Question: How can I view encryption information about my AMI or snapshot?

"How can I determine if my Amazon Machine Image (AMI) or snapshot is encrypted, and if it is, whether it uses an AWS managed AWS KMS key (KMS key) or a customer managed key?"

Answer: "How can I determine if my Amazon Machine Image (AMI) or snapshot is encrypted, and if it is, whether it uses an AWS managed AWS KMS key (KMS key) or a customer managed key?Short descriptionYou can view encryption information for your snapshots or AMI using the console or using the AWS Command Line Interface (AWS CLI).ResolutionNotes:If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.JSON is the default AWS CLI output. You can use the default, or append --output json to the commands to receive output as shown in the following examples. For more information, see How to filter the output with the --query option.View encryption information using AWS CLI commands1.    Run the describe-images command with the BlockDeviceMappings query filter to view the snapshots associated with the AMI. In the following example, replace image-ids and region with the ID and Region of your AMI.# aws ec2 describe-images --image-ids ami-xxxxxxxxx --region eu-west-1 --query "Images[*].BlockDeviceMappings"[    [        {            "DeviceName": "/dev/xvda",            "Ebs": {                "DeleteOnTermination": true,                "SnapshotId": "snap-xxxxxxxxx",                "VolumeSize": 8,                "VolumeType": "gp2",                "Encrypted": true            }        }    ]]The preceding command output example shows the snapshot associated with the AMI has the Encrypted parameter set to true.2.    Run the describe-snapshots command using the snapshot-id of the snapshot listed in the output of the describe-images command:# aws ec2 describe-snapshots --snapshot-ids snap-xxxxxxxxx  --region eu-west-1{    "Snapshots": [        {            "Description": "Copied for DestinationAmi ami-xxxxxxxxx from SourceAmi ami-xxxxxxxxx for SourceSnapshot snap-xxxxxxxxx. Task created on 1,579,611,950,318.",            "Encrypted": true,            "KmsKeyId": "arn:aws:kms:eu-west-1:9208xxxxxxxxx:key/dcd4d062-xxxxxxxxx-xxxxxxxxxx",            "OwnerId": "111122223333",            "Progress": "100%",            "SnapshotId": "snap-xxxxxxxxx",            "StartTime": "2020-01-21T13:05:53.887Z",            "State": "completed",            "VolumeId": "vol-ffffffff",            "VolumeSize": 8        }    ]}In the command output, note the KMSKeyId.3.    Run the describe-key command to determine whether the key is an AWS managed key or a customer managed key. In the following command, replace key-id with the KMSKeyId listed in the describe-snapshot command. Replace region with the snapshot's Region.# aws kms describe-key --key-id dcd4d062-xxxxxxxxx-xxxxxxxxx  --region eu-west-1{    "KeyMetadata": {        "AWSAccountId": "92xxxxxxxxx",        "KeyId": "dcd4d062-xxxxxxxxx-xxxxxxxx",        "Arn": "arn:aws:kms:eu-west-1:92xxxxxxxxx:key/dcd4d062-xxxxxxxxx-xxxxxxx",        "CreationDate": 1579611763.538,        "Enabled": true,        "Description": "02-example-CMK",        "KeyUsage": "ENCRYPT_DECRYPT",        "KeyState": "Enabled",        "Origin": "AWS_KMS",        "KeyManager": "CUSTOMER",        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",        "EncryptionAlgorithms": [            "SYMMETRIC_DEFAULT"        ]    }}In the preceding output example, the "KeyManager" parameter is "Customer", indicating the key is a customer managed key. For an AWS managed key, the "KeyManager" parameter is "AWS".View encryption information using the console1.    Open the Amazon EC2 console, and then choose AMIs.2.    Copy the ID of the AMI you want details for.3.    Under Elastic Block Store, choose Snapshots.4.    Paste the AMI ID into the search box, and then press ENTER.5.    Select the snapshot, and then on the Description tab, verify if Encryption is set to Encrypted or Not Encrypted. If the snapshot is encrypted, note the KMS Key ID and KMS Key ARN.6.    Open the AWS Key Management Service (AWS KMS) console.7.    Select AWS managed keys and then paste the KMS Key ID into the filter box. If no results appear, choose Customer managed keys and then paste the KMS Key ID into the filter box.Note: You can't share AMIs that are encrypted with an AWS managed key. For more information, see Sharing a snapshot - Considerations.Related informationAWS KMS conceptsFollow"


Question: "How do I turn on the EPEL repository for my Amazon EC2 instance running CentOS, RHEL, or Amazon Linux?"

"I want to turn on access to the Extra Packages for Enterprise Linux (EPEL) repository in an Amazon Elastic Compute Cloud (Amazon EC2) instance running CentOS, Red Hat Enterprise Linux (RHEL), or Amazon Linux-based distribution."

Answer: "I want to turn on access to the Extra Packages for Enterprise Linux (EPEL) repository in an Amazon Elastic Compute Cloud (Amazon EC2) instance running CentOS, Red Hat Enterprise Linux (RHEL), or Amazon Linux-based distribution.Short descriptionStandard repositories might not provide all the packages that can be installed on CentOS, RHEL, or Amazon Linux-based distribution. Turning on the EPEL repository provides additional options for package installation.ResolutionFollow these steps to download, install, and turn on the EPEL repository on CentOS, RHEL, or Amazon Linux-based distribution.To verify the distribution, run the following command:cat /etc/os-releaseAmazon LinuxAmazon Linux 2:Install the EPEL release package for RHEL 7 and turn on the EPEL repository:sudo amazon-linux-extras install epel -yRHELRHEL 8:Install the EPEL release package for RHEL 8.sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -yRHEL 7:Install and turn on the EPEL release package for RHEL 7:sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpmCentOSCentOS 8:Install the EPEL release package for RHEL 8. Turn on both the EPEL and PowerTools repositories. The PowerTools repository contains development tools required by many EPEL packages:sudo sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*sudo sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -ysudo dnf config-manager --set-enabled PowerToolsCentOS 7:Install and turn on the EPEL release package. CentOS 7 includes the epel-release package in the base repositories:sudo yum -y install epel-releaseList repositories that are turned onTo verify that the EPEL repository is turned on, run the repolist command:sudo yum repolistRelated informationAdd repositories on an Amazon Linux instanceExtras library (Amazon Linux 2)Amazon Linux 2 FAQsExtra Packages for Enterprise Linux (EPEL)Follow"


Question: Is the charge that I received on my credit card from AWS?

I received a charge from Amazon that I think might be from AWS. How can I be sure?

Answer: "I received a charge from Amazon that I think might be from AWS. How can I be sure?ResolutionAWS charges are billed on your credit card using the charge description that includes your nine-digit invoice number. You can check the invoice number against the Invoice ID in the Payments  section in the AWS Billing and Cost Management console.Note: You might see "AMAZON WEB SERVICES" or "AMAZON MKTPLACE PMTS AMAZON.COM" on your credit card statement for charges related to AWS offerings.You can view your monthly AWS statements in the AWS Billing and Cost Management console.If you have questions about the charges related to an AWS account, then follow these steps:Open the AWS Support Center.Choose Create case.Select Account and billing support.Enter the required information.Choose Submit.If the charge you see doesn't have your invoice number, but it appears to be from Amazon, then contact Amazon.com.Related informationWhat do I do if I'm receiving a bill from AWS, but can't find the resources related to the charges?How do I find the AWS account associated with an unknown Amazon Web Services charge?Report suspicious emails Follow"


Question: Why am I experiencing high latency issues with Kinesis Data Streams?

My Amazon Kinesis data stream is experiencing high latency while getting data records. Why is this happening and how do I troubleshoot this?

Answer: "My Amazon Kinesis data stream is experiencing high latency while getting data records. Why is this happening and how do I troubleshoot this?Short DescriptionGetRecords.Latency can increase if there is an increase in record count or record size for each GET request. If you tried to restart your application while the producer was ingesting data into the stream, records can accumulate without being consumed. This increase in the record count or amount of data to be fetched increases the value for GetRecords.Latency. Additionally, if an application is unable to catch up with the ingestion rate, the IteratorAge gets increased.Note: Enabling server-side encryption on your Kinesis data stream can also increase your latency.ResolutionMonitor the Amazon Kinesis Data Streams service with Amazon CloudWatch. Check the CloudWatch metrics such as GetRecords.Latency to verify whether the latency increase is continuous. If the latency increase is continuous, then check if there is also an increase in the IncomingRecords, IncomingBytes, GetRecords.Records, and GetRecords.Bytes metrics in CloudWatch. As data volumes increase, these metrics also increase, causing high latency. This increase occurs because GetRecords fetches more records when there are more records available in the Kinesis data stream.If your IteratorAge also increased, then there are likely more IncomingBytes put into the stream. Check the IncomingBytes metric in CloudWatch to verify whether the number of bytes increased. You can also check whether fewer GetRecords calls were made to the stream. More incoming bytes indicate that each GetRecords call is retrieving more data, which increases the value for GetRecords.Latency.If you still observe high latency (even though there is no increase in IncomingBytes or IncomingRecords), there might be too much incoming data. If the consumer application is unable to catch up with the incoming data, the data continues to accumulate in the Kinesis data stream. Even if you restart the application, more records are fetched within each GetRecords call. The increase in records or fetched data for each GetRecords call then increases the value for GetRecords.Latency.To resolve this issue, try the following troubleshooting tips:Check your application to see if enough GetRecords calls are being made to process the volume of incoming data. If you are using the Amazon Kinesis Client Library (KCL) application or AWS Lambda as a consumer, increase the number of shards in your stream. An increase in shard count increases the consumption rate from the delivery stream, while decreasing the values for the IteratorAge and GetRecords.Latency.Increase the retention period of the Kinesis data stream to avoid any data losses. A longer retention period can help your application to catch up with the data backlog.If you have your own consumer application, check the processing logic and record processing time.Check the central processing unit (CPU) and memory utilization of your system to see if you need to free up more memory.Follow"


Question: Why aren't the subnet network ACLs in my VPC allowing traffic through the transit gateway?

"I allowed inbound SSH traffic on the network access control list (ACL) for the subnet of my destination Amazon Elastic Compute Cloud (Amazon EC2) instance. However, traffic is still blocked. Why aren't the subnet network ACLs in my virtual private cloud (VPC) allowing traffic through the transit gateway?"

Answer: "I allowed inbound SSH traffic on the network access control list (ACL) for the subnet of my destination Amazon Elastic Compute Cloud (Amazon EC2) instance. However, traffic is still blocked. Why aren't the subnet network ACLs in my virtual private cloud (VPC) allowing traffic through the transit gateway?ResolutionWhen you create a transit gateway attachment and then associate a subnet in your VPC, a transit gateway interface is created in that subnet. The transit gateway interface routes traffic from the Amazon EC2 instance's elastic network interface to the transit gateway. The elastic network interface for the Amazon EC2 instance and the transit gateway might be in the same subnet. However, you must consider them as separate entities when configuring the network ACLs.In the network ACL associated with the transit gateway interface at the destination's VPC, add an inbound rule to allow custom TCP on the ephemeral port. With this rule configured, return traffic on the ephemeral port is allowed.Confirm that traffic is flowing as intended by reviewing the VPC Flow Logs on the transit gateway network interface.Note: To learn more about Flow Logs, see Learn From your VPC Flow Logs with additional meta-data.Network ACL inbound and outbound rules are applied differently based on whether Amazon EC2 and the transit gateway are in the same subnet or different subnets. For more information, see How network ACLs work with transit gateways.Related informationVPC Flow Logs - Log and view network traffic flowsFollow"


Question: How can I make a private Amazon Redshift cluster publicly accessible?

I want to update my Amazon Redshift cluster so that it is publicly accessible. How can I do this?

Answer: "I want to update my Amazon Redshift cluster so that it is publicly accessible. How can I do this?ResolutionTo modify a cluster, follow these steps:1.    From the AWS Management Console, navigate to the Amazon Redshift console.2.    On the navigation menu, choose CLUSTERS.3.    Select the cluster that you want to modify.4.    Choose Actions.5.    Choose Modify Publicly accessible setting.6.    Choose Enable.7.    Choose Save changes.Note: An Elastic IP address is required. If you do not choose one, an address will be randomly assigned to you.If you still can't connect to the cluster from the internet or a different network, then check the following settings.Security group1.    Open the Amazon Redshift console.2.    Select the cluster that you want to modify.3.    Under Properties, choose Network and security settings.4.    Choose the link next to VPC security group to open the Amazon Elastic Compute Cloud (Amazon EC2) console.5.    On the Inbound Rules tab, make sure that your IP address and the port of your Amazon Redshift cluster are allowed. The default port for Amazon Redshift is 5439, but your port might be different.Note: Although security groups are stateful, it’s a best practice to verify that the Outbound Rules allow outbound communications. By default, a security group includes an outbound rule that allows all outbound traffic. For more information, see Security group basics.VPC network access control list (network ACL)Unlike security groups, network ACLs are stateless. This means that you must configure both inbound and outbound rules. Make sure that your IP address and the port of your Amazon Redshift cluster are allowed in the inbound rules for the VPC network ACL. In the outbound rules, allow all traffic (port range: 0–65535) to your IP address. For more information, see Adding and deleting rules.VPC route tableVerify route table settings on the Amazon VPC console. To connect to a publicly accessible cluster from the public internet, an internet gateway must be attached to the route table. Confirm that the internet gateway's target is set with source 0.0.0.0/0 or a public IP CIDR. The route table must be associated with the VPC subnet where your cluster resides. For more information, see Turning on internet access.If you don’t want to make the subnet publicly accessible (because of other resources in that subnet), then use a snapshot. You can use a snapshot to restore the cluster into a public subnet.If you still have connection problems, then use network diagnostic tools such as Telnet and tcpdump for additional troubleshooting.Related informationManaging clusters in a VPCConnecting from outside of Amazon EC2 —firewall timeout issueFollow"


Question: How do I troubleshoot a failed or stuck Spark SQL query in Amazon EMR?

I want to collect information to troubleshoot issues with my Spark SQL queries in Amazon EMR.

Answer: "I want to collect information to troubleshoot issues with my Spark SQL queries in Amazon EMR.ResolutionSpark SQL completed queries are located on the Application User Interfaces tab of your EMR cluster's Spark History Server. For more information, see View persistent application user interfaces.To access completed Spark SQL queries, do the following:On the Spark History Server, select SQL/DataFrame to view completed Spark SQL queries.Select the query's Spark SQL job application IDs to open the completed job ID information on the Jobs tab. Note that a SQL query might have more than one job ID.The following information is available from the Jobs tab:On the Jobs tab, you can see the status of the job, the job duration, and the associated SQL query.On the Jobs tab, you can review the application ID's timeline. The timeline displays the addition and removal of the Spark executors in chronological order.Scroll down to see the DAG (Direct Acyclic Graph). The DAG is a visualization of the Spark SQL query. You can also see the chain of RDD dependencies.Scroll further to see the completed stages of the Spark SQL job.Select the stage ID description to see the query's total time across all tasks, a locality level summary, and the associated job ID. The Stages view provides details of all the RDDs that correspond to this stage. This view also provides information about the lower level RDD operation related to the high level Spark SQL operation.Expand Aggregated Metric by Executor to view the Executors log. The Executors log provides additional details about the Spark SQL job. The following is an example log:23/01/17 18:10:17 INFO Executor: Finished task 0.0 in stage 16.0 (TID 16). 1882 bytes result sent to driver23/01/17 18:10:17 INFO YarnCoarseGrainedExecutorBackend: Got assigned task 1723/01/17 18:10:17 INFO Executor: Running task 0.0 in stage 17.0 (TID 17)23/01/17 18:10:17 INFO TorrentBroadcast: Started reading broadcast variable 17 with 1 pieces (estimated total size 4.0 MiB)23/01/17 18:10:17 INFO MemoryStore: Block broadcast_17_piece0 stored as bytes in memory (estimated size 7.2 KiB, free 4.8 GiB)23/01/17 18:10:17 INFO TorrentBroadcast: Reading broadcast variable 17 took 8 ms23/01/17 18:10:17 INFO MemoryStore: Block broadcast_17 stored as values in memory (estimated size 13.8 KiB, free 4.8 GiB)23/01/17 18:10:17 INFO PythonRunner: Times: total = 52, boot = -31, init = 83, finish = 023/01/17 18:10:17 INFO Executor: Finished task 0.0 in stage 17.0 (TID 17). 1883 bytes result sent to driver23/01/17 18:11:20 ERROR CoarseGrainedExecutorBackend: RECEIVED SIGNAL TERM23/01/17 18:11:20 INFO MemoryStore: MemoryStore cleared23/01/17 18:11:20 INFO BlockManager: BlockManager stopped23/01/17 18:11:20 INFO ShutdownHookManager: Shutdown hook calledFor detailed information, see Jobs Tab in the Web UI section of the Apache Spark documentation.Related informationExamine the log filesFollow"


Question: How do I troubleshoot common issues with AWS SDK workloads in Amazon EKS?

"I used AWS SDK to develop a container application for Amazon Elastic Kubernetes Service (Amazon EKS). When I try to make calls to AWS services, I get an error."

Answer: "I used AWS SDK to develop a container application for Amazon Elastic Kubernetes Service (Amazon EKS). When I try to make calls to AWS services, I get an error.ResolutionWhen you deploy a container application that uses AWS SDK to an Amazon EKS cluster, you might receive one of the following errors:NoCredentialsError: Unable to locate credentialsEndpointConnectionErrorClientError: An error occurred (AccessDenied)ClientError: An error occurred (UnauthorizedOperation)The specific error message depends on the AWS SDK programming language that your application uses. Refer to the following troubleshooting steps for your error.Unable to locate credentialsIf Amazon EKS can't find your pod's credentials, then you see an error that's similar to the following message:"File "/usr/local/lib/python2.7/site-packages/botocore/auth.py", line 315, in add_authraise NoCredentialsErrorbotocore.exceptions.NoCredentialsError: Unable to locate credentials"This error occurs when you don't configure your pod's credentials, you don't configure the credentials properly, or your AWS SDK version isn't supported.To resolve this error, use AWS Identity and Access Management (IAM) roles. Typically, you create and distribute AWS credentials for the SDK client in the application or with the Amazon EC2 instance's role. Instead, configure your pods to use IAM roles for service accounts. Associate an IAM role with a Kubernetes service account, and then configure your pods to use the service account.Important: Your pods' containers must use an AWS SDK version that supports assuming an IAM role through an OpenID Connect web identity token file.Could not connect to the endpoint URLIf your pod can't communicate with the AWS service endpoints, then you see an error that's similar to the following message:"File "/usr/local/lib/python2.7/site-packages/botocore/retryhandler.py", line 359, in _check_caught_exceptionraise caught_exceptionbotocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: "https://ec2.eu-west-1.amazonaws.com/"botocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: "https://sts.eu-west-1.amazonaws.com/""To resolve this error, troubleshoot DNS issues and confirm the following points:Check if CoreDNS pods are running in the clusterRun the following command:kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o wideYou see an output that's similar to the following example:NAME                       READY   STATUS    RESTARTS   AGE   IP                NODE                                            NOMINATED NODE   READINESS GATES  coredns-7f85bf9964-kz8lp   1/1     Running   0          15d   192.168.100.36    ip-192-168-101-156.eu-west-1.compute.internal   <none>           <none>  coredns-7f85bf9964-wjxvb   1/1     Running   0          15d   192.168.135.215   ip-192-168-143-137.eu-west-1.compute.internal   <none>           <none>Be sure to have running worker nodes with sufficient capacity in the Amazon EKS cluster to successfully run the CoreDNS pods.Test endpoint resolutionVerify that your CoreDNS pod and application pod can resolve the AWS service endpoint that you want your pod to call. Run the following command:nslookup SERVICE_ENDPOINT    nslookup ec2.eu-west-1.amazonaws.com    nslookup ec2.amazonaws.comNote: Replace SERVICE_ENDPOINT with the ENDPOINT that's printed in the error message.An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operationIf your pod can't request a temporary security credential, then you see an error that's similar to the following message:"File "/usr/local/lib/python3.11/site-packages/botocore/client.py", line 960, in _make_api_callraise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity"To resolve this error, complete the following steps:Confirm the assumed IAM roleConfirm that the Pod assumes an IAM role that's associated with a Kubernetes service account that exists in the cluster. Otherwise, the pod assumes the Amazon EKS node IAM role. To get the service account's IAM role ARN, run the following command:kubectl get serviceaccount -A    kubectl describe serviceaccount serviceaccount_name -n namespace_name | grep -i arnNote: Replace serviceaccount_name and namespace_name with your own values.You see an output that's similar to the following example:Annotations: eks.amazonaws.com/role-arn: arn:aws:iam::11112222333:role/AccessEC2roleCheck CloudTrail eventsVerify which IAM identity is denied access to perform the AssumeRoleWithWebIdentity actionView. To do this, check AWS CloudTrail events in the CloudTrail console.Log in to the CloudTrail console.In the navigation pane, choose Event history.In the Lookup attributes dropdown menu, change the selection from Read-only to Event name.In the Enter an event name search bar, enter AssumeRoleWithWebIdentity . Inspect the list of events that appears in the content pane. See the following example of a denied event:{      "eventVersion": "1.08",      "userIdentity": {          "type": "WebIdentityUser",          "userName": "system:serviceaccount:serverless:aws-sdk"      },      "eventName": "AssumeRoleWithWebIdentity",      "errorCode": "AccessDenied",      "errorMessage": "An unknown error occurred",      "requestParameters": {          "roleArn": "arn:aws:iam::11112222333:role/AccessEC2role",          "roleSessionName": "botocore-session-1675698641"      }  }In this output, the roleArn must be the same IAM role that you configured for the pod's service account.The userName (system:serviceaccount:serverless:aws-sdk) must match the service account name and its namespace. The format for this name is system:serviceaccount:namespace:serviceaccount_name.Configure the pod’s service account IAM roleIn the IAM Console, configure the pod's service account IAM role with the correct IAM trust policy statement:     {              "Effect": "Allow",              "Principal": {                  "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/oidc.eks.region_code.amazonaws.com/id/EXAMPLE11111122222333334444ABCD"              },              "Action": "sts:AssumeRoleWithWebIdentity",              "Condition": {                  "StringEquals": {                      "oidc.eks.region_code.amazonaws.com/id/EXAMPLE11111122222333334444ABCD:sub": "system:serviceaccount:namespace_name:serviceaccount_name",                      "oidc.eks.region_code.amazonaws.com/id/EXAMPLE11111122222333334444ABCD:aud": "sts.amazonaws.com"                  }              }      }     Note: Replace region_code, ACCOUNT_ID, EXAMPLE11111122222333334444ABCD, serviceaccount_name and namespace_name with your own values.An error occurred (UnauthorizedOperation)The IAM role that you configured for the pod's service account might not be authorized to call other AWS services. In this case, you see an error that's similar to the following message:File "/usr/local/lib/python3.11/site-packages/botocore/client.py", line 960, in _make_api_callraise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.To resolve this error, complete the following steps:Confirm that the pod assumes an IAM role that's associated with a Kubernetes service account. To do this, see the previous section Confirm the assumed IAM role. Note the role ARN that this step returns.Open the IAM console. In the navigation pane, choose Roles. Then, search and select the role ARN from Step 1.Under the Permissions tab, attach the necessary IAM policy permissions to the IAM role.For an example pod, see Sample pod running AWS Python SDK with web federated identity provider as credential provider on GitHub.Follow"


Question: Why is my Amazon RDS for Oracle DB instance using more storage than expected?

I have an Amazon Relational Database Service (Amazon RDS) for Oracle DB instance that uses more space than I expect it to.

Answer: "I have an Amazon Relational Database Service (Amazon RDS) for Oracle DB instance that uses more space than I expect it to.Short descriptionVarious components can use the underlying storage for Amazon RDS for Oracle instances. These components include tablespaces, archive logs, log files, online redo log files, and data pump files.To manage storage growth in your instance, identify how much storage space your components use:1.    Find the amount of space that's allocated to data in all tablespaces, including temporary tablespaces.2.    Check the space allocation for archive logs or trace files.3.    Check the space allocation for the data pump directory.Note: The allocated storage space for an RDS instance represents the data volume. When you create an instance, Amazon RDS maps the allocated storage to the data volume. This process also uses a small percentage of raw disk space to create the filesystem on top of the physical storage volume.ResolutionFind the amount of space allocated to data in the tablespacesTo determine the spread of the space that's allocated to different components of the Oracle database, use the following query:set pages 200select'===========================================================' || chr(10) ||'Total Database Physical Size = ' || round(redolog_size_gib+dbfiles_size_gib+tempfiles_size_gib+ctlfiles_size_gib,2) || ' GiB' || chr(10) ||'===========================================================' || chr(10) ||' Redo Logs Size : ' || round(redolog_size_gib,3) || ' GiB' || chr(10) ||' Data Files Size : ' || round(dbfiles_size_gib,3) || ' GiB' || chr(10) ||' Temp Files Size : ' || round(tempfiles_size_gib,3) || ' GiB' || chr(10) ||' Archive Log Size - Approx only : ' || round(archlog_size_gib,3) || ' GiB' || chr(10) ||' Control Files Size : ' || round(ctlfiles_size_gib,3) || ' GiB' || chr(10) ||'===========================================================' || chr(10) ||' Used Database Size : ' || used_db_size_gib || ' GiB' || chr(10) ||' Free Database Size : ' || free_db_size_gib || ' GiB' ||chr(10) ||' Data Pump Directory Size : ' || dpump_db_size_gib || ' GiB' || chr(10) ||' BDUMP Directory Size : ' || bdump_db_size_gib || ' GiB' || chr(10) ||' ADUMP Directory Size : ' || adump_db_size_gib || ' GiB' || chr(10) ||'===========================================================' || chr(10) ||'Total Size (including Dump and Log Files) = ' || round(round(redolog_size_gib,2) +round(dbfiles_size_gib,2)+round(tempfiles_size_gib,2)+round(ctlfiles_size_gib,2) +round(adump_db_size_gib,2) +round(dpump_db_size_gib,2)+round(bdump_db_size_gib,2),2) || ' GiB' || chr(10) ||'===========================================================' as summaryFROM (SELECT sys_context('USERENV', 'DB_NAME')db_name,(SELECT SUM(bytes) / 1024 / 1024 / 1024 redo_sizeFROM v$log)redolog_size_gib,(SELECT SUM(bytes) / 1024 / 1024 / 1024 data_sizeFROM dba_data_files)dbfiles_size_gib,(SELECT nvl(SUM(bytes), 0) / 1024 / 1024 / 1024 temp_sizeFROM dba_temp_files)tempfiles_size_gib,(SELECT SUM(blocks * block_size / 1024 / 1024 / 1024) size_gibFROM v$archived_logWHERE first_time >= SYSDATE - ((SELECT valueFROM rdsadmin.rds_configurationWHERE name ='archivelog retention hours') /24 ))archlog_size_gib,(SELECT SUM(block_size * file_size_blks) / 1024 / 1024 / 1024controlfile_sizeFROM v$controlfile)ctlfiles_size_gib,round(SUM(used.bytes) / 1024 / 1024 / 1024, 3)db_size_gib,round(SUM(used.bytes) / 1024 / 1024 / 1024, 3) - round(free.f / 1024 / 1024 / 1024)used_db_size_gib,round(free.f / 1024 / 1024 / 1024, 3)free_db_size_gib,(SELECT round(SUM(filesize) / 1024 / 1024 / 1024, 3)FROM TABLE(rdsadmin.rds_file_util.listdir('BDUMP')))bdump_db_size_gib,(SELECT round(SUM(filesize) / 1024 / 1024 / 1024, 3)FROM TABLE(rdsadmin.rds_file_util.listdir('ADUMP')))adump_db_size_gib,(SELECT round(SUM(filesize) / 1024 / 1024 / 1024, 3)FROM TABLE(rdsadmin.rds_file_util.listdir('DATA_PUMP_DIR')))dpump_db_size_gibFROM (SELECT bytesFROM v$datafileUNION ALLSELECT bytesFROM v$tempfile) used,(SELECT SUM(bytes) AS fFROM dba_free_space) freeGROUP BY free.f);By default, Amazon RDS for Oracle DB instances turn on auto-extend for all tablespaces. This includes data tablespaces, UNDO tablespaces, and temporary tablespaces. This means that each tablespace grows to accommodate more data. This feature continues until you no longer need more storage or you use all allocated storage space.Resize tablespacesData tablespace and UNDO tablespaceTo resize data and UNDO tablespaces, see How do I resize the tablespace for my Amazon RDS for Oracle DB instance?Temporary tablespace1.    To view information about temporary tablespace usage, run the following query on the view DBA_TEMP_FREE_SPACE:SQL> SELECT * FROM dba_temp_free_space;2.    To resize the temporary tablespace (for example, to 10 GB), run the following query based on the output of the tablespace usage query:SQL> ALTER TABLESPACE temp RESIZE 10g;If the allocated tablespace extends beyond the 10 GB threshold, then this command might fail.3.    If the command fails, then shrink space on the temporary tablespace:SQL> ALTER TABLESPACE temp SHRINK SPACE KEEP 10g;4.    Check for long-running sessions that perform active sorting to disk and have temporary segments allocated. To do this, run the following query:SQL> SELECT * FROM v$sort_usage;5.    If the application logic and business allow you to end the session, then end the session. Then, resize the temporary tablespace again, as shown in step 2.6.    If you can't end your sessions, then create a new temporary tablespace. Then, set the new tablespace as the default and drop the old temporary tablespace:SQL> SELECT property_name,property_value FROM DATABASE_PROPERTIES where PROPERTY_NAME='DEFAULT_TEMP_TABLESPACE';SQL> create temporary tablespace temp2;SQL> exec rdsadmin.rdsadmin_util.alter_default_temp_tablespace(tablespace_name => 'temp2');<wait for a few minutes and verify if the default temporary tablespace for all users have been updated>SQL> set pages 2000SQL> column username for a30SQL> select username, TEMPORARY_TABLESPACE from dba_users;SQL> drop tablespace temp including contents and datafiles;Check the space allocation for archive logs or trace files1.    Check the current archive log retention:SQL> SELECT value FROM rdsadmin.rds_configuration WHERE name ='archivelog retention hours';In Amazon RDS for Oracle instances, archive log retention is set to 0 by default. This means that after archivelogs upload to Amazon S3, Amazon RDS automatically deletes them from the underlying host. If you need to use archivelogs with products like Oracle LogMiner or GoldenGate, then increase archivelog retention.2.    Calculate the space that archivelogs use on the underlying host. First, create an archivelog directory:SQL> EXEC rdsadmin.rdsadmin_master_util.create_archivelog_dir;Then, identify the exact usage of archivelog on an RDS instance:SQL> SELECT sum(FILESIZE)/1024/1024/1024 archivelog_usage_GiB FROM TABLE(rdsadmin.rds_file_util.listdir(p_directory => 'ARCHIVELOG_DIR'));3.    If the allocated space for archive logs is more than expected, then update the retention policy value. Then, allow Amazon RDS automation to clear older archive log files. The following example configures the RDS for Oracle instance to retain 24 hours of archive logs:begin rdsadmin.rdsadmin_util.set_configuration(name => 'archivelog retention hours', value => '24');end; /commit;For more information about listing and purging trace files, see Purging trace files.Check the space allocation for the data pump directory1.    If the allocated space of the data pump directory is more than expected, then find the .dmp files that can be removed:SQL> SELECT * FROM TABLE(RDSADMIN.RDS_FILE_UTIL.LISTDIR('DATA_PUMP_DIR')) ORDER by mtime;2.    If this query finds .dmp files, then delete them with the following query. Replace the file name with the name of the .dmp files:SQL> EXEC utl_file.fremove('DATA_PUMP_DIR','[file name]');Related informationWorking with storage for Amazon RDS DB instancesTerminating a sessionMonitoring metrics in an Amazon RDS instanceAmazon RDS DB instance running out of storageFollow"


Question: How do I troubleshoot issues when I integrate AWS Secrets Manager with Amazon EKS?

"I'm trying to integrate AWS Secrets Manager with Amazon Elastic Kubernetes Service (Amazon EKS), but I'm getting an error."

Answer: "I'm trying to integrate AWS Secrets Manager with Amazon Elastic Kubernetes Service (Amazon EKS), but I'm getting an error.Short descriptionYou can get an error if your pods fail to enter into Running state when you're integrating AWS Secrets Manager with Amazon EKS. To resolve this issue, check the logs from the Secrets Store Container Storage Interface (CSI) Driver pods to see if any pods aren't performing.ResolutionDisplay the Secrets Store CSI Driver pods:kubectl --namespace=kube-system get pods -l "app=secrets-store-csi-driver"Display the logs from the Secrets Store CSI pods:kubectl --namespace=kube-system logs -f -l "app=secrets-store-csi-driver"The following logs show that each pod is performing well:I1120 20:21:19.135834       1 secrets-store.go:74] Driver: secrets-store.csi.k8s.ioI1120 20:21:19.135857       1 secrets-store.go:75] Version: v0.2.0, BuildTime: 2021-08-12-18:55I1120 20:21:19.135868       1 secrets-store.go:76] Provider Volume Path: /etc/kubernetes/secrets-store-csi-providersI1120 20:21:19.135874       1 secrets-store.go:77] GRPC supported providers will be dynamically createdI1120 20:21:19.135895       1 driver.go:80] "Enabling controller service capability" capability="CREATE_DELETE_VOLUME"I1120 20:21:19.135912       1 driver.go:90] "Enabling volume access mode" mode="SINGLE_NODE_READER_ONLY"I1120 20:21:19.135922       1 driver.go:90] "Enabling volume access mode" mode="MULTI_NODE_READER_ONLY"I1120 20:21:19.135938       1 main.go:172] starting managerI1120 20:21:19.136210       1 server.go:111] Listening for connections on address: //csi/csi.sockI1120 20:21:18.956092       1 exporter.go:33] metrics backend: prometheusNote: Pods that perform the same actions appear as duplicate entries.If the SecretProviderClass in the volumeMount doesn't exist in the same namespace as the pod, then you receive the following error:* Warning  FailedMount  3s (x4 over 6s)  kubelet, kind-control-plane  MountVolume.SetUp failed for volume "secrets-store-inline" : rpc error: code = Unknown desc = failed to get secretproviderclass default/aws, error: secretproviderclasses.secrets-store.csi.x-k8s.io "aws" not foundThe SecretProviderClass must exist in the same namespace as the pod.The Secrets Store CSI Driver is deployed as a daemonset. If the CSI Driver pods aren't running on the node, then you receive the following error:* Warning  FailedMount  1s (x4 over 4s)  kubelet, kind-control-plane  MountVolume.SetUp failed for volume "secrets-store-inline" : kubernetes.io/csi: mounter.SetUpAt failed to get CSI client: driver name secrets-store.csi.k8s.io not found in the list of registered CSI driversIf the node is tainted, then add a toleration for the taint in the Secrets Store CSI Driver daemonset.Check if there are any node selectors preventing the Secrets Store CSI Driver pods from running on the node:kubectl --namespace=kube-system describe pods -l "app=secrets-store-csi-driver" | grep Node-Selectors*Get the labels that are associated to the worker nodes in your pod:kubectl get node --selector=kubernetes.io/os=linuxCompare the outputs from the preceding commands to make sure that the labels match the node selector values.Check if the CSI Driver was deployed to the cluster. All pods should be in the Running state.Run the following command:kubectl get pods -l app=secrets-store-csi-driver -n kube-system-or-kubectl get daemonset csi-secrets-store-secrets-store-csi-driver -n kube-systemExample output:kubectl get csidriverNAME                       ATTACHREQUIRED   PODINFOONMOUNT   MODES       AGEsecrets-store.csi.k8s.io   false            true             Ephemeral   110mThe preceding output shows that the driver was deployed to the cluster. If the secrets-store.csi.k8s.io isn't found, then reinstall the driver.If the files that the SecretProviderClass pulled in are larger than 4 mebibytes (MiB), then you might get FailedMount warnings with a message that includes, grpc: received message larger than max. You can configure the driver to accept responses larger than 4 MiB. To accept larger responses, specify --max-call-recv-msg-size=size in bytes to the Secrets Store Container in the csi-secrets-store daemonset.Note: Replace size in bytes with the size you want the driver to accept.If you still have issues, then review the log events in chronological order to see if any other failures occurred:kubectl get events -n kube-system --sort-by='.metadata.creationTimestamp'Follow"


Question: How can I resolve the error that I receive when I subscribe an AWS Lambda function to a push-based event source in AWS CloudFormation?

"I can't subscribe my AWS Lambda function to an Amazon Simple Storage Service (Amazon S3) event notification or Amazon Simple Notification Service (Amazon SNS) topic in my AWS CloudFormation stack. If I use the AWS::Lambda::EventSourceMapping resource, I receive the following error: "Unrecognized event source, must be kinesis or dynamodb stream.""

Answer: "I can't subscribe my AWS Lambda function to an Amazon Simple Storage Service (Amazon S3) event notification or Amazon Simple Notification Service (Amazon SNS) topic in my AWS CloudFormation stack. If I use the AWS::Lambda::EventSourceMapping resource, I receive the following error: "Unrecognized event source, must be kinesis or dynamodb stream."Short descriptionThe AWS::Lambda::EventSourceMapping resource is designed for pull-based event sources, such as Amazon DynamoDB event streams and Amazon Kinesis. With push-based event sources, such as Amazon S3 event notifications or Amazon SNS messages, the event source is responsible for invoking the Lambda function. For a push event source to invoke a Lambda function, the function’s resource policy must authorize a supported event source.ResolutionIn your AWS CloudFormation template, add a resource-based policy using the AWS::Lambda::Permission resource.For example, the following resource-based policy allows an Amazon SNS topic to invoke a Lambda function:"LambdaResourcePolicy": {  "Type": "AWS::Lambda::Permission",  "Properties": {    "FunctionName" : { "Ref" : "MyFunction" },    "Principal": "sns.amazonaws.com",    "Action": "lambda:InvokeFunction",    "SourceArn" : { "Ref" : "MySNSTopic" }  }}For an Amazon SNS topic event source, you must define a topic policy with the required permissions.For an Amazon S3 event source, you must have a notification configuration statement that subscribes the Lambda function to the Amazon S3 bucket. For example:{  "AWSTemplateFormatVersion": "2010-09-09",  "Parameters": {    "BucketPrefix": {      "Type": "String",      "Default": "test-bucket-name"    }  },  "Resources": {    "EncryptionServiceBucket": {      "DependsOn": "LambdaInvokePermission",      "Type": "AWS::S3::Bucket",      "Properties": {        "BucketName": {          "Fn::Sub": "${BucketPrefix}-encryption-service"        },        "NotificationConfiguration": {          "LambdaConfigurations": [            {              "Function": {                "Fn::GetAtt": [                  "AppendItemToListFunction",                  "Arn"                ]              },              "Event": "s3:ObjectCreated:*",              "Filter": {                "S3Key": {                  "Rules": [                    {                      "Name": "suffix",                      "Value": "zip"                    }                  ]                }              }            }          ]        }      }    },    "LambdaInvokePermission": {      "Type": "AWS::Lambda::Permission",      "Properties": {        "FunctionName": {          "Fn::GetAtt": [            "AppendItemToListFunction",            "Arn"          ]        },        "Action": "lambda:InvokeFunction",        "Principal": "s3.amazonaws.com",        "SourceAccount": {          "Ref": "AWS::AccountId"        },        "SourceArn": {          "Fn::Sub": "arn:aws:s3:::${BucketPrefix}-encryption-service"        }      }    },    "AppendItemToListFunction": {      "Type": "AWS::Lambda::Function",      "Properties": {        "Handler": "index.handler",        "Role": {          "Fn::GetAtt": [            "LambdaExecutionRole",            "Arn"          ]        },        "Code": {          "ZipFile": {            "Fn::Join": [              "",              [                "exports.handler = function(event, context) {",                "console.log('Received event: ', JSON.stringify(event, null, 2));",                "};"              ]            ]          }        },        "Runtime": "nodejs8.10"      }    },    "LambdaExecutionRole": {      "Type": "AWS::IAM::Role",      "Properties": {        "AssumeRolePolicyDocument": {          "Version": "2012-10-17",          "Statement": [            {              "Effect": "Allow",              "Principal": {                "Service": [                  "lambda.amazonaws.com"                ]              },              "Action": [                "sts:AssumeRole"              ]            }          ]        },        "Path": "/",        "Policies": [          {            "PolicyName": "root",            "PolicyDocument": {              "Version": "2012-10-17",              "Statement": [                {                  "Effect": "Allow",                  "Action": [                    "logs:*"                  ],                  "Resource": "arn:aws:logs:*:*:log-group:/path/<log-group-name>:log-stream:<log-stream-name>"                }              ]            }          }        ]      }    }  }}In the preceding example, the S3 bucket and notification configuration are created at the same time. The example avoids a circular dependency by using the Fn::Join intrinsic function and the DependsOn attribute to create the resources in the following order: 1) IAM role, 2) Lambda function, 3) Lambda permission, and then 4) S3 bucket. For more information, see How do I avoid the "Unable to validate the following destination configurations" error with Lambda event notifications in AWS CloudFormation?Related informationCloudFormation best practicesLambda permissionsUpdate behaviors of stack resourcesFollow"


Question: Why can't my IAM user or role with full Amazon EC2 permissions start an EC2 instance?

"My AWS Identity and Access Management (IAM) entity (users, groups, roles) has full permissions to an Amazon Elastic Compute Cloud (Amazon EC2) instance. I tried to start the Amazon EC2 instance, but it changed from the Pending state to Stopped."

Answer: "My AWS Identity and Access Management (IAM) entity (users, groups, roles) has full permissions to an Amazon Elastic Compute Cloud (Amazon EC2) instance. I tried to start the Amazon EC2 instance, but it changed from the Pending state to Stopped.Short descriptionCheck to see if the instance has an Amazon Elastic Block Store (Amazon EBS) attached. If the Amazon EBS volume is encrypted using an AWS Key Management Service (AWS KMS) key, then there might be a permission issue. The IAM entity calling the StartInstances API action must have permissions to create a grant for the Amazon EC2 service. The grant allows Amazon EC2 to decrypt the AWS KMS key (KMS key).Amazon EBS volumes send a GenerateDataKeyWithoutPlaintext API call request to AWS KMS that creates a new data key and encrypts it in the KMS key. The encrypted data key is sent back to the Amazon EBS volume, and then attached to the Amazon EC2 instance. For this scenario, the KMS key is present in the same AWS account for the EC2 instance and the KMS key.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.To confirm why the Amazon EC2 instance is in a Stopped state, run the AWS CLI command similar to the following:aws ec2 describe-instances --instance-id your-instance_ID --query "Reservations[*].Instances[*].StateReason"Example output:[  [    {      "Message": "Client.InternalError: Client error on launch",      "Code": "Client.InternalError"    }  ]]This error means that the root volume or additional attached volumes are encrypted. You don't have permission to access the AWS KMS key for decryption.(Optional) Follow the instructions for filtering AWS CloudTrail events for the event name CreateGrant.Example output:"errorMessage": "User: arn:aws:iam::123456789012:user/test is not authorized to perform: kms:CreateGrant on resource: arn:aws:kms:eu-west-1:123456789012:key/8e3426b8-87b4-434c-ae74-8e63dadf354a"This error means that the IAM entity doesn't have the CreateGrant permission for Amazon EC2 to decrypt the data key so the instance can't start.ResolutionTo find the key type, follow these steps:1.    Open the Amazon EC2 console, and then choose Instances.2.    In Instance ID, choose the Amazon EC2 instance ID, and then choose the Storage tab.3.    In Volume ID, choose the volume ID for the encrypted volume.4.    In KMS key ID, copy the key ID.5.    Open the AWS KMS console in the same AWS Region.6.    In AWS managed keys and Customer managed keys, paste the KMS key ID from step 4.7.    Choose the Key ID.8.    In General configuration under Description, note the KMS key type.Attach an IAM policy to the IAM entity similar to the following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "kms:CreateGrant"      ],      "Resource": [        "arn:aws:kms:eu-west-1:123456789012:key/8e3426b8-87b4-434c-ae74-8e63dadf354a"      ],      "Condition": {        "Bool": {          "kms:GrantIsForAWSResource": true        }      }    }  ]}The kms:GrantIsForAWSResource condition key assures that the IAM entity is only able to create grants for the KMS key with AWS resources such as EC2 instances. This policy doesn't allow the IAM entity to create grants for another IAM entity.(Optional) Allow the AWS account root user account full access to the KMS key similar to the following:{  "Sid": "Enable IAM User Permissions",  "Effect": "Allow",  "Principal": {"AWS": "arn:aws:iam::123456789012:root"},  "Action": "kms:*",  "Resource": "*"}You can also add the IAM entity in the KMS key policy to allow the CreateGrant API action.Note:It's a best practice to grant least privilege for only the permissions required to perform a task. For more information, see Grant least privilege.If your EC2 instances are created using Amazon EC2 Auto Scaling groups, then see Required AWS KMS key policy for use with encrypted volumes.Related informationHow EBS encryption worksInstance terminates immediatelyFollow"


Question: I'm using the Amazon S3 static website feature but getting an Access Denied error. Why is this happening?

I'm using an Amazon Simple Storage Service (Amazon S3) bucket to host a static website with the S3 static website endpoint. Why I am getting an Access Denied error?

Answer: "I'm using an Amazon Simple Storage Service (Amazon S3) bucket to host a static website with the S3 static website endpoint. Why I am getting an Access Denied error?Short descriptionIf you're trying to host a static website using Amazon S3, but you're getting an Access Denied error, check the following requirements:Objects in the bucket must be publicly accessible.S3 bucket policy must allow access to the s3:GetObject action.The AWS account that owns the bucket must also own the object.Objects can't be encrypted by AWS Key Management Service (AWS KMS).Objects that are requested must exist in the S3 bucket.Amazon S3 Block Public Access must be disabled on the bucket and account level.ResolutionObjects in the bucket must be publicly accessibleS3 static website endpoint supports only publicly accessible content. To verify whether an object in your S3 bucket is publicly accessible, open the object's URL in a web browser. Or, you can run a cURL command on the URL.The following is an example URL of an S3 object:http://doc-example-bucket.s3-website-us-east-1.amazonaws.com/index.htmlIf anAccess Denied error is returned by the web browser or cURL command, then the object isn't publicly accessible. To allow public read access to your S3 object, create a bucket policy thatallows public read access for all objects in the bucket.S3 bucket policy must allow access to the s3:GetObject actionReview your bucket policy, and make sure that there aren't any deny statements that block public read access to the s3:GetObject action. Even if you have an explicit allow statement for s3:GetObject in your bucket policy, confirm that there isn't a conflicting explicit deny statement. An explicit deny statement will always override an explicit allow statement.To review your bucket policy for s3:GetObject, perform the following steps:1.    Open the Amazon S3 console.2.    Choose the Permissions tab.3.    Choose Bucket Policy.4.    Review the bucket policy for statements with "Action": "s3:GetObject" or "Action": "s3:*".5.    (Optional) Modify the bucket policy. For example, you can remove or edit statements that block public read access to s3:GetObject.The AWS account that owns the bucket must also own the objectTo allow public read access to objects, the AWS account that owns the bucket must also own the objects. A bucket or object is owned by the account of the AWS Identity and Access Management (IAM) identity that created the bucket or object.Note: The object-ownership requirement applies to public read access granted by a bucket policy. It doesn't apply to public read access granted by the object's access control list (ACL).To check if your Amazon S3 bucket and objects are owned by the same AWS account, perform the following steps:1.    To retrieve the S3 canonical ID of the bucket owner, use the following command:aws s3api list-buckets --query Owner.ID2.    To retrieve the S3 canonical ID of the object owner, use the following command:aws s3api list-objects --bucket DOC-EXAMPLE-BUCKET --prefix index.htmlNote: This example shows a single object. To check several objects, use the list command.3.    Confirm whether the canonical IDs of the bucket owner and object owner match. If they don't match, then the bucket and object have different owners.Note: You can also use the Amazon S3 console to check the bucket and object owners. The owners are found in the Permissions tab of the respective bucket or object.4.    If the canonical IDs of the bucket and object owner don't match, change the object's owner to the bucket owner.From the object owner's account, run the following command to retrieve the ACL permissions assigned to the object:aws s3api get-object-acl --bucket DOC-EXAMPLE-BUCKET --key object-nameIf the object doesn't have bucket-owner-full-control ACL permissions, then run the following command from the object owner's account:aws s3api put-object-acl --bucket DOC-EXAMPLE-BUCKET --key object-name --acl bucket-owner-full-controlIf the object has bucket-owner-full-control ACL permissions, run the following command from the bucket owner's account. This command changes the owner of the object by copying the object over itself:aws s3 cp s3://DOC-EXAMPLE-BUCKET/index.html s3://DOC-EXAMPLE-BUCKET/index.html --storage-class STANDARDYou can also use S3 Object Ownership to grant the bucket owner automatic ownership of any objects uploaded by anonymous users or other AWS accounts.Objects in the bucket can't be AWS KMS-encryptedAWS KMS doesn't support anonymous requests. As a result, any Amazon S3 bucket that allows anonymous or public access will not apply to objects that are encrypted with AWS KMS. You must remove KMS encryption from the objects that you want to serve using the Amazon S3 static website endpoint.Note: Instead of using AWS KMS encryption, use AES-256 to encrypt your objects.You can check if an object in your bucket is KMS encrypted using the following methods:Use the Amazon S3 console to view the properties of the object. Review the Encryption dialog box. If AWS-KMS is selected, then the object is KMS-encrypted.Run the head-object command using the AWS Command Line Interface (AWS CLI). If the command returns ServerSideEncryption as aws:kms, then the object is KMS-encrypted.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.To change the object's encryption settings using the Amazon S3 console, see Specifying Amazon S3 encryption.To change the object's encryption settings using the AWS CLI, verify that the object's bucket doesn't have default encryption. If the bucket doesn't have default encryption, then remove the object's encryption by copying the object over itself:aws s3 cp s3://DOC-EXAMPLE-BUCKET/index.html s3://DOC-EXAMPLE-BUCKET/index.html --storage-class STANDARDWarning: Copying the object over itself removes settings forstorage-class andwebsite-redirect-location. To maintain these settings in the new object, make sure to explicitly specifystorage-class orwebsite-redirect-location values in the copy request.Objects that are requested must exist in the S3 bucketIf a user performing the request doesn’t have s3:ListBucket permissions, then the user gets an Access Denied error for missing objects.You can run the head-object AWS CLI command to check if an object exists in the bucket.Note: S3 object names are case-sensitive. If the request doesn't have a valid object name, then Amazon S3 will report that the object is missing.If the object exists in the bucket, then the Access Denied error isn't masking a 404 Not Found error. Verify other configuration requirements to resolve the Access Denied error.If the object doesn't exist in the bucket, then the Access Denied error is masking a 404 Not Found error. Resolve the issue related to the missing object.Note: It's not a security best practice to enable public s3:ListBucket access. Enabling public s3:ListBucket access allows users to see and list all objects in a bucket. This access exposes object metadata details (for example, key and size) to users even if the users don't have permissions for downloading the object.Amazon S3 Block Public Access must be disabled on the bucketAmazon S3 Block Public Access settings can apply to individual buckets or AWS accounts. Confirm that there aren't any Amazon S3 Block Public Access settings applied to either your S3 bucket or AWS account. These settings can override permissions that allow public read access.Follow"


Question: How do I view the total storage used for my Amazon Aurora MySQL DB cluster?

I want to see the size of my Amazon Aurora MySQL-Compatible Edition DB cluster volume.

Answer: "I want to see the size of my Amazon Aurora MySQL-Compatible Edition DB cluster volume.ResolutionAurora MySQL-Compatible cluster volume automatically scales up as the amount of data in your database increases. A database can be scaled up to a maximum of 128 tebibytes (TiB) in Aurora MySQL-Compatible versions 1.23.0 or higher, 2.09.0 or higher, and 3.01.0 or higher. For all previous versions, a database can be scaled up to a maximum of 64 TiB. You can review the storage that is used by the Aurora MySQL-Compatible cluster by using the following the Amazon CloudWatch metrics:AuroraVolumeBytesLeftTotal is the remaining available space for the cluster volume, as measured in bytes. As the data grows in your cluster, the value for AuroraVolumeBytesLeftTotal decreases. This value can help you identify when the cluster is approaching its size limit.Note: The AuroraVolumeBytesLeftTotal metric is available only on Aurora MySQL-Compatible version 1.19.5 or higher, and on Aurora MySQL-Compatible version 2.04.5 or higher.VolumeBytesUsed is the amount of storage used by the Aurora MySQL-Compatible DB cluster in bytes. As the data grows in your cluster, the value for VolumeBytesUsed increases.Important: Dynamically reducing the billed storage on deleting data is possible on certain Aurora MySQL-Compatible versions. For more information, see Aurora storage scaling.View the AuroraVolumeBytesLeftTotal in the CloudWatch consoleOpen the CloudWatch console.Choose Metrics from the navigation pane.In the All metrics tab, choose RDS.Choose DBClusterIdentifier.Enter AuroraVolumeBytesLeftTotal in the search box, and select the metric.For more information, see Viewing available metrics.View the VolumeBytesUsed in the RDS consoleOpen the Amazon Relational Database Service console.Choose the AWS Region where you created the Aurora MySQL-Compatible DB cluster.Choose Databases from the navigation pane, and then choose the name of the DB instance that you want to monitor.Choose the Monitoring tab.From the CloudWatch section, enter [Billed] Volume Bytes Used, or choose it from the list. The storage use appears on the graph.Note: Aurora uses separate local storage for nonpersistent temporary files. This includes database logs and files that are used for sorting large data sets during query processing and building indexes. For more information, see Temporary storage limits for Aurora MySQL and Temporary storage limits for Aurora PostgreSQL. You can monitor local storage available for a specific database instance with the FreeLocalStorage Cloudwatch metric.Related informationAurora DB clustersMonitoring Aurora metrics with Amazon CloudWatchUpgrading the minor version or patch level of an Aurora MySQL-Compatible DB clusterFollow"


Question: How do I trace an Application Load Balancer request using X-Amzn-Trace-Id?

How do I log X-Amzn-Trace-Id to trace requests through my Application Load Balancer and web servers?

Answer: "How do I log X-Amzn-Trace-Id to trace requests through my Application Load Balancer and web servers?Short descriptionIn Elastic Load Balancing (ELB), when an Application Load Balancer handles a request, the trace information is added to the X-Amzn-Trace-Id header. For example:X-Amzn-Trace-Id: Root=1-67891233-abcdef012345678912345678Log the identifier and then use it to troubleshoot issues with your load balancer. For example, use the X-Amzn-Trace-Id header to identify when many similar requests are received from the same client within a short time. If you have many layers in your stack, then you can also use the X-Amzn-Trace-Id header to track a request across all the layers.ResolutionUse the following steps for common web server configurations (Apache, Tomcat, NGINX, or IIS) to log the X-Amzn-Trace-Id header:Apache1.    Open the Apache configuration file (/etc/httpd/conf/httpd.conf in Amazon Linux) in your preferred text editor.2.    In the LogFormat section, add the option  %{X-Amzn-Trace-Id}i as follows:LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Amzn-Trace-Id}i\"" combined3.    Restart the Apache service to apply your changes as follows:sudo service apache restartTomcat1.    Open the Tomcat configuration file (/etc/tomcat7/server.xml in Amazon Linux) in your preferred text editor.    2.    In the org.apache.catalina.valves.AccessLogValve class, add the option %{X-Amzn-Trace-Id}i as follows:<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"      prefix="localhost_access_log." suffix=".txt"      pattern="%h %l %u %t "%r" %s %b %{X-Amzn-Trace-Id}i" />3.    Restart the Tomcat service to apply your changes as follows:sudo service tomcat7 restartNGINX1.    Open the NGINX configuration file ( /etc/nginx/nginx.conf in Amazon Linux) in your preferred text editor.2.    In the log_format section, add the option $http_x_amzn_trace_id as follows:log_format  main  '"$http_x_forwarded_for" $remote_addr - $remote_user [$time_local] "$request" '    '$status $body_bytes_sent "$http_referer" '    '"$http_user_agent" "$http_x_amzn_trace_id"';3.    Restart the NGINX service to apply your changes as follows:sudo service nginx restartInternet Information Services (IIS)1.    Open the IIS Manager.2.    Select your server’s name.3.    Choose Logging.4.    Choose Select Fields.5.    Choose Add Field.6.    In the dialog box, for Field Name, enter X-Amzn-Trace-Id. For Source Type, enter Request Header. For Source, enter X-Amzn-Trace-Id.7.    Choose Apply to apply your changes.Related informationRequest tracing for your Application Load BalancerAccess logs for your Application Load BalancerFollow"


Question: How can I control the number of CDC files being generated for my target S3 endpoint using AWS DMS?

I want to control the number of change data capture (CDC) files generated when I use Amazon Simple Storage Service (Amazon S3) as a target endpoint. How can I use AWS Database Migration Service (AWS DMS) to do this?

Answer: "I want to control the number of change data capture (CDC) files generated when I use Amazon Simple Storage Service (Amazon S3) as a target endpoint. How can I use AWS Database Migration Service (AWS DMS) to do this?Short descriptionWhen using Amazon S3 as a target endpoint, you can use a number of parameters to control the associated file size in the target endpoint. This includes using Amazon S3 as a target endpoint for a full load and CDC, or a CDC-only AWS DMS task.This article discusses the following extra connection attributes (ECAs). Additionally, it covers how to use them to control the volume of CDC files generated on your Amazon S3 endpoint:cdcMaxBatchInterval - The maximum interval length condition, defined in seconds, to output a file to Amazon S3. The default value is 60 seconds.cdcMinFileSize - The minimum file size condition, defined in KB, to output a file to Amazon S3. The default value is 32000 KB.maxFileSize - The maximum size, in KB, of any .csv file to be created while migrating to an S3 target during full load. The default value is 1 GB.WriteBufferSize - The size, in KB, of the in-memory file write buffer used when generating .csv files on the local disk at the AWS DMS replication instance. The default value is 1000 KB.ResolutionThe cdcMaxBatchInterval parameter controls the time interval for writing files to Amazon S3. When it uses the default value of 60 seconds, AWS DMS writes files into Amazon S3 every minute. Another important parameter is the cdcMinFileSize parameter, which determines the maximum size of the CDC file. When using the default value of 32000 KB, AWS DMS writes into Amazon S3 every time it has 32000 KB of change data.The cdcMaxBatchInterval and cdcMinFileSize parameters work together. AWS DMS uses whichever parameter value is met first. With the default setup, AWS DMS writes file into Amazon S3 if it has either a minute of pending changes or 32000 KB of data. Depending on which happens first, one of these actions will be completed.Note: AWS DMS maintains the transaction in the same file, so the file size can exceed the cdcMinFileSize and cdcMaxBatchInterval if the transaction is large.maxFileSize determines the max file size from S3 target output files for both CSV and Parquet formats. But, when writing into .parquet files, AWS DMS writes data in batches:1.    AWS DMS allocates a memory segment of 1024 KB, which is the default size for writeBufferSize.2.    Regardless of the value of maxFileSize, AWS DMS allocates at least one write buffer with a default size of 1 MB.3.    When AWS DMS finishes writing the first batch of data, it compares the current size of data against the maxFileSize. The data is written to a .parquet file in the target S3 bucket if the current size is greater than or equal to maxFileSize.4.    If you set the maxFileSize to 1 MB, then writeBufferSize, with a default value of 1 MB, meets the value of maxFileSize. This is because the condition is already met after one write buffer is allocated. If you want to decrease the overall size of the generated .parquet file, you can decrease the value of writeBufferSize. By setting it to less than 1 MB, the conditional check happens when the size of the data written is less than 1 MB.Note: The WriteBufferSize parameter settings apply only to .parquet and not to .csv files.Related informationUsing Amazon S3 as a target for AWS Database Migration ServiceFollow"


Question: How can I remove email addresses that are on an Amazon SES suppression list?

I want to remove email addresses that are on the Amazon Simple Email Service (Amazon SES) global suppression list or an account-level suppression list. Can I automatically remove email addresses from an Amazon SES suppression list?

Answer: "I want to remove email addresses that are on the Amazon Simple Email Service (Amazon SES) global suppression list or an account-level suppression list. Can I automatically remove email addresses from an Amazon SES suppression list?Short descriptionIt's a best practice to not automatically remove email addresses from account-level suppression lists. Instead, validate the email addresses and the associated bounces or complaints. If you determine that an email address can receive messages, then remove this email address from the suppression list. You can remove an email address using either the AWS Command Line Interface (AWS CLI) or the Amazon SES console.For more information on using an account-level suppression list, see Amazon SES account-level suppression list considerations.Note: If your Amazon SES account's ability to send email is paused, then Amazon SES deletes the addresses in your account-level suppression list after 90 days. If your account's ability to send email is restored within 90 days, then your account-level suppression list retains the addresses.The global suppression list email address removal request feature is no longer a functionality that you can interact with in Amazon SES. The global suppression list is turned on by default and can't be turned off. Instead, you can manage your suppression lists through account-level suppression lists and configuration set-level suppression lists. For more information, see Amazon SES global suppression list.ResolutionRemove email addresses from account-level suppression listUsing the AWS CLINote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.To remove an email address from an account-level suppression list using the AWS CLI, follow these steps:1.    Configure the AWS CLI with the AWS account and AWS Region that's associated with the account-level suppression list that you want to modify.2.    Run the delete-suppressed-destination command on the email addresses that you want to remove from the email list:$aws sesv2 delete-suppressed-destination --email-address user@example.comFor more information, see Removing an email address from the account-level suppression list.Using the AWS SES consoleTo remove an email address from an account-level suppression list using the Amazon SES console, follow these steps:Log in to the Amazon SES console.In the navigation pane, under Configuration, choose Suppression list.Remove individual email addresses by either table selection or typed entry.To remove the email addresses by table selection, follow these steps:In the Suppression list table, select the corresponding checkbox of the email addresses.Choose Remove.To remove the email addresses by typed entry, follow these steps:In the Suppression list table, choose Remove email address.Type an email address in the Email address field. To enter more addresses, choose Enter another address and repeat for each email address.Review your entries for accuracy. To remove an email address, choose Remove next to the entry.Choose Save changes.Related informationDo bounces from the Amazon SES suppression list affect my daily sending quota?Understanding email deliverability in Amazon SESFollow"


Question: How do I configure a Data Pipeline precondition for Amazon S3?

I want to use an AWS Data Pipeline precondition to stop a running pipeline when a specific Amazon Simple Storage Service (Amazon S3) bucket doesn't exist.

Answer: "I want to use an AWS Data Pipeline precondition to stop a running pipeline when a specific Amazon Simple Storage Service (Amazon S3) bucket doesn't exist.Short descriptionCreate an S3PrefixNotEmpty precondition for the S3DataNode object. S3PrefixNotEmpty is a system-managed precondition. Unless you specify a timeout (preconditionTimeout), system-managed preconditions run until their condition is true.Note: On active pipelines, preconditions incur additional charges. For more information, see AWS Data Pipeline pricing.ResolutionYou can't configure preconditions while a pipeline is active. To add a precondition to an active pipeline, clone the pipeline and then complete the following steps:Open the AWS Data Pipeline console.Select a deactivated pipeline, and then choose Actions, Edit.Choose an existing S3DataNode object. Or, create a new one by choosing the Add dropdown list, and then choosing S3DataNode.In the Add optional field dropdown list for the S3DataNode object, choose Precondition.In the Precondition dropdown list, choose Create new: Precondition.Open the Precondition section, and then find the precondition object that you just created.In the Type dropdown list, choose S3PrefixNotEmpty.In the S3 Prefix field, enter an Amazon S3 path. For an example of how this looks in the pipeline definition JSON, see S3PrefixNotEmpty.To specify a timeout, do the following:In the Add optional field dropdown list for the S3PrefixNotEmpty object, choose Precondition Timeout.Specify the timeout conditions.When preconditionTimeout is met, the dependent nodes fail with the status CASCADE_FAILED.Follow"


Question: How do I delete an AWS CloudFormation stack that's stuck in DELETE_FAILED status?

"I want to delete my AWS CloudFormation stack, but my stack is stuck in DELETE_FAILED status."

Answer: "I want to delete my AWS CloudFormation stack, but my stack is stuck in DELETE_FAILED status.Short descriptionYour stack might be stuck in DELETE_FAILED status for the following reasons:A stack resource has a dependent object or other dependencies that can't be deleted. To resolve this issue, complete the steps in the Delete a stack with a dependent object or other dependencies that can't be deleted section.The service role being used isn't valid or can't be assumed. To resolve this issue, complete the steps in the Delete a stack with an invalid role section.A custom resource failed to stabilize in the expected amount of time. To resolve this issue, complete the steps in the Delete a stack for a custom resource that failed to stabilize section.ResolutionDelete a stack with a dependent object or other dependencies that can't be deletedDependency issues usually occur when you make an out-of-band change. For example, your stack fails if a security group that's part of your stack is attached to an elastic network interface that's not part of your stack. The stack fails because the security group resource can't be deleted. To delete the stack, you must retain that dependent resource.To delete a stack while retaining a resource, complete the following steps:AWS CloudFormation ConsoleOpen the AWS CloudFormation console.Choose the stack that's stuck in DELETE_FAILED status.Choose Delete.Note: A window opens and lists the resources that failed to delete.In the window, select all the resources that you want to retain, and then choose Delete stack.AWS Command Line InterfaceNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Run the following delete-stack command:$ aws cloudformation delete-stack --stack-name my-stack --retain-resources myresource1 myresource2Note: Replace my-stack with the name of your stack. Replace myresource1 and myresource2 with the logical IDs of the resources that failed to delete.The CloudFormation stack tries to delete the stack again, but doesn't delete any of the resources that you selected to retain. The status of your stack changes to DELETE_COMPLETE.Important: To avoid unnecessary charges, you must manually delete the resources that are retained when the stack is deleted.Delete a stack with an invalid roleIf you try to delete a stack that was created using a service role that now doesn't exist, then you receive the following error: **"An error occurred (ValidationError) when calling the DeleteStack operation: Roleis invalid or cannot be assumed."**To resolve this error, complete the following steps:Open the AWS CloudFormation console.Choose the stack that you want to delete to see its details.In the Stack info tab, note the name of the IAM role assigned to the stack.Create an AWS Identity and Access Management (IAM) role using the same name as the IAM role in step 3.Important: When you create your IAM role, verify that it has the right permissions to delete the resources in the stack.In the AWS CloudFormation console, re-attempt to delete the stack.Delete a stack for a custom resource that failed to stabilizeTo delete a stack for a custom resource that failed to stabilize in the expected amount of time, see How do I troubleshoot an AWS Lambda backed custom resource that's stuck in DELETE_FAILED status or DELETE_IN_PROGRESS status in AWS CloudFormation?Follow"


Question: How can I turn on monitoring for an AWS DMS task?

How can I turn on monitoring for an AWS Database Migration Service (AWS DMS) task?

Answer: "How can I turn on monitoring for an AWS Database Migration Service (AWS DMS) task?Short descriptionYou can use Amazon CloudWatch logs to monitor the progress of your DMS task, the resources used, and the network activity used. Monitor an AWS DMS task by using the AWS DMS console, the AWS Command Line Interface (AWS CLI), or the AWS DMS API.ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Turn on task loggingTo modify a DMS task, the task must be in a stopped or failed state.Open the AWS DMS console, and then choose Database migration tasks from the navigation pane.Select your task, choose Actions, and then choose Modify.From the Task Settings pane, choose Enable CloudWatch logs.Choose Save.Check the task's progressOpen the AWS DMS console, and then choose Database migration tasks from the navigation pane.Choose the name of the task that you want to monitor.From the Table Statistics section, review the load states of your AWS DMS task.For more information about the status of your task, see Task status.View the Amazon CloudWatch logsOpen the AWS DMS console, and then choose Database migration tasks from the navigation pane.Choose the name of the task that you want to review.From the Overview details section, choose View logs.View the Amazon CloudWatch metricsOpen AWS DMS console, and then choose Database migration tasks from the navigation pane.Choose the name of the task that you want to monitor.From CloudWatch metrics, view the metrics for your task.Check the metrics for CDCLatencySource and CDCLatencyTarget during the CDC phase of the task. Review these metrics to identify potential latency in the source or target. For more information, see Monitoring replication tasks using Amazon CloudWatch.Check task configuration and settingsOpen the AWS DMS console, and then choose Database migration tasks from the navigation pane.Choose the name of the task that you want to review.From the Overview details section, you can see the Basic configuration and Task settings for your task.View the metrics for a replication instanceOpen the AWS DMS console, and then choose Replication instances from the navigation pane.Choose the name of the replication instance in use.From the CloudWatch metrics tab, review the metrics for CPU utilization, freeable memory, free storage space, and SWAP usage.Use advanced settingsOpen the AWS DMS console, and then choose Database migration tasks from the navigation pane.Select your task, choose Actions, and then choose Modify.Expand Advanced task settings.In the Create control table in target using schema field, enter the name of your schema on the target database where AWS DMS can create its control tables.In the History timeslot (minutes), enter the amount of time you want each history record to stay in the replication history table.In the Enable control table section, for Apply Exceptions, awsdms_apply_exceptions is always turned on. Optionally, you can add these control tables to monitor additional details about the task:Replication Status - awsdms_statusSuspended Tables - awsdms_suspended_tablesReplication History - awsdms_historyNote: These control tables are created in the target instance. They can be viewed only by using a SELECT query in the target control schema in the target database instance.Related informationControl table task settingsMigration step-by-step guideWorking with AWS DMS tasksFollow"


Question: How do I connect to a Redshift cluster using Spark in my EMR cluster?

I want to connect an Amazon Redshift cluster using Apache Spark in my Amazon EMR cluster.

Answer: "I want to connect an Amazon Redshift cluster using Apache Spark in my Amazon EMR cluster.ResolutionNote: Configure your Redshift cluster and EMR cluster and install the Spark service before proceeding with the following steps.Test connectivity from the EMR cluster to the Redshift cluster1.    Verify that EMR primary, core, and task node security groups are allowed in Redshift's security group (inbound rules) for TCP port 5439. If the EMR and Redshift clusters are deployed in two different Amazon Virtual Private Clouds (Amazon VPC), configure the VPC peering.2.    Connect to the EMR primary node using SSH and run the following Telnet command. This Telnet command verifies that you can establish a connection between the EMR cluster and the Redshift cluster. In the following command, replace Redshift_Endpoint with the correct endpoint for your Redshift cluster.telnet Redshift_Endpoint 5439The following is example output for a successful connection:telnet redshift-cluster-1.XXXX.us-east-1.redshift.amazonaws.com 5439Trying 172.31.48.21...Connected to redshift-cluster-1.XXXXX.us-east-1.redshift.amazonaws.com.Escape character isConnect to the Redshift cluster using Spark in EMR-5.x.x series clustersUse Databrick’s spark-redshift package (library). This library loads data into Spark SQL DataFrames from Amazon Redshift and also saves DataFrames back into Amazon Redshift tables.1.    Connect to the EMR primary node using SSH.2.    To work with the spark-redshift library, download the following .jar files into the EMR cluster:wget https://repo1.maven.org/maven2/com/databricks/spark-redshift_2.11/2.0.1/spark-redshift_2.11-2.0.1.jarwget https://github.com/ralfstx/minimal-json/releases/download/0.9.4/minimal-json-0.9.4.jar3.    Copy the downloaded JAR files to the default Spark library. The Spark library path is /usr/lib/spark/jars/.sudo cp spark-redshift_2.11-2.0.1.jar /usr/lib/spark/jars/sudo cp minimal-json-0.9.4.jar /usr/lib/spark/jars/4.    Run the spark-shell command using the Amazon Redshift JDBC driver to connect to the Redshift cluster. The JDBC driver is included in Amazon EMR versions 4.7.0 and above.spark-shell --jars /usr/share/aws/redshift/jdbc/RedshiftJDBC41.jar5.    After the spark-shell session is initialized, run the following steps to connect to the Redshift cluster. In the following commands, update the Amazon Redshift endpoint, Amazon Simple Storage Service (Amazon S3) bucket name, and table details according to your use case.import com.amazonaws.auth.AWSCredentialsProviderimport com.amazonaws.auth.AWSSessionCredentialsimport com.amazonaws.auth.InstanceProfileCredentialsProvider// Instance Profile for authentication to AWS resourcesval provider = new InstanceProfileCredentialsProvider();val credentials: AWSSessionCredentials = provider.getCredentials.asInstanceOf[AWSSessionCredentials];val token = credentials.getSessionToken;val awsAccessKey = credentials.getAWSAccessKeyId;val awsSecretKey = credentials.getAWSSecretKey// Set JDBC URL of Redshiftval jdbcUrl = "jdbc:redshift://<cluster-name>.<id>.<region>.redshift.amazonaws.com:5439/<database>?user=<user>&password=<password>"// Create DataFrame by loading Redshift queryval df = spark.read.format("com.databricks.spark.redshift").option("url", jdbcUrl).option("tempdir", "s3://<S3-path-to-store-temp-data>").option("query", "select * from <table-name>").option("temporary_aws_access_key_id", awsAccessKey).option("temporary_aws_secret_access_key", awsSecretKey).option("temporary_aws_session_token", token).load()df.show(2)Connect to Redshift cluster using Spark in Amazon EMR-6.x.x series clustersAmazon EMR versions 6.x and above use Scala version 2.12. Amazon EMR 5.x uses Scala version 2.11. The spark-redshift_2.11-2.0.1.jar file that the Amazon EMR 5.x version uses isn't compatible with Amazon EMR version 6.x and above. So, use the spark-redshift_2.12-4.2.0.jar connector in Amazon EMR 6.x and above clusters.1.    Connect to the EMR primary node using SSH.2.    To work with the spark-redshift library, download the following .jar files into the EMR cluster:wget https://repo1.maven.org/maven2/io/github/spark-redshift-community/spark-redshift_2.12/4.2.0/spark-redshift_2.12-4.2.0.jarwget https://github.com/ralfstx/minimal-json/releases/download/0.9.4/minimal-json-0.9.4.jar3.    Copy the downloaded JAR files to the default Spark library. The Spark library path is /usr/lib/spark/jars/.sudo cp spark-redshift_2.12-4.2.0.jar /usr/lib/spark/jars/sudo cp minimal-json-0.9.4.jar /usr/lib/spark/jars/4.    Run the spark-shell command using the Amazon Redshift JDBC driver to connect to the Redshift cluster. the JDBC driver is included in EMR versions 4.7.0 and above.spark-shell --jars /usr/share/aws/redshift/jdbc/RedshiftJDBC41.jar5.    After the spark-shell session is initialized, run the following steps to connect to the Redshift cluster. In the following commands, update the Amazon Redshift endpoint, S3 bucket name, and table details according to your use case.import com.amazonaws.auth.AWSCredentialsProviderimport com.amazonaws.auth.AWSSessionCredentialsimport com.amazonaws.auth.InstanceProfileCredentialsProvider// Instance Profile for authentication to AWS resourcesval provider = new InstanceProfileCredentialsProvider();val credentials: AWSSessionCredentials = provider.getCredentials.asInstanceOf[AWSSessionCredentials];val token = credentials.getSessionToken;val awsAccessKey = credentials.getAWSAccessKeyId;val awsSecretKey = credentials.getAWSSecretKey// Set JDBC URL of Redshiftval jdbcUrl = "jdbc:redshift://<cluster-name>.<id>.<region>.redshift.amazonaws.com:5439/<database>?user=<user>&password=<password>"// Create DataFrame by loading Redshift queryval df = spark.read.format("io.github.spark_redshift_community.spark.redshift").option("url", jdbcUrl).option("tempdir", "s3://bucket/tmp/").option("query", "select * from <table>").option("temporary_aws_access_key_id", awsAccessKey).option("temporary_aws_secret_access_key", awsSecretKey).option("temporary_aws_session_token", token).load()df.show(2)Follow"


Question: How do I troubleshoot Amazon Redshift connection errors?

I'm unable to connect to my Amazon Redshift cluster. How do I troubleshoot this?

Answer: "I'm unable to connect to my Amazon Redshift cluster. How do I troubleshoot this?ResolutionThe Amazon Redshift cluster was recently resized or restored from a snapshotIf your Amazon Redshift cluster was recently resized or restored from a snapshot, then check your cluster's subnet. The cluster must be launched in the same subnet from before the snapshot resize or restore.If your Amazon Redshift cluster wasn't resized or restored recently, then verify your network configurations. The network configurations must be the same for both the old and new subnets.The Amazon Redshift cluster resides in a public subnetIf you're trying to connect to an Amazon Redshift cluster that resides in a public subnet, then check the following:Confirm that the Amazon Redshift cluster is set to "Publicly Accessible." For more information about publicly accessible options, see Managing clusters in a VPC.Confirm that you have an internet gateway attached to your route table.To test connectivity, use telnet to test the connection to your Amazon Redshift cluster:telnet <cluster endpoint> <cluster port>The Amazon Redshift cluster resides in a private subnetIf your Amazon Redshift cluster resides in a private subnet, then check the following:Be sure to attach the NAT Gateway to the public subnet’s route table. The NAT Gateway allows clusters in a private subnet to connect to the internet.Be sure that your cluster isn't set to Publicly Accessible.To confirm that your client can reach the private IP address of the Amazon Redshift cluster's leader node, use the dig command:dig <cluster endpoint>To test the connection to your Amazon Redshift cluster, use the telnet command:telnet <cluster endpoint><cluster port>Telnet is unsuccessful or Amazon Redshift cluster remains inaccessibleIf the telnet command indicates that your Amazon Redshift cluster connection is unsuccessful, then verify that the following conditions are true:The Amazon Redshift port (default 5439) of type TCP is allowed in the Security Group’s inbound rule.The CIDR range or IP you are connecting to the Amazon Redshift cluster from is added in the Security Group’s ingress rule.If the telnet command indicates that your Amazon Redshift cluster connection is successful but your cluster remains inaccessible, then check your network's firewall. Your firewall might be blocking the Amazon Redshift port (the default port is 5439).Invalid operation connection errorIf your Amazon Redshift cluster requires SSL to be enabled for any connection, then you might receive the following connection error:Error: [Amazon](500310) Invalid operation: no pg_hba.conf entry for host "::ffff:205.xxx.xxx.xxx", user "username", database "dbname", SSL off;To confirm whether the require_ssl parameter is set to true, perform the following steps:1.    Open the Amazon Redshift console.2.    Choose the Config tab.3.    Modify the parameter group that's associated with your Amazon Redshift cluster.4.    (Optional) Verify your SSL configuration using the AWS Command Line Interface (AWS CLI):describe-cluster-parametersIf your SSL configuration is set to true, then consider the following approaches:Update the require_ssl parameter back to false, which is default parameter value. You can change the SSL configuration by editing the parameter group that's associated with your Amazon Redshift cluster. The parameter group can be edited from the Parameters tab of the Amazon Redshift console.If the SSL connection is a requirement for your use case or environment, make sure that your connection string includes the required SSL parameter.For example:jdbc:redshift://examplecluster.abc123xyz789.us-west-2.redshift.amazonaws.com:5439/dev?ssl=trueFatal connection errorWhen there are too many open connections in your Amazon Redshift cluster, you receive the following error:Error: FATAL:  connection limit [500]/[2000] exceeded for userAs the error message indicates, 500 is the max connection limit for dc2.large and ds2.xlarge node types in Amazon Redshift. For ds2.8xlarge, dc2.8xlarge, ra3.xlplus, ra3.4xlarge and ra3.16xlarge nodes, the max connection limit is 2,000.To verify the number of open connections in your Amazon Redshift cluster, perform the following steps:1.    Open the Amazon CloudWatch console.2.    Look for the DatabaseConnections metric in your Amazon CloudWatch Logs entries.3.    Use the STL_CONNECTION_LOG table to check your open connections:select recordtime, username, dbname, remotehost, remoteportfrom stl_connection_logwhere event = 'initiating session'and pid not in(select pid from stl_connection_logwhere event = 'disconnecting session')order by 1 desc;4.    Use the STV_SESSIONS table to view information about the active user sessions for Amazon Redshift:select * from stv_sessions;If you have a large number of open connections, consider the following approaches:Use the PG_TERMINATE_BACKEND command to shut down any idle sessions.Change your TCP/IP timeout settings on the client-side based on the operating system used to connect to your Amazon Redshift cluster. The update to your TCP/IP timeout settings can help to prevent any idle sessions from remaining open.Connection refused errorIf your Amazon Redshift cluster fails to establish a connection, you might receive the following Connection Refused error:Error:  amazon 500150 error setting/closing connection: operation timed out/ connection refused.This error can indicate a permissions issue with accessing your Amazon Redshift cluster. To resolve this connection error, consider the following approaches:If you created your cluster in an Amazon Virtual Private Cloud (Amazon VPC), then add your client CIDR/IP address to the VPC security group. For more information about configuring VPC security groups for your cluster, see Managing clusters in a VPC.If you created your cluster outside of a VPC, then add your client CIDR or IP address to the cluster security group. For more information about configuring cluster security groups, see Amazon Redshift cluster security groups.Related informationHow can I make a private Amazon Redshift cluster publicly accessible?I can't connect to my Amazon Redshift clusterFollow"