Question: Do I need to specify the AWS KMS key when I download a KMS-encrypted object from Amazon S3?

I want to download stored objects from Amazon Simple Storage Service (Amazon S3) that use server-side encryption with AWS Key Management Service-managed keys (SSE-KMS).

Answer: "I want to download stored objects from Amazon Simple Storage Service (Amazon S3) that use server-side encryption with AWS Key Management Service-managed keys (SSE-KMS).ResolutionYou don't need to specify the AWS Key Management Service (AWS KMS) key ID when you download an SSE-KMS-encrypted object from an S3 bucket. Instead, you need the permission to decrypt the AWS KMS key.When a user sends a GET request, Amazon S3 must check for the appropriate authorization. Amazon S3 checks if the AWS Identity and Access Management (IAM) user or role that sent the request is authorized to decrypt the object's key. If the IAM user or role and key belong to the same AWS account, then decrypt permissions must be granted on the key policy.Note: When the IAM user or role and KMS key are in the same account, you can use IAM policies to control access to the key. However, you must modify the key policy to explicitly turn on IAM policies to allow access to the key. For more information, see Using IAM policies with AWS KMS.If the IAM user or role and key belong to different accounts, then you have to grant decrypt permissions on the IAM user's policy and the key's policy.The following is an example IAM policy that allows the user to both decrypt the AWS KMS key and also download from the S3 bucket:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Allow",      "Action": [        "kms:Decrypt",        "s3:GetObject"      ],      "Resource": [        "arn:aws:kms:example-region-1:123456789012:key/example-key-id",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"      ]    }  ]}The following is an example key policy statement that allows the user to decrypt the key:{  "Sid": "Allow decryption of the key",  "Effect": "Allow",  "Principal": {    "AWS": [      "arn:aws:iam::123456789012:user/Bob"    ]  },  "Action": [    "kms:Decrypt"  ],  "Resource": "*"}Note: For IAM users or roles that belong to a different account than the bucket, the bucket policy must also grant the user access to objects. For example, if the user needs to download from the bucket, then the user must have permission to the s3:GetObject action on the bucket policy.After you have the permission to decrypt the key, you can download S3 objects encrypted with the key using the AWS Command Line Interface (AWS CLI). Run a command similar to the following:aws s3api get-object --bucket DOC-EXAMPLE-BUCKET --key dir/example-object-name example-object-nameNote: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.Related informationGetObjectget-objectProtecting data using server-side encryption with CMKs stored in AWS Key Management Service (SSE-KMS)Follow"


Question: Why is my Amazon EBS volume stuck in the "deleting" state?

"My Amazon Elastic Block Store (Amazon EBS) volume is stuck in the "deleting" state, and I don't know why."

Answer: "My Amazon Elastic Block Store (Amazon EBS) volume is stuck in the "deleting" state, and I don't know why.ResolutionGenerally, Amazon EBS volumes are immediately deleted when you use the Amazon Elastic Compute Cloud (Amazon EC2) console or AWS Command Line Interface (AWS CLI). However, the volume can get stuck in the "deleting" state when there's an active snapshot that's associated with your volume.If you make a CreateSnapshot API call immediately before making a DeleteVolume request, then volume deletion is postponed until snapshot creation completes. Before deleting a volume, check for any snapshot creations that are still in progress. For instructions on how to access snapshot information, see View Amazon EBS snapshot information.Note: Even after a snapshot creation is complete, volume deletion might still be delayed because volume workflows are asynchronous.Follow"


Question: How do I subscribe a Lambda function to an Amazon SNS topic in the same account?

I want to subscribe my AWS Lambda function to an Amazon Simple Notification Service (Amazon SNS) topic in my AWS account. How do I do that?

Answer: "I want to subscribe my AWS Lambda function to an Amazon Simple Notification Service (Amazon SNS) topic in my AWS account. How do I do that?ResolutionNote: The instructions in this article follow those in Tutorial: Using AWS Lambda with Amazon Simple Notification Service. However, this article provides same-account setup instructions. For prerequisites and cross-account set-up instructions, see the tutorial.1.    Run the following command to create an Amazon SNS topic:Note: Replace lambda-same-account with the name that you want for your topic.$ aws sns create-topic --name lambda-same-accountNote the topic's Amazon Resource Name (ARN) that's returned in the command output. You'll need it later.2.    Create an execution role for Lambda to access AWS resources. Note the role's ARN. You'll need it later.3.    Create a deployment package. (Follow steps 1 and 2 in the tutorial.)4.    Run the following command to create a Lambda function:Note: Replace sns-same-account with the name that you want for your function. Replace arn:aws:iam::123456789012:role/service-role/lambda-sns-role with your execution role's ARN.$ aws lambda create-function --function-name sns-same-account \--zip-file fileb://function.zip --handler index.handler --runtime nodejs14.x \--role arn:aws:iam::123456789012:role/service-role/lambda-sns-role \--timeout 60Note the function's ARN that's returned in the command output. You'll need it in the next step.5.    Run the following command to add Lambda permissions for your Amazon SNS topic:Note: Replace sns-same-account with the name you gave your function. Replace arn:aws:sns:us-east-1:123456789012:lambda-same-account with your topic's ARN.$ aws lambda add-permission --function-name sns-same-account \--source-arn arn:aws:sns:us-east-1:123456789012:lambda-same-account \--statement-id sns-same-account --action "lambda:InvokeFunction" \--principal sns.amazonaws.com6.    Run the following command to subscribe your Lambda function to the Amazon SNS topic:Note: Replace arn:aws:sns:us-east-1:123456789012:lambda-same-account with your topic's ARN. Replace arn:aws:lambda:us-east-1:123456789012:function:sns-same-account with your function's ARN.$ aws sns subscribe --protocol lambda \--topic-arn arn:aws:sns:us-east-1:123456789012:lambda-same-account \--notification-endpoint arn:aws:lambda:us-east-1:123456789012:function:sns-same-account7.    Run the following command to test the subscription by publishing a sample message:Note: Replace arn:aws:sns:us-east-1:123456789012:lambda-same-account with your topic's ARN.$ aws sns publish --message "Hello World" --subject Test \--topic-arn arn:aws:sns:us-east-1:123456789012:lambda-same-accountThe command output returns a message ID, confirming that the message is published to your topic.8.    (Optional) Run the following commands to confirm in your Amazon CloudWatch Logs that the Lambda function was invoked:Note: Replace sns-same-account with the name of your function.$ aws logs describe-log-streams --log-group-name /aws/lambda/sns-same-accountNote the logStreamName returned. Then, use the following command to retrieve the logs:Note: Replace sns-same-account with the name of your function and logStreamName with the logStreamName returned by describe-log-streams.$ aws logs get-log-events --log-group-name /aws/lambda/sns-same-account \--log-stream-name 'logStreamName'Related informationInvoking AWS Lambda functions via Amazon SNSFollow"


Question: Why can't I access or view my Performance Insights data in Amazon RDS for MySQL?

I'm trying to enable Performance Insights in Amazon Relational Database Service (Amazon RDS) for MySQL. Why can't I access the data?

Answer: "I'm trying to enable Performance Insights in Amazon Relational Database Service (Amazon RDS) for MySQL. Why can't I access the data?Short descriptionYou might not be able to access or view your data in Performance Insights in Amazon RDS for MySQL for the following reasons:You've tried to manually set the Performance Schema values in a parameter group.Your DB instance doesn't have enough resources to access the data from Performance Insights.There's a transient networking issue, or system maintenance is underway on your DB instance.You've performed an upgrade of your DB instance from an unsupported Performance Insights version to a supported version.The data load on your MySQL DB instance is below the database load threshold.ResolutionYou've tried to manually set the Performance Schema values in a parameter groupIf you tried to manually update the Performance Schema parameter values in a parameter group, then Performance Insights won't work properly. A list of detailed wait events won't appear.The following parameters can't be automatically updated by Performance Insights:performance-schema-consumer-events-waits-current: ONperformance-schema-instrument: wait/%=ONperformance-schema-consumer-global-instrumentation: ONperformance-schema-consumer-thread-instrumentation: ONNote: You can reset the Performance Schema parameters back to the default values. After resetting the values, make sure to reboot your DB instance to enable the Performance Schema.Your DB instance doesn't have enough resources to access the data from Performance InsightsIf your DB instance is experiencing a heavy load, then your resources are dedicated to the database process. As a result, system processes such Performance Insights are deprioritized. To check whether your DB instance is under a heavy load, review the CPU utilization, disk queue depth, and read write latency values in Amazon CloudWatch.If your MySQL DB instance is experiencing a heavy load, then consider vertically scaling your DB instance class. When you configure a DB instance class, there will be some downtime. To troubleshoot CPU usage issues, see How can I troubleshoot and resolve high CPU utilization on my Amazon RDS for MySQL instances?There's a transient networking issue, or system maintenance is underway on your DB instanceWhen your DB instance experiences a transient networking issue or system maintenance, Performance Insights might not properly report data. If these factors affect your resources, then review the Personal Health Dashboard. The Personal Health Dashboard will provide guidance on how to proceed.You've performed an upgrade of your DB instance from an unsupported Performance Insights version to a supported oneIf you enable Performance Insights while performing a DB engine version upgrade, then your DB instance might not properly apply these changes. Also, make sure that your Amazon RDS Performance Insights version is supported, or your data might not properly sync.If your MySQL DB engine version is supported, then you can enable or disable Performance Insights when creating an instance or when modifying an instance. Make sure to choose Apply Immediately to apply the changes right away.Performance Insights is available only for MySQL DB engine versions 8.0.17 and higher, version 5.7.22 and higher, and version 5.6.41 and higher. Additionally, Performance Insights isn't supported on the following DB instance classes: db.t2.micro, db.t2.small, db.t3.micro, and db.t3.small. Therefore, check to make sure that your MySQL DB engine version is compatible. For more information about supported DB engine versions for Performance Insights, see Amazon RDS DB engine support for Performance Insights.The data load on your MySQL DB instance is below the database load thresholdIf you enabled Performance Insights and you can't view your data, then check the Db load chart and Counter metrics in your Performance Insights dashboard. If you see data under Counter metrics, but not Db load chart, then your DB load might be below the database load threshold for MySQL. To test and confirm, run a long-running transaction on your MySQL DB instance, and then check the Performance Insights dashboard again. If the data populates, then your original data load is likely below the data load threshold.Follow"


Question: How do I send AWS WAF logs to an Amazon S3 bucket in a centralized logging account?

I want to send AWS WAF logs to an Amazon Simple Storage Service (Amazon S3) bucket that's in a different account or AWS Region.

Answer: "I want to send AWS WAF logs to an Amazon Simple Storage Service (Amazon S3) bucket that's in a different account or AWS Region.ResolutionTo send AWS WAF logs to an Amazon S3 bucket that's in a centralized logging account, complete the steps in the following sections.Create an S3 bucket in the centralized logging account in your selected Region1.    Create an S3 bucket in the centralized logging account for your selected AWS Region.2.    Enter a bucket name that starts with the prefix aws-waf-logs-. For example, name your bucket similar to aws-waf-logs-example-bucket.Create and add a bucket policy to the S3 bucketAdd the following S3 bucket policy to your S3 bucket:Important:Replace the account IDs in aws:SourceAccount with the list of source account IDs that you want to send logs to this bucket.Replace the ARNs in aws:SourceArn with the list of ARNs of source resources that you want to publish logs to this bucket. Use the format of arn:aws:logs:*:source-account-id:*.Replace the S3 bucket name aws-waf-logs-example-bucket in Resource with the name of your S3 bucket.{  "Version": "2012-10-17",  "Id": "AWSLogDeliveryWrite20150319",  "Statement": [    {      "Sid": "AWSLogDeliveryWrite",      "Effect": "Allow",      "Principal": {        "Service": "delivery.logs.amazonaws.com"      },      "Action": "s3:PutObject",      "Resource": "arn:aws:s3:::aws-waf-logs-example-bucket/AWSLogs/*",      "Condition": {        "StringEquals": {          "s3:x-amz-acl": "bucket-owner-full-control",          "aws:SourceAccount": [            "111111111111",            "222222222222"          ]        },        "ArnLike": {          "aws:SourceArn": [            "arn:aws:logs:*:111111111111:*",            "arn:aws:logs:*:222222222222:*"          ]        }      }    },    {      "Sid": "AWSLogDeliveryAclCheck",      "Effect": "Allow",      "Principal": {        "Service": "delivery.logs.amazonaws.com"      },      "Action": "s3:GetBucketAcl",      "Resource": "arn:aws:s3:::aws-waf-logs-example-bucket",      "Condition": {        "StringEquals": {          "aws:SourceAccount": [            "111111111111",            "222222222222"          ]        },        "ArnLike": {          "aws:SourceArn": [            "arn:aws:logs:*:111111111111:*",            "arn:aws:logs:*:222222222222:*"          ]        }      }    }  ]}Configure your web ACLs to send the logs to the desired S3 bucketNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.You must configure your web ACLs to send the AWS WAF logs to the centralized logging account's S3 bucket. To configure a web ACL, run the put-logging-configuration AWS CLI command from the account that owns the web ACL.Important:Replace the ResourceArn value with your web ACLs ARN.Replace LogDestinationConfigs value with the ARN of the S3 bucket that's in your centralized logging account.Replace region with the AWS Region where your web ACL is located.aws wafv2 put-logging-configuration --logging-configuration ResourceArn=arn:aws:wafv2:eu-west-1: 111111111111:regional/webacl/testing/b4a768c9-4895-4f35-9354-3049ab8acc29,LogDestinationConfigs=arn:aws:s3:::aws-waf-logs-example-bucket --region eu-west-1Note: For web ACLs in the CloudFront(Global) Region, use us-east-1 as the Region in preceding command.Repeat the preceding put-logging-configuration command for each of your web ACLs.Related informationPermissions to publish logs to Amazon S3Follow"


Question: How do I resolve the "Unable to import module" error that I receive when I run Lambda code in Python?

I receive an "Unable to import module" error when I try to run my AWS Lambda code in Python.

Answer: "I receive an "Unable to import module" error when I try to run my AWS Lambda code in Python.Short descriptionYou typically receive this error when your Lambda environment can't find the specified library in the Python code. This is because Lambda isn't prepackaged with all Python libraries.To resolve this, create a deployment package or Lambda layer that includes the libraries that you want to use in your Python code for Lambda.Important: Make sure that you put the library that you import for Python inside the /python folder.ResolutionNote: The following steps show you how to create a Lambda layer rather than a deployment package. This is because you can reuse the Lambda layer across multiple Lambda functions. Each Lambda runtime adds specific folders inside the /opt directory referenced by the PATH variable. If the layer uses the same folder structure, then your Lambda function's code can access the layer content without specifying the path.It's a best practice to create a Lambda layer on the same operating system that your Lambda runtime is based on. For example, Python 3.8 is based on an Amazon Linux 2 Amazon Machine Image (AMI). However, Python 3.7 and Python 3.6 are based on the Amazon Linux AMI.To create a Lambda layer for a Python 3.8 library, do the following:Note: Steps 1-3 are optional.1.    In the AWS Cloud9 console, create an Amazon Elastic Compute Cloud (Amazon EC2) instance with Amazon Linux 2 AMI. For instructions, see Creating an EC2 environment in the AWS Cloud9 User Guide.2.    Create an AWS Identity and Access Management (IAM) policy that grants permissions to call the PublishLayerVersion API operation.Example IAM policy statement that grants permissions to call the PublishLayerVersion API operation{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Allow",      "Action": "lambda:PublishLayerVersion",      "Resource": "*"    }  ]}3.    Create an IAM role and attach the IAM policy to the role. Then, attach the IAM role to the Amazon EC2 instance.Note: Your EC2 instance now has permissions to upload Lambda layers for the PublishLayerVersion API call.4.    Open your AWS Cloud9 Amazon EC2 environment. Then, install Python 3.8 and pip3 by running the following commands:$ sudo amazon-linux-extras install python3.8$ curl -O https://bootstrap.pypa.io/get-pip.py$ python3.8 get-pip.py --user5.    Create a python folder by running the following command:$ mkdir python6.    Install the Pandas library files into the python folder by running the following command:Important: Replace Pandas with the name of the Python library that you want to import.$ python3.8 -m pip install pandas -t python/7.    Zip the contents of the python folder into a layer.zip file by running the following command:$ zip -r layer.zip python8.    Publish the Lambda layer by running the following command:Important: Replace us-east-1 with the AWS Region that your Lambda function is in.$ aws lambda publish-layer-version --layer-name pandas-layer --zip-file fileb://layer.zip --compatible-runtimes python3.8 --region us-east-19.    Add the layer to your Lambda function.Related informationHow do I troubleshoot "permission denied" or "unable to import module" errors when uploading a Lambda deployment package?Follow"


Question: Why is my instance terminating immediately after launching or starting an instance?

"My Amazon Elastic Compute Cloud (Amazon EC2) instance state changes from pending to terminated immediately after launching a new instance, or after starting a stopped instance. How can I troubleshoot this issue?"

Answer: "My Amazon Elastic Compute Cloud (Amazon EC2) instance state changes from pending to terminated immediately after launching a new instance, or after starting a stopped instance. How can I troubleshoot this issue?ResolutionFirst, determine the termination reason using the Amazon EC2 console or AWS Command Line Interface (AWS CLI). Then, follow the troubleshooting steps for that reason. For more information, see Instance terminates immediately.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Related informationInstance volume limitsdescribe-instancesUsing key policies in AWS KMSWhy am I unable to start or launch my EC2 instance?Follow"


Question: How can I create additional listeners for AWS Elastic Beanstalk environments that use a shared load balancer?

I want to create additional listeners for AWS Elastic Beanstalk environments that use a shared load balancer.

Answer: "I want to create additional listeners for AWS Elastic Beanstalk environments that use a shared load balancer.Short descriptionIf you're using a shared load balancer with Elastic Beanstalk, then you can't create additional listeners using the aws:elbv2:listener:listener_port option setting or the Elastic Beanstalk console. This is because the load balancer isn't managed by Elastic Beanstalk.You can use .ebextension custom resources to create additional listeners for an Elastic Beanstalk environment with a shared load balancer.Tip: It's a best practice to associate additional listeners with the lifecycle of the environment, and to remove the listeners if you terminate the environment.Resolution1.    Create an Application Load Balancer that includes a default listener and target group.2.    Create a configuration file called additional-listener.config file that includes the following:Resources:  AdditionalHttpListener:      Type: AWS::ElasticLoadBalancingV2::Listener      Properties:        LoadBalancerArn:          "Fn::GetOptionSetting":            Namespace: "aws:elbv2:loadbalancer"            OptionName: "SharedLoadBalancer"        DefaultActions:        - Type: forward          TargetGroupArn:            Ref: AWSEBV2LoadBalancerTargetGroup        Port: 8080        Protocol: HTTPNote: The YAML file in step 2 follows the AWS CloudFormation specification for the AWS::ElasticLoadBalancingV2::Listener resource.3.    Place the file from step 2 into the .ebextensions folder that's part of your application source bundle.4.    Create a ZIP file of your updated application source bundle.5.    Use the ZIP file from step 4 to create a new Elastic Beanstalk environment, or update an existing environment that's configured with the shared load balancer from step 1.The configuration file from step 2 creates an HTTP listener on port 8080 for the shared load balancer associated with your Elastic Beanstalk environment. Then, the listener forwards all traffic to the default process. You can further extend this configuration file to add additional rules to the listener using the AWS::ElasticLoadBalancingV2::ListenerRule resource definition of CloudFormation.Important: Because this listener is created as an additional resource as part of the Elastic Beanstalk environment, the listener is removed if the environment is terminated.Note: To learn more about shared load balancers and default listener rules, see Configuring a shared Application Load Balancer.Follow"


Question: Why are my scheduled backup plans in AWS Backup not running?

"I have configured backup plans and rules in AWS Backup, but my backup doesn't run as scheduled. How do I troubleshoot this issue?"

Answer: "I have configured backup plans and rules in AWS Backup, but my backup doesn't run as scheduled. How do I troubleshoot this issue?Short descriptionTo troubleshoot a scheduled backup plan that doesn't get initiated automatically, check if:the resource is opted-in for backupthe backup window for the backup rule is configured according to your needsthe AWS Identity and Access Management (IAM) role used to assign resources to the backup plan has sufficient permissions for resource assignmentsthe tags on the resources match the tag keys and values configured in the resource assignmentsthe backup policy is configured correctly for the cross-account management backup (if you are using cross-account management)ResolutionResource type turned on for backupBe sure that the resource type is turned on for protection by the backup plans in your account. The service opt-in feature allows you to choose the resource types that are protected by your backup plans.To activate a resource type for backup protection, do the following:Open the AWS Backup console.In the navigation pane, expand My account.Choose Settings.In the Service opt-in section, choose Configure resources.Turn on the services that you want to activate.Note: Services, such as Amazon Aurora and Amazon FSx, aren't activated by default.Choose Confirm.Note: Service opt-in settings are Region-specific. Be sure to check this setting in all AWS Regions where you've configured backups.For more information, see Service Opt-in.Configuration of the backup windowWhen you configure a backup rule, you can customize your backup window. Backup windows consist of the time that the backup window begins (that is, the Backup window start time) and the duration of the window (that is, Start within) in hours. By default, the Backup window start time and Start within fields are set to UTC 05:00 AM and 8 hours, respectively. Backup jobs are started within this window. Your backup jobs might be initiated during this backup window. Your backup jobs might not be initiated depending on when you check the status of these jobs.You can customize the backup window by modifying the default values for Backup window start time and Start within fields to your preferred values. To modify the Backup window start time and Start within fields, do the following:Open the AWS Backup console.In the navigation pane, choose Backup plans.Choose the backup plan that you want to update.Select the Backup rule that you want to update, and then choose Edit.In the Backup rule configuration section, select Customize backup window.For Backup window start time, select the start time of your preference.For Start within, select the duration of your preference.Choose Save.Configuration of the IAM role for resource assignmentsWhen you assign resources to a backup plan, you must choose an IAM role. If you are assigning resources through a deployment service, such as AWS CloudFormation, be sure of the following:The IAM role that's associated with the AWS::Backup::BackupSelection resource exists in the AWS account where the CloudFormation template is deployed. For more information, see Using AWS CloudFormation to provision AWS Backup resources.The IAM role has sufficient permissions to initiate the backup job on resources that are assigned to the backup plan.For more information, see Assign resources to a backup plan.Tags on assigned resourcesYou can assign resources to backup plans using tags. During these assignments, be sure that the tags on the resources match the tag keys and values configured in the resource assignments in terms of the following:Case-sensitivity: The tag keys and values are both case sensitive. Therefore, a tag value of true isn't equal to TRUE or True. For example, if the resource to be backed up is tagged with the key-value pair of backup:true, it's backed up only if the tag-based policy is configured with a key-value pair that completely matches the letters and the case.No white space: When you create tags for some AWS resources, the trailing white space might be accepted as allowed characters in tag names and values. For example, the tag name AWSBackup with a trailing space ("AWSBackup ") isn't the same as AWSBackup. The trailing space on tags might not be easy to view from the console. You can run a command similar to the following using the AWS Command Line Interface (AWS CLI):aws backup get-backup-selection --backup-plan-id abcd-efgh-ijkl-mnop --selection-id 11111111-2222-3333-4444-55555example            Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.            Replace abcd-efgh-ijkl-mnop and 11111111-2222-3333-4444-55555example with the backup-plan-id and selection-id of your backup plan.            The output of the AWS CLI command is similar to the following:{......        "ListOfTags": [            {                "ConditionType": "STRINGEQUALS",                "ConditionKey": "examplekey ",                "ConditionValue": "examplevalue "            }        ]    },......}            You can view the trailing spaces after both the tag name and the tag value in the output. For more information, see get-backup-selection.Backup policy for cross-account backupAs part of a scheduled backup plan, you can back up to multiple AWS accounts on demand. If you are configuring the backup policy for a cross-account management, check all the previous troubleshooting steps. Then, be sure of the following:The backup vault configured in the backup policy exists in the member accounts where the backup policy is attached.The backup policy is attached in the correct member account.The backup vault name configured in the backup policy matches the name of an existing backup vault in the target account. Note: Backup vault names are case-sensitive.For more information, see Managing AWS Backup resources across multiple AWS accounts.Amazon RDS backup failureWhen your Amazon Relational Database Service (Amazon RDS) instance misses a backup cycle, you get one of the following error messages:Can't start a backup now. RDS DB instance is closer to enter RDS automated maintenance window.Backup job could not start because it is either inside or too close to the automated backup window configured in RDS instance.This can happen when the RDS maintenance window or the RDS automated backup window is approaching. In AWS Backup, RDS backups aren't allowed within an hour before the RDS maintenance window or the RDS automated backup window. Therefore, be sure that your backup plans for RDS databases are scheduled more than an hour apart from the RDS maintenance window and the RDS automated backup window. This time frame is extended to 4 hours for Amazon FSx.Related informationTroubleshooting AWS BackupAccess controlTagging AWS resourcesFollow"


Question: How can I troubleshoot 5xx errors for API Gateway?

"When I call my Amazon API Gateway API, I get an 5xx error."

Answer: "When I call my Amazon API Gateway API, I get an 5xx error.Short descriptionHTTP 5xx response codes indicate server errors. API Gateway 5xx errors include the following cases:500 internal server502 bad gateway503 service unavailable504 endpoint request timed outResolutionBefore you begin, follow the steps to turn on Amazon CloudWatch Logs for troubleshooting API Gateway errors.Use the CloudWatch logs to find 5xx errors from API Gateway. The API Gateway metric 5XXError counts the number of server-side errors that are captured in a given period.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.500 error: internal server errorThis error can occur because of any of the following scenarios:Errors in the AWS Lambda function codeMissing permissions for using a stage variableIncorrect or missing HTTP status code mappingThrottling issuesUndefined HTTP method of POSTLambda permissionsLambda function JSON format issueBackend payload size exceeding 10 MBPrivate endpoint integrationInternal service failuresErrors in the Lambda function codeAPI endpoint 500 errors that integrate with Lambda might indicate that the Lambda function has an error in the code. For more information and troubleshooting, see Error handling patterns in Amazon API Gateway and AWS Lambda.Missing permissions for using a stage variableIf you use a stage variable to set up an API Gateway to invoke a Lambda function, then you might receive an Internal server error. To resolve this error, see I defined my Lambda integration in API Gateway using a stage variable. Why do I get an "Internal server error" and a 500 status code when I invoke the API method?Incorrect or missing HTTP status code mappingIncorrect or missing HTTP status code mapping can also result in 500 errors. To resolve this issue, set up mock integrations in API Gateway.Throttling issuesIf a high number of requests is throttling the backend service, then the API Gateway API might return an Internal server error. To resolve this issue, activate an exponential backoff and retry mechanism, and then try the request again. If the issue persists, then check your API Gateway quota limit. If you exceed the service quota limit, then you can request a quota increase.Undefined HTTP method of POSTFor Lambda integration, you must use the HTTP method of POST for the integration request.Run the AWS CLI command put-integration to update the method integration request:aws apigateway put-integration \    --rest-api-id id \    --resource-id id \    --http-method ANY \    --type AWS_PROXY \    --integration-http-method POST \    --uri arn:aws:apigateway:us-east-2:lambda:path//2015-03-31/functions/arn:aws:lambda:us-east-2:account_id:function:helloworld/invocationsThen, use the AWS CLI command create-deployment to deploy the REST API:aws apigateway create-deployment \    --rest-api-id id \    --stage-name <value>Lambda permissionsMake sure that the integrated Lambda function's or Lambda authorizer's resource-based policy includes permissions for your API to invoke the function. Follow the instructions to update your Lambda function's resource-based policy.Lambda function JSON format issueThe integrated Lambda function isn't returning output according to the predefined JSON format for REST APIs and HTTP APIs. Update your Lambda function or Lambda authorizer in JSON format:REST API:{    "isBase64Encoded": true|false,    "statusCode": httpStatusCode,    "headers": { "headerName": "headerValue", ... },    "multiValueHeaders": { "headerName": ["headerValue", "headerValue2", ...], ... },    "body": "..."}HTTP API:{    "isBase64Encoded": true|false,    "statusCode": httpStatusCode,    "headers": { "headername": "headervalue", ... },    "multiValueHeaders": { "headername": ["headervalue", "headervalue2", ...], ... },    "body": "..."}Backend payload size exceeding 10 MBThe maximum backend payload size is 10 MB. You can't increase the size. Make sure that the backend payload size doesn't exceed the 10 MB default quota.Private endpoint integrationIf you're using a private API endpoint, you must also configure API Gateway private integration. Follow the instructions to set up API Gateway private integrations.Internal service failuresIf AWS experiences internal service problems, then you might receive a 500 error. Wait for the issue to resolve within AWS or the API Gateway service, and then retry the request with exponential backoff.502 error: bad gatewayA 502 error code is related to the AWS service that your API Gateway integrates with, such as an AWS Lambda function. API Gateway can't process the response as a gateway or proxy.To troubleshoot this issue, see How do I resolve HTTP 502 errors from API Gateway REST APIs with Lambda proxy integration?Note: When API Gateway interprets the response from the backend service, it uses mapping templates to map the format in the integration response section. For more information, see Set up an integration response in API Gateway.503 error: service unavailableA 503 error code is related to the backend integration and if the API Gateway API can't receive a response.This error might occur in the following scenarios:The backend server is overloaded beyond capacity and can't process new client requests.The backend server is under temporary maintenance.To resolve this error, consider provisioning more resources to the backend server and activating an exponential backoff and retry mechanism on the client. Then, try the request again.504 error: endpoint request timed outIf an integration request takes longer than your API Gateway REST API maximum integration timeout parameter, API Gateway returns an HTTP 504 status code.To resolve this error, see How can I troubleshoot API HTTP 504 timeout errors with API Gateway?Related informationSecurity best practices in Amazon API GatewayMonitoring REST API execution with Amazon CloudWatch metricsFollow"


Question: How can I update the WorkSpace image in a custom bundle?

I want to update the application installed in the Amazon WorkSpaces image associated with a custom WorkSpaces bundle. How can I do this?

Answer: "I want to update the application installed in the Amazon WorkSpaces image associated with a custom WorkSpaces bundle. How can I do this?ResolutionYou can update an existing custom WorkSpaces bundle by:Modifying the WorkSpace that is based on the bundle.Creating an image from the WorkSpace.Updating the bundle with the new image.You can then launch new WorkSpaces using the updated bundle.For a detailed tutorial, see Update a custom WorkSpaces bundle.Follow"


Question: Why isn’t my AWS Config rule working?

My AWS Config rule isn't working. How can I troubleshoot this issue?

Answer: "My AWS Config rule isn't working. How can I troubleshoot this issue?ResolutionVarious issues can cause managed AWS Config rules to not work, including permissions, resource scope, or configuration change items. To resolve AWS Config rules that don't work, try the following troubleshooting steps.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent version of the AWS CLI.General AWS Config rule troubleshootingVerify that your configuration recorder is recording all of the resource types that your rule requires (for example, AWS::EC2::Instance).Open the AWS Config console , and then choose Rules from the navigation pane. If the Compliance field indicates No results reported or No resources in scope, see step 8 of Setting up and activating an AWS managed rule.If an evaluation time isn't reported and indicates Evaluations failed, review the PutEvaluations API call in AWS CloudTrail Logs for reported errors.Open the AWS CloudTrail console , and then choose Event history from the navigation pane. To filter the logs, choose Event source from the dropdown, and enter config.amazonaws.com in the search field. Review the filtered log results for Access Denied errors.For periodic trigger AWS Config rules, access the CloudTrail console Event history dashboard to verify the relevant service APIs on the resource.Review specific resource configuration and compliance timelines. Confirm that a configuration item generated to reflect the change to the AWS Config rules with a configuration change-based trigger.Confirm that the recorder role permissions requirements are met. These credentials are used to describe the resource configuration and publishing compliance using the PutEvaluations API.Run the following AWS CLI command. Replace ConfigRuleName with your AWS Config rule name, and replace RegionID with your AWS Region. From the output, review the LastErrorMessage value.aws configservice describe-config-rule-evaluation-status --config-rule-names ConfigRuleName --region RegionIDCustom AWS Config rule troubleshootingFor custom AWS Config rules, in addition to the preceding general troubleshooting steps, verify the following:An "Unable to execute lambda function" error message indicates that the AWS Config service doesn't have permission to invoke the AWS Lambda function. To resolve this error, run the following command to grant the required permissions. Replace function_name with your Lambda function name, RegionID with your AWS Region, and AWS-accountID with your AWS account ID:aws lambda add-permission --function-name function_name --region RegionID --statement-id allow_config --action lambda:InvokeFunction --principal config.amazonaws.com --source-account AWS-accountIDThe following is an example resource policy of the Lambda function:{    "Version": "2012-10-17",    "Id": "default",    "Statement": [        {            "Sid": "allow_config",            "Effect": "Allow",            "Principal": {                "Service": "config.amazonaws.com"            },            "Action": "lambda:InvokeFunction",            "Resource": "lambda-function-arn",            "Condition": {                "StringEquals": {                    "AWS:SourceAccount": "AWS-accountID"                }            }        }    ]}Identify the PutEvaluations event that has a User name value matching the Lambda function name. Review the errorMessage for details.If the role that the Lambda function uses to run the code isn't authorized to perform config:PutEvaluations, then add the permissions to the specified role.If the permissions are correct, review the Lambda function code for any raised exceptions. For more details, review the logs in the Amazon CloudWatch log group (/aws/lambda/FunctionName) associated with the Lambda function. Add a print statement in the code to generate more debugging logs.Related informationWhy can't I create or delete organization config rules?Follow"


Question: How do I find out what stopped my AWS OpsWorks Stacks instance?

One of my Amazon Elastic Compute Cloud (Amazon EC2) instances that's managed by AWS OpsWorks Stacks stopped running. How do I verify what stopped the instance?

Answer: "One of my Amazon Elastic Compute Cloud (Amazon EC2) instances that's managed by AWS OpsWorks Stacks stopped running. How do I verify what stopped the instance?Short descriptionThere are two ways to stop an OpsWorks Stacks instance:Manually stopping an instance in the OpsWorks console or by using the OpsWorks Stacks API.The OpsWorks Stacks autohealing feature.Important: OpsWorks Stacks doesn't recognize start, stop, or restart operations performed in the Amazon EC2 console. For more information, see Manually starting, stopping, and rebooting 24/7 instances.To verify what stopped your OpsWorks Stacks instance, you can do either of the following:Review your AWS CloudTrail for simultaneous Amazon EC2 StopInstances API calls and OpsWorks Stacks StopInstance API callsIf the two API calls are logged over the same time period, then the instance was stopped manually on the OpsWorks Stacks side. If there's an Amazon EC2 StopInstances API call logged only, then autohealing was applied to the instance.Review your instance's Agent logs to see if the OpsWorks agent was still sending its keepalive signal when the instance stoppedIf successful keepalive signals are logged when the instance stopped, then the instance was stopped manually on the OpsWorks Stacks side. If the keepalive logs are missing or there are failed signal attempts logged when the instance stopped, then autohealing was applied.If autohealing was applied to your instance, see How do I stop AWS OpsWorks Stacks from unexpectedly restarting healthy instances? If your instance was stopped manually, review the AWS Identity and Access Management (IAM) role that made the StopInstance API call. Then, determine who has access to that role and find out why they stopped the instance.ResolutionReview your instance's CloudTrail logs for Amazon EC2 StopInstances API calls1.    Open the CloudTrail console.Important: Make sure that the AWS Region selected is the same Region that your instance is in.2.    In the left navigation pane, choose Event history.3.    In the upper left of the Event history page, select the filter dropdown list. Then, choose Resource name.4.    In the search text box to the right of the filter dropdown list, enter your Amazon EC2 instance ID. Results for all of the events associated with the instance appear.5.    In the Event name column, look for StopInstances.6.    In the Event time column of the StopInstances event row, note the API call's timestamp. You will reference the timestamp when reviewing your instance's CloudTrail logs for OpsWorks Stacks StopInstance API calls.7.    Open the event record by choosing the name of the event (StopInstances) in the Event name column.8.    In the Event record pane, look for the "invokedBy" value. If the instance was stopped on the OpsWorks Stacks side—either manually or through autohealing—then the Amazon EC2 StopInstances API response shows the following output:"invokedBy": "opsworks.amazonaws.com"Note: There is no indicator in the Event record if autohealing was applied to the instance or not.Review your instance's CloudTrail logs for OpsWorks Stacks StopInstance API calls1.    Open the CloudTrail console.Important: Make sure that the AWS Region selected is the same Region that your OpsWorks Stacks API endpoint is in.2.    In the left navigation pane, choose Event history.3.    In the upper left of the Event history page, select the filter dropdown list. Then, choose Resource name.4.    In the search text box to the right of the filter dropdown list, enter your OpsWorks Stacks instance ID. Results for all of the events associated with the instance appear.5.    In the Event name column, look for StopInstance.6.    In the Event time column of the StopInstance event row, verify if the event's timestamp is the same as the Amazon EC2 StopInstances event's timestamp or not.If the StopInstance API call is logged at the same time as the StopInstances API call, then the instance was stopped manually on the OpsWorks Stacks side.If no StopInstance API call is logged at the same time as the StopInstances API call, then autohealing was applied to the instance.(Optional) Review your instance's Agent logs to see if the OpsWorks agent was still sending its keepalive signal when the instance stoppedConnect to your Linux instance by using SSH (Secure Shell), or connect to your Windows instance by using the Windows remote desktop protocol (RDP). Then, check for the log file opsworks-agent.keep_alive.log in the instance's OpsWorks Agent log.If successful keepalive signals are logged when the instance stopped, then the instance was stopped manually on the OpsWorks Stacks side. If the keepalive logs are missing or there are failed signal attempts logged when the instance stopped, then autohealing was applied.Related informationHow to set up AWS OpsWorks Stacks autohealing notifications in Amazon CloudWatch EventsHow do I stop AWS OpsWorks Stacks from unexpectedly restarting healthy instances?How do I troubleshoot "Internal Error" messages when stopping an AWS OpsWorks Stacks instance that's in the "stop_failed" state?Follow"


Question: How can I back up a DynamoDB table to Amazon S3?

I want to back up my Amazon DynamoDB table using Amazon Simple Storage Service (Amazon S3).

Answer: "I want to back up my Amazon DynamoDB table using Amazon Simple Storage Service (Amazon S3).Short descriptionDynamoDB offers two built-in backup methods:On-demand: Create backups when you choose.Point-in-time recovery: Turn on automatic and continuous backups.Both of these methods are suitable for backing up your tables for disaster recovery purposes. However, with these methods, you can't use the data for use cases involving data analysis or extract, transform, and load (ETL) jobs. The DynamoDB Export to S3 feature is the easiest way to create backups that you can download locally or use with another AWS service. To customize the process of creating backups, you can use Amazon EMR, AWS Glue, or AWS Data Pipeline.ResolutionDynamoDB Export to S3 featureUsing this feature, you can export data from an Amazon DynamoDB table anytime within your point-in-time recovery window to an Amazon S3 bucket. For more information, see DynamoDB data export to Amazon S3.For an example of how to use the Export to S3 feature, see Export Amazon DynamoDB table data to your data lake in Amazon S3, no code writing required.Using the Export to S3 Feature allows you to use your data in other ways including the following:Perform ETL against the exported data on S3 and import the data back to DynamoDBRetain historical snapshots for auditingIntegrate the data with other services/applicationsBuild an S3 data lake from the DynamoDB data and analyze the data from various services, such as Amazon Athena, Amazon Redshift, and Amazon SageMaker.Run as-needed queries on your data from Athena or Amazon EMR without affecting your DynamoDB capacityKeep in mind the following pros and cons when using this feature:Pros: This feature allows you to export data across AWS Regions and accounts without building custom applications or writing code. The exports don't affect the read capacity or the availability of your production tables.Cons: This feature exports the table data in DynamoDB JSON or Amazon Ion format only. The AWS Data Pipeline Import DynamoDB backup data from S3 feature can't be used to import data directly to DynamoDB, because this feature doesn't meet the data format requirements. You can't use the Data Pipeline templates to import the data back to a DynamoDB table. To re-import the data natively with an S3 bucket, see DynamoDB data import from Amazon S3. You can also create a new template or use AWS Glue, Amazon EMR, or the AWS SDK to re-import the data.Amazon EMRUse Amazon EMR to export your data to an S3 bucket. You can do so using either of the following methods:Run Hive/Spark queries against DynamoDB tables using DynamoDBStorageHandler. For more information, see Exporting data from DynamoDB.Use the open-source emr-dynamodb-tool on GitHub to export/import DynamoDB tables.Keep in the mind the following pros and cons when using these methods:Pros: If you're an active Amazon EMR user and are comfortable with Hive or Spark, then these methods offer more control than the native Export to S3 function. You can also use existing clusters for this purpose.Cons: These methods require you to create and maintain an EMR Cluster. If you use DynamoDBStorageHandler, then you must be familiar with Hive or Spark.AWS GlueUse AWS Glue to copy your table to Amazon S3. For more information, see Using AWS Glue and Amazon DynamoDB export.Pros: Because AWS Glue is a serverless service, you don't need to create and maintain resources. You can directly write back to DynamoDB. You can add custom ETL logic for use cases, such as filtering and converting, when exporting data. You can also choose your preferred format from CSV, JSON, Parquet, or ORC. For more information, see Data format options for inputs and outputs in AWS Glue.Cons: If you choose this option, you must have knowledge about using Spark. You also must maintain a source code for your AWS Glue ETL job. For more information, see "connectionType": "dynamodb".Data PipelineUse AWS Data Pipeline to export your table to an S3 bucket in the same account or a different account. For more information, see Import and export DynamoDB data using AWS Data Pipeline.Pros: Data Pipeline uses Amazon EMR to create the backup and the scripting is done for you. You don't have to learn Apache Hive or Apache Spark to accomplish this task. The cluster is created and maintained for you.Cons: If you use the templates provided, then creating the backups is not as customizable as AWS Glue or Amazon EMR. To create customizable backups to Amazon S3, choose one of the other methods, or create your own template for Data Pipeline.If none of these options offer the flexibility that you need, then you can use the DynamoDB API to create your own solution.Related informationRequesting a table export in DynamoDBHow to export an Amazon DynamoDB table to Amazon S3 using AWS Step Functions and AWS GlueFollow"


Question: How can I resolve the error "Unknown dataset URI pattern: dataset" when exporting Amazon RDS data to Amazon S3 in Parquet format using Sqoop?

"I'm trying to use an Amazon EMR cluster to export Amazon Relational Database Service (Amazon RDS) data to Amazon Simple Storage Service (Amazon S3) in Apache Parquet format using Apache Sqoop. I'm using the --as-parquetfile parameter, but I keep getting this error:"Check that JARs for s3a datasets are on the class path org.kitesdk.data.DatasetNotFoundException: Unknown dataset URI pattern: dataset.""

Answer: "I'm trying to use an Amazon EMR cluster to export Amazon Relational Database Service (Amazon RDS) data to Amazon Simple Storage Service (Amazon S3) in Apache Parquet format using Apache Sqoop. I'm using the --as-parquetfile parameter, but I keep getting this error:"Check that JARs for s3a datasets are on the class path org.kitesdk.data.DatasetNotFoundException: Unknown dataset URI pattern: dataset."Short descriptionThis error affects Sqoop version 1.4.7. To resolve the error, download and install the kite-data-s3-1.1.0.jar.ResolutionNote: The following solution was tested on Amazon EMR release version 5.34.0 and Sqoop version 1.4.7.1.    Connect to the master node using SSH.2.    Use wget to download the kite-data-s3-1.1.0.jar:[hadoop@ip-xxx-xx-xx-x]$ wget https://repo1.maven.org/maven2/org/kitesdk/kite-data-s3/1.1.0/kite-data-s3-1.1.0.jar3.    Confirm that the downloaded file is the correct size (1.7 MB):[hadoop@ip-xxx-xx-xx-x]$ du -h1.7M     /usr/lib/sqoop/lib/kite-data-s3-1.1.0.jar4.    Move the JAR to the Sqoop library directory ( /usr/lib/sqoop/lib/):sudo cp kite-data-s3-1.1.0.jar /usr/lib/sqoop/lib/5.    Grant permission on the JAR:sudo chmod 755 kite-data-s3-1.1.0.jar6.    Use the s3n connector to import the jar. If you use the s3 connector, you get the Unknown dataset URI pattern: dataset error.sqoop import --connect jdbc:mysql://mysql.cdfqbesrukqe.eu-west-1.rds.amazonaws.com:8193/dev --username admin -P --table hist_root --target-dir "s3n://awsexamplebucket/sqoop_parquet/demo" --as-parquetfile -m 2 --split-by identifiers -- --schema onwatchFor more information about the Kite SDK dataset URI, see Dataset, view, and repository URIs.Follow"


Question: Why is my Amazon RDS for MySQL or MariaDB instance showing as storage full?

My Amazon Relational Database Service (Amazon RDS) for MySQL or MariaDB instance is showing as storage full. Why is this happening and how do I view what is using storage in my DB instance?

Answer: "My Amazon Relational Database Service (Amazon RDS) for MySQL or MariaDB instance is showing as storage full. Why is this happening and how do I view what is using storage in my DB instance?Short descriptionTo troubleshoot a storage full issue, you must first analyze the total space used on your DB instance. Space on your DB instance is used for the following:User-created databasesTemporary tablesBinary logs or MySQL standby instance relay logs (if you use a read replica)InnoDB tablespaceGeneral logs, slow query logs, and error logsAfter you identify what's using storage space, you can reclaim storage space. Then, monitor the FreeStorageSpace metric to avoid running out of space again.Note: If there's a sudden decrease in available storage, check ongoing queries at the DB instance level by running the SHOW FULL PROCESSLIST command. The SHOW FULL PROCESSLIST command provides information about all active connections and queries that are performed by each connection. To review the transactions that have been active for a long time, run the INFORMATION_SCHEMA.INNODB_TRX or SHOW ENGINE INNODB STATUS command. Then, review the output.ResolutionAnalyze the total space used on the DB instance (user-created databases)To find the size of each user-created database, run the following query:mysql> SELECT table_schema, ROUND(SUM(data_length+index_length)/1024/1024/1024,2) "size in GB" FROM information_schema.tables GROUP BY 1 ORDER BY 2 DESC;To check the size of each table for a particular database (in your DB instance), run the following query:mysql> SELECT table_schema "DB Name", table_name,(data_length + index_length)/1024/1024/1024 AS "TableSizeinGB" from information_schema.tables where table_schema='database_name';To get more accurate tables sizes in MySQL version 5.7 and higher, or MySQL 8.0 and higher, use the following query:Note: The information_schema.files query is not applicable to MariaDB engines.mysql> SELECT file_name, ROUND(SUM(total_extents * extent_size)/1024/1024/1024,2) AS "TableSizeinGB" from information_schema.files where file_name like '%/database_name/%';To obtain complete storage details and approximate fragmented space at the database level and table level, run the following query:Note: This query is not applicable to tables residing in shared tablespace.mysql> SELECT table_schema AS "DB_NAME", SUM(size) "DB_SIZE", SUM(fragmented_space) APPROXIMATED_FRAGMENTED_SPACE_GB FROM (SELECT table_schema, table_name, ROUND((data_length+index_length+data_free)/1024/1024/1024,2) AS size, ROUND((data_length - (AVG_ROW_LENGTH*TABLE_ROWS))/1024/1024/1024,2)    AS fragmented_space FROM information_schema.tables WHERE table_type='BASE TABLE' AND table_schema NOT IN ('performance_schema', 'mysql', 'information_schema') ) AS TEMP GROUP BY DB_NAME ORDER BY APPROXIMATED_FRAGMENTED_SPACE_GB DESC;mysql> SELECT table_schema DB_NAME, table_name TABLE_NAME, ROUND((data_length+index_length+data_free)/1024/1024/1024,2) SIZE_GB, ROUND((data_length - (AVG_ROW_LENGTH*TABLE_ROWS))/1024/1024/1024,2) APPROXIMATED_FRAGMENTED_SPACE_GB from information_schema.tables    WHERE table_type='BASE TABLE' AND table_schema NOT IN ('performance_schema', 'mysql', 'information_schema') ORDER BY APPROXIMATED_FRAGMENTED_SPACE_GB DESC;Record the database sizes acquired from these two queries and compare them to the Amazon CloudWatch metrics in Amazon RDS. You can then confirm whether the full storage is caused because of data usage.Temporary tablesInnoDB user-created temporary tables and on-disk internal temporary tables are created in a temporary tablespace file named ibtmp1. Sometimes, the temporary tablespace file can even extend to ibtmp2 in the MySQL data directory.Tip: If the temporary table (ibtmp1) uses excessive storage, reboot the DB instance to release the space.The online DDL operations use temporary log files for the following:Recording concurrent DMLCreating temporary sort files when an index is createdCreating temporary intermediate tables files when tables are rebuilt (so that temporary tables can occupy storage)Note: File sizes of the InnoDB tablespace can be queried only using MySQL version 5.7 and higher, or MySQL 8.0 and higher.To find the InnoDB temporary tablespace, run the following query:mysql> SELECT file_name, tablespace_name, table_name, engine, index_length, total_extents, extent_size from information_schema.files WHERE file_name LIKE '%ibtmp%';To reclaim disk space that's occupied by a global temporary tablespace data file, restart the MySQL server or reboot your DB instance. For more information, see The temporary tablespace on the MySQL website.InnoDB table spaceSometimes MySQL will create internal temporary tables that can't be removed because a query is intervening. These temporary tables aren't part of the table named "tables" inside information_schema. For more information, see Internal temporary table use in MySQL on the MySQL website.Run the following query to find these internal temporary tables:mysql> SELECT * FROM information_schema.innodb_sys_tables WHERE name LIKE '%#%';The InnoDB system tablespace is the storage area for the InnoDB data dictionary. Along with the data dictionary, the doublewrite buffer, change buffer, and undo logs are also present in the InnoDB system tablespace. Additionally, the tablespace might contain index and table data if tables are created in the system tablespace (instead of file-per-table or general tablespaces).Run the following query to find the InnoDB system tablespace:mysql> SELECT file_name, tablespace_name, table_name, engine, index_length, total_extents, extent_size from information_schema.files WHERE file_name LIKE '%ibdata%';Note: This query runs on MySQL version 5.7 and higher, or MySQL 8.0 and higher.After the size of your system table space is increased, you can't reduce it. However, you can dump all of your InnoDB tables and import the tables into a new MySQL DB instance. To avoid large system tablespaces, consider using file-per-table tablespaces. For more information, see File-per-table tablespaces on the MySQL website.If you do enable Innodb_file_per_table, then each table will store the data and index in its own tablespace file. You can reclaim the space (from fragmentation on databases and tables) by running OPTIMIZE TABLE on that table. The OPTIMIZE TABLE command creates a new empty copy of your table. Then, data from the old table is copied row by row to the new table. During this process, a new .ibd tablespace is created and space is reclaimed. For more information about this process, see OPTIMIZE TABLE statement on the MySQL website.Important: The OPTIMIZE TABLE command uses the COPY algorithm to create temporary tables that are the same size as the original table. Confirm that you have enough available disk space before running this command.To optimize your table, run the following command syntax:mysql> OPTIMIZE TABLE <tablename>;Or, you can rebuild the table by running the following command:mysql> ALTER TABLE <table_name> ENGINE=INNODB;Binary logsIf you activate automated backups on your Amazon RDS instance, the binary logs are also automatically activated on your DB instance. These binary logs are stored on the disk and consume storage space, but are purged at every binary log retention configuration. The default binlog retention value for your instance is also set to "Null", which means that the file is removed immediately.To avoid low storage space issues, set the appropriate binary log retention period in Amazon RDS for MySQL. You can review the number of hours that a binary log is retained with the mysql.rds_show_configuration command syntax:CALL mysql.rds_show_configuration;You can also reduce this value to retain logs for a shorter period to reduce the amount of space the logs use. A value of NULL means that logs are purged as soon as possible. If there's a standby instance for the active instance, then monitor the ReplicaLag metric on the standby instance. The ReplicaLag metric indicates any delays that occur during the binary log processing on the active instance or relay logs on the standby instance.If there's a standby instance for the active instance, then monitor the ReplicaLag metric on the standby instance. The ReplicaLag metric indicates any delays during the binary log purge on the active instance and relay log on the standby instance. If there are purging or replication issues, then these binary logs can accumulate over time, consuming additional disk space. To check the number of binary logs on an instance and file size, use the SHOW BINARY LOGS command. For more information, see SHOW BINARY LOGS statement on the MySQL website.If the DB instance is acting as a replication standby instance, then check the size of the relay logs (Relay_Log_Space) value using the following command:SHOW SLAVE STATUS\GMySQL logs (general logs, slow query logs, and error logs)Amazon RDS for MySQL provides logs (such as general logs, slow query logs and error logs) that can be used to monitor your database. Error logs are active by default. However, the general logs and slow query logs can be activated using a custom parameter group on the RDS instance. After the slow query logs and general logs are activated, they are automatically stored in the slow_log and general_log tables inside the MySQL database. To check the sizes of any slow queries, general logs (of "FILE" type), and error logs, view and list the database log files.If the slow query log and general log tables are using excessive storage, thenmanage the table-based MySQL logs by manually rotating the log tables. To completely remove the old data and reclaim your disk space, call the following commands twice in succession:mysql> CALL mysql.rds_rotate_slow_log;mysql> CALL mysql.rds_rotate_general_log;Note: The tables don't provide an accurate file size of the logs. Modify the parameter so that the value of log_output for slow_log and general_log is "File" instead of "Table".It's also a best practice to monitor your Amazon RDS DB instance using Amazon CloudWatch. You can set up CloudWatch alarms on the FreeStorageSpace metric to receive alerts whenever your storage space drops below a certain threshold value. Finally, monitor the FreeStorageSpace metric by setting up a CloudWatch alarm to receive notifications whenever your DB instance is low on free space. For more information, see How can I create CloudWatch alarms to monitor the Amazon RDS free storage space and prevent storage full issues?Also, you can use the Amazon RDS storage autoscaling feature to manage capacity automatically. With storage autoscaling, you don't have to manually scale up database storage. For more information about Amazon RDS storage autoscaling, see Working with storage for Amazon RDS DB instances.Related informationHow do I resolve problems with my Amazon RDS for MySQL DB instance that's using more storage than expected?Follow"


Question: Why isn't my Lambda function with an Amazon SQS event source scaling optimally?

"When I use an Amazon Simple Queue Service (Amazon SQS) queue as an event source, I want my AWS Lambda function to have optimal concurrency."

Answer: "When I use an Amazon Simple Queue Service (Amazon SQS) queue as an event source, I want my AWS Lambda function to have optimal concurrency.ResolutionNote: When you configure an Amazon SQS queue as an event source, Lambda functions can optimally scale up to 60 more instances per minute. The maximum number of concurrent invocations is 1,000. If you use FIFO event source mapping, then functions can scale in concurrency to the number of active message groups. For more information see, Scaling and processing.Identify and resolve any Lambda function invocation errorsTo prevent errors at scale, Lambda throttles function scaling when invocation errors occur. When the errors are resolved, Lambda continues to scale the function. For more information, see Backoff strategy for failed invocations.For best practices on how to resolve Lambda function invocation errors, see Troubleshooting issues in Lambda and How do I troubleshoot Lambda function failures?Configure your Lambda function with optimal concurrency for your use caseReserved concurrencyIf you configured reserved concurrency on your function, then Lambda throttles your function when it reaches the reserved value. Make sure that the amount of concurrency that's reserved for your function has at least the following values:For standard Amazon SQS queues: 1,000For FIFO queues: The number of active message groupsUnreserved concurrencyIf you don't configure reserved concurrency on your function, then your function has a default unreserved concurrency quota of 1,000. This default quota applies to other functions in the same AWS account and AWS Region. If you have at least 1,000 unreserved concurrency available in your function's Region, then the function scales until it reaches the maximum available concurrency. When all of your account's concurrency is in use, Lambda throttles invocations.Note: Lambda functions initially scale as per burst capacity.If your expected traffic arrives quicker than the default burst capacity, then you can use Provisioned Concurrency to make sure that your function is available. With Provisioned Concurrency, the function continues to scale to a predefined value. After the provisioned concurrency is fully used, the function uses the unreserved concurrency pool of the account.Important: To scale up additional concurrent invocations, your account must not be near the service quota for scaling or burst concurrency in the Region. If you need a higher concurrency for a Region, then request a service quota increase in the Service Quotas console.Confirm that there are enough messages in your Amazon SQS queue to allow your Lambda function to scaleIf an Amazon SQS queue is configured to invoke a Lambda function, then Lambda will scale invocations only if there are messages in the queue.To check how many messages in your Amazon SQS queue still need to be processed, review your ApproximateNumberOfMessagesVisible metric.If the metric is low or at 0, then your function can't scale.If the metric is high and there are no invocation errors, then try increasing the batch size on your event notification. Increase the batch size until the duration metric increases faster than the batch size metric. For more information, see Monitoring functions on the Lambda console.Note: The maximum batch size for a standard Amazon SQS queue is 10,000 records. For FIFO queues, the maximum batch size is 10 records. For more information, see ReceiveMessage in the Amazon SQS API Reference.Related informationUsing Lambda with Amazon SQSManaging AWS Lambda function concurrencyConfiguring maximum concurrency for Amazon SQS event sourcesFollow"


Question: How do I install and activate the latest ENA driver for enhanced network support on an Amazon EC2 instance running Red Hat 6/7?

How do I install and activate the latest Elastic Network Adapter (ENA) driver for enhanced network support on an Amazon Elastic Compute Cloud (Amazon EC2) instance running RHEL 6 or 7?

Answer: "How do I install and activate the latest Elastic Network Adapter (ENA) driver for enhanced network support on an Amazon Elastic Compute Cloud (Amazon EC2) instance running RHEL 6 or 7?Short descriptionSome earlier versions of the Red Hat Enterprise Linux operating system don't include an ENA driver. For Nitro instances, the ENA driver is required to change your EC2 instance type for network connectivity.Note: It's a best practice to create a snapshot of your instance before proceeding with the following resolution.ResolutionRHEL 7.4 and laterRHEL 7.4 and later AMIs come preinstalled with the module needed for enhanced networking with ENA. For more information, see Enable enhanced networking with the Elastic Network Adapter (ENA) on Linux instances.RHEL 7 lower than 7.41.    Run the following command to upgrade the kernel to the latest version:sudo yum upgrade kernel -y2.    Stop the instance.Note: Data in instance store volumes is lost when an instance is stopped. For more information, see Determine the root device type of your instance. Be sure that you  back up any data that you want to keep on an instance store volume.3.    Run the following AWS Command Line Interface (AWS CLI) command:aws ec2 modify-instance-attribute --instance-id i-xxxxxxxxxxxxxxxxx --ena-support --region xx-xxxxx-xNote: If the AWS CLI isn't installed on your instance, you can install and configure it. If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.4.    Start the instance.5.    Validate that the ENA driver loaded on the instance using the following command. Replace eth0 with the name of the interface that you want to check. The default name for a single interface is eth0. If your operating system uses predictable network names, the network name might be different.$ ethtool -i eth0RHEL 6Note: RHEL 6 doesn't come with Amazon EC2 production-ready NVMe drivers and you can't upgrade to NVME drivers separately. If you want to use a Nitro-based, or any instance type with NVMe instance store volumes, upgrade to RHEL 7.4 or higher.Download and install the ENA driver1.    Update the kernel and reboot the system so that the latest kernel takes effect:sudo yum upgrade kernel -y && sudo reboot2.    Install the development package for building kernel modules to match the kernel:sudo yum install kernel-devel-$(uname -r) gcc git patch rpm-build wget -ycd /usr/src/sudo wget https://github.com/amzn/amzn-drivers/archive/master.zipsudo unzip master.zipcd amzn-drivers-master/kernel/linux/enasudo make3.    Copy the module to the modules directory:sudo cp ena.ko /lib/modules/$(uname -r)/4.    Regenerate the kernel module dependency map files:sudo depmod5.    Use the modinfo command to confirm that the ENA module is present:modinfo enaThe modinfo command output shows the ENA driver information.Note: The ENA driver version might be newer than 2.2.11g while you compile and install it on your system.filename:       /lib/modules/2.6.32-754.33.1.el6.x86_64/ena.koversion:        2.2.11glicense:        GPLdescription:    Elastic Network Adapter (ENA)author:         Amazon.com, Inc. or its affiliatesretpoline:      Ysrcversion:     17C7CD1CEAD3F0ADB3A5E5Ealias:          pci:v00001D0Fd0000EC21sv*sd*bc*sc*i*alias:          pci:v00001D0Fd0000EC20sv*sd*bc*sc*i*alias:          pci:v00001D0Fd00001EC2sv*sd*bc*sc*i*alias:          pci:v00001D0Fd00000EC2sv*sd*bc*sc*i*alias:          pci:v00001D0Fd00000051sv*sd*bc*sc*i*depends:        vermagic:       2.6.32-754.33.1.el6.x86_64 SMP mod_unload modversions parm:           debug:Debug level (0=none,...,16=all) (int)parm:           rx_queue_size:Rx queue size. The size should be a power of 2. Max value is 8K (int)parm:           force_large_llq_header:Increases maximum supported header size in LLQ mode to 224 bytes, while reducing the maximum TX queue size by half. (int)parm:           num_io_queues:Sets number of RX/TX queues to allocate to device. The maximum value depends on the device and number of online CPUs. (int)6.    Append net.ifnames=0 to /boot/grub/grub.conf to turn off network interface naming:sudo sed -i '/kernel/s/$/ net.ifnames=0/' /boot/grub/grub.conf7.    Stop the instance.8.    Activate enhanced network support at the instance level. The following example modifies the instance's attribute from the AWS Command Line Interface (AWS CLI).aws ec2 modify-instance-attribute --instance-id i-xxxxxxxxxxxxxxxxx --ena-support --region xx-xxxxx-x9.    Change the instance type to one of the ENA supported instance types.10.    Start the instance, connect to the instance using SSH, and then run the ethtool command:ethtool -i eth0The output includes the ENA driver version, as shown in the following example:driver: enaversion: 2.2.11gfirmware-version: bus-info: 0000:00:05.0supports-statistics: yessupports-test: nosupports-eeprom-access: nosupports-register-dump: nosupports-priv-flags: noConfigure the Dynamic Kernel Module Support (DKMS) program to make sure that the driver is included during future kernel upgradesKeep the following in mind:Software from the EPEL repository is not supported by Red Hat or AWS.Using DKMS voids the support agreement for your subscription.1.    Install the following Red Hat Package Manager ( rpm) file:sudo yum install https://archives.fedoraproject.org/pub/archive/epel/6/x86_64/epel-release-6-8.noarch.rpm -yNote: For a list of the most recent .rpm packages, refer to the EPEL - Fedora Project Wiki website.2.    Run the install command:sudo yum install dkms -y3.    Detect the current version:VER=$( grep ^VERSION /usr/src/amzn-drivers-master/kernel/linux/rpm/Makefile | cut -d' ' -f2 )4.    Copy the source files into the source directory:sudo cp -a /usr/src/amzn-drivers-master /usr/src/amzn-drivers-${VER}5.    Generate the DKMS config file and build and install the ENA module:sudo cat <<EOM | sudo tee /usr/src/amzn-drivers-${VER}/dkms.confPACKAGE_NAME="ena"PACKAGE_VERSION="$VER"CLEAN="make -C kernel/linux/ena clean"MAKE="make -C kernel/linux/ena/ BUILD_KERNEL=\${kernelver}"BUILT_MODULE_NAME[0]="ena"BUILT_MODULE_LOCATION="kernel/linux/ena"DEST_MODULE_LOCATION[0]="/updates"DEST_MODULE_NAME[0]="ena"AUTOINSTALL="yes"EOMsudo dkms add -m amzn-drivers -v $VERsudo dkms build -m amzn-drivers -v $VERsudo dkms install -m amzn-drivers -v $VERFollow"


Question: Why can't I delete my requester-managed VPC endpoint?

Why can't I delete my requester-managed Amazon Virtual Private Cloud (Amazon VPC) endpoint?

Answer: "Why can't I delete my requester-managed Amazon Virtual Private Cloud (Amazon VPC) endpoint?Short descriptionWhen deleting an interface VPC endpoint, you might receive the following error:vpce-0399e6e9fd2f4e430: Operation is not allowed for requester-managed VPC endpoints for the service com.amazonaws.vpce.region.vpce-svc-04c257ad126576358This error occurs when the endpoint being deleted is a requester-managed VPC endpoint. Requester-managed endpoints are created by any of the AWS-managed services (for example, Amazon Aurora Serverless). To delete this type of endpoint, you must determine the AWS-managed service that created the endpoint. After identifying the service, you must first delete that resource before you can delete the endpoint.ResolutionTo verify which AWS-managed service created an endpoint, do the following:If the endpoint was created within 90 daysIf the endpoint was created within 90 days of when you are trying to delete it, use AWS CloudTrail to determine which service created it. Make sure to set the CloudTrail console view to the last 90 days of recorded API activity (management events).To view CloudTrail events, do the following:1.    Open the CloudTrail console.2.    In the navigation pane, choose Event history.3.    From dropdown list select the Resource name, and then add the VPC endpoint ID (for example vpce-xxxxxx) in the filter.4.    Look for the CreateVpcEndpoint API call and check the username. For endpoints created by Aurora Serverless the username displays as RDSAuroraServeless. For endpoints created by Amazon Relational Database Service (Amazon RDS) Proxy, the username displays as RDSSlrAssumptionSession. To identify the endpoints created by AWS Network Firewall, view the event record for the CreateVpcEndpoint API call and check for tags with the key value of Firewall and AWSNetworkFirewallManaged:"Tag": [                  {                        "Value": ""arn:aws:network-firewall:<region>:<account number>:firewall/<firewall name>",                        "tag": 1,                        "Key": "Firewall"                    },                    {                        "Value": true,                        "tag": 2,                        "Key": "AWSNetworkFirewallManaged"                    }If the endpoint is older than 90 daysTo determine if AWS Network Firewall created the endpoint:1.    Open the VPC console, and then select Endpoints.2.    Select the endpoint and then select Tags.3.    Check for the following:The Key is AWSNetworkFirewallManaged and the Value is True.The Key is Firewall and the Value is your  Network Firewall ARN arn:aws:network-firewall:region:account number:firewall/firewall name.You can also view endpoints created by AWS Network Firewall by doing the following:1.    Open the VPC console, and then select Firewalls.2.    Select Firewall details.To determine if Aurora Serverless created the endpoint:If the requestor-managed interface endpoint is created by Aurora Serverless after 90 days, perform a name lookup for the existing Aurora Serverless databases' endpoint. This returns the CNAME as the VPC interface endpoint DNS name. You can use this to confirm if the endpoint was created by Aurora Serverless.For example, you have an interface VPC endpoint with the ID vpce-0013b47d434ae7786 that you can't delete. To verify whether Aurora Serverless created the endpoint, do the following:1.    Perform a name lookup on the Aurora Serverless endpoint:dig test1.proxy-chnis5vssnuj.us-east-1.rds.amazonaws.com +shortvpce-0ce9fdcdd4aa4097e-1hbywnw6.vpce-svc-0b2f119acb23c050e.us-east-1.vpce.amazonaws.com.172.31.4.218172.31.21.822.    Check the CNAME value of the record matching the DNS name of the endpoint that you're trying to delete. This confirms that this endpoint was created by Aurora Serverless.Note: To verify the DNS name of the endpoint, do the following:1.    Open the VPC console and then select Endpoints.2.    Select the Details tab and view the listed DNS names.To determine if RDS Proxy created the endpoint:Complete the preceding steps provided for Aurora Serverless. If there are multiple RDS Proxy and Aurora Serverless endpoints, repeat the steps for each endpoint.To determine if it is Redshift-managed VPC endpoint:1.    Open the Amazon Redshift console, and then choose Configurations.2.    Check if there are any endpoints configured under Redshift-managed VPC endpoints.Delete the serviceAfter identifying the service that created the endpoint, delete the service (and the corresponding endpoint).Delete the network firewall to delete the endpoint created by network firewall.Delete the Aurora Serverless DB cluster.Delete the RDS Proxy to delete the endpoint created by RDS Proxy.Delete the Redshift-managed VPC endpoints using the Redshift console or use the delete-endpoint-access AWS Command Line Interface (AWS CLI) command.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Follow"


Question: I can't sign in because my credentials don't work

"I tried to sign in, but the credentials I used didn't work."

Answer: "I tried to sign in, but the credentials I used didn't work.ResolutionThe following scenarios often cause problems with account credentials:You forgot the credentials for the account.You accidentally use the incorrect credentials to sign in. For example, you use the credentials for the wrong account or AWS Identity and Access Management (IAM) identity.An authorized user changed the credentials. For example, your account administrator updated your IAM credentials.Recovering a forgotten passwordTo recover a password, you must know the email address or account number that's associated with the account. You must also have access to the email address to receive an email with instructions on how to reset the password.For instructions, see How do I recover a lost or forgotten AWS password?Finding the email address for an accountCheck any email addresses you might have used to open an AWS account. Most account-related correspondence from AWS comes from no-reply-aws@amazon.com. If you find correspondence like this, then the email address is probably associated with an AWS account.Ask other members of your team, organization, or family. If someone you know created the account, then they can help you get access.Recovering IAM credentialsContact your account administrator. Your account administrator sets the credentials for each IAM entity on the account.Some IAM identities can update their own passwords. For more information, see How an IAM user changes their own password.Note: AWS Support can't discuss the details of any AWS account other than the account that you're signed in to. AWS Support can't change the credentials associated with an account for any reason.For more information, see Troubleshooting sign-in issues.Receiving account supportIf the previous methods don't work and you still can't access your account, then contact AWS Support with the Amazon Web Services Support form.Related informationWhat do I do if I receive an error when entering the CAPTCHA to sign in to my AWS account?AWS security credentialsManaging user passwords in AWSHow do I remove a lost or broken MFA device from my AWS account?Follow"


Question: How do I access resources in another AWS account using AWS IAM?

I want to assume an AWS Identity and Access Management (IAM) role in another AWS account. How do I set up cross-account access using IAM?

Answer: "I want to assume an AWS Identity and Access Management (IAM) role in another AWS account. How do I set up cross-account access using IAM?Short descriptionYou can set up a trust relationship with an IAM role in another AWS account to access their resources. For example, you want to access the destination account from the source account. To do this, assume the IAM role from the source to destination account by providing your IAM user permission for the AssumeRole API. You must specify your IAM user in the trust relationship of the destination IAM role.Note: You can also assume a role from source IAM role to destination IAM role, instead of using user to role with role chaining. Role chaining works only for programmatic access such as the AWS Command Line Interface (AWS CLI) or API. Role changing can't be used with the AWS Management Console.ResolutionFollow these instructions to create an IAM permission policy for the source account, attach the policy to a user, and then create a role for the destination account.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Source account1.    Create an IAM policy similar to the following:Note: Replace DESTINATION-ACCOUNT-ID and DESTINATION-ROLENAME with your own values.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "sts:AssumeRole"      ],      "Resource": [        "arn:aws:iam::DESTINATION-ACCOUNT-ID:role/DESTINATION-ROLENAME"      ]    }  ]}2.    Attach the IAM policy to your IAM user permissions.Attach the created policy to your IAM user permissions by following the steps here.Destination account1.    Create an IAM role.2.    Paste the custom trust policy similar to the following:Note: Replace SOURCE-ACCOUNT-ID and SOURCE-USERNAME with your own values.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::SOURCE-ACCOUNT-ID:user/SOURCE-USERNAME"      },      "Action": "sts:AssumeRole"    }  ]}Note: If you don’t have access to create and edit IAM roles and users, then get assistance from the account's owner to complete the process. As a best practice, grant access to your account and resources only to the entities that you trust.You can modify this policy to allow the assumption of as many source entities to as many destination roles as needed. For example, you can change the Principal value of the destination account trust policy to "AWS": "SOURCE-ACCOUNT-ID". This allows all entities in the source account with the assume role permissions to assume the destination account role. For more information, see Specifying a principal and Creating or editing the policy.Test your accessTo test your access, follow the instructions for Switching to a role (console).-or-Follow the instructions for Switching to an IAM role (AWS CLI).For more information, see IAM tutorial: Delegate access across AWS accounts using IAM roles.Related informationHow do I assume an IAM role using the AWS CLI?I created or updated an IAM policy and received the error "Has prohibited field Principal". How can I resolve this?How can I provide cross-account access to objects that are in Amazon S3 buckets?Why did I receive an "AccessDenied" or "Invalid information" error trying to assume a cross-account IAM role?Follow"


Question: How do I perform native backups of an Amazon RDS DB instance that's running SQL Server?

"I want to perform a native backup of my user database in my Amazon Relational Database Service (Amazon RDS) DB instance that's running SQL Server. I need to store the backup file in Amazon Simple Storage Service (Amazon S3), or use the database backup file to restore to the same or a different Amazon RDS for SQL Server DB instance."

Answer: "I want to perform a native backup of my user database in my Amazon Relational Database Service (Amazon RDS) DB instance that's running SQL Server. I need to store the backup file in Amazon Simple Storage Service (Amazon S3), or use the database backup file to restore to the same or a different Amazon RDS for SQL Server DB instance.Short descriptionAmazon RDS supports native backup and restore for Microsoft SQL Server databases. You can create a full backup of your on-premises database and store the file in Amazon S3. You can then restore the backup file to an existing Amazon RDS DB instance that's running SQL Server. You can also restore this backup file to an on-premises server or to a different Amazon RDS DB instance that's running SQL Server.ResolutionTo set up a native backup of the SQL Server database, you need the following components:An Amazon S3 bucket to store your backup files.Note: Create the S3 bucket in the same Region as your RDS DB instance.An AWS Identity and Access Management (IAM) role to access the bucketThe SQLSERVER_BACKUP_RESTORE option added to an option group on the DB instanceOpen the Amazon RDS console, and then choose Option Groups in the navigation pane. Choose Create Group, and enter the name, description, engine, and engine version of your server. Then, choose Create.Select the option group that you created, and then choose Add Option. Choose SQLSERVER_BACKUP_RESTORE. It's a best practice to create a new IAM role and then choose Add Option, so that your IAM role has the required privileges. Choose your S3 bucket, or create a new S3 bucket. Then, choose Apply Immediately and Add Option.Associate the option group with the DB instance by choosing Databases in the navigation pane, and then choose the instance to back up. Choose Actions, and then choose Modify.Under Database Options, choose the option group that you created, and then choose Apply Immediately and Continue. Review the information, and then choose Modify DB Instance. This option group modification has no downtime because instance reboot is not required.When the status changes from modifying to available, connect to the DB instance through SQL Server Management Studio using the master user of your RDS instance. Then, choose New Query and enter one of the following SQL statements to initiate the backup of the desired database:Initiate backup for unencrypted databasesexec msdb.dbo.rds_backup_database @source_db_name='database_name', @s3_arn_to_backup_to='arn:aws:s3:::bucket_name/file_name_and_extension', @overwrite_S3_backup_file=1;Initiate backup for encrypted databasesexec msdb.dbo.rds_backup_database @source_db_name='database_name', @s3_arn_to_backup_to='arn:aws:s3:::bucket_name/file_name_and_extension',   @kms_master_key_arn='arn:aws:kms:region:account-id:key/key-id', @overwrite_S3_backup_file=1;Note: Replace database_name, bucket_name, file_name_and_extension, region, account-id, and key-id listed in these examples to match your scenario. You can use the backup file, generated in the S3 bucket, to restore the user database to a new RDS DB instance. When the rds_backup_database or rds_restore_database stored procedure is called, the task starts and outputs the information about the task.When the lifecycle status of the task is SUCCESS, the task is complete. You can then open the Amazon S3 console, choose the bucket in which you created the user database backup, and view the backup file. You can download this file, or use the user database backup file to restore to the same Amazon RDS for SQL Server DB instance or in a new RDS DB instance.Use one of the following SQL statements to restore from the backup file available in the S3 bucket:Restore unencrypted databasesexec msdb.dbo.rds_restore_database @restore_db_name='database_name', @s3_arn_to_restore_from='arn:aws:s3:::bucket_name/file_name_and_extension';Restore encrypted databasesexec msdb.dbo.rds_restore_database @restore_db_name='database_name', @s3_arn_to_restore_from='arn:aws:s3::: bucket_name/file_name_and_extension', @kms_master_key_arn='arn:aws:kms:region:account-id:key/key-id';You can get the Task ID after you perform the backup or restore statement. Or, you can use the following script to identify all the completed and pending tasks for a particular database:exec msdb.dbo.rds_task_status @db_name='database_name'To track the status of the job, use this SQL statement:exec msdb..rds_task_status @task_id= 5For a list of potential errors and solutions, see Migrating Microsoft SQL Server Enterprise workloads to Amazon RDS.Related informationWorking with backupsBacking up and restoring Amazon RDS DB instancesImporting and exporting SQL Server databases using native backup and restoreFollow"


Question: How do I include my dedicated IP address as part of my default IP pool on Amazon SES?

I have dedicated IP addresses on Amazon Simple Email Service (Amazon SES). How can I send my emails using a dedicated IP address from my default IP address pool?

Answer: "I have dedicated IP addresses on Amazon Simple Email Service (Amazon SES). How can I send my emails using a dedicated IP address from my default IP address pool?ResolutionIf you haven't assigned a dedicated IP address to an IP pool, then the dedicated IP address is already included in the default IP pool (named ses-default-dedicated-pool). Additionally, if you don't specify an IP pool in your configuration set, then Amazon SES uses one of the dedicated IP addresses from ses-default-dedicated-pool.To modify an existing configuration set to explicitly specify the use of ses-default-dedicated-pool, follow these steps:Open the Amazon SES console.From the navigation pane, under Email Sending, choose Configuration Sets.Choose the configuration set that you want to associate with ses-default-dedicated-pool.Choose the Sending IP Pool tab. Then, for Pool name, select ses-default-dedicated-pool.Choose Finish.Note the following important considerations for using a configuration set and dedicated IP addresses:For a configuration set to apply to emails, you must pass the name of the configuration set in the email headers. For more information, see Specifying a Configuration Set When You Send Email.It's a best practice to attach the default IP pool to the configuration set only after the dedicated IP addresses are warmed up. Amazon SES automatically warms up your dedicated IP addresses by gradually increasing the number of emails sent from the IP addresses. Or, you can also choose to disable the automatic warm-up process so that you can manually warm up your IP addresses. While the dedicated IP addresses are warming up, avoid sending emails explicitly using the default IP pool associated with a configuration set. This impacts the warm-up process and can result in ISPs throttling emails coming from those IP addresses.Related InformationAssigning an IP Pool to an Existing Configuration SetFollow"


Question: How do I add Python packages with compiled binaries to my deployment package and make the package compatible with Lambda?

"I used pip to install a Python package that contains compiled code, and now my AWS Lambda function returns an "Unable to import module" error. Why is this happening, and how do I resolve the issue?"

Answer: "I used pip to install a Python package that contains compiled code, and now my AWS Lambda function returns an "Unable to import module" error. Why is this happening, and how do I resolve the issue?Short descriptionPython packages that contain compiled code (for example: NumPy and pandas) aren't always compatible with Lambda runtimes by default. If you install these packages using pip, then the packages download and compile a module-name package for the architecture of the local machine. This makes your deployment package incompatible with Lambda if you're not using a Linux operating system.To create a Lambda deployment package or layer that's compatible with Lambda Python runtimes when using pip outside of Linux operating system, run the pip install command with manylinux2014 as the value for the --platform parameter.Note: macOS --platform tags don't work. For example: The win_amd64 and macosx_10_6_intel tags won't install a deployment package that's compatible with Lambda.ResolutionNote: This example procedure shows how to install pandas for the Lambda Python 3.9 runtime that's running on x86_64 architecture.1.    Open a command prompt. Then, confirm that you're using a version of pip that's version 19.3.0 or newer by running the following pip command:pip --versionIf you're using a version of pip that's older than pip version 19.3.0, then upgrade to the latest version of pip by running the following command:python3.9 -m pip install --upgrade pip2.    Install the precompiled Python package's .whl file as a dependency in your Lambda function's project directory by running the following command:Important: Replace my-lambda-function with the name of your function's project directory.pip install \    --platform manylinux2014_x86_64 \    --target=my-lambda-function \    --implementation cp \    --python 3.9 \    --only-binary=:all: --upgrade \    pandas3.    Open your Lambda function's project directory. If you're using macOS, then run the following command:cd my-lambda-function4.    In a text editor, create a new file named lambda_function.py. Then, copy and paste the following example code into the file and save it in your Lambda function's project directory:import numpy as npimport pandas as pddef lambda_handler(event, context):    df2 = pd.DataFrame(np.array([[1, 2, 3], [4, 5, 6], [7, 8, 9]]),columns=["a", "b", "c"])    number = np.pi    print(df2)    print(number)5.    Create a Lambda deployment package .zip file archive that includes all of the installed libraries and source code by running the following command:zip -r ../my-deployment-package.zip .6.    Use the my-deployment-package.zip file archive to either create a new Python 3.9 Lambda function or to update an existing one. For instructions, see Deploy your .zip file to the function in the AWS Lambda Developer Guide.Note: You can use a similar procedure to create a Lambda layer that can be used across multiple functions. For example, the following command creates a new Lambda layer to install pandas for the Lambda Python 3.9 runtime, running on arm64 architecture:pip install \    --platform manylinux2014_aarch64 \    --target=./python/lib/python3.9/site-packages \    --implementation cp \    --python 3.9 \    --only-binary=:all: --upgrade \    pandasRelated informationDeploy Python Lambda functions with .zip file archivesCreating and sharing Lambda layersFollow"