Question: "How do I move my EC2 instance to another subnet, Availability Zone, or VPC?"

"I want to move or copy my Amazon Elastic Compute Cloud (Amazon EC2) instance to another subnet, Availability Zone, or virtual private cloud (VPC)."

Answer: "I want to move or copy my Amazon Elastic Compute Cloud (Amazon EC2) instance to another subnet, Availability Zone, or virtual private cloud (VPC).Short descriptionIt's not possible to move an existing instance to another subnet, Availability Zone, or VPC. Instead, you can manually migrate the instance by creating a new Amazon Machine Image (AMI) from the source instance. Then, launch a new instance using the new AMI in the desired subnet, Availability Zone, or VPC. Finally, you can reassign any Elastic IP addresses from the source instance to the new instance.There are two methods for migrating the instance:Use the AWS Systems Manager automation document AWSSupport-CopyEC2Instance.Manually copy an instance and a launch a new instance from the copy.ResolutionBefore you begin, note the following:AMIs are based on Amazon Elastic Block Store (Amazon EBS) snapshots. For large file systems without a previous snapshot, AMI creation can take several hours. To decrease the AMI creation time, create an Amazon EBS snapshot before you create the AMI.Creating an AMI doesn't create a snapshot for instance store volumes on the instance. For information on backing up instance store volumes to Amazon EBS, see How do I back up an instance store volume on my Amazon EC2 instance to Amazon EBS?The new EC2 instance has a different private IPv4 or public IPv6 IP address. You must update all references to the old IP addresses (for example, in DNS entries) with the new IP addresses that are assigned to the new instance. If you're using an Elastic IP address on your source instance, be sure to attach it to the new instanceDomain security identifier (SID) conflict issues can occur when the copy launches and tries to contact the domain. Before you capture the AMI, use Sysprep or remove the domain-joined instance from the domain to prevent conflict issues. For more information, see How can I use Sysprep to create and install custom reusable Windows AMIs?Use the AWS System Manager automation runbook AWSSupport-CopyEC2InstanceYou can use the AWS Systems Manager Automation runbook AWSSupport-CopyEC2Instance to complete the following tasks automatically:Create a new imageLaunch a new instanceAfter these procedures complete, follow the instructions in Reassign the Elastic IP address section, if needed.To run the automation, do the following:1.    Open the AWSSupport-CopyEC2Instance runbook.Note: Make sure that you're in the same Region as the instance that you want to copy.2.    For Execute automation document, choose Simple execution.3.    For Input parameters, enter the InstanceID of the EC2 instance you want to copy. If you use the Interactive instance picker, then make sure that you select Show all instances from the dropdown list.4.    Provide the destination Region and/or the SubnetID where you want to copy the instance to.5.    Complete any of the additional optional fields that are required for your use case, and then select Execute.6.    To monitor the execution progress, open the Systems Manger console, and then choose Automation from the navigation pane. Choose the running automation, and then review the Executed steps. To view the automation output, expand Outputs.For more information about this runbook, see AWSSupport-CopyEC2Instance.Manually copy the instance and launch a new instance from the copyCreate a new image1.    Open the Amazon EC2 console, and then choose Instances from the left navigation pane.2.    Select the instance that you want to move, and then choose Actions, Instance State, Stop. This makes sure that the data is consistent between the old and new EBS volumes.Note: You can skip this step if you're testing this procedure or if you don't want to stop or reboot your instance.3.    Choose Actions, Image, Create Image.For Image name, enter a name for the image.For Image description, enter a description of the image.Note: If you select No reboot on the Create Image page, then the file system integrity of the image can't be guaranteed.4.    Choose Create Image.5.    Under Create Image request received, choose View pending image [ID]. Wait for the Status to change from pending to available.Note: You can also view pending images by choosing AMIs from the Images section of the navigation pane.Launch a new instance1.    Select the new AMI, and then choose Launch.2.    Choose the same instance type as the instance that you want to move, and then choose Next: Configure Instance Details.For Network, choose your VPC.For Subnet, choose the subnet where you want to launch the new instance.If the instance is a production instance, then for Enable termination protection, choose Protect against accidental termination.3.    Choose Next: Add Storage.4.    Accept the defaults, and then choose Next: Add Tags.For Key, enter Name.For Value, enter your instance name.5.    Choose Next: Configure Security Group.6.    Choose the same security group that's applied to the instance that you're moving.Note: If you're moving your instance between VPCs, you must create a new security group on the destination VPC.7.    Choose Review and Launch.8.    Choose Launch.9.    For Select a key pair, choose your key pair from the drop-down menu.10.  Select the agreement check box, and then choose Launch Instances.11.  Choose the instance ID to return to the EC2 console.Reassign the Elastic IP addressTo reassign the Elastic IP address, you must first disassociate the Elastic IP address from the source instance. Then, you can reassociate the Elastic IP address with the new instance. For instructions, see Disassociate an Elastic IP address.Note: Elastic IP addresses can be used in only one Region. If you move an instance to a different Region, you can't use the same Elastic IP address.Related informationCreate an Amazon EBS-backed Linux AMICreate a custom Windows AMIHow do I create and copy an Amazon Machine Image (AMI) from one AWS Region to another?Follow"


Question: How do I troubleshoot domain transfer failures in Route 53?

I want to troubleshoot domain transfer failures in Amazon Route 53.

Answer: "I want to troubleshoot domain transfer failures in Amazon Route 53.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Troubleshoot failure to transfer a domain from another registrar to Route 53 (transfer in)Before transferring a domain to Route 53, confirm the following:Your current registrar allows the transfer.The domain doesn't have any of the following EPP codes or statuses:clientTransferProhibitedserverTransferProhibitedpendingDeletependingTransferredemptionPeriodRoute 53 supports the top-level domain (TLD) of your domain name.Your AWS account has a valid payment method.Resolve invalid authcode errorsIf there are authcode errors, then you receive the message, "The authorization code that you got from the current registrar is not valid". For next steps, see The authorization code that you got from the current registrar is not valid.Resolve clientTransferProhibited status or domain lock errorsIf transfer lock is turned on with your current registrar, then the transfer-in process fails. Run a whois command to confirm that this is causing your domain transfer failure. For example:$ whois example.com | grep "Status"   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibitedIf you see the serverTransferProhibited status in your whois output, then contact your current registrar for more information.To turn off transfer lock, use your current registrar's console or contact the registrar.Determine why a transfer is stuck on step 5 of the transfer processIn step 5 of the domain transfer process, Amazon Route 53 sends a Form Of Authorization (FOA) to the registrant contact email. You must select the confirmation link in that email. If you didn't receive an FOA email, then see To resend the authorization email for a domain transfer.Note: If you change the registrant email address during the transfer process, then the authorization email might be sent to both the new and previous addresses. You must follow the confirmation link in both emails to proceed.Determine why you didn't receive a domain transfer authorization emailAs part of the domain transfer-in process, Amazon Route 53 sends an authorization email to the domain registrant's email address. You must select the link in that email to verify your email address. Failing to do so might cause your domain to stop working. If you didn't receive the authorization email, then check your email's spam or junk folder. If you still can't find the email, then see To resend the authorization email for a domain transfer.Determine why the status is "Waiting for the current registrar to complete the transfer"If your domain transfer-in request is stuck on step 7, then the status is "Waiting for the current registrar to complete the transfer". For more information on how to check your status, see Viewing the status of a domain transfer.This status indicates that the transfer is waiting on your current registrar's approval. After approval is received, the transfer process can proceed. Depending on your registrar and the requirements of the top-level domain (TLD), this step can take up to 7 days for generic TLDs. The step can take up to ten days for country code TLDs (ccTLDs).Note: You can't expediate this step in Amazon Route 53. However, you might be able to expedite the domain transfer by contacting your current registrar.Troubleshoot failure to transfer a domain from Route 53 to another registrar (transfer out)Resolve "clientTransferProhibited" status errorsThe domain registries for all generic TLDs and several geographic TLDs provide the option to lock your domain. Locking a domain prevents someone from transferring the domain to another registrar without your permission. If you turn on transfer lock for a domain, then the status is updated to "clientTransferProhibited". To remove the status, turn off the transfer lock using the following steps:1.    Open the Route 53 console.2.    In the navigation pane, choose Registered Domains.3.    Select the name of the domain that you plan to update.4.    Under Transfer lock, choose Disable.Or, you can run the following command in the AWS CLI:aws route53domains disable-domain-transfer-lock \    --region us-east-1 \    --domain-name example.comIn the preceding example, replace example.com with your domain name.Unlock "Transfer Lock" or remove "clientTransferProhibited" statusYou tried to unlock a domain from the AWS Management Console or the DisableDomainTransferLock API. However, you received the following error message: "TLDRulesViolation: [TLD] does not support domain lock/unlock operation".To resolve this, determine if the TLD supports transfer locking. If the TLD doesn't support transfer locking but you see a lock icon on your domain, then create a support case. For case type, choose Account and billing support.Transfer domains in closed AWS accountsWhen you close an AWS account, all associated AWS resources are deleted, including hosted zones. However, all domain names are maintained until their expiration date. After deleting your account, you can't modify the configuration of the remaining domain names. In this scenario, you can't update name servers or complete the transfer out process.Create a support case to transfer your domain from the closed account to another AWS account or another registrar. When creating your case, be sure to do the following:Create the support case from the closed account. You can log in to your closed account using the credentials of the AWS account root user.Choose Account and billing support for the case type.Include the domain names that you want to transfer out.Include the destination AWS account number (if transferring to another active AWS account).Troubleshoot failure to transfer a domain from an AWS account to another AWS account (cross-account transfer)To initiate the domain transfer, see To transfer a domain to a different AWS account and To accept a domain transfer from a different AWS account.If you encounter issues when following the steps listed in the preceding documentations, create a support case. For case type, choose Account and billing support.Follow"


Question: Why is no data migrated from my Amazon S3 source endpoint even though my AWS DMS task is successful?

"My AWS Database Migration Service (AWS DMS) task is successful, but no data is migrated from my Amazon Simple Storage Service (Amazon S3) source endpoint. Why isn't my data migrating, and how do I troubleshoot this issue?"

Answer: "My AWS Database Migration Service (AWS DMS) task is successful, but no data is migrated from my Amazon Simple Storage Service (Amazon S3) source endpoint. Why isn't my data migrating, and how do I troubleshoot this issue?Short descriptionThe following are the most common reasons why an AWS DMS task is successful but no data is migrated:The task status is Load complete, replication ongoing, but no data is loaded on the target.The task status is Load complete, replication ongoing, but no table is in the Table statistics section.The task status is Running and the table is created in the target endpoint, but no data is loaded. Also, you receive a No response body error in the replication log.ResolutionThe task status is Load complete, replication ongoing, but no data is loaded on the targetConfirm that the Amazon S3 path defined for the source endpoint is correct. From the replication log, review the log entries. Identify entries that indicate that AWS DMS can't find the data files in the Amazon S3 path that is defined for the source endpoint. See the following example replication log entry:[SOURCE_UNLOAD ]I: Unload finished for table 'dms_schema'.'dms_table' (Id = 1). 0 rows sent. (streamcomponent.c:3396)[TARGET_LOAD ]I: Load finished for table 'dms_schema'.'dms_table' (Id = 1). 0 rows received. 0 rows skipped. Volume transferred 0. (streamcomponent.c:3667)In Amazon S3, the data file for the full load phase (data.csv) and the data file for on-going changes (change_data.csv) are stored like this:S3-bucket/dms-folder/sub-folder/dms_schema/dms_table/data.csvS3-bucket/dms-folder/sub-folder/dms-cdc-path/dms-cdc-sub-path/change_data.csvThe Amazon S3 source endpoint uses three important fields to find the data files:Bucket folderChange data capture (CDC) pathTable structureIn the example file paths listed previously, dms-folder/sub-folder is the Bucket folder. The CDC path that you enter when creating the Amazon S3 source endpoint is dms-cdc-path/dms-cdc-sub-path. The following example Table structure uses the same example file path listed previously:{  "TableCount": 1,  "Tables": [    {      "TableColumns": […],      "TableColumnsTotal": "1",      "TableName": "dms_table",      "TableOwner": "dms_schema",      "TablePath": "dms_schema/dms_table/"    }  ]}Important: Don't include the bucket folder path ( dms-folder/sub-folder) in the TablePath of the table structure.When specifying your Endpoint configuration, consider the following:The bucket folder is optional. If a bucket folder is specified, then the CDC path and table path (the TablePath field for a full load) must be in the same folder in Amazon S3. If the bucket folder isn't specified, then the TablePath and CDC path are directly under the S3 bucket.The Bucket folder field of the Amazon S3 source endpoint can be any folder directory between the S3 bucket name and the schema name of the table structure. In the previous example, it's dms-schema. If you don't have a hierarchy of folders under the S3 bucket, then you can leave the fields blank.Bucket folders or CDC paths can be individual folders or they can include subfolders, such as dms-folder or dms-folder/sub-folder.If your DMS task setting uses Amazon S3 as the source endpoint, then you must include the schema and table in the table mapping. This is required to successfully migrate data to the target. For more information, see Source data types for Amazon S3.If you use Drop tables on target as the table preparation mode for the task, then DMS creates the target table dms_schema.dms_table. See the following example:CREATE TABLE 'dms_schema'.'dms_table' (...);Note: Folder and object names in Amazon S3 are case-sensitive. Be sure to specify both folder and object names with correct case in the S3 endpoint.The task status is Load complete, replication ongoing, but no table is in the Table statistics sectionYou might find that no table was created in the target endpoint when Drop tables on target was used. This means that the issue might be caused by the table structure that is specified for the Amazon S3 source endpoint.Confirm that the Amazon S3 path for the source endpoint is correct, as described previously. Then, verify that your data type is supported by the Amazon S3 endpoint.After confirming that the Amazon S3 path is correct and that your data type is supported, check the filter that is defined by the table mapping of your DMS task. Check to see if the filter is the cause of the missing tables. Review the table that is needed within the task table mapping and check that the table is defined in the table structure of the Amazon S3 source endpoint.The task status is Running and the table is created in the target endpoint, but no data is loaded. Also, you receive a No response body error in the replication logIf AWS DMS can't get the content from the Amazon S3 path, you can find errors in the replication log. See the following examples:[SOURCE_CAPTURE ]E: No response body. Response code: 403 [1001730] (transfer_client.cpp:589)[SOURCE_CAPTURE ]E: failed to download file </dms-folder/sub-folder/dms_schema/dms_table/data.csv> from bucket <dms-test> as </rdsdbdata/data/tasks/NKMBA237MEB4UFSRDF5ZAF3EZQ/bucketFolder/dms-folder/sub-folder/dms_schema/dms_table/data.csv>,                status = 4 (FAILED) [1001730] (transfer_client.cpp:592)This error occurs when the AWS Identity and Access Management (IAM) role for the Amazon S3 source endpoint doesn't have the correct permissions: s3:GetObject. To resolve this error, confirm that the data file exists in the Amazon S3 path that is in the error message. Then, confirm that the IAM user has permissions for s3:GetObject.Note: If the source Amazon S3 bucket has versioning enabled, additional s3:GetObjectVersion permissions is required.Related informationUsing Amazon S3 as a source for AWS DMSFollow"


Question: How can I require MFA authentication for IAM users that use the AWS CLI?

"I created a multi-factor authentication (MFA) condition policy to restrict access to AWS services for AWS Identity and Access Management (IAM) users. The policy works with the AWS Management Console, but not with the AWS Command Line Interface (AWS CLI). How can I use MFA with the AWS CLI?"

Answer: "I created a multi-factor authentication (MFA) condition policy to restrict access to AWS services for AWS Identity and Access Management (IAM) users. The policy works with the AWS Management Console, but not with the AWS Command Line Interface (AWS CLI). How can I use MFA with the AWS CLI?Short descriptionThe following example IAM policy requires IAM users to use MFA to access specific AWS services:{  "Sid": "BlockMostAccessUnlessSignedInWithMFA",  "Effect": "Deny",  "NotAction": [    "iam:CreateVirtualMFADevice",    "iam:DeleteVirtualMFADevice",    "iam:ListVirtualMFADevices",    "iam:EnableMFADevice",    "iam:ResyncMFADevice",    "iam:ListAccountAliases",    "iam:ListUsers",    "iam:ListSSHPublicKeys",    "iam:ListAccessKeys",    "iam:ListServiceSpecificCredentials",    "iam:ListMFADevices",    "iam:GetAccountSummary",    "sts:GetSessionToken"  ],  "Resource": "*",  "Condition": {    "Bool": {      "aws:MultiFactorAuthPresent": "false",      "aws:ViaAWSService": "false"    }  }}IAM users with the AWS Management Console are prompted to enter MFA authentication credentials and can then access AWS services. However, IAM users with the AWS CLI aren't prompted to enter MFA authentication credentials and can access AWS services.ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.The MultiFactorAuthPresent key doesn't exist in requests made using long-term credentials. With the Boolean condition operator, if the key in the policy isn't present, then the values don't match. The MultiFactorAuthPresent key doesn't deny access to requests made using long-term credentials.IAM users using the AWS Management Console generate temporary credentials and allow access only if MFA is used.The Boolean condition lets you restrict access with a key value set to true or false. You can add the IfExists condition operator to check if the MultiFactorAuthPresent key is present in the request. If the MultiFactorAuthPresent key isn't present, IfExists evaluates the condition element as true similar to the following:"Effect" : "Deny","Condition" : { "BoolIfExists" : { "aws:MultiFactorAuthPresent" : "false", "aws:ViaAWSService":"false"} }Note: IAM users using the AWS CLI with long-term credentials are denied access and must use MFA to authenticate. Therefore, be sure to use an MFA token to authenticate your CLI session.Related informationUsing multi-factor authenticationAssumeRoleEnabling and managing virtual MFA devices (AWS CLI or AWS API)Follow"


Question: How can I create a layer for my Lambda Python function?

I want to create a layer for my AWS Lambda Python function.

Answer: "I want to create a layer for my AWS Lambda Python function.ResolutionThe following instructions deploy an application to create a layer to invoke a Lambda Python function.Open the AWS Serverless Application Repository console.In the navigation pane, choose Available applications.Select Show apps that create custom IAM roles or resource policies.In the search pane, enter python-lambda-layer-creation.Choose the python-lambda-layer-creation function.From the python-lambda-layer-creation Applications settings, select I acknowledge that this app creates custom IAM roles, and then choose Deploy.You can create a layer to invoke your Lambda function and pass a list of dependencies included with the layer metadata.The following example creates Python Lambda layers containing requests (latest version), numpy (version 1.20.1), and keyring (version >= 4.1.1) libraries. You can invoke the Lambda function with a payload similar to the following:{  "dependencies": {     "requests": "latest",    "numpy": "== 1.20.1",    "keyring": ">= 4.1.1"   },   "layer": {      "name": "a-sample-python-lambda-layer",     "description": "this layer contains requests, numpy and keyring libraries",     "compatible-runtimes": ["python3.6","python3.7","python3.8"],     "license-info": "MIT"   } }To test the Lambda Python function layer, note the ARN. Then, create an AWS CloudFormation stack using a YAML template similar to the following:AWSTemplateFormatVersion: '2010-09-09'Parameters:  Layer:    Type: String    Description: The ARN of the lambda function layerResources:  LambdaFunction:    Type: AWS::Lambda::Function    Properties:      Code:        ZipFile: |          import json          import requests          import numpy as np          def handler(event, context):            try:                ip = requests.get("http://checkip.amazonaws.com/")                x = np.array([2,3,1,0])            except requests.RequestException as e:                raise e            return {                "statusCode": 200,                "body": json.dumps({                    "array[0]": ("%s" % str(x[0])),                    "location": ip.text.replace("\n", "")                }),            }      Handler: index.handler      Runtime: python3.7      MemorySize: 128      Timeout: 30      Layers:        - !Ref Layer      Role:        Fn::GetAtt:        - LambdaExecutionRole        - Arn  LambdaExecutionRole:    Description: Allow Lambda to connect function to publish Lambda layers    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Statement:        - Effect: Allow          Principal:            Service:            - lambda.amazonaws.com          Action: sts:AssumeRole      Path: /      ManagedPolicyArns:      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole      # Policies:      # - PolicyName: AllowPublishLambdaLayer      #   PolicyDocument:      #     Version: '2012-10-17'      #     Statement:      #     - Effect: Allow      #       Action: lambda:PublishLayerVersion      #       Resource: '*'Run the Lambda Python function. Example response:{  "statusCode": 200,  "body": "{\"array[0]\": \"2\", \"location\": \"[your-outbound-ip-address]\"}"}Note: This Lambda function uses pip to manage dependencies so that libraries included in the Lambda layer exist in the Python package index repository.For examples of Python libraries included in the layer defined for the dependencies and layer attributes, see pip install on the pip website.For more information, see Creating and sharing Lambda layers.Related informationBuilding Lambda functions with PythonUsing layers with your Lambda functionHow do I create a Lambda layer using a simulated Lambda environment with Docker?How do I integrate the latest version of the AWS SDK for JavaScript into my Node.js Lambda function using layers?Follow"


Question: How can I send custom HTTP responses for specific URLs from an Application Load Balancer?

I want to forward custom HTTP responses and drop client requests for specific URLs. How can I send custom HTTP responses for specific URLs from an Application Load Balancer?

Answer: "I want to forward custom HTTP responses and drop client requests for specific URLs. How can I send custom HTTP responses for specific URLs from an Application Load Balancer?ResolutionYou can use fixed-response actions to drop client requests and return a custom HTTP response. You can use this action to return a 2XX, 4XX, or 5XX response code and an optional message.To add a rule with a fixed-response action on your Application Load Balancer's listener:Open the Amazon Elastic Compute Cloud (Amazon EC2) console.On the navigation pane, from LOAD BALANCING, choose Load Balancers.Select your load balancer and choose the Listenerstab.Choose View/edit rules.Choose Add rules(the plus sign) in the menu bar. This action allows you to add Insert Ruleicons at every location where you can insert a rule in the priority order.Define the rule as follows:Choose Insert Rule.(Optional) To configure host-based routing, choose Add condition, Host is. Enter the hostname (for example, *.example.com), and then choose the check mark.(Optional) To configure path-based routing, choose Add condition, Path is. Enter the path pattern (for example, /img/*), and then choose the check mark.To add a fixed-response action, choose Add action, Return fixed response. Enter a response code and optional response body, and then choose the check mark.(Optional) To change the order of the rule, use the arrows. The default rule always has the last priority.Choose Save.Related InformationListener RulesFollow"


Question: How do I migrate an EC2-Classic instance to a VPC in same Region of same account?

I have multiple Amazon Elastic Compute Cloud (Amazon EC2) instances in EC2-Classic. I want to migrate the EC2-Classic instances to a virtual private cloud (VPC) before EC2-Classic is no longer available.

Answer: "I have multiple Amazon Elastic Compute Cloud (Amazon EC2) instances in EC2-Classic. I want to migrate the EC2-Classic instances to a virtual private cloud (VPC) before EC2-Classic is no longer available.ResolutionYou can use the AWSSupport-MigrateEC2ClassicToVPC Automation document to migrate your EC2-Classic instances to a VPC in the same Region of the same AWS account. The runbook supports only EC2-Classic instances with a virtualization type of HVM and a root volume type of EBS.Before using this Automation document, verify the service quotas for the following resources in the VPC:Elastic IP addressesEC2 instancesSecurity groupsIf necessary, increase the quotas before running the Automation. For more information about how to request a quota increase, see AWS service quotas.Note: AWS is retiring EC2-Classic. For more information, see EC2-Classic Network is retiring - Here's how to prepare.Migrate an EC2-Classic instance to a VPCOpen the AWS Systems Manager console, and then choose Automation from the navigation pane.Choose Execute automation.On the Owned by Amazon tab, in the Automation document search box, enter MigrateEC2Classic.Select the radio button for the AWSSupport-MigrateEC2ClassicToVPC document, and then choose Next.Under Input parameters, for InstanceId, enter your source EC2-Classic instance ID.For AutomationAssumeRole and TargetInstanceType, choose your required parameters. By default, TargetInstanceType is set to t2.xlarge.Note:: For more information about the AWS Identity and Access Management (IAM) permissions that are required for AutomationAssumeRole to successfully run the Automation, see AWSSupport-MigrateEC2ClassicToVPC.(Optional) For DestinationSubnetId and DestinationSecurityGroupId, enter your subnet ID and VPC security group ID.Note:: If these fields are left blank, then the Automation selects a random subnet in the default VPC. Security groups that are attached to the source instance are copied to the VPC and used to launch the target instance.For MigrationType, select Test or CutOver.If you select CutOver for MigrationType, then set the following parameters:SNSNotificationARNForApproval: Enter the ARN of the SNS topic used to send Approval notifications to stop the source instance.ApproverIAM: Enter the ARN of the IAM users or roles that can approve or reject the action to stop the source instance.Choose Execute.Related informationMigrate from EC2-Classic to a VPCFollow"


Question: How can I set my Amazon Connect outbound caller ID dynamically based on country?

I want my Amazon Connect outbound caller ID to change dynamically based on a call recipient's country. How can I set that up?

Answer: "I want my Amazon Connect outbound caller ID to change dynamically based on a call recipient's country. How can I set that up?Short descriptionTo have your Amazon Connect outbound caller ID change dynamically based on a call recipient's country, do the following:Create a caller ID list in JSON format.Upload the caller ID list to an Amazon Simple Storage Service (Amazon S3) bucket.Create an AWS Lambda function that identifies the outbound contact's country code and selects a corresponding phone number from the caller ID list.Add the Lambda function to your Amazon Connect instance.Create an outbound whisper flow to invoke the Lambda function.Configure the default outbound queue in your agents' routing profile to use the outbound whisper flow.Note: You can customize this solution for your use case. For example, you can store your caller ID list in an Amazon DynamoDB table instead of an S3 bucket. Then, reconfigure the Lambda function and its execution role accordingly.ResolutionCreate a caller ID list in JSON formatCreate a JSON file that contains a country-based list of phone numbers that you want to use for your outbound caller ID.As you create your caller ID list, keep in mind the following:Your outbound caller ID phone number doesn't have to be from the country that you're calling from.For this example setup, the country codes on your list must follow the ISO 3166-1 alpha-2 standard, and the phone numbers must follow the E.164 standard. For more information, see ISO 3166 — COUNTRY CODES on the ISO website and E.164 : The international public telecommunication numbering plan on the ITU website.If the Lambda function fails to invoke during call routing, then Amazon Connect uses the queue's default outbound phone number for the caller ID instead. The default outbound phone number is the number configured in the queue settings in your Amazon Connect instance. For more information, see Set up outbound caller ID.Example JSON caller ID listsIn this first example caller ID list, Amazon Connect uses the following outbound caller IDs:+12345678901 when calling a customer with a United States ("US") phone number.+441234567890 when calling a customer with a United Kingdom ("GB") phone number.+19876543210 when calling a customer with a phone number in a country that's not listed in the caller ID list ("Default").{    "US": "+12345678901",    "GB": "+441234567890",    "Default": "+19876543210"}In this second example caller ID list, Amazon connect uses the following outbound caller IDs:+441234567890 when calling a customer with a phone number in the United Kingdom ("GB"), France ("FR"), Germany ("DE"), or Ireland ("IE").+19876543210 when calling a customer with a phone number in a country that's not listed in the caller ID list ("Default").{    "GB": "+441234567890",    "FR": "+441234567890",    "DE": "+441234567890",    "IE": "+441234567890",    "Default": "+19876543210"}Upload the caller ID list to an Amazon S3 bucketFollow the instructions in Uploading objects in the Amazon S3 User Guide.Create an AWS Lambda function that identifies the outbound contact's country code and selects a corresponding phone number from the caller ID listCreate a Lambda execution roleFollow the instructions in Creating an execution role in the IAM console.As you configure the execution role, keep in mind the following:Your Lambda function's execution role must have Amazon S3 read access to read the JSON object that you uploaded to an S3 bucket.You can create an execution role in the AWS Identity and Access Management (IAM) console, and then attach the AWS managed policy AmazonS3ReadOnlyAccess to the role.Note: You can limit the execution role's access to a particular S3 bucket by creating your own IAM policy. For an example policy, see Amazon S3: Allows read and write access to objects in an S3 bucket.Create a Lambda functionCreate a Lambda function using the execution role that you created in the previous step.In your function code, include logic that checks an incoming JSON request from Amazon Connect. For more information, see How to reference contact attributes. Also, the example JSON request to a Lambda function in the Amazon Connect Administrator Guide.Note: As an example, you can use the Python function from DynamicOutboundCallerID on the aws-support-tools GitHub repository. The function code works with the Python 3.6 (or later) runtime. If you use the example function code, then you must configure the following environment variables in your function:BUCKET_NAME: The name of the S3 bucket where the JSON object is stored.COUNTRY_ROUTING_LIST_KEY: The key from the JSON file stored in the S3 bucket.For example, if the JSON object is stored in s3://hello/world/list.json, then the environment variables would be the following:BUCKET_NAME: "hello"COUNTRY_ROUTING_LIST_KEY: "world/list.json"Create a Lambda deployment package for the Lambda runtime that you're usingFollow the instructions in Lambda deployment packages.Note: The example Python function from DynamicOutboundCallerID uses the phonenumbers Python library. For more information, see phonenumbers on the Python Package Index (PyPI) website.To include a third-party library in your function, you must create a deployment package. You can create the deployment package by running the following commands in the folder that contains lambda_function.py:$ pip install phonenumbers --target ./$ zip -r9 function.zip ./These commands are valid for Linux, Unix, and macOS operating systems only.For more information on deploying Python Lambda functions, see Deploy Python Lambda functions with .zip file archives.Add the Lambda function to your Amazon Connect instanceFollow the instructions in Add a Lambda function to your Amazon Connect instance.Create an outbound whisper flow to invoke the Lambda functionCreate an outbound whisper flowIf you haven't already, create an outbound whisper contact flow.Important: To create and edit a contact flow, you must log in to your Amazon Connect instance as a user that has sufficient permissions in their security profile.1.    Log in to your Amazon Connect instance at https://instance_name.my.connect.aws/.Note: Replace instance_name with your instance's alias.2.    In the left navigation pane, hover over Routing, and then choose Contact flows.3.    On the Contact flows page, choose the arrow icon next to Create contact flow, and then choose Create outbound whisper flow.4.    In the contact flow designer, for Enter a name, enter a name for the contact flow.5.    Choose Save.For more information, see Create a new contact flow.Add an Invoke AWS Lambda function block1.    In the contact flow designer, choose Integrate.2.    Drag and drop an Invoke AWS Lambda function block onto the canvas.3.    Choose the block title (Invoke AWS Lambda function). The block's settings menu opens.4.    Under Function ARN, choose Select a function, and then choose the Lambda function that you added to your instance.5.    (Optional) For Timeout (max 8 seconds), enter a number of seconds that Amazon Connect waits to get a response from Lambda before timing out.6.    Choose Save.Note: When Amazon Connect invokes your Lambda function, the function returns a JSON response similar to the following:{    "customer_number": "<Customer's phone number that you're calling>",    "customer_country": "<Country of the customer's phone number>",    "outbound_number": "<Outbound phone number that Lambda loads from Amazon S3 and sends to Amazon Connect>",    "outbound_country": "<Country of the outbound phone number that Lambda sends to Amazon Connect>",    "default_queue_outbound_number": "<Default outbound phone number set up for the queue>",    "default_queue_outbound_country": "<Country of the default outbound phone number>"}For more information, see Invoke a Lambda function from a contact flow and Contact Block: Invoke AWS Lambda function.Add a Call phone number blockConfigure this block to use the outbound_number from Lambda as the caller ID phone number.1.    In the contact flow designer, choose Interact.2.    Drag and drop a Call phone number block onto the canvas.3.    Choose the block title (Call phone number). The block's settings menu opens.4.    Do the following:Select the Caller ID number to display (optional) check box.Choose Use attribute.For Type, choose External.For Attribute, enter outbound_number.5.    Choose Save.For more information, see Contact Block: Call phone number.Finish the contact flow1.    Add and connect more contact blocks as needed for your use case. For example use cases, see Sample contact flows.2.    Connect all the connectors in your contact flow to a block. Be sure to connect the Success node of the Invoke AWS Lambda function block to the Call phone number block. Be sure to also connect the Success node of the Call phone number block to an End flow / Resume block. You must use at least these blocks. For example: Entry point > Invoke AWS Lambda function > Call phone number > End flow / Resume.3.    To save a draft of the flow, choose Save.4.    To activate the flow, choose Publish.Configure the default outbound queue in your agents' routing profile to use the outbound whisper flowIn your agents' routing profile, identify the default outbound queue.Edit the queue by doing the following:1.    In your Amazon Connect instance, in the left navigation pane, hover over Routing, and then choose Queues.2.    On the Queues page, choose the name of the queue that you identified as the default outbound queue.3.    On the Edit queue page, for Outbound whisper flow (optional), search for and choose the name of the outbound whisper flow that you created.4.    Choose Save.For more information, see Create a routing profile and RoutingProfile object.Related informationBest practices for Amazon ConnectCreating and sharing Lambda layersHow routing worksHow do I troubleshoot Lambda function failures?Follow"


Question: How do I resolve the "HIVE_PATH_ALREADY_EXISTS" exception when I run a CTAS query in Amazon Athena?

"When I run a CREATE TABLE AS SELECT (CTAS) query in Amazon Athena, I get the exception: "HIVE_PATH_ALREADY_EXISTS: Target directory for table"."

Answer: "When I run a CREATE TABLE AS SELECT (CTAS) query in Amazon Athena, I get the exception: "HIVE_PATH_ALREADY_EXISTS: Target directory for table".ResolutionIf you use the external_location parameter in the CTAS query, then be sure to specify an Amazon Simple Storage Service (Amazon S3) location that's empty. The Amazon S3 location that you use to store the CTAS query results must have no data. When you run your CTAS query, the query checks that the path location or prefix in the Amazon S3 bucket has no data. If the Amazon S3 location already has data, the query doesn't overwrite the data.To use the Amazon S3 location that has data in your CTAS query, delete the data in the key prefix location in the bucket. Otherwise, your CTAS query fails with the exception "HIVE_PATH_ALREADY_EXISTS".If an existing Athena table is pointing to the Amazon S3 location that you want to use in your CTAS query, then do the following:Drop the Athena table.Delete the data in the key prefix location of the S3 bucket.Related informationCTAS table propertiesConsiderations and limitations for CTAS queriesFollow"


Question: How do I resolve the "RequestError: send request failed caused by: Post https://ssm.RegionID.amazonaws.com/: dial tcp IP:443: i/o timeout" SSM Agent log error?

"I'm trying to register my Amazon Elastic Compute Cloud (Amazon EC2) instance as a managed instance with AWS Systems Manager. However, the instance fails to register and I receive a TCP timeout error message."

Answer: "I'm trying to register my Amazon Elastic Compute Cloud (Amazon EC2) instance as a managed instance with AWS Systems Manager. However, the instance fails to register and I receive a TCP timeout error message.Short descriptionThe TCP timeout error indicates that one of the following issues is preventing the instance from registering:The instance is in a private subnet and uses the Systems Manager virtual private cloud (VPC) endpoint and a custom DNS server.The instance is in a private subnet and doesn't have access to the internet or to the Systems Manager endpoints.The instance is in a public subnet. The VPC security groups and network access control lists (network ACLs) aren't configured to allow outbound connections to the Systems Manager endpoints on port 443.The instance is behind a proxy, but SSM Agent isn't configured to communicate through an HTTP proxy and can't connect to the instance metadata server.You can view the TCP timeout error in the SSM Agent log on your instance located at the following paths:Linux and macOS/var/log/amazon/ssm/amazon-ssm-agent.log/var/log/amazon/ssm/errors.logWindows%PROGRAMDATA%\Amazon\SSM\Logs\amazon-ssm-agent.log%PROGRAMDATA%\Amazon\SSM\Logs\errors.logResolutionInstance in private subnet using Systems Manager endpoint and a custom DNSVPC endpoints only support Amazon-provided DNS through Amazon Route 53. To use your own DNS server, try one of the following:Use the conditional forwarder in your custom DNS server to forward any query for the domain amazonaws.com to the default VPC DNS resolver. For more information, see DHCP options sets.Set up the Route 53 resolver to resolve the DNS queries between the VPC and your network.Instance can't connect to the Systems Manager endpoints-or-VPC security groups and network ACL aren't configured to allow outbound connections on port 443-or-The instance is behind a proxy and can't connect to the instance metadata serviceFor troubleshooting steps, see Why is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?Related informationCreate VPC endpointsFollow"


Question: How do I resolve the "Resource timed out waiting for creation of physical resource" error when I create a resource using my resource provider type in CloudFormation?

"When I use my Resource Provider type to create a resource in AWS CloudFormation, I receive the following error:"Resource timed out waiting for creation of physical resource""

Answer: "When I use my Resource Provider type to create a resource in AWS CloudFormation, I receive the following error:"Resource timed out waiting for creation of physical resource"Short descriptionWhen a resource doesn't return its primaryIdentifier or Physical ID within 60 seconds, you receive the "Resource timed out waiting for creation of physical resource" error. This error occurs because the CreateHandler of your resource doesn't return the property that's specified as the primaryIdentifier in the organization-service-resource.json resource provider schema file.For other errors that are related to using a resource provider, see the following articles:How do I resolve the "Resource specification is invalid" error when I run the cfn generate command using the CloudFormation CLI in CloudFormation?How do I resolve the "Model validation failed (#: extraneous key [Key] is not permitted)" error in CloudFormation?How do I resolve the "Attribute 'Key' does not exist" error when I use the Fn::GetAtt function on my resource provider resource in CloudFormation?How do I resolve the "java.lang.ClassNotFoundException: com.example.package.resource.HandlerWrapper" error in CloudFormation?Resolution1.    In your organization-service-resource.json file, confirm that the primaryIdentifier definition uses the following format, where Id is a property that's defined in the properties section:"primaryIdentifier": [    "/properties/Id"]Note: The organization-service-resource.json format is located in the root directory of your project.2.    In your CreateHandler, set the primaryIdentifier property in the model object. For example:final ResourceModel model = request.getDesiredResourceState();model.setId("abcdxyz");return ProgressEvent.<ResourceModel, CallbackContext>builder()    .resourceModel(model)    .status(OperationStatus.SUCCESS)    .build();Related informationAWS CloudFormation CLI (from the GitHub website)Follow"


Question: How can I access an internal load balancer using VPC peering?

I want to connect to a load balancer in VPC A from my instance in VPC B. How can I access an internal load balancer using VPC peering?

Answer: "I want to connect to a load balancer in VPC A from my instance in VPC B. How can I access an internal load balancer using VPC peering?Short descriptionTo access an internal load balancer in VPC A from VPC B:Establish connectivity between VPC A and VPC B using VPC peering.Establish the necessary routes, security group rules, and network access control list (ACL) rules to allow traffic between the VPCs.ResolutionUsing VPC peering, you can access internal load balancers (including Classic Load Balancers, Application Load Balancers, and Network Load Balancers) from another VPC.Establish connectivity between your VPCs using VPC peering.Note: VPC peering is available for intra-Region and inter-Region connectivity for local or cross-account VPCs.Verify that a route for the load balancer's subnets CIDR (or VPC CIDR) exists in the route table of the client subnet. The route must be directed towards the VPC peering ID of your VPCs. Similarly, verify that the route of the client subnet/VPC CIDR exists in the route table of the load balancer's subnets.Resolve the load balancer DNS name from your instance and use nslookup  to verify it.If you're using a Classic Load Balancer or an Application Load Balancer: verify that the security group and network ACL allow traffic from either the complete subnet/VPC of the instance or the specific instance IP:In the security group of the load balancer, allow only inbound traffic on the load balancer's listener port.For the network ACL of the subnet, allow ingress traffic from the instance IP or subnet/VPC for the load balancer's listener port. In egress, be sure that the Ephemeral port range (1024 to 65535) allows return traffic from the load balancer nodes to the instance.-or-If you're using a Network Load Balancer, ensure that the traffic is allowed in the security group of the target instancesNote: Modify your security groups or network ACLs, as needed. If you haven't modified the network ACLs, there's a default rule to allow all (0.0.0.0/0) traffic. In this case, you don't need to modify the network ACLs. However, it's an AWS security best practice to allow traffic to and from specific CIDR ranges.Check that the security group of the instance permits outbound traffic to the load balancer associated with the subnets or default (0.0.0.0/0).For the network ACL of the subnet, verify that there’s a rule in Egress to allow traffic for the load balancer's subnets on the load balancer's listener port. In Ingress, verify that there’s a rule to allow traffic to the instance IP/subnet on Ephemeral ports for response traffic .Note: If you haven't modified these default settings, you don't need to make any changes to the default outbound rule (0.0.0.0/0) for the security group or the default ALLOW ALL rule for the network ACL of the subnet with the instance. However, it's an AWS security best practice to allow traffic to and from specific CIDR ranges.Follow"


Question: How can I set up Amazon SES bounce notifications using an Amazon SNS topic?

I want to get notifications whenever emails that I send using Amazon Simple Email Service (Amazon SES) result in a bounce. How can I set up these notifications using Amazon Simple Notification Service (Amazon SNS)?

Answer: "I want to get notifications whenever emails that I send using Amazon Simple Email Service (Amazon SES) result in a bounce. How can I set up these notifications using Amazon Simple Notification Service (Amazon SNS)?ResolutionBefore you begin, complete the Amazon SES verification process for the identity (domain or email address) that you want to get bounce notifications for.Create a topic and subscription in Amazon SNSOpen the Amazon SNS console.In the navigation pane, choose TopicsChoose Create topic.For Name, enter a name to create a unique identifier for your topic.For Display name, enter a display name for your topic.Choose Create topic.From the details page of the topic that you created, navigate to Subscriptions, and then choose Create subscription.For Protocol, select Email-JSON.For Endpoint, enter the email address where you want to receive notifications.Choose Create subscription.From the inbox of the email address that you specified in step 8, open the subscription confirmation email from Amazon SNS with the subject line AWS Notification - Subscription Confirmation.In the subscription confirmation email, open the URL specified as SubscribeURL to confirm your subscription.Configure Amazon SES to send bounce information to Amazon SNSOpen the Amazon SES console.In the navigation pane, choose Verified identities. Then, select the verified domain or email address that you want to get bounce notifications for.Select the Notifications tab, and then choose Edit in the Feedback notifications panel.Under Configure SNS Topics, for Bounce Feedback, select the SNS topic that you created.Note: You can choose to turn on notifications for Complaints and Deliveries. You can publish multiple event types to the same SNS topic or to different SNS topics.Select Include original headers if you want the Amazon SNS notifications to contain the original headers of the emails that you send using Amazon SES.Choose Save Config.Note: It might take a few minutes for your newly configured notification settings to take effect.Test the bounce notifications using the Amazon SES mailbox simulatorNote: The bounces from the mailbox simulator address aren't counted as part of your account's bounce metrics.Open the Amazon SES console.In the navigation pane, choose Verified identities. Then, select the verified domain or email address that you want to set up bounce notifications for.Choose Send a Test Email.From drop-down list under Scenario, select Bounce. Then, complete the rest of the form with the values that you want for the test email.Choose Send Test Email.Open the inbox for the email address that you set as the endpoint of the SNS topic. Confirm that you have an email with the subject line AWS Notification Message that contains the bounce notification.Note: This resolution sets up bounce notifications with Amazon SNS for each verified identity. To get bounce notifications across identities, you can use Amazon SES event publishing. With event publishing, you use a configuration set to specify which emails you receive notifications for. You can use the configuration set for emails sent by different verified identities.Follow"


Question: How do I allow my Lambda function access to my Amazon S3 bucket?

I want my AWS Lambda function to be able to access my Amazon Simple Storage Service (Amazon S3) bucket.

Answer: "I want my AWS Lambda function to be able to access my Amazon Simple Storage Service (Amazon S3) bucket.Short descriptionTo give your Lambda function access to an Amazon S3 bucket in the same AWS account, do the following:1.    Create an AWS Identity and Access Management (IAM) role for the Lambda function that also grants access to the S3 bucket.2.    Configure the IAM role as the Lambda functions execution role.3.    Verify that the S3 bucket policy doesn't explicitly deny access to your Lambda function or its execution role.Important: If your S3 bucket and the functions IAM role are in different accounts, then you must also grant the required permissions on the S3 bucket policy. For more information, see How can I provide cross-account access to objects that are in Amazon S3 buckets?ResolutionCreate an IAM role for the Lambda function that also grants access to the S3 bucket1.    Follow the steps in Creating an execution role in the IAM console.2.    From the list of IAM roles, choose the role that you just created.3.    The trust policy must allow Lambda to assume the execution role by adding lambda.amazonaws.com as a trusted service. Choose the Trust relationships tab, choose Edit trust policy, and replace the policy with the following:{  "Version": "2012-10-17",  "Statement": [    {     "Effect": "Allow",     "Principal": {     "Service": "lambda.amazonaws.com"    },  "Action": "sts:AssumeRole"  } ]}4. Choose Update policy.5.    In the Permissions tab, choose Add inline policy.6.    Choose the JSON tab.7.    Enter a resource-based IAM policy that grants access to your S3 bucket. For more information, see Using resource-based policies for AWS Lambda.The following example IAM policy grants access to a specific Amazon S3 bucket with Get permissions. To access the objects inside the Amazon S3 bucket, make sure to specify the correct path or use a wildcard character ("*"). For more information, see Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket for more information.Important: Replace "arn:aws:s3:::EXAMPLE-BUCKET" with your S3 buckets Amazon Resource Name (ARN).{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExampleStmt",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::EXAMPLE-BUCKET/*"      ]    }  ]}6.    Choose Review policy.7.    For Name, enter a name for your policy.8.    Choose Create policy.Configure the IAM role as the Lambda functions execution role1.    Open the Lambda console.2.    Choose your Lambda function.3.    Under Execution role, for Existing role, select the IAM role that you created.4.    Choose Save.Verify that the S3 bucket policy doesn't explicitly deny access to your Lambda function or its execution roleTo review or edit your S3 bucket policy, follow the instructions in Adding a bucket policy by using the Amazon S3 console.Important: If your S3 bucket and the functions IAM role are in different accounts, you must also explicitly grant the required permissions on the S3 bucket policy. For more information, see How can I provide cross-account access to objects that are in Amazon S3-buckets?The following example IAM S3 bucket policy grants a Lambda execution role cross-account access to an S3 bucket.Important: Replace "arn:aws:s3:::EXAMPLE-BUCKET/*" with your S3 buckets ARN. Replace "arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012" with your Lambda execution roles ARN.{  "Id": "ExamplePolicy",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExampleStmt",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::EXAMPLE-BUCKET/*"      ],      "Principal": {        "AWS": [          "arn:aws:iam::123456789012:role/ExampleLambdaRoleFor123456789012"        ]      }    }  ]}Related informationAWS Policy GeneratorFollow"


Question: How do I optimize costs with Amazon DynamoDB?

I want to optimize the cost of my Amazon DynamoDB workloads.

Answer: "I want to optimize the cost of my Amazon DynamoDB workloads.Short descriptionUse these methods to optimize the cost of your DynamoDB workloads:Use the AWS Pricing Calculator to estimate DynamoDB costs, in advance.Optimize read/write costs by selecting the correct capacity mode.Optimize storage costs by selecting the correct table class.Use cost allocation tags.ResolutionUse the AWS Pricing Calculator to estimate DynamoDB costsUse the AWS Pricing Calculator for DynamoDB to estimate the cost of your DynamoDB workloads before you build them. This includes the cost of features such as on-demand capacity mode, backup and restore, Amazon DynamoDB Streams, and Amazon DynamoDB Accelerator (DAX).Optimize read/write cost by choosing the correct capacity mode for your DynamoDB tableOn-demand capacity modeOn-demand capacity mode is a good option if you have unpredictable application traffic. With on-demand mode, you pay only for what you use.If you configured a table as provisioned capacity mode, then you're charged for provisioned capacities even if you haven't consumed any I/O. So, if you have unused DynamoDB tables in your account, reduce the cost of your unused tables using on-demand mode.Provisioned capacity modeProvisioned capacity mode is a good option if you have predictable application traffic that is consistent or ramps gradually. Use this mode to forecast capacity requirements and control costs.Reserved capacityIf you can predict your need for DynamoDB read and write throughput in a given AWS Region, then use DynamoDB reserved capacity to reduce costs. DynamoDB reserved capacity allows you to make an upfront commitment on your base level of provisioned capacity. Reserved capacity isn't available for tables that use the DynamoDB Standard-Infrequent Access (DynamoDB Standard-IA) table class, or on-demand capacity.For more information on DynamoDB capacity modes, see Read/write capacity mode.Optimize storage cost by choosing the right table class for your DynamoDB tableUsing the DynamoDB Standard-IA table class can reduce costs for tables that store data that you don't access regularly. This is a good option if you require long-term storage of data that you don't use often, such as application logs, or old social media posts. But, be aware that DynamoDB reads and writes for this table class are priced higher than standard tables.For more information on DynamoDB table classes, see Table classes.Use cost allocation tags for DynamoDBTagging for DynamoDB provides fine-grained visibility into your DynamoDB bill. You can assign tags to your tables, and see cost breakouts per tab to help with cost optimization by usage. To learn more about cost allocation reports for DynamoDB, see Introducing cost allocation tags for Amazon DynamoDB .For information on Cost Allocation Tags, see Using cost allocation tags.For additional optimizing methods, see Optimizing costs on DynamoDB tables.Related informationAmazon DynamoDB pricingFollow"


Question: How do I troubleshoot errors when I create a custom domain in Amazon Cognito?

I need to learn how to resolve common errors when configuring custom domains in Amazon Cognito.

Answer: "I need to learn how to resolve common errors when configuring custom domains in Amazon Cognito.Short descriptionWhen configuring custom domain names in Amazon Cognito, the following errors commonly occur:"Custom domain is not a valid subdomain: Was not able to resolve the root domain, please ensure an A record exists for the root domain.""Domain already associated with another user pool.""One or more of the CNAMEs you provided are already associated with a different resource.""The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.""The domain name contains an invalid character. Domain names can only contain lower-case letters, numbers, and hyphens. Please enter a different name that follows this format: ^a-z0-9?$"ResolutionCustom domain is not a valid subdomain errorTo prevent accidental changes to infrastructure, Amazon Cognito doesn't support top-level domains (TLDs) for custom domains. To create an Amazon Cognito custom domain, the parent domain must have a Domain Name System (DNS) A record.The parent might be either the root of the domain or a child domain that's one step up in the domain hierarchy. For example, if your custom domain is auth.xyz.yourdomain.com, then Amazon Cognito must resolve **xyz.**yourdomain.com to an IP address. Similarly, to configure xyz.yourdomain.com as a custom domain, configure an A record for yourdomain.com.You must create an A record for the parent domain in your DNS configuration. When the parent domain resolves to a valid A record, Amazon Cognito doesn't perform additional verifications. If the parent domain doesn't point to a real IP address, then consider putting a dummy IP address, such as "8.8.8.8", in your DNS configuration.Your DNS provider might take time to propagate the changes that you made to your DNS configuration. To make sure that your DNS provider propagated the change, run one of the following commands.Using auth.xyz.yourdomain.com as the custom domain:$ dig A xyz.yourdomain.com +short-or-Using xyz.yourdomain.com as the custom domain:$ dig A yourdomain.com +shortNote: The preceding example commands are for a Linux environment.If the DNS configuration change propagates, then the previous command returns the IP address that you configured. If the DNS lookup isn't returning the configured IP address, then wait until the change is propagated. Otherwise, you keep getting the "custom domain is not a valid subdomain" error.After the custom domain is created in Amazon Cognito, you can remove the parent domain A record mapping you configured earlier.Domain already associated with another user pool errorCustom domain names must be unique across all AWS accounts in all AWS Regions. When you use a custom domain name for a user pool, the same domain name can't be used for any other user pool. You must delete the custom domain associated with the first user pool if you want to use the domain name for another user pool.After deleting a custom domain, it takes time to fully dissociate the custom domain from the user pool. If you try to configure the domain name with another user pool immediately after deletion, then you might encounter the domain association error. If you receive the domain association error, then wait 15-20 minutes before setting up the domain name with the new user pool.One or more of the CNAMEs you provided are already associated with a different resource errorAfter creating a custom domain, Amazon Cognito creates an AWS managed Amazon CloudFront distribution using the same custom domain name. You can use a domain name with only one CloudFront distribution. If you're using a domain name as an alternate domain in CloudFront, then you can't use the existing domain name to create a custom domain. If you try to create a custom domain that's already associated with a CloudFront distribution, then the CNAME association error appears.You can resolve this error in one of the following two ways:Use a different domain name for the Amazon Cognito custom domain.When using the domain as an Amazon Cognito custom domain, stop using the domain name with another CloudFront distribution.The specified SSL certificate doesn't exist errorTo create an Amazon Cognito custom domain, you must have an AWS Certificate Manager (ACM) certificate in the us-east-1 AWS Region. When you create the custom domain, Amazon Cognito internally creates a CloudFront distribution. CloudFront supports ACM certificates only in the us-east-1 Region.When you configure the custom domain, make sure that the certificate you select isn't expired.If you import a certificate into ACM, then make sure that the certificate is issued by a public certificate authority (CA). The certificate must also have the correct certificate chain. For more information, see Importing certificates into AWS Certificate Manager.Your certificate must be 2,048 bits or smaller in size. The certificate can't be password protected.If an AWS Key Management Service (AWS KMS) policy evaluation results in an explicit deny statement, then you might receive an SSL certificate error. When certain AWS KMS actions are explicitly denied for the IAM user or role that creates the Amazon Cognito custom domain, this error occurs. The error most commonly occurs for the following explicitly denied AWS KMS actions: kms:DescribeKey, kms:CreateGrant, or kms:*.The domain name contains an invalid character errorIf a domain name contains anything other than lowercase letters, numbers, and hyphens, then the domain name isn't accepted. You can't use a hyphen for the first or last character. The maximum length of the whole domain name, including the dots, is 63 characters.Related informationUsing your own domain for the hosted UIFollow"


Question: How do I troubleshoot my virtual interface on Direct Connect when it's in the DOWN status in the AWS Management Console?

I want to troubleshoot my virtual interface on AWS Direct Connect when it's in the DOWN status in the AWS Management Console.

Answer: "I want to troubleshoot my virtual interface on AWS Direct Connect when it's in the DOWN status in the AWS Management Console.Short descriptionYour virtual interface on Direct Connect can go down for multiple reasons:Physical connection is down or flappingOSI layer 2 configuration issuesBorder Gateway Protocol (BGP) configuration issuesBidirectional Forwarding Detection (BFD) configuration issuesResolutionPhysical connection is down or flappingIf your physical connection isn't in the UP status and stable, then you must troubleshoot your layer 1 (physical) issues. For more information, see How do I troubleshoot when my Direct Connect connection is DOWN and the Tx/Rx optical signal receives no or low light readings?OSI layer 2 configuration issuesCheck your OSI layer 2 for the following configurations:Your VLAN ID with dot1Q encapsulation on your device is configured correctly, as shown in your Direct Connect console.The configuration of peer IP addresses is identical on your device in the Direct Connect console.All the intermediate devices along the path are configured correctly for dot1Q VLAN tagging with the correct VLAN ID. Also, make sure that VLAN-tagged traffic is preserved on the AWS end of the Direct Connect device.  Your device learns the MAC address of the Direct Connect device of the configured VLAN ID from the ARP table.Your device can ping the Amazon peer IP address sourcing from your peer IP address.Note: Some network providers use Q-in-Q tagging that alters your tagged VLAN. Direct Connect doesn't support Q-in-Q tagging.For more information, see Troubleshooting layer 2 (data link) issues.BGP configuration issuesIf your OSI layer 2 configuration is correct, then check your BGP for the following configurations:Your local and remote ASNs are correct, as provided in the downloaded configuration file.Your neighbor IP address and BGP MD5 password are correct, as provided in the downloaded configuration file.Your device isn't blocking inbound or outbound traffic on TCP port 179 and other ephemeral ports.Your device isn't advertising more than 100 prefixes to AWS by the BGP. By default, AWS accepts up to 100 prefixes using a BGP session on Direct Connect. For more information, see Direct Connect quotas.If the preceding configurations are correct, then your BGP status indicates UP.For more information, see How can I troubleshoot BGP connection issues over Direct Connect?BFD configuration issuesBFD is a detection protocol that provides fast forwarding path failure detection times. Fast failure detection times facilitate faster routing reconvergence times. AWS supports asynchronous BFD and is automatically turned on for Direct Connect virtual interfaces on AWS.If your OSI layer 2 and BGP configurations are correct, then check your BFD for the following configurations:BFD is turned on for your router. If it's turned on, then check that your BFD is configured correctly on your router.Your BFD session is in the UP status on your router.Your BFD events or logs on your router for any further issues.Note: The default AWS BFD liveness detection minimum interval is 300 ms. The default BFD liveness detection multiplier is three.Related informationTroubleshooting AWS Direct ConnectFollow"


Question: How do I change my AWS Support plan?

I want to change my AWS Support plan.

Answer: "I want to change my AWS Support plan.ResolutionTo access the AWS Support Center, sign in with either of the following steps:Use your AWS account root user credentials-or-Use your AWS Identity and Access Management (IAM) user credentials with access permissions for AWS Support plans. For more information, see Manage access for AWS Support plans.To change your Support plan, do the following:1.    Open the AWS Support Center.You can view your current Support plan in the navigation pane.2.    Choose Change next to your current AWS Support plan.3.    (Optional) On the AWS Support plans page, compare the Support plans. For pricing information, see AWS Support plan pricing.Under AWS Support pricing example, choose See examples, and then choose one of the Support plan options to see the estimated cost.4.    Choose Review downgrade or Review upgrade for the plan that you want. Important: If you have an Enterprise On-Ramp or Enterprise Support plan, on the Change plan confirmation dialog box, choose Contact us. Fill in the form, and then choose Submit.5.    For Change plan confirmation, expand the support items to see the features included with the plan.Under Pricing, you can view the projected one-time charges for the new Support plan.6.    Choose Accept and agree.The changes take effect within 15 minutes. You see your new plan reflected in the Billing and Cost Management console within a few hours.Your previous paid AWS Support plan remains valid up to the point when you switch to a new one. The terms and conditions of the new plan start applying to the usage of your account immediately. For more information, see AWS Support plan pricing.For an explanation of how AWS Support plans are billed, see How am I billed for AWS Support?Related informationAWS SupportCompare AWS Support plansHow do I cancel my AWS Support plan?How do AWS Support plans work in an organization in AWS Organizations?Follow"


Question: What's the most effective way as an AWS reseller to bill my end customers?

"As a reseller of AWS products, I want to use AWS tools to calculate bills for my end users."

Answer: "As a reseller of AWS products, I want to use AWS tools to calculate bills for my end users.ResolutionAs a reseller, it's a best practice to design your own specialized reporting and invoicing structures that match your business needs.You can use the AWS Cost and Usage report to help calculate bills for end users. It's a best practice to use cost allocation tags to identify the source of your costs.When you calculate bills for your end customers, make sure to use unblended rates. Blended rates are averages and aren't meant to reflect actual billed rates.Related informationAWS OrganizationsConsolidated billing for AWS OrganizationsFollow"


Question: How do I transfer an Elastic IP address between AWS accounts in the same Region?

"I use an Amazon Elastic IP address, and I want to transfer the address to another AWS account."

Answer: "I use an Amazon Elastic IP address, and I want to transfer the address to another AWS account.Short descriptionTo transfer Elastic IP addresses between accounts in the same AWS Region, use either of the following methods:The Amazon Elastic Compute Cloud (Amazon EC2) consoleAmazon EC2 APIsWhen you transfer an Elastic IP address, there's a two-step handshake between the source account and transfer account. The source account can be a standard AWS account or an AWS Organizations account. When the source account starts the transfer, the transfer account has 7 days to accept it. Otherwise, the Elastic IP address returns to its original owner.AWS doesn't inform the transfer account about pending Elastic IP address transfer requests. To facilitate the transfer within the time frame, the source account owner must communicate this request to the transfer account owner.ResolutionUse the Amazon EC2 consoleFor steps on how to send a transfer request through the Amazon EC2 console and prerequisites for it, see Activate Elastic IP address transfer.After you send the transfer request, the owner of the transfer account must accept it. For steps on how to complete the transfer in the Amazon EC2 console, see Accept a transferred Elastic IP address.Use the AWS CLI to transfer a single Elastic IP addressNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re running a recent version of the AWS CLI. To verify that you correctly configured the AWS CLI, see Configuring the AWS CLI.In the following example use case, source account A (111111111111) is transferring an Elastic IP address to transfer account B (222222222222).In the following commands, replace ELASTIC_IP with your Elastic IP address. Replace us-east-1 with your AWS Region.1.     In the source account, use either the Amazon EC2 console or AWS CLI to get the AllocationId of the Elastic IP address. For the AWS CLI, use the describe-addresses API call:aws ec2 describe-addresses --filters "Name=public-ip,Values=ELASTIC_IP" --region us-east-1  {      "Addresses": [          {              "PublicIp": "ELASTIC_IP",              "AllocationId": "eipalloc-1111111111111111",              "Domain": "vpc",              "PublicIpv4Pool": "amazon",              "NetworkBorderGroup": "us-east-1"          }      ]  }2.     In the source account, check if there are any existing or pending address transfers for the Elastic IP address. To do this, check the AllocationId (in this case, eipalloc-1111111111111111):aws ec2 describe-address-transfers --query "AddressTransfers[?AllocationId=='eipalloc-11111111111111111']" --region us-east-1  [ ]In this example, there aren’t any existing or pending address transfers. This means that you can proceed with your new transfer.3.    Use the enable-address-transfer API call to initiate the address transfer:aws ec2 enable-address-transfer --allocation-id eipalloc-11111111111111111 --transfer-account-id 222222222222 --region us-east-1      "AddressTransfer": {          "PublicIp": "3.",          "AllocationId": "eipalloc-11111111111111111",          "TransferAccountId": "222222222222",          "TransferOfferExpirationTimestamp": "2022-10-28T08:44:41+00:00",          "AddressTransferStatus": "pending"      }  }4.   Notify the transfer account owner that the Elastic IP address transfer is in the Pending state and that they must accept the transfer. To accept the transfer, the transfer account owner uses the accept-address-transfer API call.Note: The transfer account can't see the Elastic IP address that's in the Pending state. This is a security feature in case you accidentally send an IP address to the wrong account. In this case, you can cancel the transfer before the other account sees the IP address.aws ec2 accept-address-transfer --address ELASTIC_IP --region us-east-1      "AddressTransfer": {          "PublicIp": "ELASTIC_IP",          "AllocationId": "eipalloc-11111111111111111",          "TransferAccountId": "222222222222",          "TransferOfferExpirationTimestamp": "2022-10-28T08:44:41+00:00",          "AddressTransferStatus": "accepted"      }  }If the acceptance fails, then you see one of the following errors:AddressLimitExceededInvalidTransfer.AddressCustomPtrSetInvalidTransfer.AddressAssociatedTo troubleshoot any of these errors, see Accept a transferred Elastic IP address.5.    After the Elastic IP address transfers successfully, the transfer account can use the describe-addresses API to confirm the transfer:Note: A successful transfer generates a new AllocationId for the Elastic IP address in the transfer owner's account.aws ec2 describe-addresses --filters "Name=public-ip,Values=ELASTIC_IP" --region us-east-1  {      "Addresses": [          {              "PublicIp": "ELASTIC_IP",              "AllocationId": "eipalloc-22222222222222222",              "Domain": "vpc",              "PublicIpv4Pool": "amazon",              "NetworkBorderGroup": "us-east-1"          }      ]  }6.    The source account can use the describe-address-transfers API to confirm a successful transfer:aws ec2 describe-address-transfers --query "AddressTransfers[?AllocationId=='eipalloc-11111111111111111']" --region us-east-1  [         {              "PublicIp": "ELASTIC_IP",              "AllocationId": "eipalloc-11111111111111111",              "TransferAccountId": "222222222222",              "TransferOfferExpirationTimestamp": "2022-10-28T10:44:41+00:00",              "AddressTransferStatus": "accepted"          }  ]    Related informationAmazon Virtual Private Cloud (VPC) now supports the transfer of Elastic IP addresses between AWS accountsTransfer Elastic IP addressesFollow"


Question: How do I troubleshoot eksctl issues with Amazon EKS clusters and node groups?

"When I use eksctl to create or update my Amazon Elastic Kubernetes Service (Amazon EKS), I encounter issues."

Answer: "When I use eksctl to create or update my Amazon Elastic Kubernetes Service (Amazon EKS), I encounter issues.Short descriptionThe following are common issues you might encounter when you use eksctl to create or manage an Amazon EKS cluster or node group:You don't know how to create a cluster with eksctl. See Getting started with Amazon EKS - eksctl and the eksctl section of Creating an Amazon EKS cluster.You don't know how to specify kubelet bootstrap options for managed node groups. Follow the steps in the Specify kubelet bootstrap options Resolution section.You don't how to change the instance type of an existing node group. You must create a new node group. See Migrating to a new node group and Nodegroup immutability (from the eskctl website).You reached the maximum number of AWS resources. Check your resources to see if you can delete ones that you're not using. If you still need more capacity, then see, Requesting a quota increase.You launch control plane instances in an Availability Zone with limited capacity. See How do I resolve cluster creation errors in Amazon EKS?Your nodes fail to move to Ready state. Follow the steps in the Resolve operation timeout issues Resolution section.Export values don't exist for the cluster. Follow the steps in the Create the node group in private subnets Resolution section.You used an unsupported instance type to create a cluster or node group. Follow the steps in the Check if your instance type is supported Resolution section.ResolutionSpecify kubelet bootstrap optionsBy default, eksctl creates a bootstrap script and adds it to the launch template that the worker nodes run during the bootstrap process. To specify your own kubelet bootstrap options, use the overrideBootstrapCommand specification to override the eksctl bootstrap script. Use the overrideBootstrapCommand for managed and self-managed node groups.Config file specification:managedNodeGroups:  name: custom-ng  ami: ami-0e124de4755b2734d  securityGroups:    attachIDs: ["sg-1234"]  maxPodsPerNode: 80  ssh:    allow: true  volumeSize: 100  volumeName: /dev/xvda  volumeEncrypted: true  disableIMDSv1: true  overrideBootstrapCommand: |  #!/bin/bash  /etc/eks/bootstrap.sh managed-cluster --kubelet-extra-args '--node-labels=eks.amazonaws.com/nodegroup=custom-ng,eks.amazonaws.com/nodegroup-image=ami-0e124de4755b2734d'Note: You can use overrideBootstrapCommand only when using a custom AMI. If you don't specify an AMI ID, then cluster creation fails.A custom AMI ID wasn't specifiedIf you don't specify a custom AMI ID when creating managed node groups, then by default Amazon EKS uses an Amazon EKS-optimized AMI and bootstrap script. To use an Amazon EKS-optimized AMI with custom user data to specify bootstrap parameters, specify the AMI ID in your managed node group configuration.To get the latest AMI ID for the latest Amazon EKS optimized AMI, run the following command:aws ssm get-parameter --name /aws/service/eks/optimized-ami/1.21/amazon-linux-2/recommended/image_id --region Region --query "Parameter.Value" --output textNote: Replace Region with your AWS Region.Resolve operation timeout issuesIf you receive the following error when creating a node, then your node group may have timeout issues:waiting for at least 1 node(s) to become ready in "nodegroup"When you create an EKS node group with eksctl, the eksctl CLI connects to the API server to continuously check for the Kubernetes node status. The CLI waits for the nodes to move to Ready state and eventually times out if the nodes fail to move.The following are reasons why the nodes fail to move to Ready state:The kubelet can't communicate or authenticate with the EKS API server endpoint during the bootstrapping process.The aws-node and kube-proxy pods are not in Running state.The Amazon Elastic Compute Cloud (Amazon EC2) worker node user data wasn't successfully run.The kubelet can't communicate with the EKS API server endpointIf the kubelet can't communicate with the EKS API server endpoint during the bootstrapping process, then get the EKS API server endpoint.Run the following command on your worker node:curl -k https://123456DC0A12EC12DE0C12BC312FCC1A.yl4.us-east-1.eks.amazonaws.com{  "kind": "Status",  "apiVersion": "v1",  "metadata": {      },  "status": "Failure",  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",  "reason": "Forbidden",  "details": {      },  "code": 403}The preceding command should return the HTTP 403 status code. If the command times out, you might have a network connectivity issue between the EKS API server and worker nodes.To resolve the connectivity issue, complete one of the following steps that relates to your use case:If the worker nodes are in a private subnet, then check that the EKS API server endpoint is in Private or Public and Private access mode.If the EKS API server endpoint is set to Private, then you must apply certain rules for the private hosted zone to route traffic to the API server. The Amazon Virtual Private Cloud (Amazon VPC) attributes enableDnsHostnames and enableDnsSupport must be set to True. Also, the DHCP options set for the Amazon VPC must include AmazonProvideDNS in its domain list.If you created the node group in public subnets, then make sure that the subnets' IPv4 public addressing attribute is set to True. If you don't set the attribute to True, then the worker nodes aren't assigned a public IP address and can't access the internet.Check if the Amazon EKS cluster security group allows ingress requests to port 443 from the worker node security group.The kubelet can't authenticate with the EKS API server endpointIf the kubelet can't authenticate with the EKS API server endpoint during the bootstrapping process, then complete the following steps.1.    Run the following command to verify that the worker node has access to the STS endpoint:telnet sts.region.amazonaws.com 443Note: Replace region with your AWS Region.2.    Make sure that the worker node's AWS Identity and Access Management (IAM) role was added to the aws-auth ConfigMap.For example:apiVersion:v1 kind:ConfigMap metadata:name:aws-auth namespace:kube-system data:mapRoles:|    - rolearn: ARN of instance role (not instance profile)      username: system:node:{EC2PrivateDNSName}}      groups:        - system:bootstrappers        - system:nodesNote: For Microsoft Windows node groups, you must add an additional eks:kube-proxy-windows RBAC group to the mapRoles section for the node group IAM role.The aws-node and kube-proxy pods aren't in Running stateTo check whether the aws-node and kube-proxy pods are in Running state, run the following command:kubectl get pods -n kube-systemIf the aws-node pod is in Failing state, then check the connection between the worker node and the Amazon EC2 endpoint:ec2.region.amazonaws.comNote: Replace region with your AWS Region.Check that the AWS managed policies AmazonEKSWorkerNodePolicy and AmazonEC2ContainerRegistryReadOnly are attached to the node group's IAM role.If the nodes are in a private subnet, then configure Amazon ECR VPC endpoints to allow image pulls from Amazon Elastic Container Registry (Amazon ECR).If you use IRSA for your Amazon VPC CNI, then attach the AmazonEKS_CNI_Policy AWS managed policy to the IAM role that the aws-node pods use. You must also attach the policy to the node group's IAM role without IRSA.The EC2 worker node user data wasn't successfully runTo check whether any errors occurred when the user data was run, review the cloud-init logs at /var/log/cloud-init.log and /var/log/cloud-init-output.log.For more information, run the EKS Logs Collector script on the worker nodes.Create the node group in private subnetsIf you receive the following error when creating a node group, create the node group in private subnets:No export named eksctl--cluster::SubnetsPublic found. Rollack requested by userIf you created the Amazon EKS cluster with PrivateOnly networking, then AWS CloudFormation can't create public subnets. This means that export values won't exist for public subnets. If export values don't exist for the cluster, then node group creation fails.To resolve this issue, you can include the --node-private-networking flag when using the eksctl inline command. You can also use the privateNetworking: true specification within the node group configuration to request node group creation in private subnets.Update your eksctl version or specify the correct AWS RegionIf you receive the following error, check your AWS Region:no eksctl-managed CloudFormation stacks found for "cluster-name"If you use an eksctl version that's earlier than 0.40.0, then you can only view or manage Amazon EKS resources that you created with eksctl. To manage resources that weren't created with eksctl, update eksctl to version 0.40.0 or later. To learn about the commands that you can run for clusters that weren't created with eksctl, see Non eksctl-created clusters (from the eksctl website).Also, eksctl-managed CloudFormation stacks aren't found if you specify an incorrect AWS Region. To resolve this issue, make sure that you specify the correct Region where your Amazon EKS resources are located.Check if your instance type is supportedIf you used an unsupported instance type to create a cluster or node, then you receive the following error:You must use a valid fully-formed launch template. The requested configuration is currently not supported. Please check the documentation for supported configurations'To check if your instance type or other configurations are supported in a specific AWS Region, run the following command:aws ec2 describe-instance-type-offerings --region Region --query 'InstanceTypeOfferings[*].{InstanceType:InstanceType}'Note: Replace Region with your AWS Region.Follow"


Question: How do I troubleshoot an Amazon EC2 instance that stops or terminates when I try to start it?

"When I try to start my Amazon Elastic Compute Cloud (Amazon EC2) instance, it terminates or doesn't start."

Answer: "When I try to start my Amazon Elastic Compute Cloud (Amazon EC2) instance, it terminates or doesn't start.Short descriptionThe following reasons are the most common causes of an Amazon EC2 instance InternalError message:Your Amazon Elastic Block Store (Amazon EBS) volume isn't attached to the instance correctly.An EBS volume that's attached to the instance is in an error state.An encrypted EBS volume is attached to the instance.If your instance doesn't start and no error code appears, then run the describe-instances command in the AWS Command Line Interface (AWS CLI). Then, specify the instance ID. Check the StateReason message that the command returns in the JSON response.Note: Enter all commands in the AWS CLI. If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.ResolutionEBS volumes aren't attached to the instance correctlyYou must attach the EBS root volume to the instance as /dev/sda1 or /dev/xvda, depending on which one is defined in the API. You can't have a second EBS volume with a duplicate or conflicting device name. Otherwise, you can't stop or start the instance. Block device name conflicts affect only Xen-based instance types (c4, m4, t2, and so on). Block device name conflicts don't affect Nitro-based instances (c5, m5, t3, and so on).1.    Run the describe-instances API to verify the StateReason error message and error code:$ aws ec2 describe-instances --instance-id i-xxxxxxxxxxxxxxx --region us-east-1 --query "Reservations[].Instances[].{StateReason:StateReason}" --output jsonNote: Replace us-east-1 with your AWS Region. Replace i-xxxxxxxxxxxxxxx with your instance ID.If there's a device name conflict, then you see an output that's similar to the following message:[    [{        "StateReason": {            "Code": "Server.InternalError",            "Message": "Server.InternalError: Internal error on launch"        }    }]]2.    Open the Amazon EC2 console, and then select the instance that you can't start.3.    On the Description tab, verify the device name listed in Block devices. The Block devices field displays all device names of the attached volumes.4.    Verify that the root device is correctly attached and that there isn't a device listed with the same name or with a conflicting name.5.    If there's a device with a duplicate or conflicting device name, then detach the conflicting volume and rename it. Then, reattach the volume with the updated device name.An attached EBS volume is in an error state1.    Run the describe-instances API to verify the StateReason error message and error code:$ aws ec2 describe-instances --instance-id i-xxxxxxxxxxxxxxx --region us-east-1 --query "Reservations[].Instances[].{StateReason:StateReason}" --output jsonNote: Replace us-east-1 with your AWS Region. Replace i-xxxxxxxxxxxxxxx with your instance ID.If there's an attached EBS volume that's in an error state, then you see an output that's similar to the following message:[    [{        "StateReason": {            "Code": "Server.InternalError",            "Message": "Server.InternalError: Internal error on launch"        }    }]]2.    Open the Amazon EC2 console, choose Volumes, and then verify if the status of the volume is error. Your options vary depending on whether the volume in an error state is a root volume or a secondary volume.If the volume that's in an error state is a secondary volume, then detach the volume. You can now start the instance.If the volume that's in an error state is a root volume and you have a snapshot of the volume, then complete the following steps:Detach the volume.Create a new volume from the snapshot.Attach the new volume to the instance using the device name of the original instance. Start the instance.Note: If you don’t have an existing snapshot of the root volume that’s in an error state, then you can’t restart the instance. You must launch a new instance, install the relevant applications, and then configure it to replace the old instance.Attached volumes are encrypted and there are incorrect AWS Identity and Access Management (IAM) permissions or policies1.    Run the describe-instances API to verify the StateReason error message and error code:$ aws ec2 describe-instances --instance-id i-xxxxxxxxxxxxxxx --region us-east-1 --query "Reservations[].Instances[].{StateReason:StateReason}" --output jsonNote: Replace us-east-1 with your AWS Region. Replace i-xxxxxxxxxxxxxxx with your instance ID.If there's an encrypted volume that's attached to the instance and there are permissions or policy issues, then you receive a client error. You see an output that's similar to the following message:[    [{        "StateReason": {            "Code": "Client.InternalError",            "Message": "Client.InternalError: Client error on launch"        }    }]]2.    Verify that the user who's trying to start the instance has the correct IAM permissions. If you launched the instance indirectly through another service, like EC2 Auto Scaling, then also verify the following configurations:The AWS Key Management Service (AWS KMS) key that's used to encrypt the volume is activated.The key has the correct key policies.Note: To verify if a volume is encrypted, open the Amazon EC2 console, and then select Volumes. Encrypted volumes have Encrypted listed in the Encryption column.Related informationWhen I start my instance with encrypted volumes attached, the instance immediately stops with the error "client error on launch"Why can't I start or launch my EC2 instance?Key policies in AWS KMSTroubleshooting instance launch issues - Instance terminates immediatelyFollow"