Question: How do I use custom resources with Amazon S3 buckets in CloudFormation?

I want to use custom resources with Amazon Simple Storage Service (Amazon S3) buckets in AWS CloudFormation.

Answer: "I want to use custom resources with Amazon Simple Storage Service (Amazon S3) buckets in AWS CloudFormation.Short descriptionUse the CloudFormation template in the following resolution to use custom resources with an S3 bucket.Consider the following:The template allows you to create folders in S3 buckets. Amazon S3 has a flat structure, but supports the folder concept as a means of grouping objects.The template allows you to perform operations after creating an S3 bucket, including copying content, uploading content, and synchronizing two different buckets.You can modify the template with your own code.This template uses AWS Lambda-backed custom resources and assumes that you're familiar with Lambda best practices and troubleshooting issues.Note: In the following resolution, all the S3 bucket content is deleted when the CloudFormation stack is deleted. You can modify this behavior by modifying the Lambda code.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, then make sure that you’re using the most recent AWS CLI version.Get the CloudFormation templateTo create folders in an S3 bucket using CloudFormation, save the following JSON or YAML template:JSON:{  "AWSTemplateFormatVersion": "2010-09-09",  "Description": "Working with custom resources and S3",  "Parameters": {    "S3BucketName": {      "Type": "String",      "Description": "S3 bucket to create.",      "AllowedPattern": "[a-zA-Z][a-zA-Z0-9_-]*"    },    "DirsToCreate": {      "Description": "Comma delimited list of directories to create.",      "Type": "CommaDelimitedList"    }  },  "Resources": {    "SampleS3Bucket": {      "Type": "AWS::S3::Bucket",      "Properties": {        "BucketName": {"Ref":"S3BucketName"}      }    },    "S3CustomResource": {      "Type": "Custom::S3CustomResource",      "DependsOn":"AWSLambdaExecutionRole",      "Properties": {        "ServiceToken": {"Fn::GetAtt": ["AWSLambdaFunction","Arn"]},        "the_bucket": {"Ref":"SampleS3Bucket"},        "dirs_to_create": {"Ref":"DirsToCreate"}      }    },    "AWSLambdaFunction": {      "Type": "AWS::Lambda::Function",      "Properties": {        "Description": "Work with S3 Buckets!",        "FunctionName": {"Fn::Sub":"${AWS::StackName}-${AWS::Region}-lambda"},        "Handler": "index.handler",        "Role": {"Fn::GetAtt": ["AWSLambdaExecutionRole","Arn"]},        "Timeout": 360,        "Runtime": "python3.9",        "Code": {          "ZipFile": "import boto3\r\nimport cfnresponse\r\ndef handler(event, context):\r\n    # Init ...\r\n    the_event = event['RequestType']\r\n    print(\"The event is: \", str(the_event))\r\n    response_data = {}\r\n    s_3 = boto3.client('s3')\r\n    # Retrieve parameters\r\n    the_bucket = event['ResourceProperties']['the_bucket']\r\n    dirs_to_create = event['ResourceProperties']['dirs_to_create']\r\n    try:\r\n        if the_event in ('Create', 'Update'):\r\n            print(\"Requested folders: \", str(dirs_to_create))\r\n            for dir_name in dirs_to_create:\r\n                print(\"Creating: \", str(dir_name))\r\n                s_3.put_object(Bucket=the_bucket,\r\n                                Key=(dir_name\r\n                                    + '\/'))\r\n        elif the_event == 'Delete':\r\n            print(\"Deleting S3 content...\")\r\n            b_operator = boto3.resource('s3')\r\n            b_operator.Bucket(str(the_bucket)).objects.all().delete()\r\n        # Everything OK... send the signal back\r\n        print(\"Operation successful!\")\r\n        cfnresponse.send(event,\r\n                        context,\r\n                        cfnresponse.SUCCESS,\r\n                        response_data)\r\n    except Exception as e:\r\n        print(\"Operation failed...\")\r\n        print(str(e))\r\n        response_data['Data'] = str(e)\r\n        cfnresponse.send(event,\r\n                        context,\r\n                        cfnresponse.FAILED,\r\n                        response_data)"        }      }    },    "AWSLambdaExecutionRole": {      "Type": "AWS::IAM::Role",      "Properties": {        "AssumeRolePolicyDocument": {          "Statement": [            {              "Action": [                "sts:AssumeRole"              ],              "Effect": "Allow",              "Principal": {                "Service": [                  "lambda.amazonaws.com"                ]              }            }          ],          "Version": "2012-10-17"        },        "Path": "/",        "Policies": [          {            "PolicyDocument": {              "Statement": [                {                  "Action": [                    "logs:CreateLogGroup",                    "logs:CreateLogStream",                    "logs:PutLogEvents"                  ],                  "Effect": "Allow",                  "Resource": "arn:aws:logs:*:*:*"                }              ],              "Version": "2012-10-17"            },            "PolicyName": {"Fn::Sub": "${AWS::StackName}-${AWS::Region}-AWSLambda-CW"}          },          {            "PolicyDocument": {              "Statement": [                {                  "Action": [                    "s3:PutObject",                    "s3:DeleteObject",                    "s3:List*"                  ],                  "Effect": "Allow",                  "Resource": [                    {"Fn::Sub": "arn:aws:s3:::${SampleS3Bucket}/*"},                    {"Fn::Sub": "arn:aws:s3:::${SampleS3Bucket}"}                  ]                }              ],              "Version": "2012-10-17"            },            "PolicyName": {"Fn::Sub":"${AWS::StackName}-${AWS::Region}-AWSLambda-S3"}          }        ],        "RoleName": {"Fn::Sub":"${AWS::StackName}-${AWS::Region}-AWSLambdaExecutionRole"}      }    }  }}YAML:Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.Permission is hereby granted, free of charge, to any person obtaining a copy of thissoftware and associated documentation files (the "Software"), to deal in the Softwarewithout restriction, including without limitation the rights to use, copy, modify,merge, publish, distribute, sublicense, and/or sell copies of the Software, and topermit persons to whom the Software is furnished to do so.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHTHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTIONOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THESOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.AWSTemplateFormatVersion: 2010-09-09Description: Working with custom resources and S3Parameters:  S3BucketName:    Type: String    Description: "S3 bucket to create."    AllowedPattern: "[a-zA-Z][a-zA-Z0-9_-]*"  DirsToCreate:    Description: "Comma delimited list of directories to create."    Type: CommaDelimitedListResources:  SampleS3Bucket:    Type: AWS::S3::Bucket    Properties:      BucketName: !Ref S3BucketName  S3CustomResource:    Type: Custom::S3CustomResource    Properties:      ServiceToken: !GetAtt AWSLambdaFunction.Arn      the_bucket: !Ref SampleS3Bucket      dirs_to_create: !Ref DirsToCreate  AWSLambdaFunction:     Type: "AWS::Lambda::Function"     Properties:       Description: "Work with S3 Buckets!"       FunctionName: !Sub '${AWS::StackName}-${AWS::Region}-lambda'       Handler: index.handler       Role: !GetAtt AWSLambdaExecutionRole.Arn       Timeout: 360       Runtime: python3.9       Code:         ZipFile: |          import boto3          import cfnresponse          def handler(event, context):              # Init ...              the_event = event['RequestType']              print("The event is: ", str(the_event))              response_data = {}              s_3 = boto3.client('s3')              # Retrieve parameters              the_bucket = event['ResourceProperties']['the_bucket']              dirs_to_create = event['ResourceProperties']['dirs_to_create']              try:                  if the_event in ('Create', 'Update'):                      print("Requested folders: ", str(dirs_to_create))                      for dir_name in dirs_to_create:                          print("Creating: ", str(dir_name))                          s_3.put_object(Bucket=the_bucket,                                         Key=(dir_name                                              + '/'))                  elif the_event == 'Delete':                      print("Deleting S3 content...")                      b_operator = boto3.resource('s3')                      b_operator.Bucket(str(the_bucket)).objects.all().delete()                  # Everything OK... send the signal back                  print("Operation successful!")                  cfnresponse.send(event,                                   context,                                   cfnresponse.SUCCESS,                                   response_data)              except Exception as e:                  print("Operation failed...")                  print(str(e))                  response_data['Data'] = str(e)                  cfnresponse.send(event,                                   context,                                   cfnresponse.FAILED,                                   response_data)  AWSLambdaExecutionRole:     Type: AWS::IAM::Role     Properties:       AssumeRolePolicyDocument:         Statement:         - Action:           - sts:AssumeRole           Effect: Allow           Principal:             Service:             - lambda.amazonaws.com         Version: '2012-10-17'       Path: "/"       Policies:       - PolicyDocument:           Statement:           - Action:             - logs:CreateLogGroup             - logs:CreateLogStream             - logs:PutLogEvents             Effect: Allow             Resource: arn:aws:logs:*:*:*           Version: '2012-10-17'         PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambda-CW       - PolicyDocument:           Statement:           - Action:             - s3:PutObject             - s3:DeleteObject             - s3:List*             Effect: Allow             Resource:             - !Sub arn:aws:s3:::${SampleS3Bucket}/*             - !Sub arn:aws:s3:::${SampleS3Bucket}           Version: '2012-10-17'         PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambda-S3       RoleName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambdaExecutionRoleDeploy your CloudFormation templateYou can deploy your CloudFormation template using either the CloudFormation console or AWS CLI.CloudFormation console:1.    Open the CloudFormation console.2.    Choose Create stack, and then choose With new resources (standard).3.    In the Specify template section, choose Upload a template file.4.    Choose Choose file, select the template that you downloaded in step 1, and then choose Next.5.    In the Parameters section, for S3BucketName, choose your S3 bucket.6.    For DirsToCreate, enter a comma-delimited list of folders and subfolders that you want to create.Note: For example, you can enter dir_1,dir_2/sub_dir_2,dir_3 as a list.7.    Complete the rest of the steps in the setup wizard, and then choose Create stack.AWS CLI:1.    Give your downloaded template the following name: custom-resource-lmabda-s3.template2.    Open a command line in your operating system, and then go to the folder where the template is located.3.    Run the following command:aws cloudformation create-stack \                   --timeout-in-minutes 10 \                   --disable-rollback \                   --stack-name testing-custom-resource-s3 \                   --template-body file://custom-resource-lmabda-s3.template \                   --capabilities CAPABILITY_NAMED_IAM \                   --parameters \                   ParameterKey=DirsToCreate,ParameterValue="dir_1\,dir_2/sub_dir_2\,dir_3" \                   ParameterKey=S3BucketName,ParameterValue="test-bucket-custom-resource"Note: Update parameters with your values.Follow"


Question: How can I list Amazon EBS volume or snapshot information for my Amazon EC2 instance by using the AWS CLI?

How can I list Amazon Elastic Block Store (Amazon EBS) volume or snapshot information for my Amazon Elastic Compute Cloud (Amazon EC2) instance using the AWS Command Line Interface (AWS CLI)?

Answer: "How can I list Amazon Elastic Block Store (Amazon EBS) volume or snapshot information for my Amazon Elastic Compute Cloud (Amazon EC2) instance using the AWS Command Line Interface (AWS CLI)?ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Note: Install the jq processor before running the commands.Amazon Linux and Amazon Linux 2:$ sudo yum install jqFor other Linux distribution installation instructions and syntax commands, see the documentation for your Linux distribution.Find all snapshots over one month oldThe following command lists all EBS snapshots using the describe-snapshots operation where the timestamp is older than one month ( --date='-1 month').aws ec2 describe-snapshots \    --owner-ids self \    --query "Snapshots[?(StartTime<='$(date --date='-1 month' '+%Y-%m-%d')')].{ID:SnapshotId,Time:StartTime,Details:Description}"List snapshots over one month old in all RegionsThe following example command uses the same command as in the first example. It also loops through snapshots in all Regions using the describe-regions operation.for REGION in $(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]') ; do echo $REGION && aws ec2 describe-snapshots --owner self --region $REGION --output json --query "Snapshots[?(StartTime<='$(date --date='-1 month' '+%Y-%m-%d')')].{ID:SnapshotId,Time:StartTime,Details:Description}" ; doneFind all publicly available snapshots in an AWS account in all RegionsThis example command lists all snapshots where the CreateVolumePermission Group is equal to all for all Regions.for REGION in $(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]') ; do echo "$REGION:"; for snap in $(aws ec2 describe-snapshots --owner self --output text --region $REGION --query 'Snapshots[*].SnapshotId'); do aws ec2 describe-snapshot-attribute --snapshot-id $snap --region $REGION --output text --attribute createVolumePermission --query '[SnapshotId,CreateVolumePermissions[?Group == `all`]]'; done; echo; doneThe following example command lists all volumes by using the describe-volumes-modifications operation where the modification-state is set to the value of optimizing, for all Regions.$ for REGION in $(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]') ; do echo $REGION && aws ec2 describe-volumes-modifications --query 'VolumesModifications[].{VolumeID:VolumeId,TargetSize:TargetSize,OriginalSize:OriginalSize,Progress:Progress,OriginalIops:OriginalIops,TargetIops:TargetIops}' --output json --filter 'Name=modification-state,Values=optimizing' --region $REGION; doneFind all volumes not attached to any instance in all RegionsThis example command lists volumes where the status is set to available for all Regions.$ for REGION in $(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]') ; do echo $REGION && aws ec2 describe-volumes --filter "Name=status,Values=available" --query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,AvailabilityZone:AvailabilityZone}' --region $REGION; doneFind all volumes in the "error" state in all RegionsThe following example command describes all volumes in all Regions where the status is set to error.$ for REGION in $(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]') ; do echo $REGION && aws ec2 describe-volumes --filter "Name=status,Values=error" --query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,AvailabilityZone:AvailabilityZone}' --region $REGION; doneRelated informationAWS Command Line InterfaceFollow"


Question: Why is my ACM certificate marked as ineligible for renewal?

"I want to renew my AWS Certificate Manager (ACM) certificate. However, the certificate details value is ineligible for renewal."

Answer: "I want to renew my AWS Certificate Manager (ACM) certificate. However, the certificate details value is ineligible for renewal.Short descriptionACM certificates might be ineligible for renewal if:The certificate isn't associated with another AWS service.The certificate is expired.The certificate is imported.It's a private certificate issued with the IssueCertificate API call.ResolutionFollow these instructions for your use case.Before you begin, use the ACM console or the AWS Command Line Interface (AWS CLI) to list detailed metadata about your certificates.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.The certificate isn't associated with another AWS serviceACM certificates must be associated with another AWS service such as Elastic Load Balancing (ELB).If the certificate details metadata In use? value is No, this means that your ACM certificate isn't associated with an AWS service.For a list of supported AWS services with ACM, see Services integrated with AWS Certificate Manager.The certificate is expiredExpired certificates aren't eligible for renewal. If the certificate is expired, you can request a new certificate.For more information, see Check a certificate's renewal status.The certificate is importedACM doesn't provide managed renewal for imported certificates. To renew an imported certificate, request a new certificate from your certificate issuer. Then, follow the instructions to manually reimport the certificate into ACM.Private certificate issued with the IssueCertificate API callACM doesn't manage the renewal of private certificates issued by calling the ACM Private CA IssueCertificate API. You can request a new certificate before the certificates expiration date from your CA.For more information, see Managed renewal for ACM certificates.Related informationTroubleshooting certificate validationIssuing and managing certificatesFollow"


Question: How do I resolve the error "Connect timeout on endpoint URL" on Amazon SageMaker?

"When I try to connect to an AWS service from my Amazon SageMaker notebook, I get an error similar to the following:"Connect timeout on endpoint URL: "https://athena.ap-southeast-2.amazonaws.com/""

Answer: "When I try to connect to an AWS service from my Amazon SageMaker notebook, I get an error similar to the following:"Connect timeout on endpoint URL: "https://athena.ap-southeast-2.amazonaws.com/"Short descriptionTo connect to AWS services, the notebook instance's subnet must have a virtual private cloud (VPC) endpoint for the service that you're connecting to. Or, the subnet must be able to reach the internet.ResolutionUse one of the following options to resolve "Connect timeout on endpoint URL" errors.Add a VPC endpoint for the service to the notebook instance's subnetWhen you choose this option, you don't have to create a new notebook instance. Many AWS services offer either an interface endpoint or a gateway endpoint. For more information, see VPC endpoints. If the AWS service that you're connecting to doesn't offer an interface or gateway endpoint, create a new notebook instance.Create a new notebook instanceChoose one of the following configurations for a new notebook instance based on your security requirements:Create a new notebook instance with direct internet access enabled. This is the default option, regardless of whether or not you create the notebook instance in a VPC. For both VPC and non-VPC notebook instances, direct internet access is the easiest way to assure that a notebook instance can reach the public endpoint for the service that you're connecting to. When direct internet access is enabled, SageMaker provides a network interface that allows the notebook to communicate with the internet through a SageMaker-managed VPC. For more information, see Understanding Amazon SageMaker notebook instance networking configurations and advanced routing options.Create the notebook instance in a private subnet with direct internet access disabled. Then, add a NAT gateway to the subnet. The NAT gateway allows traffic to reach the public endpoint for the service that you're connecting to.Related informationConnect a notebook instance in a VPC to external resourcesFollow"


Question: Will a Multi-AZ deployment help reduce downtime during an Amazon RDS MySQL modification?

I want to modify my Amazon Relational Database Service (Amazon RDS) for MySQL instance. Will a Multi-AZ deployment help reduce downtime?

Answer: "I want to modify my Amazon Relational Database Service (Amazon RDS) for MySQL instance. Will a Multi-AZ deployment help reduce downtime?Short descriptionWhen you modify your Amazon RDS MySQL instance, Multi-AZ deployments can reduce the impact of your changes.Multi-AZ deployment can impact your Amazon RDS MySQL instance in the following scenarios:Modifying DB instance storageUpdating the DB instance classMaintaining the underlying OS or hardwareNote: Depending on the type of update that you're making, Multi-AZ deployments might not offer enhanced availability benefits.ResolutionModifying DB instance storageTo modify Amazon RDS storage, the following storage modifications are available:Allocated storage sizeProvisioned IOPs valueStorage typeIncreasing the allocated storage size and changing the IOPs values are online operations that don't include downtime. Because these storage updates to both the primary and standby DB instance occur at the same time, Multi-AZ doesn't offer additional availability during storage updates. For more information about storage modifications and potential downtime, see Settings for DB instances.There's also no downtime when you change the storage type of a Multi-AZ DB instance between General Purpose (SSD) and Provisioned IOPS (SSD). However, there is downtime in the following scenarios:From General Purpose (SSD) to Magnetic, or from Magnetic to General Purpose (SSD).From Provisioned IOPS (SSD) to Magnetic, or from Magnetic to Provisioned IOPS (SSD).From General Purpose (SSD) to Provisioned IOPS (SSD), but only if the DB instance is Single-AZ and you're using a custom parameter group.From Provisioned IOPS (SSD) to General Purpose (SSD), but only if the DB instance is Single-AZ and you're using a custom parameter group.Updating the DB instance classBecause an instance class change requires a newly defined set of hardware, this change isn't an online operation, and therefore requires downtime. A Multi-AZ deployment of an Amazon RDS MySQL DB instance can significantly reduce any impact. This is because the update doesn't happen simultaneously to the primary and standby. The standby instance is first modified, causing a failover. After the failover, the new standby is modified. The downtime required includes the duration of a failover completion, typically 60-120 seconds,  and completion of the DB engine's crash recovery. For more information, see Multi-AZ deployments.Upgrading the DB engine versionA DB engine version upgrade can be scheduled manually through the RDS console or API. Or, the DB engine upgrade occurs through an automatic minor version upgrade or after an engine deprecation. Because RDS MySQL doesn’t automate rolling upgrades, the DB engine version upgrade happens to both the primary and standby hosts at the same time. Therefore, a DB engine version upgrade doesn't benefit from a Multi-AZ deployment. To assess the scope and duration of impact, perform the upgrade in a staging environment before performing the actual upgrade. For more information, see Best practices for upgrading Amazon RDS for MySQL and Amazon RDS for MariaDB.Note: If your RDS MySQL DB instance uses read replicas, you must upgrade all the read replicas before upgrading the source instance. For more information, see Using a read replica to reduce downtime when upgrading a MySQL database.Performing a scheduled OS or hardware maintenanceWhen working with scheduled OS or hardware maintenance, Multi-AZ deployment can significantly reduce the impact of these changes.Multi-AZ deployment impacts scheduled maintenance in the following ways:When maintenance is scheduled for only the primary host, a failover occurs and maintenance is performed on the new secondary host.When maintenance is scheduled for only the secondary host, there is no downtime.When maintenance is scheduled for both the primary and secondary hosts, maintenance is performed on the secondary (standby) host first. Then, a failover occurs, and maintenance is performed on the new secondary host.For more information, see How do I minimize downtime during required Amazon RDS maintenance?Follow"


Question: How do I retrieve log data from CloudWatch Logs?

I want to find log data for my Amazon Web Services (AWS) account. What are the best practices for getting log data from Amazon CloudWatch Logs?

Answer: "I want to find log data for my Amazon Web Services (AWS) account. What are the best practices for getting log data from Amazon CloudWatch Logs?Short descriptionThere are four methods that are best practices for retrieving log data from CloudWatch Logs. You can use any one of these four, depending upon your use case:Use subscription filters to stream log data to another receiving source in real timeRun a query with CloudWatch Logs InsightsExport log data to Amazon Simple Storage Service (Amazon S3) for batch use casesCall GetLogEvents or FilterLogEvents in the CloudWatch APIResolutionUse subscription filtersTo immediately retrieve log data from CloudWatch Logs in real time, you can use subscription filters. For more information, see Real-time processing of log data with subscriptions and Using CloudWatch Logs subscription filters.Filtering for log events is performed internally, which prevents CloudWatch API throttling. Amazon Kinesis Data Streams automatically retries throttled service API calls.Run a query in CloudWatch Logs InsightsTo quickly search and analyze your log data, run a query in CloudWatch Logs Insights.Export log data to Amazon S3 (batch use cases)To move log data from CloudWatch Logs to Amazon S3 in batch use cases, see Exporting log data to Amazon S3. Log data can take up to twelve hours to become available for export from CloudWatch Logs. For real-time analysis and processing, use subscription filters.Important: An AWS account can have only one export task for log data in the state PENDING, PENDING_CANCEL, or RUNNING.Call GetLogEvents or FilterLogEventsTo find log data manually, use GetLogEvents or FilterLogEvents in the CloudWatch API.Important: This method isn’t scalable due to the transactions per second (TPS) quotas for GetLogEvents and FilterLogEvents. For current quotas, see CloudWatch Logs quotas. If you experience throttling when performing these actions, use subscription filters instead.Related informationWhat is Amazon CloudWatch Logs?Follow"


Question: How do I set Spark parameters in Amazon EMR?

I want to configure Apache Spark parameters in Amazon EMR.

Answer: "I want to configure Apache Spark parameters in Amazon EMR.Short descriptionThere are two methods for configuring Spark applications:Use command line arguments such as the spark-submit command to avoid hardcoding values.Configure the values in the spark-defaults.conf file to makes the changes permanent.ResolutionConfigure Spark parameters using spark-submitThe Spark shell and spark-submit command supports two ways to load configurations dynamically:Use command line options, such as --num-executors.Use the flag --conf.Note: Run spark-submit--help to show the complete options list.The spark-submit command also reads the configuration options from spark-defaults.conf, In the spark-defaults.conf file, each line consists of a key and a value separated by white space.For more information, see Submitting user applications with spark-submit.For more information on the parameters supported by Spark, see Spark configuration.The following are some of the most common configuration options:--class <main-class> \--master <master-url>--deploy-mode <deploy-mode> --conf <key>=<value> --num-executors <value> \--executor-memory <value>G \--driver-memory <value>G \--executor-cores <number of cores> \--driver-cores <number of cores> \--jars <Comma-separated list of jars> \--packages <Comma-separated list of Maven coordinates> \--py-files < Comma-separated list of .zip, .egg, or .py files to place on the PYTHONPATH for Python apps> \When using spark-submit, the application JAR, and any JARs included with the --jars option are automatically transferred to the cluster. URLs supplied after --jars must be separated by commas. The list is included in the driver and executor class paths and the JARs and files are copied to the working directory for each SparkContext on the executor nodes. Keep in mind that directory expansion doesn't work with --jars.Examplespark-submit --deploy-mode cluster --class org.apache.spark.examples.SparkPi --conf spark.dynamicAllocation.enabled=false --master yarn --num-executors 4 --driver-memory 4G --executor-memory 4G --executor-cores 1 /usr/lib/spark/examples/jars/spark-examples.jar 10You can pass the memory parameters using the flag --conf as shown in the following example:spark-submit --deploy-mode cluster --class org.apache.spark.examples.SparkPi --conf spark.dynamicAllocation.enabled=false --master yarn >--conf spark.driver.memory=1G --conf spark.executor.memory=1G /usr/lib/spark/examples/jars/spark-examples.jar 10Launch spark-shell and pyspark shell using custom Spark parametersTo launch spark-shell or pyspark shell, run the following commands:spark-shellspark-shell --conf spark.driver.maxResultSize=1G --conf spark.driver.memory=1G --deploy-mode client --conf spark.executor.memory=1G --conf spark.executor.heartbeatInterval=10000000s --conf spark.network.timeout=10000001s --executor-cores 1 --num-executors 5 --packages org.apache.spark:spark-avro_2.12:3.1.2 --conf 'spark.serializer=org.apache.spark.serializer.KryoSerializer'pyspark shellpyspark --conf spark.driver.maxResultSize=1G --conf spark.driver.memory=1G --deploy-mode client --conf spark.executor.memory=1G --conf spark.executor.heartbeatInterval=10000000s --conf spark.network.timeout=10000001s --executor-cores 1 --num-executors 5 --packages org.apache.spark:spark-avro_2.12:3.1.2 --conf 'spark.serializer=org.apache.spark.serializer.KryoSerializer'Configure Spark parameters using spark-defaults.confTo make the configuration changes permanent, append the configuration to the file /etc/spark/conf/spark-defaults.conf. Then, restart the Spark History Server. The following example configures the executor memory and driver memory in spark-defaults.conf. In this example, each line consists of a key and a value separated by white space.Examplespark.executor.memory      9486M spark.driver.memory     9486MThe following example configuration configures the Spark driver and executor memory during cluster launch:{  "Classification": "spark-defaults",  "Properties": {    "spark.executor.memory": "9486M",    "spark.driver.memory": "9486M"    }  }]Related informationBest practices for successfully managing memory for Apache Spark applications on Amazon EMRAdd a Spark stepModify your cluster on the fly with Amazon EMR reconfigurationFollow"


Question: How do I resolve circular dependencies with AWS Serverless Application Model (SAM) templates in CloudFormation?

"If I deploy an AWS Serverless Application Model (SAM) template in AWS CloudFormation, I get an error similar to the following: "Circular dependency between resources: [Function, Bucket, FunctionRole, FunctionUploadPermission].""

Answer: "If I deploy an AWS Serverless Application Model (SAM) template in AWS CloudFormation, I get an error similar to the following: "Circular dependency between resources: [Function, Bucket, FunctionRole, FunctionUploadPermission]."Short descriptionYou get an error in CloudFormation if you use the following example AWS SAM template:AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: Circular DependencyResources:  Bucket:    Type: AWS::S3::Bucket    Properties:      BucketName: !Sub "{AWS::StackName}-${AWS::Region}-${AWS::AccountId}"  Function:    Type: AWS::Serverless::Function    Properties:      CodeUri: s3://mybucket/function.zip      Runtime: nodejs12.x      Handler: index.handler      Policies:        - Version: 2012-10-17          Statement:            - Effect: Allow              Action: s3:GetObject*              Resource: !Sub "arn:aws:s3:::${Bucket}*"      Events:        Upload:          Properties:            Bucket:              Ref: Bucket            Events: s3:ObjectCreated:*          Type: S3The template produces an error because it creates the following circular dependency:The Bucket resource depends on the FunctionUploadPermission.The FunctionUploadPermission depends on the Function.The Function depends on the FunctionRole.FunctionRole depends on the Bucket resource, which creates a loop.Note: In the error message, the FunctionUploadPermission resource is of type AWS::Lambda::Permission. This resource is generated by AWS SAM automatically when the Events property for AWS::Serverless::Function is specified. The FunctionRole resource is of type AWS::IAM::Role. This resource is generated by AWS SAM automatically when the Role property for AWS::Serverless::Function is not specified.To resolve the circular dependency, you must break the loop by replacing the dynamic reference to the bucket resource.ResolutionReplace the CloudFormation template that has a circular dependency with the following template:Permission is hereby granted, free of charge, to any person obtaining a copy of thissoftware and associated documentation files (the "Software"), to deal in the Softwarewithout restriction, including without limitation the rights to use, copy, modify,merge, publish, distribute, sublicense, and/or sell copies of the Software, and topermit persons to whom the Software is furnished to do so.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHTHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTIONOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THESOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.AWSTemplateFormatVersion: '2010-09-09'Transform: AWS::Serverless-2016-10-31Description: Circular DependencyResources:  Bucket:    Type: AWS::S3::Bucket    Properties:      BucketName: !Sub "${AWS::StackName}-${AWS::Region}-${AWS::AccountId}"  Function:    Type: AWS::Serverless::Function    Properties:      CodeUri: s3://mybucket/function.zip      Runtime: nodejs12.x      Handler: index.handler      Policies:        - Version: 2012-10-17          Statement:            - Effect: Allow              Action: s3:GetObject*              Resource: !Sub "arn:aws:s3:::${AWS::StackName}-${AWS::Region}-${AWS::AccountId}*"      Events:        Upload:          Properties:            Bucket:              Ref: Bucket            Events: s3:ObjectCreated:*          Type: S3In the template, the bucket namein the policy statement's Resources section uses the same pseudo parameters used in the bucket resource’s BucketName property. Now, you can pass the bucket name without referencing that bucket directly. Consequently, the error is resolved because the circular dependency loop is broken. That is, the circular dependency loop that resulted from the FunctionRole depending on the Bucket resource.Note: Replace s3://mybucket/function.zip with your file location.Related informationFn::Sub (intrinsic function)Ref (intrinsic function)AWS::Serverless::FunctionAWS::S3::BucketFollow"


Question: Why can't I select my preferred alias target when creating a Route 53 alias resource record set?

"I'm creating an Amazon Route 53 alias resource record set in the Route 53 console, but I can't select my preferred resource from the Alias Target list."

Answer: "I'm creating an Amazon Route 53 alias resource record set in the Route 53 console, but I can't select my preferred resource from the Alias Target list.Short descriptionIf no resources are available when creating an alias record using the Route 53 console, then the Alias Target list shows the message No Targets Available. Verify the following:Route 53 supports your resource as an alias target.The resource is on the same AWS account as your Route 53 hosted zone.If you're routing to an Amazon CloudFront distribution, the resource record name matches a CNAME in the CloudFront distribution.If you're routing to an Amazon Simple Storage Service (Amazon S3) bucket, the resource record name matches the Amazon S3 bucket name.ResolutionVerify that Route 53 supports your resourceTo verify that Route 53 supports your resource and that you've configured your resource correctly, see Value/route traffic to.Verify that you're routing to resources on the same accountTo route to resources on a different AWS account, enter a value that identifies the resource.For example, to use an Amazon CloudFront distribution as an alias target, enter the CloudFront domain name.Check CloudFront distribution namesBefore routing to CloudFront distributions, be sure that the name of the resource record that you create matches a CNAME in the CloudFront distribution.For example, if the record name is example.com, then your CloudFront distribution must use example.com as one of its alternate domain names.Check S3 website endpoint namesMake sure that the name of the resource record for your Amazon S3 website endpoint matches the name of your Amazon S3 bucket. Also, configure your bucket for website hosting.For example, if your bucket's name is AWSDOC-EXAMPLE-BUCKET, the record name must also be AWSDOC-EXAMPLE-BUCKET.Related informationValues specific for simple alias recordsFollow"


Question: How do I list the attachments or detachments history of a specific Amazon EBS volume using AWS CLI commands?

How do I list the attachments or detachments history of a specific Amazon Elastic Block Storage (Amazon EBS) volume using AWS Command Line Interface (AWS CLI)?

Answer: "How do I list the attachments or detachments history of a specific Amazon Elastic Block Storage (Amazon EBS) volume using AWS Command Line Interface (AWS CLI)?Short descriptionAmazon Elastic Compute Cloud (Amazon EC2) and Amazon EBS resources don't store the history of attachments or detachments. However, AWS CloudTrail does keep this information. CloudTrail is a service that records AWS API calls and events for AWS accounts. You can use the AWS CloudTrail API through the AWS CLI to pull the attachment and detachment log.Amazon EBS volumes attached and detached using RunInstances and TerminateInstances API calls don't have individual CloudTrail events. These events don't appear in the CloudTrail lookup-events API output.ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Run the CloudTrail lookup-events API. This command uses the AWS CLI JSON processor (JMESPath) to search for Attach and Detach events.There are two methods you can use to return the data.Print Unix Epoch timestamp1.    Run the following command:$ aws cloudtrail lookup-events \--lookup-attributes AttributeKey=ResourceName,AttributeValue=VOLUME_ID \--max-results 3 \--region REGION_ID \--query 'Events[?EventName == `DetachVolume` || EventName == `AttachVolume`].{EventTime:EventTime,EventName:EventName,InstanceID:(Resources[1].ResourceName)}'Replace VOLUME_ID with your Amazon EBS volume and REGION_ID with the appropriate Region. Use the max-results variable to set the number of Amazon EBS volume events returned. The default number of results returned is 50, with a maximum of 50 possible.2.    CloudTrail displays the timestamps in Unix Epoch time. Use one of the following methods to convert the timestamp into UTC:macOS:Remove the decimal point from the timestamp, then run the following command:$ date -r 1571065747 -uMon Oct 14 15:09:07 UTC 2019Linux:Run the following command:$ date -d @1571065747.0 -uMon Oct 14 15:09:07 UTC 2019Windows:Convert the timestamp using a converter, such as epochconverter.com.Print human-readable timestamp in UTC time zoneNote: This method uses the sed utility and the jq processor, and it is recommended for Linux users only.The sed utility is used to transform the CloudTrail Event value into a JSON-friendly layout. Most Linux distributions come with the sed utility already installed. You can download the utility from the GNU sed website if it's not installed.The jq processor is used to search for and return the values for EventName, InstanceID, and EventTime. You can download it from the jq processor website if you don't have it installed.Run the following command:$ aws cloudtrail lookup-events \--lookup-attributes AttributeKey=ResourceName,AttributeValue=VOLUME_ID \--max-results 3 \--region REGION_ID \--query 'Events[?EventName == `DetachVolume` || EventName == `AttachVolume`].CloudTrailEvent' | \sed 's/\\//g' | sed 's/"}"/"}/g' | sed 's/"{"/{"/g' | \jq '.[] | {EventName:.eventName, InstanceID:.requestParameters.instanceId, EventTime:.eventTime}'Replace VOLUME_ID with your Amazon EBS volume and REGION_ID with the appropriate Region. Use the max-results variable to set the number of Amazon EBS volume events returned. The default number of results returned is 50, with a maximum of 50 possible.See the following example output:{  "EventName": "AttachVolume",  "InstanceID": "i-00a49ef5dd45af31b",  "Time": "2019-10-02T15:36:18Z"}{  "EventName": "DetachVolume",  "InstanceID": "i-0554d4452aa4cf91b",  "Time": "2019-10-02T14:26:04Z"}{  "EventName": "AttachVolume",  "InstanceID": "i-0554d4452aa4cf91b",  "Time": "2019-10-02T14:25:42Z"}**Note:**CloudTrail has a default search history length of 90 days. Any event older than 90 days doesn't appear. To retain your event logs longer than 90 days:1.    Create your own Trail in CloudTrail.2.    Store the logs in an Amazon Simple Storage Service (Amazon S3) bucket.3.    Use Amazon Athena to query the logs in your Amazon S3 bucket.Related informationAWS CLI command reference - Lookup-eventsViewing CloudTrail events with the AWS CLIFollow"


Question: How do I troubleshoot SageMaker notebook instance connectivity issues?

I'm unable to launch an Amazon SageMaker notebook and I see intermittent errors.

Answer: "I'm unable to launch an Amazon SageMaker notebook and I see intermittent errors.Short descriptionWhen opening a SageMaker Jupyter notebook, the notebook might become unresponsive or display errors.Some common causes for this are:SageMaker can't establish connection between Jupyter and its browser.The Notebook kernel reached its defined timeout period.Resource utilization load.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Can't establish connection between Jupyter and the browserSometimes when opening a Jupyter notebook, you receive the following error:"A connection to the notebook server could not be established. The notebook will continue trying to reconnect. Check your network connection or notebook server configuration."This message occurs when there's a connection issue between Jupyter and the browser. To troubleshoot the connection failed message, do the following:Restart your notebook instance. It's a best practice to regularly restart notebook instances. Restarting helps keep notebook instance software updated. When you restart, the notebook instance moves to a new host. Restarting the notebook also helps to resolve HTTP 503 and 504 errors in the browser.Restart your browser, clear your browser cache, or try a different browser.Use a different network connection.Check if the firewall, proxy, or antivirus software is blocking the connection.Check the log of all WebSockets in your browser. This setting is typically found in the developer mode of the browser.Temporarily turn off all browser extensions, and then try again.Notebook kernel reached its defined timeout periodThe Jupyter notebook session token has a maximum validity of 12 hours. After the token expires, the session times out and must be refreshed to reset the timeout token. However, the Jupyter kernel continues to run even if the browser disconnects.To mitigate the effects of the 12-hour token, do the following:Write the results of program to a file instead of using stdout.Convert your program to a Python script, and then run it.Make a call to CreatePresignedNotebookInstanceURL to generate a new URL with AuthToken. Next, paste the new URL in your browser before the session expires. This generates a new 12-hour session token:aws sagemaker create-presigned-notebook-instance-url —notebook- instance-name <instance name> }"AuthorizedUrl": "https:// name>.notebook. <region>.sagemaker.aws? AuthToken=<authToken>"{Go directly to AuthorizedUrl. This is the same as choosing Open Jupyter from the SageMaker console.You can modify the URL to add "view=Lab&" to the following form to open JupyterLab:"https:// name>.notebook..sagemaker.aws? view=Lab&AuthToken="Reached the limit of resource utilizationCheck the system resources for your SageMaker notebook instance to make sure that they’re running at acceptable load levels. To check SageMaker notebook instance resources, enter following commands in the Notebook terminal:To check memory utilization:free -hTo check CPU utilization:topTo check disk utilization:df -hIf you see high utilization of CPU, memory, or disk utilization, then try these solutions:Restart the notebook instance and try again.Review your SageMaker notebook instance type to verify that it's properly scoped and configured for your jobs.Related informationTroubleshoot problems with opening an Amazon SageMaker Jupyter notebookTroubleshoot insufficient capacity error in Amazon SageMakerFollow"


Question: How do I automate the AWS DMS error log deletion process to avoid storage-full on my replication instance?

I want to automate the AWS Database Migration Service (AWS DMS) error log deletion process to delete more often. How can I do this?

Answer: "I want to automate the AWS Database Migration Service (AWS DMS) error log deletion process to delete more often. How can I do this?Short descriptionIf your AWS DMS error logs take up a lot of space in your DMS replication instance, the replication instance might go into the storage-full state. To fix this, delete the DMS task error logs for your DMS tasks.You can delete the error log for your AWS DMS task using one of the following methods:Using the AWS DMS consoleUsing the AWS Command Line Interface (AWS CLI)Using API (implemented with Python in this example)Note: There are a number of other reasons why storage-full can occur. For more information on resolving storage-full issues with AWS DMS, see Why is my AWS DMS replication DB instance in the storage-full status?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Delete error log using the AWS DMS ConsoleTo delete the error log of your DMS task manually, see How do I enable, access, and delete Amazon CloudWatch logs for AWS DMS?Delete error logs using the AWS CLIYou can delete your DMS task logs by modifying your task settings using the following AWS CLI command:aws dms modify-replication-task --replication-task-arn <DMS task ARN> --replication-task-settings '{"Logging": { "DeleteTaskLogs": true}}'This command modifies the task by changing the "DeleteTaskLogs": true parameter. After you add the task setting with this parameter and value, all logs present for this task are deleted from the replication instance. After the logs are deleted, the task settings remove the "DeleteTaskLogs": true parameter. After running this command, confirm that the logs are deleted from the replication instance.To delete the logs periodically, modify the task setting with the "DeleteTaskLogs": true parameter, every time. You can schedule this AWS CLI command to run periodically using cronjob. For more information about modifying task setting, see modify-replication-task in the AWS CLI Reference.Automate task log deletion process using API (Lambda)AWS DMS task logs are deleted every seven days for all replication instances. To delete the logs more often, you can create a script and automate the process to run every day, or at the frequency you want. This example uses simple Python code to automate the task error log deletion for the provided task ARN using AWS Lambda.Set up the Lambda functionTo set up the Lambda function, perform the following steps:1.    Open the Lambda console, and then choose the AWS Region containing your DMS resources.2.    From the Functions panel, choose Create function.3.    Enter a Function name.4.    For Runtime, choose python 3.8.5.    For Change default execution role, choose Create a new role with basic Lambda permissions. Note the AWS Identity and Access Management (IAM) role name that Lambda creates.6.    Choose Create function.7.    Open the AWS IAM console, and then open the IAM role that the Lambda function created.8.    Create an IAM policy using the following JSON. Make sure to replace the task ARN for Resource:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "dms:ModifyReplicationTask"            ],            "Resource": "arn:aws:dms:us-east-1:1234567890:task:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"        }    ]}9.    Attach the newly created policy to the role created by the Lambda function.10.    Open the Lambda console, and then choose the Lambda function you created.11.    For Function code, enter the following code, and then click Deploy:import boto3import jsonclient = boto3.client('dms')def lambda_handler(event, context):    # specific task ARN    taskarn = 'arn:aws:dms:us-east-1:1234567890:task:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'    # modify the DMS task    response = client.modify_replication_task(        ReplicationTaskArn=taskarn,        ReplicationTaskSettings='{"Logging": { "DeleteTaskLogs": true}}'    )12.    Choose Test, and then enter Event name with the default template.13.    Choose Create.14.    Choose Test again, and the code runs without errors.After performing these steps, the DMS task status changes to Modifying. At the same time, you can see that the DMS task error logs under the replication instance are deleted.Automate using Lambda SchedulerTo automate the deletion of DMS task error logs using Lambda Scheduler, perform the following steps:1.    Open the Lambda console, and then choose the Lambda function you created.2.    For Designer, choose Add trigger.3.    From the dropdown list, choose EventBridge (Cloudwatch Events).4.    For Rule, choose Create a new rule.5.    Enter Rule name and Rule description.6.    To run the code every seven days, for schedule expression, enter rate (7 days). For more flexible expressions, see Schedule expressions using rate or cron.7.    Choose Add.After completing these steps, the automation is set up to delete the specified DMS logs once every seven days.Note: You can change and optimize this code as per your business requirement. You can also schedule this script to run periodically using cronjob or Lambda scheduler.Related informationWhy is my AWS DMS replication DB instance in the storage-full status?How do I enable, access, and delete CloudWatch logs for AWS DMS?Follow"


Question: How can I disable temporary credentials access while using query editor in Amazon Redshift?

I don't want users connecting to the Amazon Redshift query editor using temporary credentials. How can I disable temporary credentials access to the query editor?

Answer: "I don't want users connecting to the Amazon Redshift query editor using temporary credentials. How can I disable temporary credentials access to the query editor?Short descriptionYou can connect to an Amazon Redshift cluster with the query editor using:AWS Secrets Manager.-or-AWS Identity and Access Management (IAM) temporary credentials.For more information, see Connecting with the query editor.ResolutionFollow these instructions to create an IAM policy to restrict access to the query editor with temporary credentials.1.    Open the IAM console.2.    If you haven't already done so, create an IAM user.3.    In the navigation pane, choose Users.4.    In User name, choose the IAM user that you want to use to prevent access to the query editor.5.    Choose the Permissions tab, and then choose Add inline policy.6.    Choose the JSON policy tab, and then paste the following policy:Note: Replace account ID, cluster name, db-name, db-group, and db-user with your variables.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Deny",      "Action": "redshift:GetClusterCredentials",      "Resource": [        "arn:aws:redshift:<region>:<account ID>cluster:<cluster name>"        "arn:aws:redshift:<region>:<account ID>:dbname:<cluster name>/<db-name>",        "arn:aws:redshift:<region>:<account ID>:dbgroup:<cluster name>/<db-group>",        "arn:aws:redshift:<region>:<account ID>:dbuser:<cluster name>/<db-user>"      ]    }  ]}7.    Choose Review policy.8.    For Name, enter a name for the policy, and then choose Create policy.Attempts to access the query editor using this IAM user with temporary credentials receive an error similar to the following:"Databases couldn't be listed".For more information, see Create an IAM role or user with permissions to call GetClusterCredentials.Related informationWhy can't I connect to the Amazon Redshift query editor?Resource policies for GetClusterCredentialsFollow"


Question: How do I configure my Amazon ECS task to assume an IAM role in another AWS account?

I want to set up my Amazon Elastic Container Service (Amazon ECS) task to assume an AWS Identity and Access Management (IAM) role in another account.

Answer: "I want to set up my Amazon Elastic Container Service (Amazon ECS) task to assume an AWS Identity and Access Management (IAM) role in another account.Short descriptionYou might set up your Amazon ECS task to assume an IAM role in another account to do either of the following:Access resources, such as an Amazon Simple Storage Service (Amazon S3) bucket.Perform tasks, such as describing a resource and starting or stopping instances, through API calls.To allow your Amazon ECS task to assume an IAM role in another AWS account, do the following:Configure an IAM role in the source account.Modify the trust policy of the destination account's IAM role to allow the source account's IAM role to assume the IAM role in the destination account.Create a task definition in the source account, and define the IAM role created in step 1 as the Amazon ECS task role.ResolutionThe examples used in this article reference two different AWS accounts:A source account that hosts the Amazon ECS task (example: 1111222233334444)A destination account that includes the IAM role (example: destination-account-role) that the Amazon ECS task assumes (example: 5555666677778888)Configure the IAM role in the source accountUse the instructions in Adding and removing IAM identity permissions to add the following policy statement to your Amazon ECS task role (example: my-ECS-task-role). Doing so allows the ECS task role to assume the IAM role in the destination account.Note:Replace 5555666677778888 with the account ID of the cross-account role that your task needs to assume.Replace destination-account-role with the name of the assumed role.{  "Version": "2012-10-17",  "Statement": {    "Effect": "Allow",    "Action": "sts:AssumeRole",    "Resource": "arn:aws:iam::5555666677778888:role/destination-account-role"  }}Modify the trust policy of the IAM role in the destination accountUse the instructions in Modifying a role trust policy (console) to add the following policy statement to your cross-account IAM role's (destination-account-role) trust policy in the destination account.Note:Replace 1111222233334444 with the account ID of the source account where the ECS task IAM role exists.Replace my-ECS-task-role with the name of your ECS IAM task role.{  "Version": "2012-10-17",  "Statement": [{    "Effect": "Allow",    "Principal": {      "AWS": "arn:aws:iam::1111222233334444:role/my-ECS-task-role"    },    "Action": "sts:AssumeRole"  }]}Create the task definitionCreate a task definition file similar to the following (example-task-def.json), and use the ARN of the source account's IAM role (my-ECS-task-role) for taskRoleArn:{  "containerDefinitions": [    {      "name": "test",      "image": "your-test-image",      "cpu": 100,      "memory": 200,      "essential": true    }  ],  "family": "verify-assume-cross-account-role",  "taskRoleArn": "arn:aws:iam::1111222233334444:role/my-ECS-task-role"}Run the following command to register the task definition using the example-task-def.json file:aws ecs register-task-definition —cli-input-json file://example-task-def.jsonNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.After completing the preceding steps, you can run a standalone task to assume an IAM role on the destination account using the AWS Command Line Interface (AWS CLI). Or, you can use the credential_source settings in the AWS CLI config file to specify where the AWS CLI can find credentials to assume the IAM role attached to the ECS container. With this setting, the task can assume the role without having to export new credentials. For more information, see Assume role credentials.Verify that the container within the task can assume the IAM role in the destination account and access the resource1.    Run the task using the task definition that you created.If you are running the task on Amazon Elastic Compute Cloud (Amazon EC2), then use the docker exec command to get into the container to perform the testing.If you are running task on AWS Fargate, then use the ECS Exec feature to get into the container to perform the testing.2.    Configure the AWS CLI config file, and then verify that the task assumes the IAM role in the destination account:Using the ECS exec command to access the container$ aws ecs execute-command --cluster example-cluster --task example-taskID --container test --interactive --command "/bin/bash"The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.Starting session with SessionId: ecs-execute-command-064a40c5149cecc32# Create AWS CLI config filebash-4.2# mkdir /root/.awsbash-4.2# cat <<EOF > /root/.aws/config[profile cross-account]role_arn = arn:aws:iam::5555666677778888:role/destination-account-rolecredential_source = EcsContainerEOF# Check the current task IAM rolebash-4.2# aws sts get-caller-identity{  "UserId": "AROA4SHE6JAGEAYNUH6ST:8ee54a7f5c474a3f93ee28474486402f",  "Account": "1111222233334444",  "Arn": "arn:aws:sts::1111222233334444:assumed-role/my-ECS-task-role/8ee54a7f5c474a3f93ee28474486402f"}# Assume the cross-account IAM rolebash-4.2# aws sts get-caller-identity --profile cross-account{  "UserId": "AROA3A44JRHY6FFSMMJKN:botocore-session-1647426859",  "Account": "5555666677778888",  "Arn": "arn:aws:sts::5555666677778888:assumed-role/destination-account-role/botocore-session-1647426859"}# Verify that you can list the resources in cross-account in the taskbash-4.2# aws ecs list-clusters --profile cross-account{  "clusterArns": [    "arn:aws:ecs:us-east-1:5555666677778888:cluster/default"  ]}If your outputs look similar to those listed, then the ECS task in account 1111222233334444 can assume the IAM role in account 5555666677778888 to list the ECS cluster resources.Related informationIAM roles for tasksIAM tutorial: Delegate access across AWS accounts using IAM rolesAWS SDKs and tools that use the shared config and credentials filesCredential file settingsFollow"


Question: How do I assign a custom primary private IP address to my Amazon EC2 instance?

I want to assign a custom primary private IP address to my Amazon Elastic Compute Cloud (Amazon EC2) instance.

Answer: "I want to assign a custom primary private IP address to my Amazon Elastic Compute Cloud (Amazon EC2) instance.Short descriptionYou can associate a custom private IP address to your Amazon EC2 instance while you configure the instance before you launch it. However, the IP address must meet these conditions:Have a valid IPv4 range.Be within the CIDR range of the chosen subnet.Be available. The private IP address must not be tied to any other resource.Note: It's not possible to assign a new custom primary private IP address to an existing instance.ResolutionConfigure an Amazon EC2 instance. For detailed steps, see Launch an instance using the old launch instance wizard or Launch an instance using the new launch instance wizard.In the Configure Instance Details section, for Network, select a virtual private cloud (VPC), or create a new VPC. For Subnet, select the subnet, or create a new subnet where you want to launch your instance.In the Network interfaces section, for Primary IP (the primary private IPv4 address of the network interface), enter the custom private IPv4 address.Complete the launch instance wizard configurations, and then launch the instance.Related informationVPCs and subnetsFollow"


Question: How do I migrate API Gateway REST APIs between AWS accounts or Regions?

I want to migrate my Amazon API Gateway REST API between AWS accounts or Regions. How do I do that?

Answer: "I want to migrate my Amazon API Gateway REST API between AWS accounts or Regions. How do I do that?Short descriptionExport a REST API from API Gateway to an OpenAPI 2.0 (Swagger) or OpenAPI 3.0 definition file. Then, import the API to API Gateway in another account or Region.Important: To import a REST API, you must also recreate any integrated API resources in the destination account or Region.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Export the API using either the API Gateway console or AWS CLITo export an API using the API Gateway console1.    In the API Gateway console, choose your API.2.    Deploy your API to a stage.3.    In the Stage Editor pane, choose the Export tab.4.    For Export as, choose Swagger or OpenAPI3.5.    Based on your use case, pause on one of the following:Export as Swagger + API Gateway ExtensionsExport as OpenAPI 3 + API Gateway ExtensionsYour OpenAPI definition appears in the console.6.    Choose JSON or YAML to download the OpenAPI definition as your preferred file type.To export an API using the AWS CLIRun the following get-export command:Important: Change the values of the command options --parameters, --export-type, and --accept to match your preferred export format.aws apigateway get-export --parameters extensions='integrations' --rest-api-id a1b2c3d4e5 --stage-name dev --export-type swagger --accept application/yaml /path/to/filename.yamlFor more information, see Export a REST API from API Gateway. Also, get-export (AWS CLI command reference).Update the Amazon Resource Names (ARNs) of API resources in your exported OpenAPI definitionChange the ARNs of API resources in your OpenAPI definition to the resource ARNs in the account and Region the API is migrating to.Example snippet of a Swagger template for an API with AWS Lambda integrationsImportant: To use this snippet, replace arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:12345678910:function:mylambda/invocations with the ARN of a Lambda function in the destination account."x-amazon-apigateway-integration": {          "uri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:12345678910:function:mylambda/invocations",          "responses": {            "default": {              "statusCode": "200"            }          }Import the API to API Gateway in another account or RegionTo import an API using the API Gateway console1.    Open the API Gateway console in the destination account or Region.2.    Choose Create API.3.    Under REST API, for Choose an API type, choose Import.4.    Under Import from Swagger or Open API 3, do either of the following:Choose Select Swagger File, then choose your updated OpenAPI definition file.-or-Paste your updated OpenAPI definition into the text editor field.5.    Under Settings, for Endpoint Type, choose one of the following based on your use case:RegionalEdge optimizedPrivate6.    Choose Fail on warnings to stop importing if there's an error or warning during import. Or, choose Ignore warnings to import the API whether there's an error or warning during import or not.To import an API using the AWS CLI1.    Configure the AWS CLI for the destination account or Region.2.    Run the following import-rest-api command:$ aws apigateway import-rest-api --endpointConfigurationTypes 'REGIONAL' --fail-on-warnings --body 'file:/// path/to/filename.json'For more information, see Import a REST API into API Gateway.Related informationTutorial: Create a REST API by importing an exampleFollow"


Question: What do I do if my Amazon SES emails fail DMARC validation for SPF alignment or DKIM alignment?

"The emails that I send using Amazon Simple Email Service (Amazon SES) are failing Domain-based Message Authentication, Reporting and Conformance (DMARC) validation for Sender Policy Framework (SPF) alignment or DomainKeys Identified Mail (DKIM) alignment. How can I fix this?"

Answer: "The emails that I send using Amazon Simple Email Service (Amazon SES) are failing Domain-based Message Authentication, Reporting and Conformance (DMARC) validation for Sender Policy Framework (SPF) alignment or DomainKeys Identified Mail (DKIM) alignment. How can I fix this?Short descriptionDMARC is an email authentication protocol that uses SPF and DKIM to detect email spoofing. To comply with DMARC, your messages must be authenticated through either SPF or DKIM, or both.For DMARC validation of SPF alignment or DKIM alignment, the key components in an email header are:A From address that's displayed to the message recipientA Mail From or Envelope From address that indicates where the message originated fromA d= domain in the DKIM signatureDMARC checks SPF alignment by matching the Mail From or Envelope From domain with the From domain. One of the following alignments must be met:Strict alignment: The Mail From or Envelope From domain is the same as the From domain.Relaxed alignment: The Mail From or Envelope From domain is a subdomain of the From domain.DMARC checks DKIM alignment by matching the d= domain in the DKIM signature and the From domain. One of the following alignments must be met:Strict alignment: The d= domain is the same as the From domain.Relaxed alignment: The d= domain is a subdomain of the From domain.ResolutionTo pass DMARC validation, your emails must comply with either SPF authentication or DKIM authentication.Use relaxed alignment for SPF or DKIM in your DMARC recordUsing relaxed alignment for either SPF or DKIM can help your emails pass DMARC validation.To determine your domain's DMARC alignment for SPF and DKIM, run the following command:nslookup -type=TXT _dmarc.example.comThe command returns your DMARC record, similar to the following:"v=DMARC1;p=quarantine;pct=25;rua=mailto:hello@example.com"For SPF, if the record doesn't include an aspf string (as in the preceding example), or the record includes the string aspf=r, then your domain uses relaxed alignment. If the record includes the stringaspf=s, then your domain uses strict alignment.For DKIM, if the record doesn't include an adkim string, or the record includes the string adkim=r, then your domain uses relaxed alignment. If the record includes the string adkim=s, then your domain uses strict alignment.The change from strict alignment to relaxed alignment must be made by your system administrator.Comply with DMARC through SPFTo get your SPF record, run the following command:nslookup -type=TXT example.comThe command returns your SPF record, similar to the following:"v=spf1 include:amazonses.com ~all"To be sure that your messages are compliant with DMARC through SPF, check the following:1.    Your messages must pass the SPF check. This means that your domain's SPF record must have "include:amazonses.com", which authorizes Amazon SES to send emails on behalf of your domain.2.    The domain in the From address of the email header must align with the Mail From or Envelope From domain that the sending mail server specifies to the receiving mail server.When you send emails using Amazon SES, the Mail From or Envelope From domain is amazonses.com by default, and your From domain is the domain that you verified. These values fail SPF alignment and DMARC validation.To resolve this, you must set up a custom MAIL FROM domain so that the Mail From value is a subdomain of your verified domain. For example, if your verified domain (the From domain) is example.com, then you can set up the custom Mail From domain to be mail.example.com. These values pass SPF alignment and DMARC validation.Note: With Amazon SES, you add the SPF record as part of your custom Mail From subdomain. For instructions, see Configuring the MAIL FROM domain.Comply with DMARC through DKIMWhen you use Easy DKIM in Amazon SES, you're given three CNAME records. To check the respective DKIM records, run the following command on each of the CNAMEs:nslookup -type=CNAME example1._domainkey.example.comThe command returns the DKIM record:example1.dkim.amazonses.com.To be sure that your messages are compliant with DMARC through DKIM, check the following:1.    The message must have a valid DKIM signature.2.    The From address in the email header must align with the d= domain in the DKIM signature.It's a best practice to set up Easy DKIM, because this feature allows you to meet both DMARC validation requirements through DKIM. You can also choose to manually sign your emails, but Amazon SES doesn't validate the DKIM signature that you construct.Follow"


Question: Why is the default value of the shared_buffers DB parameter for Aurora PostgreSQL higher than the default value for Amazon RDS PostgreSQL?

I want to understand the differences between default values of DB parameter groups for Amazon Aurora PostgreSQL and Amazon Relational Database Service (Amazon RDS) PostgreSQL?

Answer: "I want to understand the differences between default values of DB parameter groups for Amazon Aurora PostgreSQL and Amazon Relational Database Service (Amazon RDS) PostgreSQL?ResolutionPostgreSQL recommends using a reasonable starting value for shared_buffers of 25% of the memory in your system. However, you can change this value depending on your workload requirements. To find an appropriate value for shared_buffers for your workload, see the PostgreSQL documentation for Resource Consumption.PostgreSQL relies heavily on the operating system for its caching (double buffering). As a result, allocating more than 40% of RAM to shared_buffers is unlikely to perform better than a smaller value.For RDS DB instances, the default value of the DB parameter group is set to 25% of total memory. For Aurora DB instances, the default value of the DB parameter group is set between 50% and 75%, depending on the instance class. Default values for Aurora DB instances are higher because Aurora PostgreSQL eliminates double buffering and doesn't utilize file system cache. As a result, Aurora PostgreSQL can increase shared_buffers to improve performance. It's a best practice to use the default value of 75% for the shared_buffers DB parameter when using Aurora PostgreSQL. A smaller value can degrade performance by reducing the available memory to the data pages while also increasing I/O on the Aurora storage subsystem. For more information, see Amazon Aurora PostgreSQL reference.Note: You might need to reduce the value of the shared_buffers parameter for some workloads. For example, you might need to reduce the value if your workload accepts a large number of connections that is higher than the default value, or if you frequently use larger work_mem, maintenance_work_mem, and so on. However, a smaller value for shared_buffers means that the cache hit ratio is also lower. As a result, you might see an increase in access latency for database pages because of frequent storage access.Related informationWorking with parameter groupsFollow"


Question: How do I dynamically use parameters stored in Systems Manager with an AWS CloudFormation stack?

I have multiple parameter values stored in the AWS Systems Manager Parameter Store. I want to use these parameters dynamically in an AWS CloudFormation stack based on my requirements.

Answer: "I have multiple parameter values stored in the AWS Systems Manager Parameter Store. I want to use these parameters dynamically in an AWS CloudFormation stack based on my requirements.Short descriptionThe following resolution uses Microsoft Windows and Linux as example environments to demonstrate how to use different parameters dynamically in a CloudFormation stack.Important: When you use the following commands and template, make sure to replace Windows and Linux with your requirements.Resolution1.    Open the AWS Systems Manager console.2.    In the navigation pane, choose Parameter Store.3.    Create Systems Manager parameters as type String to store Amazon Machine Image (AMI) IDs for Linux or Windows.Linux:LinuxAmiId - AMI-Id-for-Linux-resources-or-Windows:WindowsAmiId - AMI-Id-for-Windows-resourcesNote: Replace AMI-Id-for-Linux-resources and AMI-Id-for-Windows-resources with the AMI IDs for your resources.4.    Use the following example CloudFormation template to create the parameter that selects which AMI to use for deployment: "Parameters": {    "AmiToUse": {      "Type": "String",      "AllowedValues": [        "windows",        "linux"      ]    }  },  "Conditions": {    "CreateWindowsResources": {      "Fn::Equals": [        "windows",        {          "Ref": "AmiToUse"        }      ]    }  },  "Resources": {    "EC2Instance": {      "Type": "AWS::EC2::Instance",      "Properties": {        "ImageId": {          "Fn::If": [            "CreateWindowsResources",            "{{resolve:ssm:WindowsAmiId:1}}",            "{{resolve:ssm:LinuxAmiId:1}}"          ]        }      }    }  }Note: In the preceding template, if AmiToUse is selected as windows, then the CreateWindowsResources condition evaluates to true. CloudFormation uses the value stored at WindowsAmiId to provision the AWS::EC2::Instance resource. For Linux, the condition evaluates to false, and CloudFormation uses the value stored at LinuxAmiId to provision the AWS::EC2::Instance resource.For more information on dynamic referencing, see Use dynamic references to specify template values.Related informationCloudFormation Workshop: Dynamic reference labFollow"


Question: How do I set up an email forwarding rule in WorkMail?

I want to create a rule in Amazon WorkMail that forwards my received email messages to another email address. How can I do this?

Answer: "I want to create a rule in Amazon WorkMail that forwards my received email messages to another email address. How can I do this?ResolutionYou can create a rule in your mailbox that forwards emails that match specific conditions to the intended party. Replies to the forwarded email will go to the email account that created the email forwarding rule.For instructions, see Working with email rules, and then follow the steps for To create an email forwarding rule.Note: Email rules don't work for recipients in Bcc.Related informationHow do I set up an email redirecting rule in WorkMail?Signing in to the Amazon WorkMail web clientAmazon WorkMail FAQsFollow"


Question: How do I use AWS DMS mapping rules to migrate an Oracle schema to PostgreSQL in lowercase?

"I want to move my Oracle database schema to PostgreSQL, but the casing isn't compatible. What are my options?"

Answer: "I want to move my Oracle database schema to PostgreSQL, but the casing isn't compatible. What are my options?Short descriptionOracle stores metadata in its data dictionary in uppercase, and PostgreSQL stores it in lowercase. With either database, it's possible to override these default formats by encasing object names in quotes when you create them. However, this isn't a best practice, because doing so can cause unexpected behavior. Because the AWS Database Migration Service (AWS DMS) can't autocorrect metadata storage formatting, AWS DMS creates the objects in quotes. As a workaround, you can override AWS DMS quotes with mapping rules. For more information, see Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to PostgreSQL.ResolutionThis example migrates the Oracle SCOTT schema to PostgreSQL. If you have an on-premises Oracle database, you can create this schema by running the following command:$ORACLE_HOME/rdbms/admin/utlsampl.sqlIf you have an Amazon Relational Database Service (Amazon RDS) DB instance that's running Oracle, search online for a similar script.This script creates four tables under the SCOTT schema: EMP, DEPT, BONUS, and SALGRADE. Collectively, they contain a small number of rows.Verify that no tables in the Oracle database were created with lowercase letters in the table or column names. If the application is accustomed to mixed-case table and column names, it's a best practice to allow AWS DMS to replicate the tables exactly as it finds them. For this reason, don't use these mapping rules.oracle> SELECT table_name from dba_tables where owner='SCOTT' and table_name <> upper(table_name);oracle> SELECT table_name, column_name from dba_tab_columns where owner='SCOTT' and column_name <> upper(column_name);Create endpoints and a replication instance:1.    Use the AWS DMS console or the AWS Command Line Interface (AWS CLI) to create the replication instance and then create the source and target endpoints.2.    Create a task. Be sure to choose Enable logging.3.    In the Table mappings view, select the JSON tab, and then choose Enable JSON editing. Then, use code similar to the following example to build the transformation rules for schema, tables, and column case handling. For more information, see Using table mapping to specify task settings.{  "rules": [    {      "rule-type": "selection",      "rule-id": "1",      "rule-name": "select-scott",      "object-locator": {        "schema-name": "SCOTT",        "table-name": "%"      },      "rule-action": "include"    },    {      "rule-type": "transformation",      "rule-id": "2",      "rule-name": "convert-schemas-to-lower",      "rule-action": "convert-lowercase",      "rule-target": "schema",      "object-locator": {        "schema-name": "%"      }    },    {      "rule-type": "transformation",      "rule-id": "3",      "rule-name": "convert-tables-to-lower",      "rule-action": "convert-lowercase",      "rule-target": "table",      "object-locator": {        "schema-name": "%",        "table-name": "%"      }    },    {      "rule-type": "transformation",      "rule-id": "4",      "rule-name": "convert-columns-to-lowercase",      "rule-action": "convert-lowercase",      "rule-target": "column",      "object-locator": {        "schema-name": "%",        "table-name": "%",        "column-name": "%"      }    }  ]}4.    Choose Create task.Note: You can also use a rename schema rule instead of converting the schema to lowercase.After the task is created, verify that all the objects are created in lowercase in PostgreSQL:postgres> select table_name from information_schema.tables where table_schema='scott'; table_name------------ bonus dept salgrade emp(4 rows)postgres> select table_name, column_name from information_schema.columns  where table_schema='scott' order by table_name; table_name | column_name------------+------------- bonus      | ename bonus      | job bonus      | sal bonus      | comm dept       | deptno dept       | dname dept       | loc emp        | deptno emp        | hiredate emp        | sal emp        | comm emp        | empno emp        | ename emp        | job emp        | mgr salgrade   | losal salgrade   | hisal salgrade   | grade(18 rows)Related informationAWS Database Migration Service step-by-step walkthroughsMigrate an on-premises Oracle database to Amazon RDS for PostgreSQL using an Oracle bystander and AWS DMSFollow"


Question: How do I troubleshoot common issues when using my Amazon MSK cluster with SASL/SCRAM authentication?

I'm facing issues with my Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster with SASL/SCRAM authentication enabled.

Answer: "I'm facing issues with my Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster with SASL/SCRAM authentication enabled.ResolutionYou're getting the ClusterAuthorizationException error in broker logsYou might see the following error message when you access your Amazon MSK cluster:org.apache.kafka.common.errors.ClusterAuthorizationException: Request Request(processor=11, connectionId=INTERNAL_IP-INTERNAL_IP-0, session=Session(User:ANONYMOUS,/INTERNAL_IP), listenerName=ListenerName(REPLICATION_SECURE), securityProtocol=SSL, buffer=null) is not authorized.You get this error when both the following conditions are true:Your Amazon MSK cluster has Simple Authentication and Security Layer (SASL)/Salted Challenge Response Mechanism (SCRAM) authentication enabled.You've set resourceType=CLUSTER and operation=CLUSTER_ACTION in the access control lists (ACLs) for your cluster.The Amazon MSK cluster doesn't support this setting because this setting prevents the internal Apache Kafka replication. With this setting, the identity of the brokers appear as ANONYMOUS for inter-broker communication. If you need your cluster to support these ACLs while using the SASL/SCRAM authentication, then you must grant the permissions for ALL operations to the ANONYMOUS user. This prevents the restriction of replication between the brokers. Use the following command to grant this permission to the ANONYMOUS user:./kafka-acls.sh --authorizer-propertieszookeeper.connect=example-ZookeeperConnectString --add --allow-principalUser:ANONYMOUS --operation ALL --clusterYou changed the user name and/or password for your AWS Secrets Manager secret, but the old credentials are still activeAn AWS Secrets Manager secret must be associated with a single user. If the user no longer needs access to the cluster, the secret must be dissociated, and the ACLs must be updated. When you update the user name on the secret, the old user name is not automatically dissociated. Therefore, it's a best practice to create a new secret for the new user. If you need to use the old secret, first dissociate the secret, and then update the credentials before associating the secret again. For more information, see Working with users.Non-admin users are able to create new ACLs and modify the existing ACLsBy default, any user can create or modify ACLs. To prevent non-admin users from creating or updating ACLs using Apache ZooKeeper, be sure to restrict access to Apache ZooKeeper by placing the zooKeeper nodes in a separate security group. Also, be sure all the Apache Kafka commands and client connections are run through bootstrap brokers instead of Apache ZooKeeper. Note that all Apache Kafka operations can be performed using the bootstrap string.Related informationApache Kafka ACLsScram secretsFollow"


Question: How can I turn on SSL on my Aurora PostgreSQL-Compatible DB instance and how can I connect to my instance using SSL certificates?

I want to connect to my Amazon Aurora PostgreSQL-Compatible Edition DB cluster using a Secure Socket Layer (SSL) connection.

Answer: "I want to connect to my Amazon Aurora PostgreSQL-Compatible Edition DB cluster using a Secure Socket Layer (SSL) connection.Short descriptionYou can encrypt a connection to your Aurora PostgreSQL-Compatible DB cluster from your application using either SSL or Transport Layer Security (TLS). SSL and TLS connections provide a single layer of security for your cluster, and encrypt the data that moves between your client and cluster. For more information, see Using SSL/TLS to encrypt a connection to a DB cluster.To be secure, SSL connections must be configured on both the client and server before you make the connection. If SSL is not configured on the server, then the client might send sensitive information like passwords. For more information on creating an SSL-secured connection, see the PostgreSQL documentation for SSL support.The SSL modes for PostgreSQL are:verify-fullverify-carequirepreferallowdisableFor more information on choosing the right SSL mode for your use case, see the PostgreSQL documentation for Protection provided in different modes.ResolutionAmazon Relational Database Service (Amazon RDS) creates the SSL or TLS certification for your cluster when you create it. For more information, see Security with Amazon Aurora PostgreSQL.Connect to your DB cluster over SSL/TLS1.    Download the SSL/TSL certificate.2.    Import the certificate into your operating system.3.    Connect to your Aurora PostgreSQL-Compatible DB cluster over SSL/TLS.See this example:psql -h DBInstance.cluster-Account-Number.eu-west-1.rds.amazonaws.com  -p 5432 "dbname=postgres user=postgres sslrootcert=global-bundle.pem sslmode=verify-full"When you set rds.force_ssl to 1 (on), your DB instance's pg_hba.conf file is modified to support the new SSL configuration. You can use the pg_hba_file_rules view to see the summary of contents of the pg_hba.conf file. The type value in the pg_hba_file_rules view is updated to hostssl after rds.force_ssl is set to 1 (on).You can make it a requirement that connections to your DB cluster use SSL/TLS. To do this, use the rds.force_ssl parameter. The rds.force_ssl parameter is set to 0 by default, meaning it is turned off. To turn this parameter on, set rds.force_ssl to 1. This makes SSL/TLS a requirement for connections to your DB cluster.For more information, see Securing Aurora PostgreSQL data with SSL/TLS.Review the SSL connectionTo review that the SSL connection, run this command:postgres=> select ssl_is_used(); ssl_is_used------------- t(1 row)postgres=> select ssl_cipher();         ssl_cipher----------------------------- ECDHE-RSA-AES128-GCM-SHA256(1 row)Follow"


Question: Why is my static website on Amazon S3 still accessible from public IP addresses even though I restricted access to a specific Amazon VPC?

"I use Amazon Simple Storage Service (Amazon S3) to host my static website. I attached a bucket policy that limits access to only a specific Amazon Virtual Private Cloud (Amazon VPC). However, I can still access the website from public IP addresses."

Answer: "I use Amazon Simple Storage Service (Amazon S3) to host my static website. I attached a bucket policy that limits access to only a specific Amazon Virtual Private Cloud (Amazon VPC). However, I can still access the website from public IP addresses.ResolutionBefore you troubleshoot the issue, be sure to complete the following steps:Clear your web browser or proxy cache so that you view the latest configuration.Confirm that the Amazon Elastic Compute Cloud (Amazon EC2) instance that you access the bucket from is in the same AWS Region as the bucket.Associate the VPC endpoint to the route table of the EC2 instance that you use. This way, the traffic associates with the VPC ID that's referenced in the bucket policy.Check the bucket policyConfirm that the bucket policy allows access to the bucket from the VPC. To verify this, review the statements in your bucket policy. For example, the following bucket policy statement allows s3:GetObject on the condition that the request is from vpc-id123456.{  "Version": "2012-10-17",  "Id": "Policy1",  "Statement": \[{    "Sid": "Access-to-Trusted-VPC-only",    "Effect": "Allow",    "Principal": "\*",    "Action": "s3:GetObject\*",    "Resource": "arn:aws:s3:::awsexamplebucket/\*",    "Condition": {      "StringEquals": {        "aws:sourceVpc": "vpc-id123456"      }    }  }\]}Note: Static website hosting allows unauthenticated (anonymous) requests. However, if a user authenticates, then you can grant them access based on their credentials. For example, suppose that a user authenticates with an AWS Identity and Access Management (IAM) role that has full access to Amazon S3. This user can still download objects outside of the VPC, despite the following bucket policy. For a more restrictive bucket policy, see Restricting access to a specific VPC. Restricting access to a specific VPC denies access even to administrator or AWS account root users for requests that don't come from the VPC.Check the object access control list (ACL)After you confirm that the bucket policy is correct, check if any object ACLs allow public access. If some object ACLs allow public access and you want to override the ACLs, then take one of the following actions:Configure the public access settings for the individual bucket or your AWS account.Add an explicit deny statement to the bucket policy.To override object ACLs, use the Amazon S2 console to configure the individual bucket's public access settings or your account's public access settings. Select the following options:Block public access to buckets and objects granted through new access control lists (ACLs)Block public access to buckets and objects granted through any access control lists (ACLs)Note: You can also use AWS Command Line Interface (AWS CLI), an AWS SDK, or the Amazon S3 REST API to configure the bucket's public access settings. For more information, see Blocking public access to your Amazon S3 storage.To use a bucket policy to override object ACLs, add a statement that explicitly denies actions when the request isn't from the VPC. For example, the following bucket policy includes a statement that explicitly denies s3:GetObject when the request isn't from vpc-id123456.Warning: Because this example bucket policy includes an explicit deny statement, review the parameters for explicit denial of access before you save the policy. If you get accidentally locked out, then see I accidentally denied everyone access to my Amazon S3 bucket. How do I regain access?{  "Version": "2012-10-17",  "Id": "Policy1",  "Statement": \[{      "Sid": "Access-to-Trusted-VPC-only",      "Effect": "Allow",      "Principal": "\*",      "Action": "s3:GetObject",      "Resource": "arn:aws:s3:::awsexamplebucket/\*",      "Condition": {        "StringEquals": {          "aws:sourceVpc": "vpc-id123456"        }      }    },    {      "Sid": "Deny-Access-Except-For-Trusted-VPC",      "Effect": "Deny",      "Principal": "\*",      "Action": "s3:GetObject",      "Resource": "arn:aws:s3:::awsexamplebucket/\*",      "Condition": {        "StringNotEquals": {          "aws:sourceVpc": "vpc-id123456"        }      }    }  \]}Related informationAWS Policy GeneratorFollow"


Question: How do I subscribe to Microsoft Office license with BYOL Amazon WorkSpaces?

I want to add or subscribe to Microsoft Office license with BYOL Amazon WorkSpaces.

Answer: "I want to add or subscribe to Microsoft Office license with BYOL Amazon WorkSpaces.ResolutionBefore you begin, be sure that the following prerequisites are met:Your account is eligible for BYOL WorkSpaces. For more information, see Check the eligibility of your account for BYOL using the Amazon WorkSpaces console.You've enabled BYOL for your account using the Amazon WorkSpaces console.To add Microsoft Office to Workspaces, use one of the following methods:Add Microsoft Office when you create the BYOL image for deploying WorkSpaces. If you are using Windows 10, you have the option to subscribe to Microsoft Office Professional 2016 (32-bit) or 2019 (64-bit) through AWS. If you choose this option, Microsoft Office is pre-installed in your BYOL image and included on any WorkSpaces that you launch from this image. Use the new BYOL image to deploy WorkSpaces. For more information, see Add Microsoft Office to your BYOL image.Add Microsoft Office to the existing BYOL WorkSpaces. First, create a BYOL bundle that's subscribed to Microsoft Office. Then, use the WorkSpaces migration feature to migrate your current BYOL WorkSpaces with this new BYOL bundle.Upgrade your Microsoft Office package. You can upgrade your Microsoft Office package from Office 2016 to Office 2019 or vice versa. Create a BYOL image with the required Office version. Then, with the WorkSpaces migration feature, migrate your BYOL WorkSpaces using the new BYOL WorkSpaces bundle.Related informationBring Your Own Windows desktop licensesFollow"


Question: Can I reopen my closed AWS account?

"I closed my AWS account, but I want to reopen it and continue using AWS services."

Answer: "I closed my AWS account, but I want to reopen it and continue using AWS services.Short descriptionIf you closed your account less than 90 days ago, then you can sign in to your account and file a support case to reopen the account.After 90 days, you can't reopen your closed account or open a new AWS account with the email address associated with your closed AWS account. Any content remaining in your closed account will be deleted.To create new AWS accounts or use AWS services, create a new AWS account using a different email address.Service attributes are retained as long as needed for billing and administration. AWS retains your account information as described in the Privacy Notice.ResolutionReopen your accountIf you have closed your account within the last 90 days, then contact AWS Support to reopen your account using the following steps:Sign in to your AWS account as the root user. This is required to reopen an account.Check that a valid default payment method is associated with your account.Open a support case.In the Create case section, select Account and billing support, and enter all the required details.If your need is urgent, choose the Phone contact method to have an AWS Support agent contact you to help reopen your account.After AWS reopens your accountNote: After AWS reopens your account, it can take up to 24 hours for all services to activate.After your account is reopened, do the following:When you receive the email confirming that your services are active, sign in to the AWS Management Console.Re-subscribe to AWS services.Verify that your account and payment methods are correct and update any outdated information. Be sure to check your email address, phone number, account name, and your mailing address.After your account is re-established, check the following:If you had any Amazon Elastic Compute Cloud (Amazon EC2) instances, check if they are in a stopped state. You might need to restart your Amazon EC2 instances.If you had any Amazon Relational Database Service (Amazon RDS) instances, you can restore these instances from an automatically generated snapshot. For more information, see Restoring from a DB snapshot.Note: The snapshot was taken on the account closure date and is available for up to 30 days from the date the account was reopened.If you had any AWS Marketplace subscriptions, you must cancel your subscription and re-subscribe to the product.Check for active resources that you no longer need. To find all your active resources, see How do I check for active resources that I no longer need on my AWS account?Note: You might incur charges for any AWS services and resources that you didn’t delete before you originally closed your account.Note: The account resources in AWS China (Beijing) and AWS China (Ningxia) Regions are subject to the policies of operating partners (Sinnet in the Beijing Region and NWCD in the Ningxia Region). Account closure procedures might take longer in China than in other AWS Regions.Related informationHow do I close my AWS account?Closing an accountFollow"