line Interface (AWS CLI) stop-instance command. The command must include the --force parameter and the OpsWorks instance IDs of the instances that need to be stopped.ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Verify that your stack's IAM service role is configured correctlyFollow the instructions in Allowing AWS OpsWorks Stacks to act on your behalf.If the issue isn't permissions related, stop the instance by running the AWS CLI stop-instance command.To stop an instance by running the AWS CLI stop-instance commandNote: You can also use AWS CloudShell to run the following commands.1.    Return the instance IDs of the instances in your stack that are in the stopped_failed state by running the following describe-instances command:Important: Replace your-stack-id with your stack ID. Replace your-OpsWorks-Stack-Endpoint-region with the AWS OpsWorks Stacks endpoint Region that your stack is in.$ aws opsworks describe-instances --stack-id your-stack-id --region your-OpsWorks-Stack-Endpoint-region --query 'Instances[?Status==`stop_failed`].{Id:InstanceId}'2.    Identify the instance IDs of the instances that you're stopping. You need these instance IDs to run the stop-instance command.3.    (To stop a single instance) Run the following stop-instance command:Important: Replace your-opsworks-instance-id with the instance ID that you're stopping and the your-OpsWorks-Stack-Endpoint-region with the OpsWorks Stacks endpoint Region that your stack is in.$ aws opsworks stop-instance --instance-id your-opsworks-instance-id --force --region your-OpsWorks-Stack-Endpoint-region-or-(To stop multiple instances) Use custom syntax logic to run a stop-instance command that iterates through the instances that you're stopping.Example stop-instance command that stops multiple instancesImportant: Replace your-stack-id with your stack ID. Replace your-OpsWorks-Stack-Endpoint-region with the OpsWorks Stacks endpoint Region that your stack is in.$ for Id in $(aws opsworks describe-instances --stack-id your-stack-id --region your-OpsWorks-Stack-Endpoint-region --query 'Instances[?Status==`stop_failed`].{Id:InstanceId}' --output text) ; do aws opsworks stop-instance --instance-id $Id --force --region your-OpsWorks-Stack-Endpoint-region  ; doneFollow"


Question: Does AWS provide support in languages other than English?

I want to know if the AWS Support team can speak in a language other than English.

Answer: "I want to know if the AWS Support team can speak in a language other than English.ResolutionAWS Support is available in the following languages: Chinese, English, Japanese, and Korean. You can use one of the supported languages as your preferred contact language to access AWS Support.If you have an AWS Enterprise Support plan, we have Technical Account Managers who can speak and interact with you in these local languages:ChineseEnglishFrenchGermanItalianJapaneseKoreanPortugueseSpanishThaiAnd moreTo know if we can interact in your language, contact your account management team or contact AWS sales support for more information.Follow"


Question: How do I resolve the "FAILED: NullPointerException Name is null" error when I query a table in Amazon Athena?

I get the "FAILED: NullPointerException Name is Null" error when I query my Amazon Athena table.

Answer: "I get the "FAILED: NullPointerException Name is Null" error when I query my Amazon Athena table.Short descriptionYou get this error when the attribute TableType isn't defined for the queried table in the AWS Glue Data Catalog. The TableType attribute defines whether the table is an external table or a view. This attribute can be defined with values, such as EXTERNAL_TABLE and VIRTUAL_VIEW. If you want to run DDL queries, such as SHOW CREATE TABLE or MSCK REPAIR TABLE, then you must define the TableType attribute.If you defined the table using an AWS CloudFormation template or the AWS Glue API without specifying TableType as one of the properties, then you might get this error.ResolutionTo resolve this error, do one or more of the following based on your use case:Add the attribute during table creationAdd the TableType attribute when you create the table.Note: If the table is created using a DDL statement or an AWS Glue crawler, then the TableType property is defined automatically.Update the CloudFormation template or the AWS Glue API callIf the table is defined using a CloudFormation template or the AWS Glue API without specifying TableType, then update the CloudFormation template or the AWS Glue API call to add the TableType attribute.Update the table using the AWS Command Line Interface (AWS CLI)To update the TableType attribute for your table, use the AWS CLI command aws glue update-table . To run this command, you must have the TableInput object that defines the entire table architecture.To get the TableInput object for your table, run the aws glue get-table command. Then, update the output of this command as defined in the following steps.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.1.    Run a command similar to the following on your table.aws glue get-table --catalog-id 1111222233334444 --database doc_example_database --name doc_example_table2.    You get an output similar to the following:{    "Table": {            "StorageDescriptor": {            "OutputFormat": "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat",            "SortColumns": [],            "InputFormat": "org.apache.hadoop.mapred.TextInputFormat",            "SerdeInfo": {                    "SerializationLibrary": "org.apache.hadoop.hive.serde2.OpenCSVSerde",                    "Parameters": {                    "serialization.format": "1"                        }            },            "Parameters": {                "separatorChar": ","            },            "Location": "s3://doc_example_bucket/doc_example_prefix/",            "NumberOfBuckets": 0,            "StoredAsSubDirectories": false,            "Columns": [                {                    "Type": "int",                    "Name": "id"                },                {                    "Type": "string",                    "Name": "name"                }            ],            "Compressed": false        },        "UpdateTime": 1620508098.0,        "IsRegisteredWithLakeFormation": false,        "Name": "doc_example_table",        "CreatedBy": "arn:aws:iam::1111222233334444:user/Administrator",        "DatabaseName": "doc_example_database",        "Owner": "1111222233334444",        "Retention": 0,        "CreateTime": 1619909955.0,        "Description": "tb description"    }}3.    Remove parameters, such as UpdateTime, IsRegisteredWithLakeFormation, CreatedBy, DatabaseName, and CreateTime from the above output. AWS Glue doesn't support these parameters. If you include these parameters in the TableInput attribute when running the update-table command, then you might see the following errors:Parameter validation failed:Unknown parameter in TableInput: "UpdateTime", must be one of: Name, Description, Owner, LastAccessTime, LastAnalyzedTime, Retention, StorageDescriptor, PartitionKeys, ViewOriginalText, ViewExpandedText, TableType, ParametersUnknown parameter in TableInput: "IsRegisteredWithLakeFormation", must be one of: Name, Description, Owner, LastAccessTime, LastAnalyzedTime, Retention, StorageDescriptor, PartitionKeys, ViewOriginalText, ViewExpandedText, TableType, ParametersUnknown parameter in TableInput: "CreatedBy", must be one of: Name, Description, Owner, LastAccessTime, LastAnalyzedTime, Retention, StorageDescriptor, PartitionKeys, ViewOriginalText, ViewExpandedText, TableType, ParametersUnknown parameter in TableInput: "DatabaseName", must be one of: Name, Description, Owner, LastAccessTime, LastAnalyzedTime, Retention, StorageDescriptor, PartitionKeys, ViewOriginalText, ViewExpandedText, TableType, ParametersUnknown parameter in TableInput: "CreateTime", must be one of: Name, Description, Owner, LastAccessTime, LastAnalyzedTime, Retention, StorageDescriptor, PartitionKeys, ViewOriginalText, ViewExpandedText, TableType, Parameters4.    Add the parameter "TableType": "EXTERNAL_TABLE" to the output.5.    Use the output as the TableInput parameter to run the update-table command.aws glue update-table --catalog-id 1111222233334444 --database-name doc_example_database --table-input'{        "StorageDescriptor": {            "OutputFormat": "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat",            "SortColumns": [],            "InputFormat": "org.apache.hadoop.mapred.TextInputFormat",            "SerdeInfo": {                "SerializationLibrary": "org.apache.hadoop.hive.serde2.OpenCSVSerde",                "Parameters": {                    "serialization.format":"1"                }            },            "Parameters": {                "separatorChar":","            },            "Location": "s3://doc_example_bucket/doc_example_prefix/",            "NumberOfBuckets": 0,            "StoredAsSubDirectories": false,            "Columns": [                {                    "Type": "int",                    "Name": "id"                },                {                    "Type": "string",                    "Name": "name"                }            ],            "Compressed": false        },        "Name": "doc_example_table",        "TableType": "EXTERNAL_TABLE",        "Owner": "1111222233334444",        "Retention": 0,        "Description": "tb description"    }Be sure to replace the following in the above commands:doc_example_database with the name of your databasedoc_example_table with the name of your table1111222233334444 with your account IDs3://doc_example_bucket/doc_example_prefix/ with the Amazon Simple Storage Service (Amazon S3) location where you stored the tableAfter running the above command, the TableType parameter gets updated, and DDL queries, such as SHOW CREATE TABLE or MSCK REPAIR TABLE, are successful.Related informationTroubleshooting in AthenaFollow"


Question: How can I resolve the error "You have exceeded the allowed number of AWS accounts." for AWS Organizations?

I received the error message "You have exceeded the allowed number of AWS accounts." when inviting or creating accounts in AWS Organizations.

Answer: "I received the error message "You have exceeded the allowed number of AWS accounts." when inviting or creating accounts in AWS Organizations.Short descriptionThis error indicates that you exceeded the default maximum number of AWS accounts for your AWS Organizations organization. The default maximum number of accounts allowed in an organization is 10.ResolutionYou can request an increase to the maximum number of accounts for Service Quotas allowed in your AWS Organizations organization. You can use either the Services Quota console or the AWS Command Line Interface (AWS CLI).Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.Important: Organizations is a global service that is physically hosted in the US East (N. Virginia) (us-east-1) AWS Region. You must use the us-east-1 Region to access Organizations quotas using the Service Quotas console or AWS CLI.Services Quota console1.    Open the Service Quotas console in the us-east-1 Region.2.    In the navigation pane, expand Organization, and then choose Quota request template.3.    In Quota request template, choose Add quota.4.    Choose the Region dropdown list, and choose US East (N. Virginia).5.    Choose the Service dropdown list, and choose AWS Organizations.6.    Choose the Quota dropdown list, and choose Default maximum number of accounts.7.    In Desired quota value, enter your value.Note: The value must be larger than 10 and more than your current value.8.    Choose Add.For more information, see Requesting a quota increase.AWS CLIRequest a quota increase using the AWS CLI command request-service-quota-increase similar to the following:Note: Replace your-value with your value.$ aws service-quotas request-service-quota-increase --service-code organizations --quota-code L-29A0C5DF --desired-value your-valueFor more information, see How can I request, view, and manage service quota increase requests using AWS CLI commands?Related informationHow do I manage my AWS service quotas?Follow"


Question: How do I monitor security-related changes made to the file system on my EC2 Linux instance?

I want to enable the Linux Audit system to monitor changes to the file system on my Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I do this?

Answer: "I want to enable the Linux Audit system to monitor changes to the file system on my Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I do this?Short descriptionThe Linux Audit system tracks access to important files and creates an audit trail in case of file corruption or other unintended changes. You can use the Linux Audit system to track changes to files in Amazon Elastic File System (Amazon EFS) or any other file system type. Be aware that configuring the audit system to log many types of information might impact the local system performance. After installing the Linux Audit system on your system, you can create rules that monitor the activity on your file system.Important: To track all changes to your file system, enable the Linux Audit system on every client that mounts your file system.Resolution1.    Connect to your EC2 instance using SSH as ec2-user/ubuntu/root user. Replace ubuntu with the user name for your AMI.2.    Run the following command to install the audit package:RHEL and CentOS:# sudo yum install auditSUSE Linux:# sudo zypper install auditUbuntu:# sudo apt install auditd3.    Create rules for the Linux Audit system. For the purpose of testing rules initially, use the command auditctl to immediately add or remove rules.Note: The following examples show rules for an EFS file system.Use the following command to monitor all activity where your file system is mounted:$ auditctl -w /home/ec2-user/efs -k efs_changesThe following are examples of actions that you can configure the audit system to log:$ mkdir dir1$ touch file1$ touch file2$ mv file1 file3$ rm -f file2$ chmod 600 file3$ rmdir dir1$ rm -f file34.    Next, use the ausearch -k efs_changes command to view the audit log. The following example shows the audit log for the mkdir command shown in the preceding example operations:time->Thu Jan  9 21:30:59 2020type=PROCTITLE msg=audit(1578605459.080:127433): proctitle=6D6B6469720064697231type=PATH msg=audit(1578605459.080:127433): item=1 name="dir1" inode=4989235361872937641 dev=00:16 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0type=PATH msg=audit(1578605459.080:127433): item=0 name="/home/ec2-user/efs/audit" inode=12759736523397539955 dev=00:16    mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0type=CWD msg=audit(1578605459.080:127433): cwd="/home/ec2-user/efs/audit"type=SYSCALL msg=audit(1578605459.080:127433): arch=c000003e syscall=83 success=yes exit=0 a0=7fffe6aca6e1 a1=1ff a2=1ff a3=7fffe6ac7720 items=2 ppid=18661 pid=2948 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=18369 comm="mkdir" exe="/bin/mkdir"     key="efs_changes"The preceding example shows the raw audit log. The audit log contains a large amount of information for each operation.Use the aureport command to create a less verbose output in the audit log, but still show all of the operations:$ ausearch -k efs_changes | aureport -f -i10118. 01/09/2020 21:36:29 file1 open yes /bin/touch ec2-user 12745010119. 01/09/2020 21:36:29 dir1 mkdir yes /bin/mkdir ec2-user 12744910120. 01/09/2020 21:36:29 file2 open yes /bin/touch ec2-user 12745110121. 01/09/2020 21:36:29 file3 rename yes /bin/mv ec2-user 12745210122. 01/09/2020 21:36:29 file2 unlinkat yes /bin/rm ec2-user 12745310123. 01/09/2020 21:36:29 file3 fchmodat yes /bin/chmod ec2-user 12745410124. 01/09/2020 21:36:29 dir1 rmdir yes /bin/rmdir ec2-user 12745510125. 01/09/2020 21:36:35 file3 unlinkat yes /bin/rm ec2-user 127456Keep in mind that you don't have to log all operations. For example, you can create a rule to log only delete-related actions:auditctl -a always,exit -F arch=b64 -F dir=/home/ec2-user/efs -S unlink -S unlinkat -S rename -S renameat  -S rmdir -k efs_changesIf a user runs the same commands shown in the original example set of operations, only the specified delete-related commands appear in the log:10126. 01/09/2020 22:17:08 file3 rename yes /bin/mv ec2-user 12751910127. 01/09/2020 22:17:08 file2 unlinkat yes /bin/rm ec2-user 12752010128. 01/09/2020 22:17:08 dir1 rmdir yes /bin/rmdir ec2-user 12752110129. 01/09/2020 22:17:09 file3 unlinkat yes /bin/rm ec2-user 1275225.    To make the rules persistent, configure them in the /etc/audit/audit.rules file. For more information, see Defining persistent audit rules and controls in the /etc/audit/audit.rules file on the Red Hat Customer Portal.Related informationSystem auditingCustomized file monitoring with Auditd (tutorial)Follow"


Question: How do I use the AWS CLI to view the contents of an S3 Glacier vault?

I want to check the contents of an Amazon Simple Storage Service (Amazon S3) Glacier vault.

Answer: "I want to check the contents of an Amazon Simple Storage Service (Amazon S3) Glacier vault.ResolutionUse the following AWS Command Line Interface (AWS CLI) commands to check the contents of your Amazon S3 Glacier vaults.Before you begin, configure the AWS CLI. If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.To list the vaults in your AWS account, run the list-vaults command.Note: If you don't see any vaults listed, run the configure command. Confirm that the correct AWS Region is configured for the AWS CLI.To request an inventory of a specific vault, run the initiate-job command and include the option --job-parameters '{"Type": "inventory-retrieval"}'.Note: The job run time varies depending on the retrieval type. For more information, see Archive retrieval options.To view the status of a job, run the describe-job command.To download the output of a job, run the get-job-output command.For a list of all available commands, see the AWS CLI command reference for Amazon S3 Glacier.Related informationUsing Amazon S3 Glacier with the AWS CLIAmazon S3 Glacier data retrieval policiesSet data retrieval policy (PUT policy)Follow"


Question: "How to troubleshoot 500, 502 and 503 errors caused by Lambda@Edge functions in CloudFront?"

"I associated the AWS Lambda@Edge function with an Amazon CloudFront distribution. Now I'm getting 500, 502 or 503 errors. How do I troubleshoot the errors?"

Answer: "I associated the AWS Lambda@Edge function with an Amazon CloudFront distribution. Now I'm getting 500, 502 or 503 errors. How do I troubleshoot the errors?Short descriptionLambda@Edge 500, 502 and 503 errors indicate the following:HTTP 500 status code indicates that the Lambda function returned a run error.HTTP 502 status code indicates that the Lambda function response was incorrectly formed or included content that is not valid.HTTP 503 status code indicates that CloudFront is throttled due to Lambda service quotas (formerly known as limits).See the following sections for the causes of the errors, and how to troubleshoot them.ResolutionLambda@Edge function returns a 500 errorA 500 run error results when CloudFront doesn’t get a response from Lambda. This happens because there are unhandled exceptions in the function, there’s an error in the code, or it's an unsupported run environment.To resolve 500 error generated by Lambda@Edge, you must debug your code by adding logging statements for Lambda functions. To learn more, see Four Steps for Debugging your Content Delivery on AWS and review the information under I – Execution Errors. These logging statements write messages to CloudWatch log files that monitor the running of the CloudFront function. You can review those statements in the CloudWatch log files to verify that the function is working correctly.For more information, see Lambda function errors in Node.js and Lambda function errors in Python.Lambda@Edge function returns a 502 errorAfter the function runs, CloudFront receives a response from Lambda. A 502 error is returned if the object structure of the response doesn't conform to the Lambda@Edge event structure. A 502 error is also returned if the response contains not valid headers or other not valid fields.To resolve 502 error generated by Lambda@Edge, check the Lambda@Edge function for the following common issues:Returned JSON objectMissing required fieldsThe response has an object that is not validAdding or updating is disallowed or there are read-only headersExceeding the maximum body sizeCharacters or values are not validFor more information, see Testing and debugging Lambda@Edge functions and Restrictions on edge functions.Lambda@Edge function returns a 503 errorThe Lambda service throttles executions in each Region, and returns a 503 error if you exceed the quota.To resolve 503 error, check the Lambda@Edge CloudWatch metrics and log files for the following common issues:Concurrent executions on per Region basisFunctions quotas reachedFor more information, see Quotas on Lambda@Edge.Note: You must review CloudWatch log files in the correct Region to see the log files created when CloudFront executed the Lambda function.Related informationLambda@Edge design best practicesFollow"


Question: "Why can't I collect metrics from containers, pods, or nodes using Metrics Server in Amazon EKS?"

"I can't collect metrics from containers, pods, or nodes with Metrics Server in my Amazon Elastic Kubernetes Service (Amazon EKS) cluster."

Answer: "I can't collect metrics from containers, pods, or nodes with Metrics Server in my Amazon Elastic Kubernetes Service (Amazon EKS) cluster.Short descriptionIn Amazon EKS, Metrics Server isn't installed by default. If you just created your cluster and can't collect metrics from containers, pods, or nodes using Metrics Server, then confirm that you deployed the Metrics Server application to your cluster.If you still can't collect metrics with Metrics Server, then complete the steps in the following sections:Check whether you can retrieve metrics from your cluster's nodes and pods.Check if the APIService is available and can handle requests.Check GitHub for common issues.Check your Horizontal Pod Autoscaler (HPA) and application resource requests if metrics are showing as .Note: Metrics Server isn't intended for long-term monitoring of application and cluster performance. For long-term monitoring, see Managing resources for containers.ResolutionCheck if you can retrieve metrics from your cluster's nodes and podsTo check for errors between the API server and Metrics Server, run the following commands to pull metrics from the nodes and pods of your cluster:$ kubectl top nodes$ kubectl top podsIf you don't receive an error from either command, then complete the steps in the Check if the APIService is available and can handle requests section.If you did receive an error, then complete the steps in one of the following sections based on the error that you received:Error from server (Forbidden)Error from server (ServiceUnavailable)Client.Timeout exceeded while awaiting headersConnection refusedError from server (Forbidden)This error message indicates that you have an issue with RBAC authorization. To resolve this error, confirm the following:The ServiceAccount is attached to the deployment correctly.The ClusterRole/Role and ClusterRoleBinding/RoleBindings use the correct RBAC permissions for Metrics Server.If you access your cluster through a role defined in the aws-auth ConfigMap, confirm that you have set the username field and the mapping.1.    To describe the aws-auth ConfigMap, run the following command:$ kubectl describe -n kube-system configmap aws-auth2.    Confirm that the username field is set for the role accessing the cluster. See the following example:Name:         aws-authNamespace:    kube-systemLabels:       <none>Annotations:  <none>Data====mapRoles:----...-  groups:  - system:masters  rolearn: arn:aws:iam::123456789123:role/kubernetes-devops  username: devops:{{SessionName}}  # Ensure this has been specified.Error from server (ServiceUnavailable)To check for an issue with the configuration of the Metrics Server service application in your cluster, run the following command:$ kubectl describe apiservices v1beta1.metrics.k8s.ioThe output looks similar to the following:Name:         v1beta1.metrics.k8s.ioNamespace:Labels:       app=metrics-server...API Version:  apiregistration.k8s.io/v1Kind:         APIServiceSpec:  Group:                     metrics.k8s.io  Group Priority Minimum:    100  Insecure Skip TLS Verify:  true  Service:    Name:            metrics-server    Namespace:       kube-system...Status:  Conditions:    Last Transition Time:  2020-01-09T13:57:23Z    Message:               all checks passed    Reason:                Passed    Status:                True    Type:                  AvailableEvents:                    <none>If the Metrics Server service is available and passing checks, then Status is set to True.If your issue still isn't resolved even though Status is set to True, complete the steps in the Check if the APIService is available and can handle requests section.If Status is set to False, then look for the associated Reason code and human readable Message for Conditions in the output. See the following example of a failing APIService:...Status:  Conditions:    Last Transition Time:  2020-01-09T14:40:28Z    Message:               no response from https://10.0.35.231:443: Get https://10.0.35.231:443: dial tcp 10.0.35.231:443: connect: connection refused    Reason:                FailedDiscoveryCheck    Status:                False    Type:                  AvailableIf the Reason isn't FailedDiscoveryCheck, then complete the steps in Other APIServer condition failure reasons section.If the reason code is FailedDiscoveryCheck, then the Metrics Server service is available and pods are running. The Kubernetes APIServer returns an error when it tries to hit the Metrics Server endpoint.If the APIServer Conditions Message contains "Client.Timeout exceeded while awaiting headers," then complete the steps in the Resolve the "Client.Timeout exceeded while awaiting headers" error section.If the APIServer Conditions Message contains "connection refused," then complete the steps in the Resolve the "connection refused" error section.Resolve the "Client.Timeout exceeded while awaiting headers" errorThis error message on the APIService indicates that a security group or network access control list (ACL) isn't configured correctly. This prevents access to the metrics-server pods. See the following example:no response from https://10.0.35.231:443: Get https://10.0.35.231:443: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)To resolve this error, confirm that your security groups comply with minimum traffic requirements for Amazon EKS.Resolve the "connection refused" errorThis error in the APIServer message indicates that the container is listening on the wrong port. See the following example:no response from https://10.0.35.231:443: Get https://10.0.35.231:443: dial tcp 10.0.35.231:443: connect: connection refusedTo resolve this error, run the following command to confirm that the values for ports, image, and command are correct in the metrics-server deployment:$ kubectl describe deployment metrics-server -n kube-systemThe output looks similar to the following:Name:                   metrics-serverNamespace:              kube-systemCreationTimestamp:      Wed, 08 Jan 2020 11:48:45 +0200Labels:                 app=metrics-server...  Containers:   metrics-server:    Image:      gcr.io/google_containers/metrics-server-amd64:v0.3.6    Port:       443/TCP    Command:    - /metrics-server    - --logtostderr    - --secure-port=443...Note: The Command and Image values can vary depending on how Metrics Server was deployed and where the images are stored. If the Command contains the --secure-port parameter, then the Port (443/TCP, in the preceding example) exposed by the pod must match this parameter. If the Command doesn't contain the --secure-port parameter, then the port defaults to 443.Other APIServer condition failure reasonsIf you receive any of the following codes for the APIService, then take action based on the associated error message: ServiceNotFound, ServiceAccessError, ServicePortError, EndpointsNotFound, EndpointsAccessError, MissingEndpoints.1.    To get information on the service with the error, run the following command:$ kubectl get service -n kube-systemIn the output, confirm that the Kubernetes service has the same name and namespace as defined in APIService.Spec.Service. Then, confirm that the port is set to 443/TCP. See the following example:NAME                             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGEmetrics-server                   ClusterIP   172.20.172.133   <none>        443/TCP    65m2.    To list endpoints, run the following command:$ kubectl get endpoints metrics-server -n kube-systemIn the output, confirm that you have at least one endpoint for the metrics-server service:NAME             ENDPOINTS         AGEmetrics-server   10.0.35.231:443   76m3.    To confirm that the deployment is present and that the labels match those of the metrics-server service, run the following command:$ kubectl describe deploy metrics-server -n kube-systemIn the output, confirm that the deployment has at least one replica:Name:                   metrics-serverNamespace:              kube-systemCreationTimestamp:      Wed, 08 Jan 2020 11:48:45 +0200Labels:                 app=metrics-server                        release=metrics-server...Selector:               app=metrics-server,release=metrics-serverReplicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable...Pod Template:  Labels:           app=metrics-server                    release=metrics-server  Service Account:  metrics-server  Containers:   metrics-server:    Image:      gcr.io/google_containers/metrics-server-amd64:v0.3.6...If you still can't collect metrics with Metrics Server, then complete the steps in the Check if the APIService is available and can handle requests section.Check if the APIService is available and can handle requestsTo extract logs from your Metrics Server pods, run the following command:$ kubectl logs -n <namespace> -l app=metrics-serverFor example, error logs in metrics-server start with an E:E0610 23:13:28.247604       1 reststorage.go:98] unable to fetch pod metrics for pod default/php-apache-b5f58cc5f-nv8sz: no metrics known for pod "default/php-apache-b5f58cc5f-nv8sz"E0610 23:13:43.260069       1 reststorage.go:98] unable to fetch pod metrics for pod default/php-apache-b5f58cc5f-nv8sz: no metrics known for pod "default/php-apache-b5f58cc5f-nv8sz"E0610 23:16:13.346070       1 reststorage.go:98] unable to fetch pod metrics for pod default/php-apache-b5f58cc5f-cj67b: no metrics known for pod "default/php-apache-b5f58cc5f-cj67b"E0610 23:16:13.346087       1 reststorage.go:98] unable to fetch pod metrics for pod default/php-apache-b5f58cc5f-sqc6l: no metrics known for pod "default/php-apache-b5f58cc5f-sqc6l"E0610 23:16:13.346091       1 reststorage.go:98] unable to fetch pod metrics for pod default/php-apache-b5f58cc5f-4cpwk: no metrics known for pod "default/php-apache-b5f58cc5f-4cpwk"Error logs reported by Metrics Server indicate either a configuration issue on the Metrics Server Deployment Command or a bug with the Metrics Server container. If the error message isn't obvious or you suspect that it's a bug, then complete the steps in the Check GitHub for common issues section.Check GitHub for common issuesIf you still can't collect metrics from containers, pods, or nodes, then check GitHub for common issues with Metrics Server.Check your HPA and application resource requests for unknown metrics1.    To check the HPA configuration, run the following command:$ kubectl get hpa -n namespace 2048-deploymentNote: Replace namespace and 2048-deployment with the HPA configuration values for your application.You might see  under the Targets column of the output. See the following example:NAME              REFERENCE                    TARGETS         MINPODS   MAXPODS   REPLICAS   AGE2048-deployment   Deployment/2048-deployment   <unknown>/80%   1         2         2          10s2.    Wait several minutes, and then repeat the command from step 1.If you still receive the  error, run the following command:$ kubectl describe hpa -n <namespace> 2048-deploymentThen, check the Events section of the output for more information:Name:                                                  2048-deploymentNamespace:                                             2048-game...Metrics:                                               ( current / target )  resource cpu on pods  (as a percentage of request):  <unknown> / 80%Min replicas:                                          1Max replicas:                                          2Deployment pods:                                       2 current / 2 desiredConditions:  Type           Status  Reason                   Message  ----           ------  ------                   -------  AbleToScale    True    SucceededGetScale        the HPA controller was able to get the target's current scale  ScalingActive  False   FailedGetResourceMetric  the HPA was unable to compute the replica count: missing request for cpuEvents:  Type     Reason                   Age                     From                       Message  ----     ------                   ----                    ----                       -------  Warning  FailedGetResourceMetric  3m29s (x4333 over 19h)  horizontal-pod-autoscaler  missing request for cpuIf the Message column shows missing request for [x], then your Deployments or ReplicaSet probably isn't declaring resource requests in its specification. Confirm that all the containers in the pod have the requests declared.Leaving out a request can cause the metric in HPA to return the  response. For more information, see Managing resources for containers.Follow"


Question: How do I request a concurrency limit increase for my Lambda function?

I need to increase my AWS Lambda function's concurrency limit so the function doesn't get throttled.

Answer: "I need to increase my AWS Lambda function's concurrency limit so the function doesn't get throttled.Short descriptionTo increase your Lambda function's concurrency limit, you must open a quota increase case in the Service Quotas dashboard.For more information, see Lambda function scaling and managing concurrency for a Lambda function.Important: Increasing your concurrency limit can add cost to your AWS account. For more information, see AWS Lambda pricing. Your concurrency limit is shared across all of the functions in your account that are in a specific AWS Region.ResolutionConfirm that a concurrency limit increase is required for your use case by verifying the reason why your function is getting throttledFollow the instructions in How do I troubleshoot Lambda function throttling with "Rate exceeded" and 429 "TooManyRequestsException" errors?Make sure that you verify you're not exceeding the burst concurrency quota for a particular Region. If you're limited by burst scaling, configure provisioned concurrency for your function instead of increasing your concurrency limit.Also, make sure that you review your Concurrent executions metric in the Service Quotas dashboard to see your current concurrency usage.Calculate your required concurrency limitImportant: Make sure that you request a concurrency limit appropriate for your use case. AWS denies requests for high concurrency limits that don't have a valid use case.Multiply your function's average runtime duration in seconds by the average number of requests (invocations) the function receives per second. The result is your required concurrency limit.Important: If you're using unreserved concurrency, make sure that the limit isn't higher than the AWS Region concurrency limit.When calculating your required concurrency limit, keep in mind the following:The default concurrency limit per AWS Region is 1,000 invocations at any given time. However, note that new AWS accounts have reduced concurrency and memory quotas.The default burst concurrency quota per Region is between 500 and 3,000, which varies per Region.There is no maximum concurrency limit for Lambda functions. However, limit increases are granted only if the increase is required for your use case.To avoid throttling, it's a best practice to request a limit increase at least two weeks before the increase is needed.If you're using Lambda with CloudFront Lambda@Edge in Amazon CloudFront, then you must open a separate quota increase case for each Region.Example concurrency limit calculation60 second average function runtime duration x 20 requests on average per second = 1,200 required concurrency limitWrite a description of your Lambda function's use caseMake sure that your request for a concurrency limit increase includes the following details:Concurrency limit requestedAnticipated average number of requests that your function will receive per secondAnticipated highest number of requests that your function will receive per secondAnticipated runtime durationFunction memory sizeInvocation type (event or request-response)Event sourceLoad test results that explain the reason why the quota increase is neededAny additional information that will help us better understand your use caseOpen a quota increase case in the Service Quotas dashboard1.    Open the Service Quotas dashboard.2.    Choose the AWS Lambda card. The Lambda Service quotas page opens.3.    Choose Concurrent executions.4.    In the Recent quota increase requests pane, choose the Request quota increase button.5.    Enter your requested concurrency limit. Then, choose Request.Note: You can also choose the Quota Details button to display the following details:Previous quota requestsUtilization percentage of your current quotaAlarms and tags associated with your concurrency metricsAdd your Lambda function's use case description to your request1.    Open the Service Quotas dashboard.2.    In the navigation pane, choose Quota request history. A list of your quota requests appears.3.    Find your concurrency limit increase request. Then, choose the Status option next to the quota increase request. The status of your request and the associated support case link appears.Note: The initial status of a request is Pending. After the status changes to Quota requested, the AWS Support case number appears.4.    Choose the case number to open the ticket for your request.5.    In the ticket's comment thread, add the description of your Lambda function's use case.Note: You'll receive a status update email from AWS Support that either approves or denies the request. For more information, see Requesting a quota increase.Related informationOperating Lambda: Application design—scaling and concurrency: part 2Follow"


Question: Why does the SELECT COUNT query in Amazon Athena return only one record even though the input JSON file has multiple records?

"When I run SELECT COUNT(*) FROM TABLE, the output is "1," but the input file has multiple JSON records. I used org.openx.data.jsonserde.JsonSerDe to create the table."

Answer: "When I run SELECT COUNT(*) FROM TABLE, the output is "1," but the input file has multiple JSON records. I used org.openx.data.jsonserde.JsonSerDe to create the table.ResolutionWhen records aren't separated by a newline character (\n), the SELECT COUNT(*) FROM TABLE query returns "1."Example:{"ID":"1","MYTIMESTAMP":"2020-06-09 17:50:46.267","Name":"John"}{"ID":"2","MYTIMESTAMP":"2020-06-10 17:50:46.267","Name":"Joel"}{"ID":"3","MYTIMESTAMP":"2020-06-10 17:50:46.267","Name":"Patrick"}To correct this problem, be sure that the records are delimited by \n, as shown in the following example:{"ID":"1","MYTIMESTAMP":"2020-06-09 17:50:46.267","Name":"John"}{"ID":"2","MYTIMESTAMP":"2020-06-10 17:50:46.267","Name":"Joel"}{"ID":"3","MYTIMESTAMP":"2020-06-10 17:50:46.267","Name":"Patrick"}In this case, SELECT COUNT(*) FROM TABLE returns "3."Note: The SerDE expects each JSON document to be on a single line of text with no line termination characters separating the fields in the record. For more information, see Best practices for reading JSON data.Related informationSELECTCREATE TABLERunning SQL queries using Amazon AthenaFollow"


Question: How can I resolve a warning message that says "no privileges could be revoked for "public"" when trying to revoke access on the public schema of an Amazon RDS PostgreSQL DB instance?

I am trying to execute REVOKE CREATE ON SCHEMA public FROM PUBLIC on an Amazon Relational Database Service (Amazon RDS) PostgreSQL DB instance. But I receive the following warning message: "no privileges could be revoked for "public""How do I resolve this warning message?

Answer: "I am trying to execute REVOKE CREATE ON SCHEMA public FROM PUBLIC on an Amazon Relational Database Service (Amazon RDS) PostgreSQL DB instance. But I receive the following warning message: "no privileges could be revoked for "public""How do I resolve this warning message?Short DescriptionBy default, users can't access objects in schemas that they don't own. To use objects inside a schema, the USAGE privilege for that schema must be granted to the user. Similarly, for creating objects, the CREATE privilege must be granted on that schema. However, all users have CREATE and USAGE privileges on the public schema, so users who can connect to a database have privileges to create objects in the database's public schema. If you don't want all users to be able to create objects in a public schema, then revoke the privilege:REVOKE CREATE ON SCHEMA public FROM PUBLIC;Note: In this command, public is the schema, and PUBLIC means all users—public is an identifier and PUBLIC is a keyword.When you revoke the CREATE privilege on the public schema for an Amazon RDS PostgreSQL DB instance, you can receive a warning message that says "no privileges could be revoked for "public."" This warning message generally appears in RDS DB instances when the owner of public schema in the database that you are connected to is rdsadmin and not the database owner. The owner of the public schema, rdsadmin, occurs most often when the database is created using template0 instead of the default, which is template1. For more information, see the PostgreSQL documentation for Template Databases.In Amazon RDS PostgreSQL, the owner of database template0 is rdsadmin, and the owner of template1 is the master user. If you create a database using template0, then the public schema is owned by rdsadmin and not by your master user or database owner. See the following example database that is created using template0:testpg=> create database tmp0 template template0;CREATE DATABASEtmp0=> SELECT n.nspname AS "Name",  pg_catalog.pg_get_userbyid(n.nspowner) AS "Owner"FROM pg_catalog.pg_namespace nWHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'ORDER BY 1;List of schemasName  |  Owner   --------+----------public | rdsadmin(1 row)Because the owner is rdsadmin, a warning message is returned when the REVOKE command is executed:tmp0=> REVOKE CREATE ON SCHEMA public FROM PUBLIC;WARNING:  no privileges could be revoked for "public"REVOKEResolution1.    Change the owner of the public schema:ALTER SCHEMA public OWNER TO user1;Note: In this example command, user1 is the database owner.2.    Verify that the ownership is changed:SELECT n.nspname AS "Name",  pg_catalog.pg_get_userbyid(n.nspowner) AS "Owner"FROM pg_catalog.pg_namespace nWHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'ORDER BY 1;List of schemasName  |  Owner   --------+----------public | user1(1 row)3.    Execute the revoke command from inside the database using the user name that owns the database (user1).REVOKE CREATE ON SCHEMA public FROM PUBLIC;Related InformationPostgreSQL documentation for The Public SchemaPostgreSQL on Amazon RDSFollow"


Question: How can I grant permissions to newly created objects in Amazon Redshift?

My user received a permission denied error for a newly created object. How do I grant the user the required permissions to access newly created objects in the schema?

Answer: "My user received a permission denied error for a newly created object. How do I grant the user the required permissions to access newly created objects in the schema?Short descriptionFor a user to access newly created objects in the schema, privileges must be granted to the objects by a superuser.When a user isn’t able to access newly created objects in the schema, they might receive the following error:ERROR: permission denied for relation “objectname”.This error happens when access is granted for only the current objects present in a schema when the access was granted. By default, access isn’t automatically granted on future objects that are created under the schema.To resolve this issue, grant access privileges to the user using the ALTER DEFAULT PRIVILEGES command.ResolutionTo grant permissions for the current and future tables in the schema, do the following as a superuser:1.    To grant usage access on the schema and SELECT access on all tables currently present under the schema, run the following commands:Note: Replace newtestschema with the name of your schema and newtestuser with the name of the user.grant usage on schema newtestschema to newtestuser;grant select on all tables in schema newtestschema to newtestuser;2.    To grant SELECT access to the user for future tables created under the schema, run the following command: Note: Replace awsuser with the username that is used to create future objects under the schema, newtestschema with the schema name, and newtestuser with the username that needs access to future objects.alter default privileges for user awsuser in schema newtestschema grant select on tables to newtestuser;Note: Default privileges apply only to new objects. Running ALTER DEFAULT PRIVILEGES doesn’t change privileges on existing objects.3.    To verify default privileges have been granted to the user, run the following query as a superuser:select pg_get_userbyid(d.defacluser) as user, n.nspname as schema, case d.defaclobjtype when 'r' then 'tables' when 'f' then 'functions' end as object_type, array_to_string(d.defaclacl, ' + ')  as default_privileges from pg_catalog.pg_default_acl d left join pg_catalog.pg_namespace n on n.oid = d.defaclnamespace;If access is present, then you will see an entry for the user under the column default_privileges.Now, when the superuser creates a new object under the schema, the user will have SELECT access over the table.ExampleThe following example starts with this configuration:A user named newtestuser who isn’t a superuser.A schema named newtestschema and one table named newtesttable1 under the schema with a few records.The superuser named awsuser, grants access to newtestuser on newtestschema schema and all the tables currently present under the schema, using the following example command:grant usage on schema newtestschema to newtestuser;grant select on all tables in schema newtestschema to newtestuser;The preceding command grants newtestuser with SELECT access on the current tables present under the newtestschema. Currently, only the newtesttable1 table is present under the newtestschema. The newtesttable1 table is accessible to newtestuser.Next, awsuser creates another table named newtesttable2 under the newtestschema. If newtestuser runs a SELECT query on the table newtestschema.newtesttable2, they see the following error:ERROR: permission denied for relation newtesttable2.To resolve the error, the awsuser does the following:1.    Grants access to the table, newtesttable2, by running the following example command:grant select on table newtestschema.newtesttable2 to newtestuser;2.    Grants access to newtestuser, on any future tables created by awsuser under the newtestschema, by running the following example command:alter default privileges for user awsuser in schema newtestschema grant select on tables to newtestuser;Now, when awsuser creates another new table named newtesttable3, under the newtestschema, the newtestuser will have SELECT access on newtesttable3.3.    To verify default privileges have been granted to the newtestuser, the awsuser runs the following query:select pg_get_userbyid(d.defacluser) as user, n.nspname as schema, case d.defaclobjtype when 'r' then 'tables' when 'f' then 'functions' end as object_type, array_to_string(d.defaclacl, ' + ')  as default_privileges from pg_catalog.pg_default_acl d left join pg_catalog.pg_namespace n on n.oid = d.defaclnamespace;The output of the preceding query is similar to the following:user    | schema    | object_type    | default_privilegesawsuser | newtestschema    | tables    | newtestuser=r/awsuserThe output shows that awsuser grants SELECT privileges to newtestuser for all new tables created by awsuser in the newtestschema.Related informationPG_DEFAULT_ACLFollow"


Question: How do I migrate my DNS services from a third-party DNS provider to Amazon Lightsail?

I want to migrate my DNS services from a third-party DNS provider so that I can point my domain to an Amazon Lightsail instance? How do I do this?

Answer: "I want to migrate my DNS services from a third-party DNS provider so that I can point my domain to an Amazon Lightsail instance? How do I do this?Short descriptionThere are three scenarios for transferring your DNS services:Scenario A: Move the entire name server setup of your domain from the third-party DNS provider to Amazon Lightsail.Scenario B: Move the entire name server setup of your sub domain from a third-party DNS provider to AWS and not the entire domain.Scenario C: Point your domain (for example: xyz.abc.com) to the Lightsail instance, but don't move the DNS servers.ResolutionScenario A: Move the entire name server setup of your domain from the third-party DNS provider to Amazon Lightsail1.    Open the Amazon Lightsail console.2.    Select Networking, Create DNS Zone.Note: For more information on creating a DNS zone, see Create a DNS zone in the Lightsail console.3.    Enter the domain, and then select Create DNS Zone. An example domain is abc.com. You receive a set of four name servers.4.    Add more DNS records in the newly created DNS zone. Refer to the DNS record details in your current DNS provider. Copy all the records to your Lightsail DNS zone, one at a time.5.    After all the records are copied and you're ready to switch your domain's name server to Lightsail, go to your domain's current registrar portal. Replace the current name servers with the new servers you received in step 3. Replace the name servers in the name servers section in the domain's current registrar portal, not in the DNS zone of the current DNS provider.6.    Select Save.Note: Allow time for the name server change to propagate through the internet's DNS. This might take several hours.Scenario B: Move the entire name server setup of your sub domain from a third-party DNS provider to AWS and not the entire domain1.    Open the Amazon Lightsail console.2.    Select Networking, Create DNS Zone.Note: For more information on creating a DNS zone, see Create a DNS zone in the Lightsail console.3.    Enter the domain, and then select Create DNS Zone. An example domain is xyz.abc.com. You will receive a set of four name servers.4.    Open the DNS records at your third-party DNS provider. Create 4 new DNS records using NS as the record type. In this example, the record name is xyz and the value is each of the name servers you received in step 3.5.    Open the Amazon Lightsail console and then open the DNS zone. Create a DNS record pointing xyz.abc.com to the Lightsail instance. For more information see Add records to the DNS zone.Scenario C: Point your domain (for example: xyz.abc.com) to the Lightsail instance, but don't move the DNS serversIn this scenario, you don't need to create a Lightsail DNS zone. Create an A record in your third-party DNS provider for your domain (for example, xyz.abc.com). Then point it to the Lightsail instance's IP address. Now the website loads from the Lightsail instance.Note: It might take a few hours for DNS propagation.Related informationPointing your domains to your Amazon Lightsail distributionsFollow"


Question: How do I troubleshoot ConnectionReset errors when I upload or download objects from Amazon S3?

"When I upload or download objects in my Amazon Simple Storage Service (Amazon S3) bucket, I get one of the following errors: ConnectionResetError, Connection Aborted, or Connection reset by peer."

Answer: "When I upload or download objects in my Amazon Simple Storage Service (Amazon S3) bucket, I get one of the following errors: ConnectionResetError, Connection Aborted, or Connection reset by peer.ResolutionYou get connection reset errors because your application can't establish a connection to Amazon S3 endpoints. This might be because of connection closures or connections becoming inactive when S3 resources are accessed. These errors occur because of issues with the application or client layer, network path, or any intermediary resource. To identify the root cause of the issue, you must find out the component that's causing the error.Test connectivityTo test connectivity, run the following commands to check if your machine can establish a connection to S3 over HTTP or HTTPS.$ telnet mybucket.s3.REGION-CODE.amazonaws.com 80  $ telnet mybucket.s3.REGION-CODE.amazonaws.com 443Bypass SSL validationInclude the --no-verify-ssl parameter in your request to bypass SSL Validation. This parameter prevents the SSL certificates from getting validated. However, the request traverses over port 443. This approach helps you to isolate issues that are related to SSL validation.Analyze network trafficTake a packet capture to analyze the network traffic between your machine and Amazon S3. Analyze the packet capture to determine if the client or server throws the RST flag.If your network throws the RST flag, then note the IP address and the process when the RST flag is thrown. The processes include DNS lookup, TCP handshake, SSL handshake, and data transfer.If your network throws the RST flag during an SSL handshake, then be sure that your machine trusts the certificate that's returned by Amazon.Debug connectionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent version of the AWS CLI.Run the AWS CLI cp command from the machine where you got the error to try to connect to the Amazon S3 bucket. Include the --debug flag in the command:aws s3 cp/sync SOURCE_FILE_PATH/SOURCE_FILE_NAME DESTINATION --debugAnalyze the request headers, request method, and response. If the issue is intermittent and a few requests are successful, then check whether there are differences between a successful and an unsuccessful request.Check the output of the command to verify whether a proxy in the network environment causes the error. The output indicates a proxy error or proxy connection failure for errors that occur because of a HTTP proxy. If an SSL proxy caused the error, then you see one of the connection reset errors when the SSL handshake tries to be established.Check HTTP Keep-AliveTurn on HTTP Keep-Alive on your machine so that your machine uses a single TCP connection to remain open for multiple HTTP requests and responses. Run the following command to check if TCP Keep-Alive is turned on:curl -Iv s3.amazonaws.com 2>&1 | grep -i 'connection #0'When TCP Keep-Alive is turned on, the output shows the following string:Connection #0 to host s3.amazonaws.com left intactCheck intermediary resourcesIntermediary resources, such as a NAT gateway, firewall, or load balancer, might close the connection prematurely when these resources experience high utilization. Also, they might close the connection prematurely and mark it dead when data isn't written to or from the wire for a period of time.Follow"


Question: Why do I need to add a payment method if my account is covered by the AWS Free Tier?

My account is covered by the AWS Free Tier. Why do I need to add a payment method to my account?

Answer: "My account is covered by the AWS Free Tier. Why do I need to add a payment method to my account?ResolutionYou must add a valid credit card, debit card, or another payment method for your accounts covered under the AWS Free Tier for the following reasons:Accounts covered under the AWS Free Tier aren't restricted in what they can launch. As you ramp up with AWS, you might start using more than what's covered under the AWS Free Tier. Because these additional resources might incur charges, a payment method is required on the account.The AWS Free Tier doesn't cover all AWS services. For example, you might decide to purchase Reserved Instances, Amazon Route 53 domains, or an AWS Support subscription. These services require a valid payment method for activation.For more information, see How do I make sure that I don't incur charges when using the AWS Free Tier?Related informationAWS Free TierUsing the AWS Free TierFollow"


Question: Why is the RefreshCache operation taking a long time on my file gateway?

"I initiated the RefreshCache operation on my file gateway in AWS Storage Gateway. However, the operation is taking a long time to complete. What's the reason for this delay?"

Answer: "I initiated the RefreshCache operation on my file gateway in AWS Storage Gateway. However, the operation is taking a long time to complete. What's the reason for this delay?ResolutionThe RefreshCache operation identifies the changes (updates, uploads, or deletes) of Amazon Simple Storage Service (Amazon S3) objects since the last time the gateway identified and cached the objects. To do this operation, the file gateway runs a recursive LIST operation on the S3 bucket, and then runs a HEAD object operation on every object that comes back from the LIST operation. The HEAD operation grabs the metadata, which is then stored in the file gateway cache.The following factors can impact how long it takes for a RefreshCache operation to complete:If there's a large number of objects in the S3 bucket, then the run time of RefreshCache increases. This is because the file gateway runs a HEAD object against all objects in the bucket.RefreshCache operations are specific to individual file shares within a file gateway. One file share supports two RefreshCache API operations at any given time. If you send more requests to initiate a cache refresh, then more operations are triggered even before the completion of operations that are in progress. This can result in an InvalidGatewayRequestException error.S3 buckets can support 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix. These supported requests rates also apply to the requests made by the file gateway to your S3 buckets, which impacts how quickly a RefreshCache operation can be completed. The run time of RefreshCache can increase if the S3 bucket is also being used by services other than the file gateway.Consider the following ways you can decrease the run time of a RefreshCache operation:You can reduce the number of objects in the bucket.You can deploy multiple file shares that correspond to separate prefixes in the S3 bucket, instead of having one file share for the entire bucket.Note: You can create up to 10 file shares for an individual file gateway. Because the RefreshCache operations are run per file share, this approach can help reduce the time it takes to complete individual RefreshCache operations.If you're using one file share for an entire S3 bucket, consider focusing the RefreshCache operations on specific prefixes or folders of the bucket that are being updated with new objects. This reduces the scope of the operation, which can help reduce the run time. You can target RefreshCache operations to specific folders when you run the operation using the AWS Command Line Interface (AWS CLI) or the Storage Gateway API. This option is currently not available in the Storage Gateway console.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.You can run the RefreshCache operation during off-peak times for other requests to the S3 bucket. You can use AWS Lambda and Amazon CloudWatch to trigger the operation on a timer.Related informationAutomating cache refresh process for File Gateway on AWS Storage GatewayFollow"


Question: Why does Amazon Redshift run the COPY ANALYZE process when STATUPDATE is turned off?

I tried to use the COPY command to load data into a new table in Amazon Redshift. I even added the COMPUPDATE OFF parameter. Why does COPY ANALYZE still run?

Answer: "I tried to use the COPY command to load data into a new table in Amazon Redshift. I even added the COMPUPDATE OFF parameter. Why does COPY ANALYZE still run?Short descriptionBefore you create a table in Amazon Redshift, select the distribution style of your table. If a table doesn't specify a distribution style, it defaults to AUTO distribution. Amazon Redshift's AUTO distribution feature then uses the COPY ANALYZE process to determine whether the table should use EVEN or ALL distribution.Note: The COMPUPDATE OFF parameter still runs COPY ANALYZE on tables using an AUTO distribution style. The STATUPDATE OFF parameter does not disable or repress the COPY ANALYZE command.Resolution1.    Verify the current distribution style of a table by running a SHOW TABLE:SHOW TABLE [schema_name.]table_nameNote: By default, Amazon Redshift applies AUTO distribution if a distribution style isn't specified in the CREATE TABLE statement.2.    If AUTO distribution is turned on, then create a table with a defined distribution style. Specifying a distribution style prevents COPY ANALYZE from running.The following example specifies an EVEN distribution style:create table rs_example_test (id int)diststyle even;For more information about distribution styles, see Working with data distribution styles.3.    Use the COPY command to load the data into your table, and then append it with the STATUPDATE OFF parameters.Note: It's a best practice to use the COPY command to load large amounts of data, instead of using individual INSERT statements. This minimizes the risk of performance issues.4.    Run a query on the SVL_STATEMENTTEXT system table, and then filter by the process ID (PID) related to your session:select userid, xid, pid, trim(label) as label, starttime, endtime, sequence, trim(type) as type, left(text,60) text from svl_statementtext where pid = 26815 order by xid, starttime, sequence;The syntax above checks whether COPY ANALYZE ran as part of the COPY transaction.The output will look similar to the following:userid      xid            pid    label      starttime            endtime               sequence     type      text100       78915    26815   default      2019-03-19  14:06:19    2019-03-19 14:06:21   0             QUERY      copy rs_test3 from 's3://xxxxx-rs-log/AWSLogs/rs_test2.csv'\100       78915    26815   default      2019-03-19  14:06:21    2019-03-19 14:06:21   0             UTILITY  COMMITThis confirms that COPY ANALYZE no longer runs as part of the COPY transaction.Related informationUse a staging table to perform a merge (upsert)Follow"


Question: How do I connect a Lambda function to a dedicated VPC?

I want to connect an AWS Lambda function to resources in a dedicated virtual private cloud (VPC). How do I set that up?

Answer: "I want to connect an AWS Lambda function to resources in a dedicated virtual private cloud (VPC). How do I set that up?Short descriptionLambda doesn't support running functions in dedicated tenancy VPCs. To connect a Lambda function to a dedicated VPC, first peer the dedicated VPC to a default tenancy VPC that contains the function.The solution requires using an Amazon Elastic Compute Cloud (Amazon EC2) Dedicated Instance. Note that your AWS account incurs charges for this instance. For more information on Amazon EC2 instance tenancy and VPCs, see Dedicated Instance basics.ResolutionNote: The following procedure requires you to understand Node.js and how to create a Lambda function.Create and configure a default tenancy VPC and a dedicated tenancy VPCNote: If you choose to use different CIDR blocks than the ones provided, make sure that the two VPCs have different, non-overlapping blocks.1.    In the Amazon VPC console, create a default tenancy VPC that has the following settings:For IPv4 CIDR block, enter 12.0.0.0/16.For Tenancy, choose Default.2.    Create a dedicated tenancy VPC that has the following settings:For IPv4 CIDR block, enter 11.0.0.0/16.For Tenancy, choose D****edicated.3.    Create an internet gateway and attach it to your dedicated tenancy VPC.Note: The internet gateway is required for the HTTP server that you'll create later, in the Test connectivity section. For more information, see Enabling internet access.4.    Create subnets in each of your VPCs. For your default tenancy VPC, create two or more subnets across different Availability Zones.Note: Creating more than one subnet across different Availability Zones is a best practice for redundancy. Doing this also allows Lambda to provide high availability for your function. For multiple subnets in each VPC, use a subset of the VPC's CIDR block. If you create one subnet only in a VPC, then you can use the same CIDR block as the VPC. For more information, see VPC and subnet sizing for IPv4.5.    Create a VPC peering connection between the two VPCs that you created. On the Create Peering Connection page, do the following:(Optional) For Peering connection name tag, enter a name for the VPC peering connection.For VPC (Requester), choose the default tenancy VPC that you created.For Account, make sure that My account is selected.For Region, make sure that This region is selected.For VPC (Accepter), choose the dedicated tenancy VPC that you created.Choose Create Peering Connection.6.    Accept the VPC peering connection.7.    Add routes to each of your new VPCs' route tables as shown in the following examples. When creating the route tables, make sure that you do the following:For the Target values starting with pcx-..., choose Peering Connection. Then, choose the peering connection that you created.For the Target value starting with igw-..., choose Internet Gateway. Then, choose the internet gateway that you created.For more information, see Adding and removing routes from a route table.Example default tenancy VPC route tableDestinationTargetStatusPropagated12.0.0.0/16LocalActiveNo11.0.0.0/16pcx-1a2b3c4d5e6f7g8h9ActiveNoExample dedicated tenancy VPC route tableDestinationTargetStatusPropagated11.0.0.0/16LocalActiveNo12.0.0.0/16pcx-1a2b3c4d5e6f7g8h9ActiveNo0.0.0.0/0igw-12345678a90b12c34ActiveNoCreate a Lambda execution role for Amazon VPCNote: If you already have a Lambda execution role for Amazon VPC access, skip this section.1.    In the AWS Identity and Access Management (IAM) console, in the left navigation pane, choose Roles.2.    In the Roles pane, choose Create role.3.    On the Create role page, do the following:For Select type of trusted entity, choose AWS service.For Choose the service that will use this role, choose Lambda.Choose Next: Permissions.4.    For Attach permissions policies, search for AWSLambdaVPCAccessExecutionRole. Choose the policy with that name, and then choose Next: Tags.5.    (Optional) Add tags that allow you to identify and organize the new resource.6.    For Review, enter the following:For Role name, enter a name for the Lambda execution role. For example, lambda_vpc_basic_execution.(Optional) For Role description, edit the description.Choose Create role.Create a new Lambda function for testingCreate a new function using the Lambda console or by building and uploading your own deployment package. When you create the new function, make sure that you do the following:Create the function in the same AWS Region as your default tenancy VPC.Attach the execution role that you created (for example, lambda_vpc_basic_execution) to the function.Example function code that uses the native HTTP interface in Node.jsvar http = require('http')     exports.handler = (event, context, callback) => {    const options = {        hostname: event.Host,        port: event.Port    }        const response = {};       http.get(options, (res) => {        response.httpStatus = res.statusCode        callback(null, response)    }).on('error', (err) =>{        callback(null, err.message);    })   };Connect your Lambda function to your VPC1.    In the Lambda console, on the Configuration tab, choose VPC. Then, choose Edit and do the following:For Virtual Private Cloud (VPC), choose the default tenancy VPC that you created.For Subnets, choose two or more subnets in your VPC.For Security groups, choose a security group.Note: The default security group is sufficient for most use cases. For more information, see Security groups for your VPC.2.    Choose Save.Test connectivity1.    Launch an EC2 instance in your dedicated tenancy VPC.Note: To connect to the EC2 instance later, you'll need a public IPv4 address that you can assign during setup. Or, you can associate an elastic IP address with your instance after setup. You must choose an EC2 instance type that's supported as a Dedicated Instance. Note that your AWS account incurs charges for this instance.2.    Verify that the network access control lists (ACLs) for both VPCs allow traffic for the following:The port that you're testing (80).Your dedicated EC2 instance's security group.3.    Connect to your EC2 instance.4.    Run the following command to launch an HTTP server on your EC2 instance:# If python version is 2.x:$ sudo python -m SimpleHTTPServer 80# If python version is 3.x$ sudo python -m http.server 805.    In the Lambda console, configure a test event for your function. Use the following example JSON code snippet for your event:Note: Replace yourHost with the local IP address of your EC2 instance.{  "Host": "yourHost",  "Port": 80}6.    In the Lambda console, choose Test.7.    Choose Details to check the execution result for a 200 response code to confirm that the connection was successful.Example 200 response code{  "statusCode": 200}If the function output shows non-nil values for average, max, and min latency, then your VPC peering connection is set up correctly.Note: If Lambda times out, make sure that your security groups are configured correctly. If you get an ECONNREFUSED error, make sure that your HTTP server is running.Related informationDedicated InstancesWhat is VPC peering?Configuring a Lambda function to access resources in an Amazon VPCBuilding Lambda functions with Node.jsBest practices for working with AWS Lambda functionsFollow"


Question: What are the minimum IAM permissions needed to set up communication between Amazon Lightsail and other AWS services using VPC peering?

I want to set up communication between Amazon Lightsail and other AWS Services using VPC peering. What are the minimum Identity and Access Management (IAM) permissions I need to do this?

Answer: "I want to set up communication between Amazon Lightsail and other AWS Services using VPC peering. What are the minimum Identity and Access Management (IAM) permissions I need to do this?ResolutionAmazon Lightsail requires a peering connection with your VPC to connect to other AWS resources, such as an Amazon Relational Database Service (Amazon RDS) databases. Along with Lightsail permissions, the IAM entity requires certain Amazon Elastic Compute Cloud (Amazon EC2) permissions to establish and create a VPC peering connection with Lightsail.Prerequisite: To set up VPC peering in Lightsail, you must have a default Amazon VPC. If you don’t have a default Amazon VPC, then you can create one. To learn more, see Create a default VPC. Because AWS Regions are isolated from one another, a VPC is also isolated in the Region where you created it. You must set up VPC peering in each Region where you have Lightsail resources.It's a best practice to grant the IAM user the minimum permissions necessary for creating the connection. You can specify only the necessary Amazon EC2 actions within the policy. The following example policy includes actions for accessing the EC2 endpoint, accept peering connections, and editing the existing route table to accommodate this connection.{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "ec2:DeleteNetworkInterfacePermission",                "ec2:CreateNetworkInterfacePermission",                "ec2:AcceptVpcPeeringConnection",                "ec2:DescribeVpcs",                "ec2:CreateRoute",                "ec2:DescribeVpcPeeringConnections",                "ec2:DeleteRoute",                "ec2:ModifyVpcPeeringConnectionOptions",                "ec2:DescribeRouteTables",                "ec2:DescribeSecurityGroups",                "lightsail:*"            ],            "Resource": "*"        }    ]}The preceding policy gives full access to Amazon Lightsail ("lightsail:*"). If your IAM entity is using a restrictive policy for Amazon Lightsail, (not "lightsail:*"), make sure that you include "lightsail:PeerVpc" and "lightsail:UnpeerVpc". In this case, you might not be able to use the Amazon Lightsail console to perform the peering actions. Instead, you can use AWS API calls such as PeerVpc and UnpeerVpc to set up the peering connection.The following are sample AWS Command Line Interface (AWS CLI) calls to set up the peering connection.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Create VPC peering connectionaws lightsail peer-vpc --region regionNameCheck VPC peering connectionaws lightsail is-vpc-peered --region regionNameDelete VPC peering connectionaws lightsail unpeer-vpc --region regionNameReplace regionName with the correct Region where you want to add the VPC peering.Note: Other actions require additional permissions not included in this policy. For example, exporting Lightsail snapshots to Amazon EC2, or accessing other AWS services using this Lightsail VPC peering connection require additional permissions.Follow"


Question: What are the guidelines for adding ADS session variables with values provided from segmentation UPID tokens in MediaTailor?

I want to add ADS session variables with values provided from segmentation UPID tokens in AWS Elemental MediaTailor. What are the guidelines for doing this?

Answer: "I want to add ADS session variables with values provided from segmentation UPID tokens in AWS Elemental MediaTailor. What are the guidelines for doing this?Short descriptionMediaTailor can send specific data within the SCTE-35 segmentation unique program ID (UPID). MediaTailor parses the UPID and sends the tokens to the ad decision server (ADS) as session variables. If the payloads are formatted correctly, then you can send a variety of private data payloads.ResolutionThe following are guidelines on the segmentation UPID formatting requirements and example segmentation UPIDs. The functionality works for DASH and HLS. DASH requires the binary marker to work with XML EventStreams.GuidelinesThe segmentation UPID must have the following:A segmentation_upid_type of 12.A format_identifier, consisting of any four bytes.The MediaTailor solution works with any ADS platform and the number of tokens isn't fixed.The decoded SCTE-35 segmentation UPID can contain one or more colon delimiters. If there is no colon delimiter, then the UPID is considered a single value. Colon delimiters allow for one or more values.The number of template variables and decoded UPID tokens must be equal, as shown in the following examples:https://domain/ads?sur0=[scte.segmentation_upid.private_data.0]&sur1=[scte.segmentation_upid.private_data.1]:46175218:46175218/5ADS URL template variables default to empty if they find an invalid string, for example, https://domain/ads?sur0=&sur1=&sur2=.The limits and format structure follows the ANSI/SCTE 35 2019 section 10.3.3.3 specification. This specification is as follows:SyntaxBitsMnemonicMPU() {         format_identifier          private_data }32N*8uimsbfuimsbfformat_identifier is a 32-bit unique identifier as defined in ISO/IEC 13818-1 and registered with the SMPTE Registration Authority.private_data is a variable length, byte-aligned set of data as defined by the registered owner of theformat_identifier field value. The length is defined by thesegmentation_upid_length, which includes theformat_identifier field length.Example of segmentation UPID usageSCTE source/DBlAAAAAAAAAP/wFAUAFlNif+//5KMqQ/4AUmXAAAAAAAA9AAhDVUVJAAAAAAIxQ1VFSQAWU2J/wAAAUmXADB15aml0OjQ2MTc1MjE4OjQ2MTc1MjE4LzU6NDA1MwAAAAAAAIu9c38=Decoded SCTEMediaTailor parses the UPID and assumes the first four bytes are the format_identifier. If the format_identifier is missing, then the private_data truncates the first four bytes. This might cause problems with the ADS expecting a different value. For example, if the UPID is written as 123456 instead of ABCD123456 (where ABCD is the format_identifier), then MediaTailor interprets 1234 as the format identifier and the rest of the UPID as 56. This causes the ADS call to be made with 56 instead of 123456."segmentation_upid_type": 12,                  "segmentation_upid_type_name": "MPU",                  "segmentation_upid_length": 29,                  "segmentation_upid": {                        "format_identifier": "0x796a6974",                        "private_data": "0x3a34363137353231383a34363137353231382f353a34303533"                  },Decoded UPID (Private data)ABCD:46175218:46175218/5:4053The preceding bytes, if present, are the ASCII encoded HyLDA (FreeWheel) fields separated by colons.In this example, the tokens map to session variables where the token order is :Airing ID:Break ID:Channel ID. The token is then sent to the ad server (ADS). This example uses FreeWheel as the ad server. MediaTailor also works with other ad servers.Example segmentation UPIDs:DS8291:33129DS:SAD123 is considered valid.:46175218:46175218/5:4053 is considered valid.:46175218::4053 is considered invalid due to the use of the double colon with no value in between.:461752@a:46175218/5:4053 is considered valid.:: is considered invalid due to the use of the double colon with no values before, between, or at the end.Example session variables_fw_hylda=aiid=[scte.segmentation_upid.private_data.0]&abid=[scte.segmentation_upid.private_data.1]&acid=[scte.segmentation_upid.private_data.2]_fw_hylda=aiid=46175218&abid=46175218/5&acid=4053_fw_hylda=aiid%3D46175190%26abid%3D46175190%2F2%26acid%3D4053Related informationUsing session variablesFollow"


Question: Why can't my third-party SSL provider verify my Route 53 domain ownership?

"I host my domain on Amazon Route 53. However, a third-party SSL provider can't verify my domain ownership and therefore can't issue an SSL certificate."

Answer: "I host my domain on Amazon Route 53. However, a third-party SSL provider can't verify my domain ownership and therefore can't issue an SSL certificate.ResolutionThird-party SSL providers require domain owners to create a DNS record to verify domain ownership. To create a DNS record, complete the following steps.Note: If you have an SSL from AWS Certificate Manager, then use DNS to validate your domain ownership. If you don't have permission to modify DNS records, then use email to validate your domain ownership.Open the Route 53 console.Choose Hosted zones.Select your domain name and choose Go to Record Sets.Choose Create Record Set.For Record name, enter the unique DNS name of the validation record from your SSL provider.Note: If your SSL provider requires that you create the record at the root of your domain (example.com), then leave the Record name field blank. However, you can't leave this field black for CNAME validation records.For Type, choose the record type required for validation by your SSL provider. Typically, the type is TXT or CNAME.Enter the value that you received from your SSL provider in the Value field.Choose Create.After you create the record, check if your CNAME resolves correctly. To check your record, use any DNS record lookup tool, such as dig or nslookup:$ dig CNAME _test.example.com$ nslookup _test.example.com -type=CNAMEIf the DNS lookup returns the correct value of your validation record, then Route 53 successfully propagated your CNAME record. Your SSL provider can resolve the validation record and issue your SSL certificate for the domain.The time frame to receive a certificate after the record resolves depends on your SSL provider systems. For some third-party providers, it can take up to 72 hours to receive an SSL certificate.Related informationDNS validationFollow"


Question: Why are the emails that I send using Amazon SES getting marked as spam?

The emails that I send using Amazon Simple Email Service (Amazon SES) are landing in recipient spam folders. How can I prevent my emails from getting flagged as spam?

Answer: "The emails that I send using Amazon Simple Email Service (Amazon SES) are landing in recipient spam folders. How can I prevent my emails from getting flagged as spam?Short descriptionAn email that lands in a spam folder indicates that Amazon SES successfully delivered the email to the recipient's mail server. After the email is delivered, Amazon SES has no control over the email and can't guarantee inbox placement. Internet service providers (ISPs) use different mechanisms and algorithms to filter emails to place them in either the recipient's inbox folder or spam folder.ResolutionThe following are steps that you can take to minimize the chances of your emails landing in a recipient's spam folder:Send high-quality email. Although you can't control the mechanisms that ISPs use to filter email, there are a number of ways that you can maximize your email deliverability. For more information, see Understanding email deliverability in Amazon SES.Authenticate your emails. When you authenticate your email, you verify that you're the owner of the account. To learn how you can authenticate your emails, see Email authentication methods.Monitor your Amazon SES sender reputation. Use the information from the reputation metrics page in the Amazon SES console to handle the bounces and complaints. Make sure that you maintain a bounce rate under 5 percent, and a complaint rate under 0.1 percent.If you use a dedicated IP address, then you can maintain your IP address reputation by isolating your sender reputation.To learn more about best practices for sending emails with Amazon SES, see Tips and best practices.If you followed all best practices and your emails still land in the spam folder, then contact the ISP for more information about their spam classification.Related informationHow email sending works in Amazon SESBounce and complaint ratesFollow"


Question: What payment methods does AWS accept?

I want to know what payment methods I can use to pay my AWS bill.

Answer: "I want to know what payment methods I can use to pay my AWS bill.ResolutionAvailable payment methods vary by AWS seller of record information. The name of the AWS seller of record is noted on your invoice.Amazon.com gift cards aren't an accepted payment method for AWS services.Accepted payment methods by AWS seller of record:Amazon Web Services Inc. (AWS Inc.) and AWS MarketplaceCredit and debit cards issued by Visa, MasterCard, American Express (only in USD), Discover, Diners Club, Japan Credit Bureau (JCB), Amazon Store Card, and many others.China Union Pay (CUP) credit card.ACH direct debit payments (for qualifying customers).Amazon Web Services EMEA SARL (AWS Europe) and AWS Marketplace EMEA SARLCredit and debit cards issued by Visa, MasterCard, or American Express.SEPA direct debit payments (for qualifying customers).Amazon AWS Serviços Brasil Ltda. (AWS SBL)Credit cards issued by Visa, MasterCard, American Express, or Elo.Amazon Web Services South Africa (Pty) Ltd (AWS South Africa)Credit and debit cards issued by Visa or MasterCard.Amazon Web Services Korea LLC (AWS Korea LLC)Credit and debit cards issued by Visa, MasterCard, American Express, China Union Pay (CUP), Japan Credit Bureau (JCB), SamsungCard, HyundaiCard, and many others.Amazon Web Services Singapore Private Limited (AWS Singapore)Credit and debit cards issued by Visa, MasterCard, American Express, or China Union Pay (CUP).Amazon Web Services New Zealand Limited (AWS New Zealand)Credit and debit cards issued by Visa, MasterCard, or American Express.Amazon Web Services Australia Pty Ltd (AWS Australia)Credit and debit cards issued by Visa, MasterCard, American Express, or China Union Pay (CUP).Amazon Web Services Canada, Inc. (AWS Canada)Credit and debit cards issued by Visa, MasterCard, or American Express.Amazon Web Services Japan G.K. (AWS Japan)Credit and debit cards issued by Japan Credit Bureau (JCB), Visa, MasterCard, American Express, China Union Pay (CUP), or Diners Club.Amazon Web Services India Private Limited (AWS India) accountsCredit and debit cards issued by Visa, MasterCard, RuPay, or American Express.Net Banking enabled bank accounts, see Make a payment using net banking.Amazon Web Services Malaysia Sdn. Bhd. (AWS Malaysia)Credit and debit cards issued by Visa, MasterCard, or American Express.Note: PayPal is not an accepted payment method.Related informationHow do I change the default payment method associated with my AWS account?Why was my credit card declined when I tried to pay my AWS bill?What currencies does AWS currently support?Can I use more than one payment method to pay my AWS charges?Follow"


Question: How do I expand the Amazon EBS root volume of my Amazon EC2 Linux instance?

How do I use Amazon Elastic Block Store (Amazon EBS) Elastic Volumes functionality to expand the EBS root volume of my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance?

Answer: "How do I use Amazon Elastic Block Store (Amazon EBS) Elastic Volumes functionality to expand the EBS root volume of my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance?Short descriptionExpand the EBS root volume of EC2 Linux running on a current generation instance without detaching and reattaching the volume by using the Amazon EBS Elastic Volumes feature. To expand the EBS root volume of EC2 Linux running on a previous generation instance, you must detach and then reattach the volume.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Before modifying your EBS volume1.    Review the requirements when modifying volumes to avoid failure during modification.2.    Review the best practices for volume performance on Linux instances. This will allow the modified volume to provide the performance characteristics required for your scenario.3.    Review how to modify your EBS volume to identify and address any potential issues before you expand your volume. For example, volumes attached to current generation instances before November 3, 2016 require that you either stop and restart the instance or that you detach and reattach the volume to initialize the Amazon EBS Elastic Volumes feature. This is a one-time requirement.Warning: Stopping an instance erases the data on any instance store volumes. Therefore, if you have any data on instance store volumes that you want to keep, be sure to back it up to persistent storage.To determine your volume's creation date, open the Amazon EC2 console, and then choose Volumes. The Created field lists the volume's creation date.To display the volume's most recent attachment time, which might be more recent than the creation time, use the AWS Command Line Interface (AWS CLI).The following command issues a query for volumes that were most recently attached before the cutoff date:aws ec2 describe-volumes --region us-east-1 --query "Volumes[?Attachments[?AttachTime<='2016-11-01']].{ID:VolumeId}" --output textThe output is a text list of IDs for volumes that need attention:vol-0EXAMPLEvol-5EXAMPLEvol-4EXAMPLEvol-bEXAMPLEvol-0db1c57561EXAMPLEvol-06f90d0c16EXAMPLEIf you can't use Amazon EBS Elastic Volumes, then expand the EBS root volume of your EC2 Linux instances.Modify the EBS volume1.    Use Amazon EBS Elastic Volumes for EC2 instances. Request modifications to your EBS volumes to expand the EBS root volume of your EC2 Linux instance.2.    Extend the Linux file system after you expand the EBS root volume of your EC2 Linux instance.Related informationHow do I convert my EC2 Ubuntu instance's default MBR partitioning scheme to GPT in order to bypass the 2 TiB limit for MBR partitions on my EBS volume?Amazon EC2 instance root device volumeFollow"


Question: How do I modify the IPv4 CIDR block of my Amazon VPC?

I want to change the IPv4 CIDR block of my Amazon Virtual Private Cloud (Amazon VPC).

Answer: "I want to change the IPv4 CIDR block of my Amazon Virtual Private Cloud (Amazon VPC).Short descriptionIt's not possible to change or modify the IP address range of an existing virtual private cloud (VPC) or subnet. However, you can do one of the following:Add an additional IPv4 CIDR block as a secondary CIDR to your VPC.Create a new VPC with your preferred CIDR block and then migrate the resources from your old VPC to the new VPC (if applicable).ResolutionAdd a secondary IPv4 CIDR block to your VPCTo extend the IPv4 address range of your VPC, see Add an IPv4 CIDR block to your VPC. Make sure that you follow the CIDR block association restrictions.If your depleted CIDR block is a secondary CIDR block, then associate another CIDR block with a new IP address range.Note: By default, a local route is added to all routing tables in the VPC for every CIDR block associated with the VPC. This allows you to route traffic between the primary and secondary CIDR resources without additional routing. To restrict unintended traffic, use security groups and network access control lists (network ACLs).Create a new VPC with a different IPv4 CIDR block and migrate your resources (if applicable)If extending your VPC's IP address range with an additional IPv4 CIDR block isn't an option, you can create a new VPC with your preferred IPv4 CIDR block. Then, manually migrate all of your existing resources to the new VPC (if applicable).Note: After you complete migrating all of the resources to your new VPC, you can delete all underlying resources in your old VPC. You can delete all of the following:Terminating all instances running in the VPC.Deleting all security groups associated with the VPC (except the default one).Deleting all route tables associated with the VPC (except the default one),Deleting any other resources as needed.After you delete the underlying resources, you can delete your old VPC.Related informationHow do I move my EC2 instance to another subnet, Availability Zone, or VPC?How do I change the VPC for an Amazon RDS DB instance?I tried to delete my Amazon VPC, but I received a dependency error. How can I delete my Amazon VPC?Follow"


Question: How do I issue a bulk upload to a DynamoDB table?

I want to upload data in bulk to my Amazon DynamoDB table.

Answer: "I want to upload data in bulk to my Amazon DynamoDB table.ResolutionTo upload data to DynamoDB in bulk, use one of the following options.BatchWriteItemTo issue multiple PutItem calls simultaneously, use the BatchWriteItem API operation. You can also use parallel processes or threads in your code to issue multiple parallel  BatchWriteItem API calls. This makes the data load faster.AWS Data PipelineIf the data is in Amazon Simple Storage Service (Amazon S3), then you can use AWS Data Pipeline to export to DynamoDB. Data Pipeline automates the process of creating an Amazon EMR cluster and exporting your data from Amazon S3 to DynamoDB in parallel BatchWriteItem requests. When you use Data Pipeline, you don't have to write the code for the parallel transfer. For more information, see Importing data from Amazon S3 to DynamoDB.Import Table featureIf the data is stored in Amazon S3, then you can upload the data to a new DynamoDB table using the Import Table feature. This feature supports CSV, DynamoDB JSON, or Amazon ION format in either compressed (GZIP or ZSTD) or uncompressed format. For more information, see DynamoDB data import from Amazon S3: how it works.Amazon EMRTo upload data to DynamoDB with Amazon EMR and Apache Hive, complete the following steps:1.    Create an EMR cluster:For Release, choose emr-5.30.0 or later.For Applications, choose an option that includes Hive.2.    Create an external Hive table that points to the Amazon S3 location for your data.3.    Create another external Hive table, and point it to the DynamoDB table.4.    Use the INSERT OVERWRITE command to write data from Amazon S3 to DynamoDB. For more information, see Importing data to DynamoDB.AWS Database Migration Service (AWS DMS)You can use AWS DMS to export data from a relational database to a DynamoDB table. For more information, see Using an Amazon DynamoDB database as a target for AWS Database Migration Service.AWS GlueIf you exported your upload data to Amazon S3 from a different DynamoDB table using the DynamoDB export feature, then use AWS Glue. This option is efficient for uploading large datasets. This is because the export feature uses the DynamoDB backup functionality, and it doesn't scan the source table. AWS Glue doesn't impact the performance or availability of the source table. For more information, see Using AWS Glue with Amazon DynamoDB as source and sink.Follow"