Question: How do I troubleshoot an "invalid SAML response" error for Okta and AWS IAM Federation?

"When I log into AWS with Okta, I receive an invalid SAML error similar to:"Your request included an invalid SAML response. To logout, click here".How do I troubleshoot this error?"

Answer: "When I log into AWS with Okta, I receive an invalid SAML error similar to:"Your request included an invalid SAML response. To logout, click here".How do I troubleshoot this error?Short descriptionWhen you use the AWS Account Federation in Okta, you might receive an invalid SAML error when logging into AWS. This can happen if you provide missing or incorrect information for the role attribute in a SAML response. The expected value of this attribute is one or more comma-separated pairs of an AWS Identity and Access Management (IAM) role and the SAML provider, as shown here:<Attribute Name="https://aws.amazon.com/SAML/Attributes/Role">  <AttributeValue>arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_NAME_1,arn:aws:iam::ACCOUNT_NUMBER:saml-provider/PROVIDER_NAME/AttributeValue>  <AttributeValue>arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_NAME_2,arn:aws:iam::ACCOUNT_NUMBER:saml-provider/PROVIDER_NAME</AttributeValue>  <AttributeValue>arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_NAME_3,arn:aws:iam::ACCOUNT_NUMBER:saml-provider/PROVIDER_NAME</AttributeValue></Attribute>To check your SAML response from your browser, follow the steps in How to view a SAML response in your browser for troubleshooting.ResolutionIf you are using the Use Group Mapping setting in Okta, follow the steps under Connect to Okta with multiple AWS accounts. If not, go to Connect to Okta with a single AWS account. Connect to Okta with multiple AWS accountsIf you connect to Okta with multiple AWS accounts, then Okta uses group-based role mapping. This means that Okta uses the Group Name to identify the AWS account ID and IAM role name for SSO.Note: Be sure to enter the Group Filter and Role Value Pattern correctly in Okta to accurately capture the information:1.    Login to the Okta admin console.2.    Choose Applications, and then choose Applications again.3.    Choose Sign On, and then choose Edit.4.    The Group Filter is a custom Regex expression that captures information like the AWS account ID and IAM role name for your Okta Group name. For more information, see Okta's setup document.The setup guide gives this example:Group name: "aws#[account alias]#[role name]#[account #]" Group Filter: "^aws\#\S+\#(?{{role}}[\w\-]+)\#(?{{accountid}}\d+)$"You can extend this example if you want to customize the Group Name. See these examples of Group Names and Group Filters:Group Name: [account alias]|[role name]|[account #] Group Filter: ^\S+\|(?{{role}}[a-zA-Z0-9+=.@\-_]+)\|(?{{accountid}}\d+)$Group Name: aws_[account #]_[role name] Group Filter: ^aws\_(?{{accountid}}\d+)\_(?{{role}}[a-zA-Z0-9+=.@\-_]+)$Note:The IAM role name allows alphanumeric and '+=,.@-_' characters. Consider using delimiters that are not part of your Role Name (e.g. '#' or '|') if you get an error caused by the group filter.Your IAM role name should not contain ',' if you want to login using IAM Federation. This is because the Role Value Pattern shown below uses a comma to separate the SAML provider and role name. Create a new IAM role without a comma in the name to use with IAM Federation.5.    The Role Value pattern must contain the ARN of the IAM role and SAML provider, separated by a comma. Replace the SAML Provider Name in this example with the Provider name of the Okta instance. You can find this information in AWS IAM console, under Identity providers.arn:aws:iam::${accountid}:saml-provider/[SAML Provider Name],arn:aws:iam::${accountid}:role/${role}Note: The SAML Provider Name must be identical for all your AWS accounts.6.    Choose Save.7.    Test the user login from Okta to AWS to confirm if the error resolved.Connect to Okta with a single AWS accountFor a single account setup, Okta automatically sets up the Role Value Pattern. If you are seeing the "Your request included an invalid SAML response. To logout, click here" error for a single account integration, raise a support case with Okta to investigate the issue.Related informationError: Your request included an invalid SAML response. to logout, click hereHow to configure SAML 2.0 for AWS Account FederationFollow"


Question: Why is my CloudFormation stack stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state?

My AWS CloudFormation stack is stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state. I want to get my stack into the UPDATE_ROLLBACK_COMPLETE or UPDATE_COMPLETE state.

Answer: "My AWS CloudFormation stack is stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state. I want to get my stack into the UPDATE_ROLLBACK_COMPLETE or UPDATE_COMPLETE state.Short descriptionA CloudFormation stack gets stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state when:CloudFormation is still in the process of removing old resources, or can't remove those resources due to a dependency issue.Resource cleanup is paused because a sibling stack of a nested stack fails to update or roll back.ResolutionCheck the status of your stackOpen the CloudFormation console.In the navigation pane, choose Stacks.Choose the stack that's stuck in the UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS or UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state.Check if your stack has a NESTED label next to its name.Choose the Resources tab for your stack, and then check if there are any resources in the DELETE_IN_PROGRESS state.Note: The Status column shows the resource state.If your stack has a NESTED label next to its name, then complete the steps in the Troubleshoot nested stacks section.If your stack doesn't have a label next to its name, then complete the steps in the Troubleshoot non-nested stacks section.Troubleshoot nested stacksIf your stack has one or more resources in the DELETE_IN_PROGRESS state, then check the status of the resource. Or, follow the steps in the Check the AWS CloudTrail logs section of Why is my CloudFormation stack stuck in the state CREATE_IN_PROGRESS, UPDATE_IN_PROGRESS, UPDATE_ROLLBACK_IN_PROGRESS, or DELETE_IN_PROGRESS?Your resource could be stuck in the DELETE_IN_PROGRESS state for the following reasons:The resource requires additional time to be deleted. For example, resources like AWS::RDS::DBInstance and AWS::CloudFront::Distribution take longer to get deleted than other resources.Other resources are dependent on your resource. For example, an Amazon Elastic Compute Cloud (Amazon EC2) security group could be used by other resources outside of your CloudFormation stack. Use the AWS Management Console to check that there are no dependencies manually created for the resource.Note: CloudFormation attempts to delete a resource three times before skipping the resource and continuing the cleanup process.If your stack has no resources in the DELETE_IN_PROGRESS state, then complete the following steps:Open the CloudFormation console.In the navigation pane, choose Stacks, and then choose your stack.In the Overview tab for your stack, choose the stack in the Root stack section.Check the status of the root stack in the Status section.If the root stack is in the UPDATE_IN_PROGRESS or UPDATE_ROLLBACK_IN_PROGRESS state, then other resources dependent on your stack are still being updated. After all the dependent resources are updated (including resources in nested stacks), then CloudFormation starts the cleanup process.If the root stack is in the UPDATE_ROLLBACK_FAILED state, identify the first resource that failed to roll back after the stack entered the UPDATE_ROLLBACK_IN_PROGRESS state. To identify this resource, check the Events tab of the root stack in the CloudFormation console.If the resource that failed to roll back isn't a nested stack, then complete the steps in How can I get my CloudFormation stack to update if it's stuck in the UPDATE_ROLLBACK_FAILED state?If the resource that failed to roll back is a nested stack, then complete the following steps:Identify the first resource that failed to roll back after the nested stack entered the UPDATE_ROLLBACK_IN_PROGRESS state. To identify this resource, check the Events tab of the nested stack in the CloudFormation console. If the resource is still a nested stack, then repeat this step for the nested stack until you identify the resource that failed to roll back that's not a nested stack.Continue the rollback process to bring the stack to a stable state.Important: If you skip a resource during a ContinueUpdateRollback operation, CloudFormation sets the status of specified resources to UPDATE_COMPLETE. Then, CloudFormation continues to roll back the stack. After the rollback is complete, the state of the skipped resources is inconsistent with the state of the resources in the stack template. Before updating the stack again, update the resources to be consistent with each other. Otherwise, subsequent stack updates can fail, and the stack becomes unrecoverable.Troubleshoot non-nested stacksIf your stack has one or more resources in the DELETE_IN_PROGRESS state, then check the status of the resource by using the AWS Management Console. Or, follow the steps in the Check the AWS CloudTrail logs section of Why is my CloudFormation stack stuck in the state CREATE_IN_PROGRESS, UPDATE_IN_PROGRESS, UPDATE_ROLLBACK_IN_PROGRESS, or DELETE_IN_PROGRESS?Note: The Status column shows the resource state.If there are no resources in the DELETE_IN_PROGRESS state, then look for operational issues using the AWS Service Health Dashboard for CloudFormation.Related informationWorking with nested stacksUpdate rollback failedFollow"


Question: How do I troubleshoot "Unauthorized" errors when running GraphQL requests in AWS AppSync?

I receive "Unauthorized" errors when I run GraphQL requests with AWS AppSync. How do I troubleshoot these errors?

Answer: "I receive "Unauthorized" errors when I run GraphQL requests with AWS AppSync. How do I troubleshoot these errors?Short descriptionThere are two types of unauthorized errors that are defined by the HTTP status code that's returned in the response:401 Unauthorized: The request is denied by either AWS AppSync or the authorization mode because the credentials are missing or invalid.200 OK response with an Unauthorized type error: The request is denied because of an issue at or beyond the resolver level.To determine the cause of the unauthorized error, try to reproduce the issue in a web browser. Then, use the browser's network tools to capture the HTTP request and response messages. Analyze the messages to determine where the error occurred. To analyze them offline, save the messages in an HTTP Archive (HAR) file.Resolution401 Unauthorized responseFor a 401 Unauthorized response, check the network request that sends the GraphQL payload to confirm that:The Authorization or x-api-key header is present and contains the correct credentials for the authorization mode that the operation or field requires. If the header doesn't have the correct credentials, then the authorization mode rejects the request.For JSON Web Tokens (JWT), the Authorization header doesn't include the text "Bearer" (from the GitHub website).The JWT is from the correct Amazon Cognito user pool or OIDC provider.The credentials are valid and not expired.200 OK responseTo get more details on what causes Unauthorized errors for a  200 OK response, turn on Amazon CloudWatch logs on the AWS AppSync API. As a best practice for troubleshooting, set the field-level logging to All, and include verbose content.Requests that receive a 200 OK response with error type Unauthorized and message Not Authorized to access X on type Y are denied by logic in the Apache Velocity Template Language (VTL) resolver mapping templates. To resolve this issue, complete the following troubleshooting steps for the authorization mode that you use.Amazon Cognito and OIDC authorizationCompare the user's token claims, such as groups, email_verified, and client ID or audience, with the authorization checks in the VTL resolver mapping templates. You can use the third-party tool  jwt.io (from AuthO) to check the token claims. If you're using AWS Amplify, then verify that the token claims support the authorization rule requirements on the model schema type.For example, the following resolver mapping template for Amplify checks the data that's passed from the preliminary authorization check that AWS AppSync does.#if( $util.authType() == "User Pool Authorization" )  #if( !$isAuthorized )    #set( $staticGroupRoles = [{"claim":"cognito:groups","entity":"Admin","allowedFields":xxxxx,yyyyy}] )    #foreach( $groupRole in $staticGroupRoles )      #set( $groupsInToken = $util.defaultIfNull($ctx.identity.claims.get($groupRole.claim), []) )      #if( $groupsInToken.contains($groupRole.entity) )        #if( $groupRole.isAuthorizedOnAllFields )          #set( $isAuthorized = true )          #break        #else          $util.qr($allowedFields.addAll($groupRole.allowedFields))        #end      #end    #end  #end#endAlso, if you're using Amplify, verify that the authorization rules on the schema allow create, read, update, or delete operations.IAM authorizationReview the policies that are applied to the AWS Identity and Access Management (IAM) user or role that signs the request to AWS AppSync. Verify that appsync:GraphQL is granted in the Action block for each of the fields that the user accesses.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "appsync:GraphQL"      ],      "Resource": [        "arn:aws:appsync:us-east-1:111122223333:apis/graphql-api-id/types/Query/fields/field-1",        "arn:aws:appsync:us-east-1:111122223333:apis/graphql-api-id/types/Mutation/fields/field-2"      ]    }  ]}Note: Replace graphql-api-id with the ID of your GraphQL API and field-1 and field-2 with your fields.If you're using Amplify to generate the resolver mapping templates, then verify the following:The role session name that the IAM credentials are issued with equals CognitoIdentityCredentials.The IAM credentials are the same as the auth or unauth role that Amplify generates.If the role session name doesn't match the string, then access to the field or operation is denied.Lambda authorizationCheck any custom logic that you wrote in the Lambda function code where isAuthorized is issued to make sure that it's set to true.Make sure that the deniedFields array doesn't contain the requested field or operation.Check the CloudWatch logs, or add debugging statements, to verify the logic flow for determining user authorization.Using multiple authorization modesWhen your AWS AppSync API has multiple authorization modes, the API uses the default authorization mode that's set. For a type or field that requires one of the other authorization modes, you must also set an authorization directive for that mode. For more information see, Using multiple authorization types with AWS AppSync GraphQL APIs.For example, an AWS AppSync API has API_KEY set as the default authorization mode and has AMAZON_COGNITO_USER_POOLS as an additional authorization mode. If you want to use both modes, then you must set the @aws_api_key and @aws_cognito_user_pools authorization directives.type Post @aws_api_key @aws_cognito_user_pools { id: ID! author: String title: String}Note: The default API_KEY authorization mode rejects requests for the following reasons:An Amazon Cognito JWT is sent in the request header.The directives are missing on the GraphQL schema.Follow"


Question: How can I troubleshoot not receiving notifications from EventBridge for AWS Backup?

"I set up an Amazon EventBridge rule to send notifications for AWS Backup, but I don't receive any notifications."

Answer: "I set up an Amazon EventBridge rule to send notifications for AWS Backup, but I don't receive any notifications.Short descriptionTo troubleshoot Amazon Simple Notification Service (Amazon SNS) notifications from Amazon EventBridge that aren't received, verify these configurations:The event pattern and targets in the EventBridge rule are configured correctly.The EventBridge rule is activated.The Amazon SNS access policy includes events.amazonaws.com.The Amazon SNS subscription is confirmed.The AWS Key Management Service (AWS KMS) key policy includes sns.amazonaws.com and events.amazonaws.com.ResolutionVerify that the event pattern and targets in the EventBridge rule are configured correctlyTo verify the configuration of event pattern and targets in the EventBridge rule, complete the following steps:1.    Open the Amazon EventBridge console.2.    In the navigation pane, choose Rules.3.    For Name, choose your rule.4.    For Event pattern, verify that the JSON object is configured with the correct source and state. The following is an example of a pattern to receive notifications about the status of a failed AWS Backup job:{    "source": ["aws.backup"],    "detail-type": ["Backup Job State Change"],   "detail": {      "state": ["FAILED"]    }  }5.    For Targets, verify that the expected Target name is set up on the EventBridge rule. If your using Amazon SNS, then confirm that the correct SNS topic is assigned.Note: A rule's targets must be in the same AWS Region as the rule.Verify that the EventBridge rule is activatedTo verify the status of an EventBridge rule, complete the following steps:Open the Amazon EventBridge console.In the navigation pane, choose Rules.Choose the rule name that you want to update.Verify that your rule is in Enabled status.Verify the permissions for the SNS topic access policyTo verify the SNS topic access policy allows events.amazonaws.com, complete the following steps:1.    Open the Amazon SNS console.2.    In the navigation pane, choose Topics.3.    For Name, select your Amazon SNS topic.4.    For Details, choose the Access policy tab.5.    Verify that the AWS Identity and Access Management (IAM) access policy has permission to publish to events.amazonaws.com. The following is an example statement that allows events.amazonaws.com:{   "Statement": [{      "Sid": "Statement1",      "Effect": "Allow",      "Principal": {        "Service": "events.amazonaws.com"      },      "Action": "sns:Publish",      "Resource": "arn:aws:sns:[region]:[account id]:[topic name]"    }]  }Verify the Amazon SNS subscriptionTo verify the Amazon SNS subscription, complete the following steps:Open the Amazon SNS console.In the navigation pane, choose Subscriptions.For your Amazon SNS subscription ID, verify that the status is Confirmed.If the status is Pending confirmation, then follow the instructions to confirm the subscription.Verify the AWS KMS permissionsTo verify the AWS KMS permissions, complete the following steps:1.    Open the AWS KMS console.2.    In the navigation pane, choose Customer managed keys.3.    Choose the check box for the KMS keys that you want to review. Then, verify the KMS key is turned on. To turn on a KMS key, choose Key actions, Enable.4.    For Key ID, select your AWS KMS key.5.    For Key policy, choose Switch to policy view.6.    Verify that the KMS key policy allows permission to publish to events.amazonaws.com. The following is an example statement allowing events.amazonaws.com:{  "Sid": "Allow access for Key User (SNS Service Principal)",  "Effect": "Allow",  "Principal": {    "Service": [      "sns.amazonaws.com",      "events.amazonaws.com"    ]  },  "Action": [    "kms:GenerateDataKey*",    "kms:Decrypt"  ],  "Resource": "*"}Related informationMonitoring AWS Backup events using EventBridgeAmazon EventBridge event patternsSubscribing to an Amazon SNS topicEncrypting messages published to Amazon SNS with AWS KMSFollow"


Question: Why can't I delete my Amazon EKS cluster?

I can't delete my Amazon Elastic Kubernetes Service (Amazon EKS) cluster. How do I resolve this?

Answer: "I can't delete my Amazon Elastic Kubernetes Service (Amazon EKS) cluster. How do I resolve this?Short descriptionTo delete an Amazon EKS cluster, you must first delete all managed node groups that are associated with the cluster. For more information, see Deleting an Amazon EKS cluster.Note: It's a best practice to delete the cluster with the same tool that you used to create the cluster.Important: If you create load balancers using the AWS Load Balancer Controller (from the GitHub website), then Application Load Balancers or Network Load Balancers are created for you. If you delete your cluster before deleting the Kubernetes ingresses or services managing the load balancer, then you must manually delete the load balancer. See Delete an Application Load Balancer, Delete a Network Load Balancer, and Delete your load balancer (Classic).If you still can't delete your cluster components, then based on your scenario, consider the following options:You receive the error message "The following resource(s) failed to delete" or "resource XXXXXXX has a dependent object". Complete the steps in the Delete the AWS CloudFormation stack that created the cluster component section.You deleted your cluster, and the nodes are still active. Deleting a cluster doesn't automatically delete self-managed nodes. You must manually delete the nodes. Complete the steps in the Delete self-managed nodes section.Your cluster is stuck in the DELETING state. Confirm that no missing AWS Identity and Access Management (IAM) policy or role is preventing your cluster from deleting. If the IAM role is missing, then complete the steps in the Recreate the IAM service role for Amazon EKS section.The Amazon EKS DeleteCluster API call fails with the error message "Cannot delete because cluster XXXXXXX currently has an update in progress." However, you see that the cluster is in the Active state, and no update is in progress. In this case, refer to the Complete an Amazon EKS automatic platform version upgrade section.Note: It's normal that deleting your cluster takes time. You aren't charged for a cluster that is in the DELETING state.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Delete the AWS CloudFormation stack that created the cluster component1.    You can delete the stack on the AWS CloudFormation console. Or, you can use the AWS CLI delete-stack command.If you can't delete your stack because of dependencies, first manually delete the resources that have the dependencies, or remove the dependencies. Then, try to delete the stack again.To retain the resources that are failing to delete, skip the resources when you delete the stack. This option is available only on resources or stacks that are in a DELETE_FAILED state. The skipped resources remain active in the account, but the CloudFormation stack is deleted. You can then delete the resources through the AWS Management Console.2.    After the stack is deleted, try deleting your cluster again.If the stack is slow to delete or failed to delete, then review the DeleteCluster API call in AWS CloudTrail.Delete self-managed nodesIf you manually created an Amazon Elastic Compute Cloud (Amazon EC2) instance, then terminate your instance. If you created the nodes by an Auto Scaling group, then delete the Auto Scaling group to delete the nodes. If you used CloudFormation to create the nodes, then delete the stack to delete the nodes.Recreate the IAM service role for Amazon EKSYou must have an IAM service role that allows Amazon EKS to make calls to other AWS services for you. If you delete or modify the role after you create the cluster, then the cluster fails to delete some resources. For example, the cluster might not delete the elastic network interface that's used for private communication with the control plane instances.1.    Create the IAM role again.Important: Make sure that you choose Amazon EKS as the service to manage clusters for you.2.    Attach the AmazonEKSClusterPolicy managed policies to the IAM role.Complete an Amazon EKS automatic platform version upgradeAmazon EKS automatically upgrades all existing clusters to the latest Amazon EKS platform version for their corresponding Kubernetes minor version. Because these updates aren't initiated by you, they don't appear as updates in the console. Automatic upgrades of existing Amazon EKS platform versions are rolled out incrementally and might take some time to complete. After your clusters are in their latest platform version for their corresponding Kubernetes minor version, you can retry the cluster deletion.Follow"


Question: How can I copy all objects from one Amazon S3 bucket to another bucket?

I want to copy or move all my objects from one Amazon Simple Storage Service (Amazon S3) bucket to another bucket. How can I migrate objects between my S3 buckets?

Answer: "I want to copy or move all my objects from one Amazon Simple Storage Service (Amazon S3) bucket to another bucket. How can I migrate objects between my S3 buckets?Short descriptionTo copy objects from one S3 bucket to another, follow these steps:1.    Create a new S3 bucket.2.    Install and configure the AWS Command Line Interface (AWS CLI).3.    Copy the objects between the S3 buckets.Note: Using the aws s3 ls or aws s3 sync commands on large buckets (with 10 million objects or more) can be expensive, resulting in a timeout. If you encounter timeouts because of a large bucket, then consider using Amazon CloudWatch metrics to calculate the size and number of objects in a bucket. Also, consider using S3 Batch Operations to copy the objects.4.    Verify that the objects are copied.5.    Update existing API calls to the target bucket name.Before you begin, consider the following:If you have many objects in your S3 bucket (more than 10 million objects), then consider using S3 Batch Operations. You can use S3 Batch Operations to automate the copy process.To copy objects across AWS accounts, set up the correct cross-account permissions on the bucket and the relevant AWS Identity and Access Management (IAM) role.If you're using AWS CLI version 2 to copy objects across buckets, then your IAM role must also have proper permissions. Make sure that your IAM role can access s3:GetObjectTagging for source objects and s3:PutObjectTagging for destination objects.To increase the performance of the sync process, tune the AWS CLI to use a higher concurrence. You can also split sync commands for different prefixes to optimize your S3 bucket performance. For more information about optimizing the performance of your workload, see Best practices design patterns: optimizing Amazon S3 performance.ResolutionCreate a new S3 bucket1.    Open the Amazon S3 console.2.    Choose Create Bucket.3.    Choose a DNS-compliant name for your new bucket.4.    Select your AWS Region.Tip: To avoid performance issues caused by cross-Region traffic, create the target bucket in the same Region as the source bucket.5.    Optionally, choose Copy settings from an existing bucket to mirror the configuration of the source bucket.Install and configure the AWS CLI1.    Install the AWS CLI.2.    Configure the AWS CLI by running the following command:aws configureNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.3.    Enter your access keys (access key ID and secret access key).4.    Press Enter to skip the default Region and default output options. For more information about Amazon S3 Region parameters, see AWS service endpoints.Note: The AWS CLI outputs are JSON, text, or table, but not all the commands support each type of output. For more information, see Controlling command output from the AWS CLI.Copy the objects between the S3 buckets1.    If you archived S3 objects in the Amazon Simple Storage Service Glacier storage class, then restore the objects.2.    Copy the objects between the source and target buckets by running the following sync command using the AWS CLI:aws s3 sync s3://DOC-EXAMPLE-BUCKET-SOURCE s3://DOC-EXAMPLE-BUCKET-TARGETNote: Update the sync command to include your source and target bucket names.The sync command uses the CopyObject APIs to copy objects between S3 buckets. The sync command lists the source and target buckets to identify objects that are in the source bucket but that aren't in the target bucket. The command also identifies objects in the source bucket that have different LastModified dates than the objects that are in the target bucket. When you use the sync command on a versioned bucket, only the current version of the object is copied—previous versions are not copied. By default, this behavior preserves object metadata.If the source bucket has access control lists (ACLs) enabled, then the ACLs won't get copied to the destination bucket. This is true whether or not the ACLs are enabled on the destination bucket. If both the source and destination bucket have ACLs enabled, then the destination object ACLs will grant FULL_CONTROL to the account that performed the copy. If the operation fails, then you can run the sync command again without duplicating previously copied objects. To troubleshoot issues with the sync operation, see Why can't I copy an object between two Amazon S3 buckets?3.    (Optional) If you encounter a timeout, then use the cloudwatch get-metric-statistics command to calculate the number of objects in your bucket:$ aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name NumberOfObjects --dimensions Name=BucketName,Value=DOC-EXAMPLE-BUCKET-SOURCE Name=StorageType,Value=AllStorageTypes --start-time 2021-05-11T00:00 --end-time 2021-05-11T00:10 --period 600 --statistic Average --output json4.    (Optional) If you encounter a timeout, then use the cloudwatch get-metric-statistics command to retrieve your bucket size:$ aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name BucketSizeBytes --dimensions Name=BucketName,Value=DOC-EXAMPLE-BUCKET-SOURCE Name=StorageType,Value=StandardStorage --start-time 2021-05-11T00:00 --end-time 2021-05-11T00:10 --period 3600 --statistics Average --unit Bytes --output jsonNote: Listcalls can be very expensive, resulting in the command timing out. For large buckets, consider using Amazon CloudWatch metrics to calculate the size of the bucket and total number of objects instead. However, because Amazon CloudWatch metrics are pulled only once a day, the reported object count and bucket size can differ from the list command results.Verify that the objects are copied1.    Verify the contents of the source and target buckets by running the following commands:aws s3 ls --recursive s3://DOC-EXAMPLE-BUCKET-SOURCE --summarize > bucket-contents-source.txt        aws s3 ls --recursive s3://DOC-EXAMPLE-BUCKET-TARGET --summarize > bucket-contents-target.txtNote: Update the list command to include your source and target bucket names.2.    Compare objects that are in the source and target buckets by using the outputs that are saved to files in the AWS CLI directory. See the following example output:$ aws s3 ls --recursive s3://DOC-EXAMPLE-BUCKET --summarize2017-11-20 21:17:39      15362 s3logo.png  Total Objects: 1        Total Size: 15362Update existing API calls to the target bucket nameUpdate any existing applications or workloads so that they use the target bucket name. You might need to run sync commands to address discrepancies between source and target buckets if you have frequent writes.Related informationAmazon S3 pricingCopy your object to a folderAfter performing a large deletion operation in Amazon S3, the list command is unresponsive. How do I troubleshoot this?Follow"


Question: How can I achieve ECMP routing with multiple Site-to-Site VPN tunnels that are associated with a transit gateway?

I want to achieve equal-cost multi-path routing (ECMP) with multiple AWS Site-to-Site VPN tunnels that are associated with a transit gateway.

Answer: "I want to achieve equal-cost multi-path routing (ECMP) with multiple AWS Site-to-Site VPN tunnels that are associated with a transit gateway.ResolutionCreate a transit gateway, and then attach your Amazon VPC and a Site-to-Site VPNCreate a transit gateway.Important: When you create your transit gateway, you must turn on VPN ECMP support.Attach your Amazon Virtual Private Clouds (Amazon VPCs) to your transit gateway.Create a Site-to-Site VPN, and then attach it to your transit gateway.Important: AWS provides two routing options to create Site-to-Site VPN connections, static and dynamic. The dynamic option uses border gateway protocol (BGP). When you create your Site-to-Site VPN, you must choose Dynamic for Routing options. Static routing doesn't support ECMP.Confirm your customer gateway BGP configurationMake sure to turn on asymmetric routing on your customer gateway. Check that the customer gateway is configured to perform ECMP for traffic going out to AWS for all Site-to-Site VPN tunnels. To do this, configure equal local preference value or weight on all the Site-to-Site VPN tunnels. If necessary, configure your customer gateway BGP to accept the route from AWS. This means that the customer gateway installs all routes with the same metric.Note: If the customer gateway isn't configured to perform ECMP, and asymmetric routing isn't turned on, then packet loss can occur.Confirm that your customer gateway is advertising the on-premises prefix to AWS with the same BGP AS PATH attribute. For AWS to choose all of the available ECMP paths, the AS Path and neighbor AS Number must match.For example, you want to use ECMP with two Site-to-Site VPN connections. The AS Number of your customer gateway is 65270. In this scenario, configure your Site-to-Site VPNs like the following example:Site-to-Site VPN-ATunnel 1 – AS PATH: 65270 (when advertising the prefix)Tunnel 2 – AS PATH: 65270 (when advertising the prefix)Site-to-Site VPN-BTunnel 1 – AS PATH: 65270 (when advertising the prefix)Tunnel 2 – AS PATH: 65270 (when advertising the prefix)With the preceding configurations, AWS sends traffic with ECMP turned on for all four Site-to-Site VPN tunnels.Note: You must turn on Dynamic VPN and VPN ECMP Support on the transit gateway for ECMP to function properly. Modify the transit gateway to turn VPN ECMP Support on or off.Create a transit gateway route table, and associate your Amazon VPCs and Site-to-Site VPN to itOpen the Amazon VPC console.From the navigation pane, choose Transit Gateways.Review the Default association route table setting for your transit gateway. If it's set to False, then proceed to step 4. If it's set to True, then all the associations are already part of the default route table, so you can proceed to step 6.Choose Transit Gateway Route Tables.Choose Create Transit Gateway Route Table, and then complete the following:For Name tag, enter Route Table A.For Transit Gateway ID, choose the Transit Gateway ID for your transit gateway.Choose Create Transit Gateway Route Table.Choose Route Table A (or the default route table of your transit gateway).Choose Associations, and then choose Create Association.For Choose attachment to associate, choose the association IDs for your Amazon VPCs and Site-to-Site VPNs. Then, choose Create Association.Repeat step 8 until all of your Amazon VPCs and Site-to-Site VPNs display under Association.Propagate routes from your Amazon VPCs and Site-to-Site VPNs on the transit gateway route tableChoose Route Table A Propagation.Choose Propagation.For Choose attachment to propagate, choose the propagation for the Site-to-Site VPNs and Amazon VPCs.Follow"


Question: I accidentally deleted my Amazon RDS for MySQL instance

What do I do if I accidentally delete my Amazon Relational Database Service (Amazon RDS) for MySQL instance? How can I prevent this from happening again?

Answer: "What do I do if I accidentally delete my Amazon Relational Database Service (Amazon RDS) for MySQL instance? How can I prevent this from happening again?ResolutionIf you've accidentally deleted your Amazon RDS for MySQL instance, you can use an earlier snapshot of the DB instance to restore the instance.To restore a DB instance from a snapshot in Amazon RDS, perform the following steps:1.    Open the Amazon RDS console.2.    In the navigation pane, choose Snapshots.3.    Choose the DB snapshot that you want to restore from.4.    For Actions, choose Restore snapshot.5.    On the Restore snapshot page, for DB instance identifier, enter the name of your restored DB instance.6.    Choose Restore DB instance.Additionally, consider the following best practices to prevent any future incidents where your instance is accidentally deleted:Enable delete protection. When a DB instance or cluster is configured with deletion protection, the database can't be deleted by any user.Enable cross-Region replication for automated backups. Automated backups that are replicated to another AWS Region are retained even if you choose not to retain automated backups.Note: Backup replication is available for Amazon RDS DB instances that are running the following database engines: Oracle Database version 12.1.0.2.v10 and higher, PostgreSQL version 9.6 and higher and unencrypted Microsoft SQL Server version 2012 and higher.Automate manual snapshots of the Amazon RDS instance.Create a final snapshot and retain any automated backups.Related informationImplementing a disaster recovery strategy with Amazon RDSFollow"


Question: What do I do if I'm having trouble signing in to or accessing my AWS account?

"I can't sign in to my AWS account, or access the resources or information that I need."

Answer: "I can't sign in to my AWS account, or access the resources or information that I need.Short descriptionIssues accessing AWS accounts or their resources usually fall under one of these categories:A browser issue prevents you from signing in.You can't sign in to an AWS account because you're using incorrect credentials (email address, username, or password). Or, you forgot the credentials that you use to sign in to an AWS account.You received a notification that there is an issue with your AWS account (for example, that it's closed or suspended).You turned on a multi-factor authentication device (MFA) for your account, but the device is lost, broken, or doesn't work.ResolutionResolving issues with your browserIf your browser prevents you from logging in, then clear your browser's cache and cookies, or use a different browser.Resolving issues signing in with AWS credentialsTo sign in to the AWS account as the root user, you must use the email address and password associated with the account. To sign in to an AWS account as an AWS Identity and Access Management (IAM) user, use the credentials that your account administrator provided.If you can sign in but you can't access part of the console, then your account administrator might have restricted your permissions. To resolve this, contact your account administrator. Usually, the administrator is the person who gives you sign in credentials, or is the owner of your organization's management account.To reset the password for the root user or an IAM user, see How do I recover a lost or forgotten AWS password?Use the troubleshooting tips at I can't sign in because my credentials don't work in any of the following situations:You forgot the email address associated with your AWS account.The email address that you're using to sign in isn't working.Resolving issues with your accountIf your account is closed for more than 90 days, then your sign-in information no longer exists. To use AWS services, create a new AWS account with a different email address than the email address that's associated with your closed AWS account.To reactivate a suspended account, see How can I reactivate my suspended AWS account?To reopen an AWS account closed for less than 90 days, see Can I reopen my closed AWS account?Removing lost or broken MFA devices from an AWS accountSee How do I remove a lost or broken MFA device from my AWS account?Receiving account supportIf the previous methods don't work and you still can't access your account, then contact AWS Support with the Amazon Web Services Support form.Related informationHow do I troubleshoot Amazon Elastic Compute Cloud (Amazon EC2) instance connection timeout errors from the internet?Sign in to the AWS Management Console as an IAM userYour AWS account ID and its aliasFollow"


Question: What should I do when my Amazon ECS cluster fails to delete as part of an AWS CloudFormation stack?

My Amazon Elastic Container Service (Amazon ECS) cluster fails to delete.

Answer: "My Amazon Elastic Container Service (Amazon ECS) cluster fails to delete.Short descriptionAn Amazon ECS cluster might fail to delete due to an issue with underlying resource dependencies. When an Amazon ECS cluster is created, AWS CloudFormation creates resources, including Auto Scaling groups, virtual private clouds (VPC), or load balancers. These resources are associated with the cluster, and their presence can prevent the deletion of the cluster. Other issues with AWS CloudFormation can also prevent the deletion of an Amazon ECS cluster.Note: Clusters created through the console first-run experience (after November 24, 2015) or the cluster creation wizard have an underlying AWS CloudFormation stack. During the cluster deletion process, your stack EC2ContainerService-yourClusterName might run into the following errors:"The vpc 'vpc-1234567' has dependencies and cannot be deleted""The security group sg-123456 failed to delete due to the error "resource sg-123456 has a dependent object""User: arn:aws:sts::1111222233334444:assumed-role/example-role/example-user is not authorized to perform: ecs:DeleteCluster on resource: arn:aws:ecs:Region:1111222233334444:cluster/example-cluster"Cluster deletion fails, and the AWS CloudFormation stack moves to the DELETE_FAILED state.If you can't delete your ECS cluster, complete the following steps.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Verify the AWS Identity and Access Management (IAM) permissions1.    Open the IAM console.2.    In the navigation pane, choose Roles.3.    In the Roles page, enter the IAM role that's specified in the error message. You can check the error message from CloudTrail Events by filtering to the DeleteCluster API calls.Note: This is the IAM role or user that's trying to delete the Amazon ECS cluster.4.    Choose the IAM role or user.5.    Choose the Permissions tab.Check if the permissions policy contains the ecs:Delete* permission. This permission is required by the IAM role or user to delete the ECS cluster.If the permission is missing, grant the required access to the IAM user or role. For more information, see AmazonECS_FullAccess.Delete the cluster by skipping the resources with dependencies1.    Open the AWS CloudFormation console.2.    To find the stack that failed, for Filter, choose Active, and then choose Failed.3.    Select the failed stack that won't delete.4.    Choose Actions, and then choose Delete Stack.5.    Select the check boxes next to the resources that failed to delete.6.    Choose Yes, Delete.Important: If you can't delete a resource, but you still want to delete the stack, then choose to retain that resource. You can also retain resources by using the AWS CLI delete-stack command. Use the resource.7.    Delete the Amazon ECS cluster.Delete the retained resourcesThe following examples show you how to delete resources that are commonly associated with the underlying AWS CloudFormation stack.Security group dependency exampleIn this example, the inbound or outbound rules of one security group refer to another security group or groups. This dependency can prevent the deletion of your cluster.1.    To find security groups associated with the security group that you want to delete, run the following AWS CLI command:aws ec2 describe-security-groups --filters Name=ip-permission.group-id,Values=[sg-xxxxxxxxx] --region us-east-1 | jq '.SecurityGroups[] .GroupId'Note: jq is a command line JSON processor.2.    Clear the dependencies for the security group that you want to delete.3.    Delete the security group resource.VPC dependency exampleNote: Common VPC dependencies include describe-internet-gateways, describe-subnets, or describe-instances.1.    To identify the dependent resources of your VPC, run the following AWS CLI command. Replace vpc-xxxxxxxx with your VPC value, and replace RegionId with your AWS Region code:aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-xxxxxxxx" --region RegionId | grep SubnetIdNote: You can run similar describe_* commands for other dependencies.2.    Clear the dependencies for the VPC that you want to delete.3.    Delete the VPC.For more information, see I tried to delete my Amazon VPC, but I received a dependency error. How can I delete my Amazon VPC?Related informationDelete stack failsFollow"


Question: How do I troubleshoot high CPU utilization on my Amazon RDS for Oracle database?

I'm experiencing high CPU utilization on my Amazon Relational Database Service (Amazon RDS) for Oracle DB instance.

Answer: "I'm experiencing high CPU utilization on my Amazon Relational Database Service (Amazon RDS) for Oracle DB instance.Short descriptionIf your RDS for Oracle database has high CPU usage, use a combination of the following tools to identify the cause:Amazon CloudWatch MetricsEnhanced Monitoring metricsPerformance Insights metricsOracle StatspackAutomatic Workload Repository (AWR)Automatic Database Diagnostic Monitor (ADDM)Active Session History (ASH)Oracle SQLTResolutionWhen diagnosing issues related to high CPU utilization, identify the time period in which the issue occurred.CloudWatch metricsAmazon RDS sends metrics to CloudWatch every minute for each active database. Review the following CloudWatch metrics for Amazon RDS to identify CPU patterns over extended periods:CPUUtilizationCPUCreditUsage, if you're using a T2 or T3 instanceCPUCreditBalance, if you're using a T2 or T3 instanceAlso, review the following metrics to check if there was a change in the workload and any thresholds were breached. These factors might contribute to the spike in CPU utilization.DatabaseConnectionsDiskQueueDepthFreeableMemoryReadIOPSReadLatencyWriteIOPSWriteLatencyFor more information, see Monitoring Amazon RDS metrics with Amazon CloudWatch and Viewing instance status and recommendations.Enhanced Monitoring metricsEnhanced Monitoring provides metrics in real time for the operating system that your DB instance runs on. While CloudWatch gets the CPU utilization metrics from the hypervisor, Enhanced Monitoring gets these metrics from an agent on the DB instance. Enhanced Monitoring metrics are more granular than the CloudWatch metrics. Enhanced monitoring metrics are stored for 30 days in CloudWatch Logs.You can define the collection interval for the metrics from 1 second to 1 minute. It's a best practice to set the granularity to 1 second or 5 seconds for business-critical applications. With this granularity, the metrics provide more accurate information about the load on the application for analyzing performance issues.To view the time period of the spike in the CPU utilization, do the following:Open the Amazon RDS console.In the navigation pane, choose Databases.Choose the database that you want to monitor.Choose the Monitoring tab.Select Enhanced monitoring from the Monitoring dropdown list.Under the Enhanced Monitoring view, if the instance is a Multi-AZ deployment, select primary to view the OS metrics of the primary instance. Select secondary to view the metrics for the standby replica.Select the date and start time.On the right corner, select the duration. You can select 5 minutes, 15 minutes, 30 minutes, or 1 hour.The CPU Total graph indicates the time period when the CPU utilization increased.The Load Avg 1 min, Load Avg 5 min, and Load Avg 15 min graphs show the number of processes requesting the CPU time over the last minute, last five minutes, and the last 15 minutes, respectively. If the load average is greater than the number of vCPUs, then the instance might be experiencing a CPU bottleneck.To view the OS processes, select OS process list from the Monitoring dropdown list. Then, sort the list by CPU% values to identify the process that has the most CPU usage.Example:NAMEVIRTRESCPU%MEM%VMLIMIToracleORCL [27074]ᵗ6.07 GiB1,007.24 MB44.7212.78unlimitedoracleORCL [27076]ᵗ6.07 GiB1,010.02 MB44.6412.82unlimitedFor more information on the columns in the preceding example, see Viewing OS metrics in the RDS console.After identifying the process with the most CPU utilization, you can run the following query to map the process ID to a session on the database:SET LINESIZE 120;SET PAGES 200;COL OSUSER FOR a20;COL USERNAME FOR a20;COL MACHINE FOR a20;SELECT a.sid, a.serial#, a.osuser, a.username, a.machine, a.sql_id, c.sql_text FROM v$session a, v$process b, v$sql c WHERE a.paddr=b.addr AND b.spid=&spid AND a.sql_id=c.sql_id(+);By default, all the Enhanced Monitoring graphs aren't displayed on the Enhanced Monitoring dashboard. To get a view of the workload at the time of the spike in CPU utilization, turn on additional graphs by doing the following:Open the Amazon RDS console.In the navigation pane, choose Databases.Choose the database that you want to monitor.Choose the Monitoring tab.Select Enhanced monitoring from the Monitoring dropdown list.Under the Enhanced Monitoring view, choose Manage graphs.Select the graphs that you want to view.Choose Save.Examples of graphs you might choose to view:MemoryFreeCachedBufferedTotalDirtyActiveSlabNote: Metrics related to metrics are retrieved from the /proc/meminfo file.SwapSwapFreeDisk I/O and Physical Device I/ORead IO/sWrite IO/sAve Queue SizeAwaitCPUUserTotalSystemWaitIdleNiceFor the list of available metrics, see Overview of Enhanced Monitoring.For more information on Enhanced Monitoring, see Monitoring OS metrics with Enhanced Monitoring.For information on the cost of Enhanced Monitoring, see Cost of Enhanced Monitoring.Performance Insights metricsWith the Amazon RDS Performance Insights dashboard, you can visualize the database load and filter the load by waits, SQL statements, hosts, or users.Open the Amazon RDS console.In the navigation pane, choose Performance Insights.Choose the DB instance that you want to monitor.For View past, Select the duration of your choice.In the Database Load graph, check the time when you experienced a spike in the CPU usage.Choose the Top waits tab.Note the top wait events during the time period of the spike.Choose the Top SQL tab.Review and optimize the SQL statements that contributed to the spike.For information on the cost of Performance Insights, see Performance Insights pricing.Oracle StatspackStatspack is a performance reporting tool that provides the performance metrics of your database over a specific time period.To review the CPU utilization of your instance using Statspack, do the following:Generate a statspack report for the time period when you experienced an issue.Review and optimize the queries that result in a high CPU load.Review the top wait events.Example extract from a Statspack report:-> Total DB CPU (s):           3,345-> Captured SQL accounts for   91.3% of Total DB CPU-> SQL reported below exceeded  1.0% of Total DB CPU    CPU                  CPU per            Elapsed                     Old  Time (s)   Executions  Exec (s)  %Total   Time (s)    Buffer Gets  Hash Value---------- ------------ ---------- ------ ---------- --------------- ----------   3043.36      598,100       0.01   91.0    3356.81     994,096,212  219593194Module: JDBC Thin ClientSELECT tt.ORDER_TOTAL, tt.SALES_REP_ID, tt.ORDER_DATE, customers.CUST_FIRST_NAME, customers.CUST_LAST_NAME FROM   (SELECT orders.ORDER_TOTAL, orders.SALES_REP_ID, orders.ORDER_DATE, orders.customer_id, rank() Over (ORDER BY orders.OFor more information, see Oracle documentation for Oracle Statspack.AWRAWR (on the Oracle website) is an Oracle performance reporting tool that provides performance metrics over a specific time period.Note: AWR requires a Diagnostic Pack License and is only available for the Enterprise Edition of Oracle.To identify the cause for your CPU load using AWR, do the following:1.    Run a query similar to the following to identify the start and end snapshot ID for the time period of high CPU load:SELECT SNAP_ID, BEGIN_INTERVAL_TIME FROM DBA_HIST_SNAPSHOT ORDER BY 1;2.    Generate the AWR report.3.    Download the AWR report.4.    Review and optimize the queries listed in the SQL ordered by CPU Time section of the AWR report.5.    Review the top wait events.In Oracle 12c and later versions, ADDM and ASH reports are included in the AWR report.Note: When an AWR report is generated for more than four consecutive snapshot IDs, all the ADDM and ASH reports aren't included. To generate these additional reports, use the instructions in the following sections.ADDMADDM is a diagnostic tool that analyzes the AWR data, identifies performance bottlenecks, and provides recommendations.Note: ADDM requires a Diagnostic Pack license and is only available for the Enterprise Edition of Oracle.1.    Run a query similar to the following to Identify the start and end snapshot ID for the time period of high CPU load:SELECT SNAP_ID, BEGIN_INTERVAL_TIME FROM DBA_HIST_SNAPSHOT ORDER BY 1;2.    Generate the ADDM report.3.    Download the ADDM report.4.    Review the recommendations in the ADDM report.ASHASH (on the Oracle website) is a diagnostic tool that collects active session information. To troubleshoot transient performance problems using ASH, do the following:Note: ASH requires a Diagnostic Pack license and is only available for the Enterprise Edition of Oracle.1.    Generate an ASH report for the time period when there was a high CPU load.2.    Download the ASH report.3.    Review the TOP SQL with TOP Events section.For information on interpreting the AWR, ADDM, and ASH reports, see Oracle Support documentation for Oracle Support Doc ID FAQ: Automatic Workload Repository (AWR) Reports (Doc ID 1599440.1).Oracle SQLTAmazon RDS supports Oracle SQLTXPLAIN (SQLT) through the use of the SQLT option. SQLT is a tool that's used to diagnose SQL statements that don't perform well.To produce a report for a specific SQL statement, see Oracle SQLT.If you receive the following error when using SQLT:Error: ORA-20106: SQLT parameter connect_identifier must be set when running SQLT from a remote client.Run one of the following commands before running the extract:EXEC sqltxadmin.sqlt$a.set_sess_param(‘connect_identifier’, ‘@SID’);EXEC sqltxadmin.sqlt$a.set_param(‘connect_identifier’, ‘@example-hostname:example-port/example-sid’);Related informationOverview of monitoring metrics in Amazon RDSGenerating performance reports with Automatic Workload Repository (AWR)Generating an ADDM reportGenerating an ASH reportHow do I check the performance statistics on an Amazon RDS DB instance that is running Oracle?Follow"


Question: Why is my EC2 Windows instance down with a system status check failure or status check 0/2?

My Amazon Elastic Compute Cloud (Amazon EC2) Windows instance went down suddenly and is no longer reachable. One or both system status checks failed. What happened and how can I fix this?

Answer: "My Amazon Elastic Compute Cloud (Amazon EC2) Windows instance went down suddenly and is no longer reachable. One or both system status checks failed. What happened and how can I fix this?Short descriptionAmazon Web Services (AWS) monitors the health of each EC2 instance with two status checks. An EC2 instance becomes unreachable if a status check fails.A system status check failure indicates a problem with the AWS systems that your instance runs on. When a problem with an underlying host impacts your production, you can stop and start your instance to migrate from the current underlying host.ResolutionEC2 resources are Region-specific. Check the AWS Service Health Dashboard for service interruptions within the AWS Region where your instance is located. Look for outages and status updates to confirm if the problem is on the AWS side.If there is no outage, then follow these steps:Warning: Before you stop an instance, be aware of the following:If you're not using an Elastic IP address, the public IP address is released when you stop the instance.If this instance has an instance store volume, any data on the volume is lost when the instance is stopped.If the instance shutdown behavior is set to Terminate, the instance terminates when it's stopped.If the instance is part of an Auto Scaling group, first detach the instance from the Auto Scaling Group. After you stop and start the instance, attach the instance back to the Auto Scaling group.For more information, see Stop and start your instance and How do I reboot an instance in an Amazon EC2 Auto Scaling group?1.    Stop the instance.Note: If the instance becomes stuck in the stopping state, force the instance to stop using the Amazon EC2 console or the AWS Command Line Interface (AWS CLI).This action can take up to 10 minutes. For more information, see Troubleshoot stopping your instance.If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.2.    Start the instance. In most cases, the instance starts on a new, healthy underlying host server.Note: You can configure automatic recovery for EC2 Windows instances. For more information, see the following:How can I set up a CloudWatch alarm to automatically recover my EC2 instance?Related informationTroubleshoot an unreachable instanceTroubleshoot connecting to your Windows instanceWhy is my EC2 Windows instance down with an instance status check failure?Why is my EC2 Linux instance unreachable and failing one or both of its status checks?Follow"


Question: How do I troubleshoot AccessDenied errors on Amazon SQS API calls?

"When I run an Amazon Simple Queue Service (Amazon SQS) API call, I receive an AccessDenied error similar to one of the following:“An error occurred (AccessDenied) when calling the SendMessage operation: Access to the resource https://sqs.us-east-1.amazonaws.com/ is denied.”“An error occurred (KMS.AccessDeniedException) when calling the SendMessage operation: User: arn:aws:iam::xxxxx:user/xxxx is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:us-east-1:xxxx:key/xxxx with an explicit deny”How can I troubleshoot this issue?"

Answer: "When I run an Amazon Simple Queue Service (Amazon SQS) API call, I receive an AccessDenied error similar to one of the following:“An error occurred (AccessDenied) when calling the SendMessage operation: Access to the resource https://sqs.us-east-1.amazonaws.com/ is denied.”“An error occurred (KMS.AccessDeniedException) when calling the SendMessage operation: User: arn:aws:iam::xxxxx:user/xxxx is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:us-east-1:xxxx:key/xxxx with an explicit deny”How can I troubleshoot this issue?ResolutionAmazon SQS access policy and IAM policyNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Either the SQS access policy or the AWS Identity and Access Management (IAM) policy must include permissions to explicitly allow access for the action.If the SQS queue is in a different account, both the SQS access policy and the IAM policy must explicitly allow access. Important: An explicit deny in either policy overrides an explicit allow.If the policy uses a condition element, verify whether the condition restricts access.If the user or role is in an AWS Organizations organization that uses a service control policy (SCP), verify that the SCP isn't blocking the user or role.To confirm the IAM identity that is used to make API calls, run the following get-caller-identity AWS CLI command:aws sts get-caller-identityFor more information about Amazon SQS access permissions, see What permissions do I need to access an Amazon SQS queue?KMS permissionsIf your Amazon SQS queue has server-side encryption (SSE) turned on, permissions must be granted to both producers and consumers. The required permissions can be provided by an AWS managed AWS KMS key or by a customer managed key. A customer managed key policy must include access permissions for each queue producer and consumer. Or, you can update the IAM policy to include the required KMS permissions for the KMS key.Required producer permissions: kms:GenerateDataKey and kms:DecryptRequired consumer permissions: kms:DecryptTo access an SSE Amazon SQS queue from a different account, the queue must use a customer managed key. You can’t use an AWS managed key because only customer managed key policies can be modified. The KMS key policy must allow cross account access of the KMS key, and the IAM policy must include permissions to access the KMS key.For more information, see Key management.VPC endpoint policyIf you access SQS through an Amazon Virtual Private Cloud (Amazon VPC) endpoint, the SQS VPC endpoint policy must allow access.The following example VPC endpoint policy specifies that the IAM user MyUser is allowed to send messages to the SQS queue MyQueue. Other actions, IAM users, and SQS resources are denied access through the VPC endpoint.{   "Statement": [{      "Action": ["sqs:SendMessage"],      "Effect": "Allow",      "Resource": "arn:aws:sqs:us-east-2:123456789012:MyQueue",      "Principal": {        "AWS": "arn:aws:iam:123456789012:user/MyUser"      }   }]}Follow"


Question: How can I resolve the domain name with the ".local" suffix for a Route 53 private hosted zone?

I can't resolve an Amazon Route 53 private hosted zone record with my Elastic Compute Cloud (Amazon EC2) instance.

Answer: "I can't resolve an Amazon Route 53 private hosted zone record with my Elastic Compute Cloud (Amazon EC2) instance.Short descriptionLinux OS distributions that use the systemd-resolved service handle DNS queries using a stub resolver. The stub resolver IP is located in /etc/resolv.conf. The local DNS stub listener doesn't forward DNS requests for domain names with the ".local" suffix. The DNS request fails with the response code "ServFail" similar to the following output:### failed ###ubuntu@ip-172-31-2-3:~$ dig example.local.; <<>> DiG 9.18.1-1ubuntu1.1-Ubuntu <<>> example.local.;; global options: +cmd;; Got answer:;; WARNING: .local is reserved for Multicast DNS;; You are currently testing what happens when an mDNS query is leaked to DNS;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 29563    ### status: SERVFAIL ###;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 65494;; QUESTION SECTION:;example.local.            IN    A;; Query time: 0 msec;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)            ### 127.0.0.53 is systemd-resolved ###;; WHEN: Thu Jun 30 12:34:56 UTC 2022;; MSG SIZE  rcvd: 42### success ###ubuntu@ip-172-31-2-3:~$ dig example.local. @172.31.0.2        ### dig to @172.31.0.2 AmazonProvidedDNS / Route 53 Resolver ###; <<>> DiG 9.18.1-1ubuntu1.1-Ubuntu <<>> example.local. @172.31.0.2;; global options: +cmd;; Got answer:;; WARNING: .local is reserved for Multicast DNS;; You are currently testing what happens when an mDNS query is leaked to DNS;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29352    ### status: NOERROR ###;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;example.local.            IN    A;; ANSWER SECTION:example.local.        300    IN    A    192.0.2.1;; Query time: 4 msec;; SERVER: 172.31.0.2#53(172.31.0.2) (UDP)            ### 172.31.0.2 is AmazonProvidedDNS / Route 53 Resolver ###;; WHEN: Thu Jun 30 12:34:56 UTC 2022;; MSG SIZE  rcvd: 58ResolutionTo resolve a domain name with the ".local" suffix, use the external resolver instead of the local DNS stub listener.Note: It's a best practice to avoid using the domain name ".local" suffix because RFC 6762 reserves this domain name for exclusive Multicast DNS use.1.    Change the DNS resolver from the local DNS stub listener to external DNS resolver (AmazonProvidedDNS).cd /etc/sudo ln -sf ../run/systemd/resolve/resolv.conf2.    Change .conf to stop the local DNS stub listener.cd /etc/systemd/sudo cp -ip resolved.conf resolved.conf.orgsudo sed -i -e 's/#DNSStubListener=yes/DNSStubListener=no/' resolved.conf3.    Restart systemd-resolved.sudo systemctl restart systemd-resolvedRelated informationBest practices for Amazon Route 53 DNSHow can I troubleshoot DNS resolution issues with my Route 53 private hosted zone?Follow"


Question: How do I add multiple SSL certificates to the Application Load Balancer in my Elastic Beanstalk environment?

I want to add additional SSL certificates to the Application Load Balancer in my AWS Elastic Beanstalk environment.

Answer: "I want to add additional SSL certificates to the Application Load Balancer in my AWS Elastic Beanstalk environment.Short descriptionThe Application Load Balancer supports multiple SSL certificates, but the SSLCertificateArns option setting in Elastic Beanstalk accepts only one certificate per listener.To add additional SSL certificates to your Application Load Balancer, you must create a resource-based .ebextension.ResolutionAdd a second SSL certificate to your Application Load Balancer1.    Create a .ebextensions folder in the root directory of the source bundle.2.    In the .ebextensions folder, create a .config file based on the following:option_settings:  aws:elbv2:listener:443:    Protocol: HTTPS    SSLCertificateArns: "cert-arn-1"Resources:  AddingSSLCert2:    Type: "AWS::ElasticLoadBalancingV2::ListenerCertificate"    Properties:      ListenerArn:        Ref : "AWSEBV2LoadBalancerListener443"      Certificates:        - CertificateArn: "cert-arn-2"Note: In the preceding code example, replace cert-arn1 and cert-arn2 with your certificate's Amazon Resource Names (ARNs).To add additional certificates, add a new ListenerCertificate resource. For example:option_settings:  aws:elbv2:listener:443:    Protocol: HTTPS    SSLCertificateArns: "cert-arn-1"Resources:  AddingSSLCert2:    Type: "AWS::ElasticLoadBalancingV2::ListenerCertificate"    Properties:      ListenerArn:        Ref : "AWSEBV2LoadBalancerListener443"      Certificates:        - CertificateArn: "cert-arn-2"  AddingSSLCert3:    Type: "AWS::ElasticLoadBalancingV2::ListenerCertificate"    Properties:      ListenerArn:        Ref : "AWSEBV2LoadBalancerListener443"      Certificates:        - CertificateArn: "cert-arn-3"Note: In the preceding code example, replace cert-arn1, cert-arn-2, and cert-arn3 with your certificates ARNs.The option_settings section creates the HTTPS listener on port 443 and attaches a certificate to this listener. If you created the HTTPS listener from the console, then you can remove the option_settings section from the .config file. The Resources section creates another resource that attaches an additional certificate to the listener.3.    Apply the .ebextensions updates to your application bundle.4.    Deploy your application again.Your application updates the existing Application Load Balancer without replacing it.Important: The additional certificate doesn't appear in the Elastic Beanstalk console. To verify that your certificate is added to the Application Load Balancer, complete the steps in the Verify that your SSL certificates are added to the Application Load Balancer listener 443 section.Verify that your SSL certificates are added to the Application Load Balancer listener 4431.    Open the Amazon Elastic Compute Cloud (Amazon EC2) console.2.    From the navigation pane, choose Load Balancers.3.    Choose the Listeners tab.4.    For listener 443, choose View/edit certificates.You should see two certificates associated with listener 443.Follow"


Question: How do I check if my EC2 instance running Linux booted using UEFI or legacy BIOS?

How do I check if my Amazon Elastic Compute Cloud (Amazon EC2) instance running Linux booted using UEFI or legacy BIOS?

Answer: "How do I check if my Amazon Elastic Compute Cloud (Amazon EC2) instance running Linux booted using UEFI or legacy BIOS?Short descriptionUnified Extensible Firmware Interface (UEFI) is a firmware specification developed to replace the legacy BIOS firmware. The UEFI firmware runs special EFI binary files that have the .efi extension to load the boot loader or operating system. EC2 instances traditionally boot using the legacy BIOS mode. However, ARM-based EC2 instances (a1, c6g, m6g, and r6g) boot using the newer UEFI firmware.For more information on UEFI, see Unified Extensible Firmware Interface Forum on the uefi.org website.Resolution1.    Connect to your EC2 Linux instance using SSH.2.    Run the following command to verify the existence of the /sys/firmware/efi directory. This directory exists only if the instance boots using UEFI. The command returns Legacy BIOS Boot Detected if this directory doesn't exist.# [ -d /sys/firmware/efi ] && echo "UEFI Boot Detected" || echo "Legacy BIOS Boot Detected"Example output from an m6g instance:# [ -d /sys/firmware/efi ] && echo "UEFI Boot Detected" || echo "Legacy BIOS Boot Detected"UEFI Boot DetectedExample output from a non-ARM instance, for example, t2/t3/m4/m5 instances:# [ -d /sys/firmware/efi ] && echo "UEFI Boot Detected" || echo "Legacy BIOS Boot Detected"Legacy BIOS Boot Detected3.    Run the following command to verify that EFI appears in the dmesg output:# dmesg | grep -i "EFI"Example output:[    0.000000] efi: Getting EFI parameters from FDT:[    0.000000] efi: EFI v2.70 by EDK IIFollow"


Question: How do I use AWSUtility::CloudFormation::CommandRunner to run a command before or after a resource in my CloudFormation stack?

I want to use AWSUtility::CloudFormation::CommandRunner to run a command before or after a resource in my AWS CloudFormation stack.

Answer: "I want to use AWSUtility::CloudFormation::CommandRunner to run a command before or after a resource in my AWS CloudFormation stack.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.To run a command before or after a resource in your CloudFormation stack, define the AWSUtility::CloudFormation::CommandRunner resource in your CloudFormation template.For example:Resources:    CommandRunner:        Type: AWSUtility::CloudFormation::CommandRunner        Properties:             Command: 'aws ssm get-parameter --name BucketName --region us-east-1 --query Parameter.Value --output text > /command-output.txt'            Role: EC2-Role            LogGroup: my-cloudwatch-log-groupImportant: If you haven't already registered the AWSUtility::CloudFormation::CommandRunner resource, then run the following commands. The register.sh script uses the awsutility-cloudformation-commandrunner.zip to register the resource type in your AWS Region. The script uses the register-type AWS CLI command to register the resource type in the default Region configured in the AWS CLI. You can check the configured default Region by running aws configure get region. For more information about what actions the register.sh script performs, see User Installation Steps on the AWS GitHub repository.git clone https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner.gitcd aws-cloudformation-resource-providers-awsutilities-commandrunnercurl -LO https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner/releases/latest/download/awsutility-cloudformation-commandrunner.zip./scripts/register.sh --set-defaultImportant: The property Role should be the name of an AWS Identity and Access Management (IAM) instance profile with an associated IAM role. The IAM role must have a trust relationship with the Amazon Elastic Compute Cloud (Amazon EC2) service (ec2.amazonaws.com). The property Role is assumed by the AWSUtility::CloudFormation::CommandRunner resource to run your command. The optional property LogGroup, if specified, writes the logs from your command's execution to the Amazon CloudWatch log group. For more information on using the AWSUtility::CloudFormation::CommandRunner resource in your template, see README.md and docs/README.md from the aws-cloudformation-resource-providers-awsutilities-commandrunner repository on AWS GitHub.You must include the --region option in your AWS CLI commands. Then, you must write the command's output to a reserved file called /command-output.txt, as in the preceding code example.You can reference the output of the command using Fn::GetAtt. For example:S3Bucket:     Type: AWS::S3::Bucket    Properties:         BucketName: !GetAtt CommandRunner.OutputTo run the command after a resource with the logical name Instance, specify DependsOn: Instance in the AWSUtility::CloudFormation::CommandRunner resource's definition. For example:Resources:   CommandRunner:      DependsOn: Instance      Type: AWSUtility::CloudFormation::CommandRunner      Properties:         Command: aws s3 ls | sed -n 1p | cut -d " " -f3 > /command-output.txt         LogGroup: my-cloudwatch-log-group         Role: EC2-Role   Instance:      Type: AWS::EC2::Instance      Properties:         Image: ami-abcd1234To run the command before a resource, set DependsOn to the logical name of the AWSUtility::CloudFormation::CommandRunner resource in that resource's definition. For example:Resources:   CommandRunner:      Type: AWSUtility::CloudFormation::CommandRunner      Properties:         Command: aws s3 ls | sed -n 1p | cut -d " " -f3 > /command-output.txt         LogGroup: my-cloudwatch-log-group         Role: EC2-Role   Instance:      DependsOn: CommandRunner      Type: AWS::EC2::Instance      Properties:         Image: ami-abcd1234Note: In the preceding examples, sed -n 1p prints only the first line from the response returned by aws s3 ls. To get the bucket name, sed -n 1p pipes the response to cut -d " " -f3. Then, cut -d " " -f3 chooses the third element in the array created after splitting the line delimited by a space.Related informationRunning bash commands in AWS CloudFormation templatesFollow"


Question: How can I activate a DataSync agent across AWS Regions or across accounts using an Amazon VPC endpoint?

I want to use AWS DataSync to transfer data between the following locations:Between on-premises and AWSBetween AWS RegionsBetween AWS accountsI want to set up my environments and DataSync agent for this scenario in a private network using an Amazon Virtual Private Cloud (Amazon VPC) endpoint.

Answer: "I want to use AWS DataSync to transfer data between the following locations:Between on-premises and AWSBetween AWS RegionsBetween AWS accountsI want to set up my environments and DataSync agent for this scenario in a private network using an Amazon Virtual Private Cloud (Amazon VPC) endpoint.ResolutionImportant: The following configuration assumes that:The resources won't connect to the public internet except for the connection between the private endpoints to AWS.The source of the data transfer is an on-premises or remote VPC environment with an NFS or SMB data source. The destination of the data transfer is an Amazon VPC that has access to Amazon Simple Storage Service (Amazon S3), Amazon Elastic File System (Amazon EFS), or Amazon FSx. After you complete the setup, you can reverse the transfer direction based on the supported location combinations for DataSync.Set up the source network environment (NFS or SMB data source)The DataSync agent runs on the source network that's close to the NFS or SMB data source. For this configuration, the source network can be either on-premises or a private Amazon VPC.Note: If you want to set up transfers between VPCs using VPC peering, be sure to review the limitations of VPC peering to be sure that the feature supports your configuration.Set up the destination network environment (Amazon S3, Amazon EFS, or Amazon FSx)For this configuration, the destination network must be a private Amazon VPC that can access a destination location, such as Amazon S3, Amazon EFS, or Amazon FSx.Additionally, you must set up the following on the destination private VPC:1.    Create a VPC endpoint for DataSync.2.    Confirm that the subnet associated with the VPC endpoint has at least four IP addresses available for DataSync execution endpoints.Note: Each DataSync task uses four IP addresses for the task execution endpoints.3.    Configure a security group for the DataSync VPC endpoints. The security group must allow:Inbound traffic on TCP port 443 to the endpointOutbound ephemeral trafficInbound traffic on TCP port range 1024-1062 to the destination VPC endpointTo open an AWS Support channel, allow inbound traffic on TCP port 22Set up the network connection between the source and destination environmentsFor this configuration, the data transfer can be from a source on-premises environment to a destination private VPC. Or, the data transfer can be between private VPCs that are in different AWS Regions or belong to different AWS accounts. You must set up the following connection and network requirements between the source and destination environments:1.    Set up an active network connection between the source environment and the destination VPC endpoint. For example, set up this connection using AWS Direct Connect, VPC peering, or a transit VPC.2.    Confirm that there's no overlap in the private network address space between the source and destination environments. Then, verify the CIDR blocks.3.    Confirm that the routing table entries in both the source subnet and destination subnet allow traffic between the networks without issues. For example, if you're using VPC peering, update your route tables for the peering connection.4.    If there's a firewall between the source and destination networks, you must allow the following:Traffic on TCP port 443 to the destination VPC endpoint subnetsTraffic on TCP port range 1024-1062 to the destination VPC endpointTo open an AWS Support channel, allow traffic on TCP port 225.    Confirm that all security groups and firewalls allow ephemeral outbound traffic or the use of connection tracking tools.Set up the machine that you'll use to activate the DataSync agentYou can use a physical computer, a virtual machine, or an Amazon Elastic Compute Cloud (Amazon EC2) instance to activate the DataSync agent. You must set up the following on the machine:1.    Set up a connection to one of the private networks in the source or destination environment. You must configure valid network routes to both networks.2.    If there's no internet connection, you must set up network access to the DataSync agent on TCP port 80 (HTTP).3.    Install the cURL command to get the activation key.4.    Install the AWS Command Line Interface (AWS CLI) to activate the DataSync agent.5.    Configure the AWS CLI with AWS Identity and Access Management (IAM) credentials that allow you to activate the DataSync agent, similar to the following:{  "Version": "2012-10-17",  "Statement": [{      "Sid": "VisualEditor2",      "Effect": "Allow",      "Action": [        "datasync:*"      ],      "Resource": "arn:aws:datasync:us-east-1:123456789012:*"    },    {      "Sid": "VisualEditor3",      "Effect": "Allow",      "Action": [        "ec2:*VpcEndpoint*",        "ec2:*subnet*",        "ec2:*security-group*"      ],      "Resource": "*"    }  ]}Note: If you're using an Amazon EC2 instance to activate the agent, then you can attach the IAM role with the correct permissions to the instance profile.Activate the DataSync agentNote: Be sure to replace us-east-1 with the AWS Region of your choice.1.    Deploy the DataSync agent on a virtual machine (on-premises) or on an EC2 instance (private VPC).2.    From the machine that you set up in the previous steps, get the DataSync agent's activation key by running the following cURL command:curl -vvv -G \  --data-urlencode "activationRegion=us-east-1" \  --data-urlencode "gatewayType=SYNC" \  --data-urlencode "endpointType=PRIVATE_LINK" \  --data-urlencode "privateLinkEndpoint=vpc_endpoint_ip_address" \  --data-urlencode "redirect_to=https://us-east-1.console.aws.amazon.com/datasync/home?region=us-east-1#/agents/create" \  "http://datasync_agent_ip"Note: You can optionally include --data-urlencode "no_redirect" to simplify and shorten the command and output.-or-You can obtain the activation key using the local console.3.    Note the activation key from the command output.4.    Using the AWS CLI, run the describe-vpc-endpoints command to get the destination VPC endpoint ID:aws ec2 describe-vpc-endpoints --region us-east-1Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.5.    Note the "VpcEndpointId" from the command output, similar to the following:"VpcEndpointId": "vpce-0ba3xxxxx3752b63"6.    Using the AWS CLI, run the describe-security-groups command to get the security group ID of the destination VPC. This is the security group that the DataSync execution endpoints will use to connect to the DataSync VPC endpoint.Note: We recommend that you use the same security group as the VPC endpoint to reduce the complexity of the configuration.aws ec2 describe-security-groups --region us-east-17.    Note the "GroupID" from the command output, similar to the following:"GroupId": "sg-000e8edxxxx4e4701"8.    Using the AWS CLI, run the describe-subnets command to get the subnet ID associated with the VPC endpoint:Note: To reduce the complexity of the configuration, it's a best practice to use the same subnet as the VPC endpoint.aws ec2 describe-subnets --region us-east-19.    Note the "SubnetArn" from the command output, similar to the following:"SubnetArn": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-03dc4xxxx6905bb76"10.    Using the AWS CLI, run the create-agent command to activate the DataSync agent:For --activation-key, enter the activation key that you got in step 3.For --vpc-endpoint-id, enter the "VpcEndpointId" that you got in step 5.For --security-group-arns, enter the GroupID that you got in step 7.For --subnet-arns, enter the SubnetArn that you got in step 9.aws datasync create-agent --agent-name your_agent_name --vpc-endpoint-id vpce-0cxxxxxxxxxxxxf57 --activation-key UxxxQ-0xxxB-LxxxL-AUxxV-JxxxN --subnet-arns arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0cxxxxxxxxxxxx3 --security-group-arns arn:aws:ec2:us-east-1:123456789012:security-group/sg-xxxxxxxxxxxxxx --region us-east-111.    The command returns the DataSync agent's Amazon Resource Name (ARN):{    "AgentArn": "arn:aws:datasync:us-east-1:123456789012:agent/agent-0bxxxxxxxxxxxxxx57c"}12.    Run the list-agents command to confirm that you created the agent successfully:aws datasync list-agents --region us-east-113.    Confirm that your DataSync agent's ARN is returned in the output:{    "Agents": [        {            "AgentArn": "arn:aws:datasync:us-east-1:123456789012:agent/agent-0bxxxxxxxxxxxxxx57c",            "Status": "ONLINE",            "Name": "your_agent_name"        }    ]}After your DataSync agent is activated, you can use the DataSync console to create locations and tasks for your transfers.Troubleshoot errors during DataSync agent activation'The cURL command returns "errorType=PRIVATE_LINK_ENDPOINT_UNREACHABLE' and doesn't return the activation key'This error typically occurs when traffic on TCP port 443 is not allowed to the VPC endpoint."An error occurred (InvalidRequestException) when calling the CreateAgent operation: Private link configuration is invalid: VPC Endpoint Id should remain unspecified for public-endpoint activation keys"This error typically occurs when you enter the public activation key for the --activation-key parameter in the create-agent command. You must enter the private activation key for the private endpoint type in this configuration."An error occurred (InvalidRequestException) when calling the CreateAgent operation: Invalid EC2 subnet, ARN: arn:aws:ec2:us-east-1:123456789012:subnet/subnet-41xxxx08, reason: invalid subnet, StatusCode: 403"-or-"An error occurred (InvalidRequestException) when calling the CreateAgent operation: Invalid EC2 security group, ARN: arn:aws:ec2:us-east-1:123456789012:security-group/sg-000e8xxxx9d4e4701, reason: invalid security group, StatusCode: 403"-or-"An error occurred (InvalidRequestException) when calling the CreateAgent operation: Private link configuration is invalid: VPC endpoint vpce-0ba34edxxxx752b63 is not valid"These errors typically occur when the IAM identity configured on your AWS CLI has insufficient permissions. You must confirm that your IAM identity's policy grants permissions for ec2:*VpcEndpoint*, ec2:*subnet*, and ec2:*security-group*.Related informationHow AWS DataSync worksUsing AWS DataSync in a virtual private cloudRequirements for AWS DataSyncFollow"


Question: How do I create a Lightsail load balancer with an SSL/TLS certificate to use with my Lightsail instances?

How do I create an Amazon Lightsail load balancer with an SSL/TLS certificate to use with my Lightsail instances?

Answer: "How do I create an Amazon Lightsail load balancer with an SSL/TLS certificate to use with my Lightsail instances?Short DescriptionA Lightsail load balancer enables better performance from your web applications by distributing inbound web traffic across your Lightsail instances in multiple Availability Zones. Attaching an SSL certificate to your Lightsail load balancer encrypts traffic between your browser and web server for an extra layer of security.ResolutionCreate a Lightsail load balancer in the Lightsail console, and then attach instances to it.Create an SSL/TLS certificate for the Lightsail load balancer.Validate your domain ownership.Attach the validated SSL/TLS certificate to the Lightsail load balancer.Verify HTTPS access to the Lightsail load balancer. Open your browser and verify that there is a green padlock symbol next the website domain URL. The green padlock symbol confirms HTTPS access to your domain.Related InformationHow do I install an SSL certificate on a Bitnami stack hosted on Amazon Lightsail?SSL/TLS certificates in LightsailFollow"


Question: What do I do when I receive my AWS Snowball Edge or Snowcone device?

I received my AWS Snowball Edge or AWS Snowcone device. I want to get started.

Answer: "I received my AWS Snowball Edge or AWS Snowcone device. I want to get started.Resolution1.    After you receive your Snowball Edge or Snowcone device, check the following:If the device has damage or apparent tampering, then don't connect to the device. Instead, open a case with AWS Support, and describe the issue so that you can be shipped a new device.If you received a Snowball Edge device, then confirm that you have the power cables. If you received a Snowcone device, then you don't get any accessories.2.    Turn on the device. Then, depending on your device, use one of the following tutorials to transfer data:How can I transfer my data to my AWS Snowball Edge device?Using NFS file shares to manage file storage3.    Depending on your device, follow these instructions to prepare the device for shipping back to AWS:For a Snowball Edge device, see Preparing an AWS Snowball Edge for shipping.For a Snowcone device, see Preparing an AWS Snowcone device for shipping.4.    Depending on your device, follow these instructions to ship the device back to AWS:For a Snowball Edge device, see Shipping an AWS Snowball Edge.For a Snowcone device, see Returning the Snowcone device.Follow"


Question: How can I troubleshoot issues associated with connecting Git repositories to Amazon SageMaker notebook instances?

"I'm trying to add a Git repository to an Amazon SageMaker notebook instance, but I'm getting one or more of the following errors:"fatal: unable to access <Git repository URL>: the requested URL returned error: 403""fatal: unable to access <Git repository  URL> : failed to connect to …: port 443: connection timed out""fatal: unable to access <Git repository URL> could not resolve the host: …""fatal: could not read Username for <Git repository URL>: terminal prompts disabled""fatal: could not read Password for <Git repository URL>: terminal prompts disabled""fatal: authentication failed for <Git repository URL>""No space left on device while cloning Git repo. Please try using a larger volume""

Answer: "I'm trying to add a Git repository to an Amazon SageMaker notebook instance, but I'm getting one or more of the following errors:"fatal: unable to access <Git repository URL>: the requested URL returned error: 403""fatal: unable to access <Git repository  URL> : failed to connect to …: port 443: connection timed out""fatal: unable to access <Git repository URL> could not resolve the host: …""fatal: could not read Username for <Git repository URL>: terminal prompts disabled""fatal: could not read Password for <Git repository URL>: terminal prompts disabled""fatal: authentication failed for <Git repository URL>""No space left on device while cloning Git repo. Please try using a larger volume"ResolutionTo add a new Git repository to your SageMaker notebook instance, see Add a Git repository to your Amazon SageMaker account. If you're trying to add a Git repository that's not hosted on AWS CodeCommit, you might get the following errors.Errors associated with connectivityIf there are connectivity issues, you might get one of the following errors:"fatal: unable to access <Git repository URL>: the requested URL returned error: 403""fatal: unable to access <Git repository URL>: failed to connect to …: port 443: connection timed out""fatal: unable to access <Git repository URL> could not resolve the host: …"To resolve these errors, do the following:Verify the notebook instance connectivity.Verify the accuracy of the Git repository URL.Verify the notebook instance connectivityBe sure that notebook instance has successfully connected to the Git repository. This repository might be located either on an on-premises Git repository server or a public cloud server, such as GitHub, Bitbucket, or GitLab.Check the network configuration that your notebook instance is using. The notebook instance might have one of the following network configurations:The instance isn't attached to an Amazon Virtual Private Cloud (VPC).Your Amazon VPC has direct internet accessYour VPC doesn't have direct internet access.If you use a VPC, be sure that the subnets, security groups, network access control Lists (ACLs), NAT gateway, internet gateway, and route tables are configured correctly.Verify the accuracy of the Git repository URLBe sure that the Git repository URL that you're adding is in the following format:GitHub URL: https://github.com/<workspace>/<repository.git>Bitbucket URL: https://bitbucket.org/<workspace>/<repository.git>GitLab URL: https://gitlab.com/<workspace>/<repository.git>Be sure to replace the following:workspace with the Git workspace namerepository.git with the code repository name that has the *.git file extension.For example, if you're using Bitbucket as a Git repository where the name of your workspace is myworkspace, and your Git repository is myrepository.git, then you must use the following Git repository URL: https://bitbucket.org/myworkspace/myrepository.gitErrors associated with authenticationIf there are authentication issues, you might get one of the following errors:"fatal: could not read Username for <Git repository URL>: terminal prompts disabled""fatal: could not read Password for <Git repository URL>: terminal prompts disabled""fatal: authentication failed for <Git repository URL>"To resolve these errors, do the following:Verify the authentication details.Verify that the AWS Identity and Access Management (IAM) user or roles has the required permissions to access AWS Secrets Manager.Verify that the authentication details are accurateBe sure that the username and password are accurate in Secrets Manager.GitHub: If you have enabled two-factor authentication, then you must use a personal access token instead of a password. After this token is generated, you must update the password in Secrets Manager with this new token.Bitbucket: Bitbucket doesn't support account passwords for Git authentication. It's a best practice to create App passwords using your Personal settings. After creating the App password, you must update the password in Secrets Manager.GitLab: If you have enabled two-factor authentication, then you must use a personal access token instead of a password. After this token is generated, you must update the password in Secrets Manager with this new token.Verify that the notebook instance's IAM role has the required permissionsVerify that the IAM role used for the notebook instance has the secretsmanager:GetSecretValue permission attached in its IAM policy. If the IAM role doesn't have the required permissions, then you can add the following policy to the IAM role:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "secretsmanager:GetSecretValue"      ],      "Resource": [        "example-secret-ARN"      ]    },    {      "Effect": "Allow",      "Action": "secretsmanager:ListSecrets",      "Resource": "*"    }  ]}Note:example-secret-ARN is the ARN in Secrets Managerthat has the secrets (username and password) for the Git repository authentication.Errors associated with storageIf there are storage related issues, you might get the following error:No space left on device while cloning Git repo. Please try using a larger volumeTo resolve this error, verify that the notebook instance has enough storage. Be sure that the size of the free space in the notebook instance’s volume is larger than that of the Git repository that you're using to clone. If you run out of disk space, specify a larger value for VolumeSizeInGB. For more information, see Customize your notebook volume size, up to 16 TB, with Amazon SageMaker.Related informationAssociate Git repositories with SageMaker notebook instancesUsing AWS CodeCommit with interface VPC endpointsFollow"


Question: How do I increase my Lambda environment variable size quota?

I want to configure more than 4 KB of environment variables for my AWS Lambda function. How do I increase my service quota for Lambda environment variables?

Answer: "I want to configure more than 4 KB of environment variables for my AWS Lambda function. How do I increase my service quota for Lambda environment variables?ResolutionLambda environment variables have a default 4 KB service quota that can't be increased.To configure more than 4 KB of environment variables for your Lambda function, you must use an external data store. For example, another database or either of the following AWS services:AWS Systems Manager Parameter StoreAmazon Simple Storage Service (Amazon S3)Note: Using either Parameter Store or Amazon S3 can incur charges on your AWS account. For pricing information, see AWS pricing. To review the Lambda service quotas, see the Service Quotas console.Related informationViewing service quotasConfiguring functions in the consoleHow do I get a Lambda function in a VPC to access Systems Manager Parameter Store?Follow"


Question: How do I resolve "error: You must be logged in to the server (Unauthorized)" errors when connecting to an Amazon EKS cluster from CodeBuild?

"I'm trying to connect to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster from AWS CodeBuild using the CodeBuild service role. Why are my kubectl commands returning "error: You must be logged in to the server (Unauthorized)" errors, and how do I troubleshoot the issue?"

Answer: "I'm trying to connect to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster from AWS CodeBuild using the CodeBuild service role. Why are my kubectl commands returning "error: You must be logged in to the server (Unauthorized)" errors, and how do I troubleshoot the issue?Short descriptionAWS Identity and Access Management (IAM) Authenticator doesn't permit a path in the role Amazon Resource Name (ARN) used in the configuration map. If the role ARN (rolearn) in your aws-auth ConfigMap includes a path, Amazon EKS returns the following error:"error: You must be logged in to the server (Unauthorized)"The CodeBuild service role ARN includes the following path: /service-role. When you specify the rolearn value in your aws-auth ConfigMap, you must remove the /service-role path—or any other path, if you're using another role. For more information, see Managing users or IAM roles for your cluster.If you receive errors after removing any paths from the role ARN in your aws-auth ConfigMap, follow the instructions in the following article: How do I resolve an unauthorized server error when I connect to the Amazon EKS API server?ResolutionIdentify your CodeBuild service role's ARN and remove the /service-role path1.    Open the CodeBuild console.2.    In the left navigation pane, choose Build. Then, choose Build projects.3.    Select your project name. Then, choose Build details.4.    Under the Environment section, in the Build details pane, copy the CodeBuild service role ARN.5.    In a text editor, paste the CodeBuild service role ARN and remove the /service-role path. Then, copy the edited ARN.Example CodeBuild service role ARNarn:aws:iam::123456789012:role/service-role/codebuild-project-service-roleExample CodeBuild service role ARN with the /service-role path removedarn:aws:iam::123456789012:role/codebuild-project-service-roleAdd the edited CodeBuild service role's ARN to your aws-auth ConfigMap1.    To edit the aws-auth ConfigMap in a text editor, the cluster owner or admin must run the following kubectl command:Note: You can run the command from your local computer or an Amazon Elastic Compute Cloud (Amazon EC2) instance that has access to the EKS cluster. The user who created the cluster has access to the cluster by default.$ kubectl edit -n kube-system cm aws-authThe aws-auth ConfigMap opens in vi editor.Note: If you receive an Error from server (NotFound): configmaps "aws-auth" not found error, use the example aws-auth ConfigMap that's provided in the following article: Managing users or IAM roles for your cluster.2.    In the vi editor, add the edited CodeBuild service role's ARN to the aws-auth ConfigMap by doing the following:Activate insert mode by pressing i.In the mapRoles statement, under system:masters, for the rolearn value, enter the edited CodeBuild service role's ARN.Activate command mode by pressing Esc. Then, save and close the file by entering :wq.Example mapRoles statement that includes a correctly formatted CodeBuild service role ARNmapRoles: |groups:system:mastersrolearn: arn:aws:iam::123456789012:role/codebuild-project-service-roleusername: codebuild-project-service-roleRelated informationHow do I resolve an unauthorized server error when I connect to the Amazon EKS API server?Follow"